SkieCan the CEO or senior managers be exempt from the strict rules?
Yes. Put them in a group of their own with a lighter policy and a wider app list. Skie applies rules by group, so executives can have more apps and an unrestricted browser while other teams stay locked down. Some company-wide protections can still stay on for them, such as blocking factory reset and VPN apps.
Every company ends up with a few people who need freedom on their devices: executives, board members, IT leads. If the policy is too tight for them, they stop using managed devices, and the exception becomes the rule.
In Skie, create an executive group and attach a policy with a longer app list. The browser can be allowed rather than restricted. The Play Store can be shown. You can leave out the optional switches such as camera or screenshot blocking. Because rules apply by group and the most specific level applies last, none of this changes any other team.
Think about which protections you still want. Hardening switches such as blocking factory reset from Settings, safe mode, developer options and uninstalling Skie can stay on even for senior users, because they protect the company if the device is lost. The always-blocked list of VPN apps, proxy apps and DNS changers applies whatever an app list says, so that stays in place too. Lost mode and location remain available for a missing executive phone.
A restricted view of the executive group in the dashboard is a good idea. Use roles and page access so only a few people can see their devices and location, and do not make the exemption a quiet one: record it in your device policy.
If an executive wants to use a personal phone, the one-time reset applies, as it does for anyone.