Uninstallation is not possible because a policy does not allow it. Error 25200

Question

Hi: 
 I'm hoping someone here can help me with this. I've tried submitting a ticket to support but I got one response that didn't make sense a week ago and nothing else since then. 
 
 I've created a policy that allows decryption and uninstallation, exported it to MSI, and installed it on the client. It allows me to decrypt the client, but it will not let me uninstall or modify the installation. I can't figure out why. So far I've tried: 
 
 Installing the policy, then attempting to uninstall the client 
 Installing the policy, rebooting, then attempting to uninstall the client. 
 Turning off Tamper protection in Sophos Endpoint Protection (also installed on the client), then installing the policy and attempting to uninstall the SafeGuard client. 
 Turning off Tamper Protection, and following these instructions to uninstall BOTH SEP and SafeGuard: https://community.sophos.com/kb/en-us/12360

Below are screenshots of the relevant parts of my configuration, as well as the error I get every time I attempt to uninstall SafeGuard.

MichaelMcLannahan · Accepted Answer

So apply the policy to the TOP level of the domain. Before you click SAVE modify who it's assigned to in the bottom half of the window. Here you can see my policy applies to the WHOLE domain but ONLY if you're a member of my decryption group. Automatically it'll assign to all computers/users so drag those out and drag in your decrypt (and uninstall in your case) group. 
 Hope this helps - Sorry about the hurried reply, meant to be socialising with friends that have come to visit!