A system for overriding application management settings from a managed account of a standard user, the system comprising: at least one processor; and at least one memory in communication with the at least one processor, the at least one memory having computer-readable instructions stored thereupon that, when executed by the at least one processor, cause the at least one processor to: obtain a security policy that includes the application management settings to indicate a set of permitted applications that are permitted to access one or more enterprise resources (124) from the managed account, wherein the application management settings are modified from at least one administrative authority account having administrative rights which override and/or preempt actions of standard users with regard to developing and/or managing the security policy; receive a request to access a particular data resource through a particular application that is operating from the managed account; determine, based on the request, that the particular data resource is tagged as an enterprise data resource (124) and that the particular application is not included in the set of permitted applications; expose an application exemption manager that is configured to enable a standard user to generate, from the managed account, an exemption instruction to at least partially exempt the particular application from the security policy, wherein the exemption instruction is generated from the managed account independently from the at least one administrative authority account; and permit, based on the exemption instruction, the particular application to access the particular data resource from the managed account. at least one processor; and at least one memory in communication with the at least one processor, the at least one memory having computer-readable instructions stored thereupon that, when executed by the at least one processor, cause the at least one processor to: obtain a security policy that includes the application management settings to indicate a set of permitted applications that are permitted to access one or more enterprise resources (124) from the managed account, wherein the application management settings are modified from at least one administrative authority account having administrative rights which override and/or preempt actions of standard users with regard to developing and/or managing the security policy; receive a request to access a particular data resource through a particular application that is operating from the managed account; determine, based on the request, that the particular data resource is tagged as an enterprise data resource (124) and that the particular application is not included in the set of permitted applications; expose an application exemption manager that is configured to enable a standard user to generate, from the managed account, an exemption instruction to at least partially exempt the particular application from the security policy, wherein the exemption instruction is generated from the managed account independently from the at least one administrative authority account; and permit, based on the exemption instruction, the particular application to access the particular data resource from the managed account. obtain a security policy that includes the application management settings to indicate a set of permitted applications that are permitted to access one or more enterprise resources (124) from the managed account, wherein the application management settings are modified from at least one administrative authority account having administrative rights which override and/or preempt actions of standard users with regard to developing and/or managing the security policy; receive a request to access a particular data resource through a particular application that is operating from the managed account; determine, based on the request, that the particular data resource is tagged as an enterprise data resource (124) and that the particular application is not included in the set of permitted applications; expose an application exemption manager that is configured to enable a standard user to generate, from the managed account, an exemption instruction to at least partially exempt the particular application from the security policy, wherein the exemption instruction is generated from the managed account independently from the at least one administrative authority account; and permit, based on the exemption instruction, the particular application to access the particular data resource from the managed account.