The ability to disable it is in the spec, but it's not required by the spec. Equally, the ability to override security decisions on a case by case basis is in the spec, but the Microsoft certification requirements forbid it.