This may have been discussed elsewhere, but is it actually desirable to have per-user overrides of mail delivery policies?
The external sender warning seems like something potentially security critical that you don't want to have disabled on a per user basis.
The per user setting of the invitation policy is perhaps less critical.

I noticed that purely from the UI it's not immediately obvious how the Policies and the per user settings interact, and it's unclear what is ultimately going to be used.
I could see the following potential improvements:

• Add a description to policies that these policies are in effect for all members of this account, mentioning that some policies can be overridden on a per-user basis in the user settings.
• Somehow reflect in the user settings page which setting ends up being used (local override or global default value)
• Mention where the default is coming from

One way for the last two points could be to generate a dynamic description of the default state: "default policy: enabled" or "default policy: disabled" instead of "default".