1) the custom signature itself is enabled as soon as you hit commit and will be applied to all security rules where an appropriate security profile is enabled.
the 'action' it takes from that moment forward depends on a) the severity level of the signature and b) the action set for the same severity level in the security profile
2) once you add an exception (that is enabled) you apply a different action to a specific signature regardless of the overall rules of the security profile (i.e. sigX is 'high', profile says drop critical,high,medium, override says alert for sig X)
well there's 2 things that make up your issue:
1) the custom signature itself is enabled as soon as you hit commit and will be applied to all security rules where an appropriate security profile is enabled.
the 'action' it takes from that moment forward depends on a) the severity level of the signature and b) the action set for the same severity level in the security profile
2) once you add an exception (that is enabled) you apply a different action to a specific signature regardless of the overall rules of the security profile (i.e. sigX is 'high', profile says drop critical,high,medium, override says alert for sig X)