The mechanism carries the credential patterns it enforces, so the diff that adds it matches its own rules. The tree is exempted by manifest; the commit is reviewed here.
