I was very confused because I couldn't get this to work at all, but I finally figured out what I was doing wrong. I was trying to both read and write data in the Shield Configuration, but like you said it only has reading permissions. So in order to implement .defer I had to architecture it so that the Shield Action does all the writing and the Configuration only needs to read it.

When you're approved, you need to manually go to the app's identifier configuration page in developer.apple and enable "Family Controls (Distribution)". This setting is hidden in a tab called "Additional Capabilities"