Restrictions are applied by Meta's automated enforcement systems rather than by a person reviewing your business. The system matches patterns it associates with violations and acts on the match. It does not read intent, and it does not know your business. That single fact explains most of what feels arbitrary about it: a supplement brand and a scam get flagged by the same signal, because the signal is the wording, not the seller.
It also explains why the fix is never an explanation. An appeal that argues you are legitimate gives the classifier nothing new. An appeal that removes the pattern, or supplies a document that raises your account's trust level, changes the inputs. Those get resolved.
Enforcement is layered, and the layer decides how bad the situation is. An ad is the smallest object, then the ad account, then the Business Manager, and personal profiles sit alongside all of them. Restrictions travel downward: a restricted Business Manager takes every ad account, page and pixel underneath it. They can also reach a business through the people attached to it: if an admin's personal profile is restricted, the businesses they administer can be affected, which is why checking admin accounts is part of the Business Manager checklist below.
The practical asymmetry is that blocking is automated and immediate while appeals are queued and, past a point, need a person. Plan your recovery around that: the part you control is how fast you remove the cause and submit once, not how fast Meta responds.