From empirical experience (read: fiddling with ProcMon):
YourApp.Exe tries to access Internet. (I'm not sure what is the exact trigger - winsock, winhttp or something else... I think it's urlmon.dll; some apps use Internet without triggering FeatureControl).
The Authoritae (I'm not sure who it is, in my case it isn't Group Policy since gp*.dll have been thoroughly nLited + manually eradicated; again I think it's urlmon since it's the last thing queried before the calls to Feature*) decides to give subset of controls to YourApp.Exe (I've seen different Feature_* queried for different apps; might be only my imagination) based on what operations YourApp.exe requested? (wild guess again).
Then YourApp.exe queries the subset of FeatureControl\Feature_* it received and if there is a YourApp.exe dword in there, it uses that; if not, it uses the * dword (if present).
I pray this post of mine makes sense.

But Microsoft's documentation isn't too much more understandable (to me)...
GL
This post has been edited by GrofLuigi: 13 November 2009 - 08:55 PM