The Application Filter should obey the "Select Action Automatically" option and, if that option is disabled, should ask the user what group to place new applications in rather than automatically classifying everything as "Low Restricted".

clean applications not in the database get low restricted at best, the analysis is to avoid users executing malware, you will be prompted for high risk threats that get put into high restricted or untrusted. a low restircted application has no problem performing, in fact in interactive mode you will be prompted if it tries to perform an action which is outside the low restricted range and you can move it to trusted.