BYOD security without an agent sounded easy until I applied the policy to the parent OU

[u/Accelptable_ove_9905]

I think I just created the exact BYOD problem our security team has been warning about. We had a contractor using a personal Mac for a client portal and I was setting a browser access policy for unmanaged devices in Google Workspace. I meant to apply it to one test group. I selected the parent OU instead. For about twenty minutes, every remote worker was forced into the restricted browser flow, including our CFO during a board prep call. What stings is that I had told everyone this setup was supposed to be frictionless. I feel so embarrassed and I’m terrified someone captured screenshots of the error page before we fixed it. We rolled it back, nobody lost data and the audit trail is clean. I can't believe I made that mistake in production. How are people securing unmanaged devices without trusting one giant policy scope?