Control user(s): ability to use / access to <iframe> - how?

It does not seem to work for me. I set to 0 yet users created posts with iframes do show up as expected, with a frame/player & do play okey.
Would there be another param/option which overrides this?
Also, how to understand * allowed iframes* in this context?