You can override the protection applied to a system by authorizing certain files based on their SHA-1 or SHA-256 values.
Authorizing files by their SHA-1 or SHA-256 value allows them to run on a protected system. If a file is not added to the whitelist but configured as an authorized file, it is allowed to run. Regardless of the source of a file, if the SHA-1 or SHA-256 value matches, the file is allowed to run. Likewise, files can be banned from execution based on their checksum, preventing them to run even if the files are in the whitelist.
You can also provide updater permissions to an authorized file. Configuring an authorized binary as an updater provides the updater permissions in addition to the execution. An authorized file that is configured as an updater is allowed to update or run software on a protected system.