Allow clients to create local exceptions

I want to allow my SEP clients to create local exceptions, but the CONFIGURE SETTING button is greyed out on all clients.

I went to SEPM and got as far as Clients | Policies | Location-Specific Settings | Client User Interface Control Settings | Tasks

but I can't find how/where to enable the button so all users (not just administrators) can add local expceptions.  Can someone point out where to change this?