Once profile locking preferences are enabled, it will be possible to pick which categories and apps can be toggled for block and allowed rules during a profile lock.

This should be extended to domains. When a domain is added, the category or app group for that domain should be validated before it is allowed to be added.

This would add some latency to adding domains, so it should be off by default, but a user could opt in to this protective measure.