Prevent network extension from being disabled?

I didn't think it was possible, but a coworker showed me a screenshot with the SentinelOne content filter having the enabled button greyed out in sysprefs:

So how are they doing that?

Prevent network extension from being disabled?
 
 
Q