Explaining Managed-Settings Precedence to a Team Lead

Your organization's managed settings include "disableBypassPermissionsMode": "disable" and a Read deny rule for secrets/**. A team lead, working on a self-contained prototype branch with no real credentials involved, asks you to "just relax the bypass-permissions restriction for my project for a week, I'll add it to our project settings file."

1. Explain to the team lead, precisely, why their proposed fix won't work, in terms of where managed settings sit in the settings hierarchy.
2. The team lead pushes back: "Then what if I just don't use managed settings — is there a way to opt my session out of them?" Answer accurately, including the one scenario in which managed settings genuinely don't apply, and why that scenario doesn't solve the team lead's actual problem.
3. What is the correct way for the team lead to get the exception they want, and why does routing it that way preserve the value of having managed settings in the first place?