1) open the DLP Policy. In the menu-bar under "tools" you will find to create a releascode.
2) the release-code is generated via "challenge-response". It is only valid for the requesting client.
Please take attention that the release code will completely bypass the DLP Agent for the defined time.
3) no. the DLP admin can create a release code for himself. but it will be reported to the log, as normal.
4) you can configure in the dlp policy if you want to inform a user, when a device is blocked. in this message the user has the option to "request" the release-code.