URLs that are not enforced are defined in the com.sun.am.policy.agents.config.notenforced_list property in AMAgent.properties. If the URL is not enforced, the request goes through without authentication or authorization.