so in theory if I threw that exact case statement at my fleet: • if osquery itself doesn't have FDA ◦ OR the MDMOverrides file isn't present • …I wouldn't even get a result from the case statement • if it DOES and the MDMOverrides file is present AND the key/value is missing, I'd get

disabled

• if the perms/file/key/value are ALL present, I'd get

enabled