The issue with your Content Compliance rule is you were picking the wrong locations. I also needed to accomplish this, and tried exactly what you did and got the same results - it didn't work. So I checked out Google's [Content Compliance][1] doc, and noticed this under "Advanced content match location":

> Sender header: *The sender header consisters of the email addres,
> located within the angle brackets, and does not include the account
> name*

That's why it wasn't working! The sender header was *never* going to contain "Jim Smith"

The correct formulation for doing this is:

 1. Check "Inbound" for "Messages to affect"
 2. Under "Add expressions that describe...", select "If ALL of the following match the message"
 3. Add expression rule "Advanced Content Match", Location = "Envelope sender", Match Type = "Not contains text", content = "[email protected]"
 4. Add expression rule "Advanced Content Match", Location = "Full headers", Match Type = "Contains text", content = "Jim Smith"

I also changed the first rule to check "Envelope Sender" because, according to Google, this is "The original sender that was reported during the SMTP communication request. It can be different from the sender reported in the Sender header. It often, but not always, matches the address found in the “Return-path” header." That location seemed more likely to never be the address we're looking for.

I tested this by creating a ProtonMail account using our CEO's name as the display name, and it was immediately quarantined by this rule.

I hope this helps!

  [1]: https://support.google.com/a/answer/1346934?hl=en&ref_topic=2683824