Glossary term
A rule matching a code-signing certificate, optionally pinned to a specific product/version range.
intermediate
Policy that decides which executables, scripts, and installers are even allowed to run — enforced before the image loader finishes its job.