The device or profile owner can allow another package to set app restrictions for any app in that user Similar to the way it can give permission to access CA certificate related APIs from M. Bug: 22541936 Change-Id: I0c1b0804ad300dfa4fbdc1c7721c5d8653d77861