Every firewall action starts in Observe unless you choose otherwise, and actions on devices start in Suggest, so a proposal waits for an administrator. Revoking a device’s credential, ending its connection and revoking its certificate are Suggest-only: a person approves every run. Disabling a device runs on its own only if you set that action to Auto yourself.