diff --git a/services/core/java/com/android/server/am/AppRestrictionController.java b/services/core/java/com/android/server/am/AppRestrictionController.java
index 6076eb1..7a09ce7 100644
--- a/services/core/java/com/android/server/am/AppRestrictionController.java
+++ b/services/core/java/com/android/server/am/AppRestrictionController.java
@@ -2790,13 +2790,6 @@
         if (isOnSystemDeviceIdleAllowlist(uid)) {
             return REASON_SYSTEM_ALLOW_LISTED;
         }
-        if (isOnDeviceIdleAllowlist(uid)) {
-            return REASON_ALLOWLISTED_PACKAGE;
-        }
-        final ActivityManagerInternal am = mInjector.getActivityManagerInternal();
-        if (am.isAssociatedCompanionApp(UserHandle.getUserId(uid), uid)) {
-            return REASON_COMPANION_DEVICE_MANAGER;
-        }
         if (UserManager.isDeviceInDemoMode(mContext)) {
             return REASON_DEVICE_DEMO_MODE;
         }
@@ -2805,6 +2798,7 @@
                 .hasUserRestriction(UserManager.DISALLOW_APPS_CONTROL, userId)) {
             return REASON_DISALLOW_APPS_CONTROL;
         }
+        final ActivityManagerInternal am = mInjector.getActivityManagerInternal();
         if (am.isDeviceOwner(uid)) {
             return REASON_DEVICE_OWNER;
         }
@@ -2822,14 +2816,9 @@
             final AppOpsManager appOpsManager = mInjector.getAppOpsManager();
             final PackageManagerInternal pm = mInjector.getPackageManagerInternal();
             final AppStandbyInternal appStandbyInternal = mInjector.getAppStandbyInternal();
+            // Check each packages to see if any of them is in the "fixed" exemption cases.
             for (String pkg : packages) {
-                if (appOpsManager.checkOpNoThrow(AppOpsManager.OP_ACTIVATE_VPN,
-                        uid, pkg) == AppOpsManager.MODE_ALLOWED) {
-                    return REASON_OP_ACTIVATE_VPN;
-                } else if (appOpsManager.checkOpNoThrow(AppOpsManager.OP_ACTIVATE_PLATFORM_VPN,
-                        uid, pkg) == AppOpsManager.MODE_ALLOWED) {
-                    return REASON_OP_ACTIVATE_PLATFORM_VPN;
-                } else if (isSystemModule(pkg)) {
+                if (isSystemModule(pkg)) {
                     return REASON_SYSTEM_MODULE;
                 } else if (isCarrierApp(pkg)) {
                     return REASON_CARRIER_PRIVILEGED_APP;
@@ -2843,6 +2832,16 @@
                     return REASON_ACTIVE_DEVICE_ADMIN;
                 }
             }
+            // Loop the packages again, and check the user-configurable exemptions.
+            for (String pkg : packages) {
+                if (appOpsManager.checkOpNoThrow(AppOpsManager.OP_ACTIVATE_VPN,
+                        uid, pkg) == AppOpsManager.MODE_ALLOWED) {
+                    return REASON_OP_ACTIVATE_VPN;
+                } else if (appOpsManager.checkOpNoThrow(AppOpsManager.OP_ACTIVATE_PLATFORM_VPN,
+                        uid, pkg) == AppOpsManager.MODE_ALLOWED) {
+                    return REASON_OP_ACTIVATE_PLATFORM_VPN;
+                }
+            }
         }
         if (isRoleHeldByUid(RoleManager.ROLE_DIALER, uid)) {
             return REASON_ROLE_DIALER;
@@ -2850,6 +2849,12 @@
         if (isRoleHeldByUid(RoleManager.ROLE_EMERGENCY, uid)) {
             return REASON_ROLE_EMERGENCY;
         }
+        if (isOnDeviceIdleAllowlist(uid)) {
+            return REASON_ALLOWLISTED_PACKAGE;
+        }
+        if (am.isAssociatedCompanionApp(UserHandle.getUserId(uid), uid)) {
+            return REASON_COMPANION_DEVICE_MANAGER;
+        }
         return REASON_DENIED;
     }