Who does enforcement apply to?

All roles: end users (contacts), agents, admins and superadmins. There are no per-role or per-user exceptions while enforcement is on.