When you're approved, you need to manually go to the app's identifier configuration page in developer.apple and enable "Family Controls (Distribution)". This setting is hidden in a tab called "Additional Capabilities"

I was very confused because I couldn't get this to work at all, but I finally figured out what I was doing wrong. I was trying to both read and write data in the Shield Configuration, but like you said it only has reading permissions. So in order to implement .defer I had to architecture it so that the Shield Action does all the writing and the Configuration only needs to read it.