SkieHow do rules flow down in Skie, and which level wins?
Settings set at a higher level apply to everything beneath it, and the most specific level is applied last. So a group can refine what its branch set, and a branch can refine its school. Blocking beats allowing, and organisation-level locked settings are the exception that lower levels cannot change.
Think of the tree as layers of paint. The organisation puts down a base: hardening switches, the web filter, the default app rules. The school adds its own layer on top, then the branch, then the group. When two levels say different things about the same setting, the one closest to the device is applied last, so it decides.
This is useful in practice. A trust can set hardening for every device. A senior school can then allow a browser mode that the junior school does not. One class can get an extra app for a single lesson, applied to the whole class in one step.
Two rules keep it safe. First, blocking beats allowing, so an app blocked by a rule at one level is not brought back by an allow elsewhere. Second, the organisation can lock settings, which stops lower levels changing them. The always-blocked list of alternative browsers, VPN, proxy and DNS changer apps applies whatever an app list says.
To see what a device actually gets, use the effective policy view. It shows the end result after all layers are combined. The where-used view shows which groups use a shared policy or app list, and the impact preview shows what a change will touch before you publish it.
Practical tip: set the broad rules high and the exceptions low. If you find yourself overriding the same setting in every group, move it up a level.