Comment by lokar

Is it not:

https://knowledge.workspace.google.com/admin/security/create...

The Org admin can put all sorts of restrictions on who can do what based on the client device setup.