Can't whitelist header / bodychecks

[Steve]

Is this right?

"You cannot whitelist a sender or client in an access list to bypass
header or body checks.  Header and body checks take place whether you
explicitly "OK" a client or sender, in access lists, or not."

I'm gob smacked if it is?