Every MFA policy has the same weak point: whoever edits the policy can turn it off. goca closes that with a floor that is compiled into the server: system-admin always requires a second factor, and no document can remove it. An MfaPolicy can only tighten — add ca-officer to requiredRoles and its holders are challenged at their next login; the enforced set is always the union of your document and the floor. A database edit cannot lower it either.
Exemptions exist, because a service identity on an appliance cannot run an authenticator — but the rules bite in the right direction. An exemption naming a system-admin is refused at save time rather than stored and silently ignored: if you truly need that identity factor-free, take the role away. Every exemption needs a reason and a mandatory end date at most a year out — the "just for today" exception is exactly the thing still there two years later. Past its date it simply stops applying.
Now I can explain why nobody — including me — can switch MFA off for an administrator.