Hello,
from the documentation, this API should work how you described:
A policy that indicates the device shields all apps and websites, except content that you specify.
However, it does not seem to work how documented, because the apps that are specified under except are still shielded, but with a generic shield that just says "Restricted" (even though it shouldn't be shielded at all).
Similar unexpected behavior has been reported here as well:
https://forums.developer.apple.com/forums/thread/762287
Topic:
App & System Services
SubTopic:
General
Tags: