Wikipedia currently explains this very well:
The disposition reflects the policy published actually applied to the messages, none, quarantine, or reject. Along with it, not shown in the table, DMARC provides for a policy override. Some reasons why a receiver can apply a policy different from the one requested are already provided for by the specification:
- forwarded: while keeping the same bounce address, usually doesn't break DKIM,
- sampled out: because a sender can choose to only apply the policy to a percentage of messages only,
- trusted forwarder: the message arrived from a locally known source
- mailing list: the receiver heuristically determined that the message arrived from a mailing list,
- local policy: receivers are obviously free to apply the policy they like, it is just cool to let senders know,
- other: if none of the above applies, a comment field allows to say more.
For more detail see RFC 7489.