I've just confirmed a bug, not sure if it's OS X Mojave or JSS... We restrict applications on our Macs for younger students. We allow anything in /Applications path, with a few restrictions such as Terminal. We also allow apps from a handful of file paths to allow support files.
However, if a user downloads an app on a DMG, all those apps can be run without restrictions.
Anyone else seen this? Have a solution? I'm suspecting this is a MacOS X bug, but I don't have time to setup a ProfileManager server to see if it works from there (in which case it would be a JAMF issue).
Jeff