SkieIf one level blocks an app and another allows it, which wins?
Blocking wins. In Skie, when a higher level such as the organisation blocks something, a lower level such as a group cannot allow it back. Allows and the most-specific-level rule decide ordinary cases, but a block is the safe side of any conflict, so one stray allow never reopens something an administrator closed.
Most settings follow a simple pattern: rules flow down the structure, and the most specific level applies last. A group's own choice normally refines what the school or organisation set above it. That is how a Class 11 group can have more apps than a Class 6 group under the same school.
Blocking is treated differently. If an organisation admin blocks an app or switches a protection on, a branch head or teacher cannot quietly undo it by allowing the app in a group list. The block holds. This protects the people responsible for safety and compliance from being overruled by a local change made in good faith.
Some apps are blocked by Skie itself regardless of any list. More than fifty alternative browsers, VPN apps, proxy apps and DNS changer apps are always blocked, whatever an app list says. Essential system apps are never touched, which keeps the device usable.
If an allow does not seem to work, use the effective policy view to find which level holds the block, then change it at that level. A practical tip is to set broad blocks high up, in the organisation defaults, and to let groups add allowed apps within that space. That gives a clear, auditable line between what is fixed and what a school may adjust.