Every location carries a security level. Set the threshold here (Organization → Security) and any location at or stricter than it will refuse a photo, reading, or signature captured without a live location fix from the device — so evidence for your most sensitive rooms can't be recorded from somewhere else.
The default catches only Restricted locations, which is deliberately narrow: turning this up firm-wide means a technician with a weak signal indoors can get stuck, so most firms raise it project by project as the site actually requires it, not everywhere at once.
This is a different screen from Security under Setup & admin, which watches for failed logins and denied scans rather than where a photo was taken. Both are called Security because both protect the record — from a different direction.