Does the Restrict System Access setting apply to all employees when a policy is configured?