I don't have much experience with SELinux, but at least in my org the base policy is to run anything started interactively by the user (or root) in unconfined_t

I don't have much experience with SELinux, but at least in my org the base policy is to run anything started interactively by the user (or root) in unconfined_t, i.e. with protections disabled. That is, the same command that gets denied by SELinux through systemd will run fine (and unprotected) when started from a shell. Do you write your own policies for individual end-user programs?