We were treating both of these as same:

* app explicitly disallowed by configuration
* app not present in configuration

As a result we were asking agent about both and since currently the only
agents we have (demo and gnome-shell) allow all apps, we ended-up allowing
apps that were explicitly disallowed by configuration.