I was under the impression that any program with a hash that had not been seen yet must be first approved remotely by a central server before it is allowed to run:
Yes. I flip the switch to allow such software almost daily. Probably lots of others on this site do the same. If you have the chance to use MacOS then you can try this for yourself.