this setting might not be enforced if other policy is configured to override category level audit