Desk research against primary sources. Figures are traced to the issuing UAE authority and linked on the page.
The standard is set by venue type, not by nationality or visitor status — the same shoulders-and-knees rule applies whether you are a tourist stepping off a tour bus or a resident on a routine errand, and malls enforce it through security staff who can and do turn people away at the door. Swimwear is the one exception, and it is confined strictly to pools and beaches rather than the walk between them.
Enforcement is inconsistent rather than absent, which is the trap: getting away with something once in a quiet mall does not mean the rule has relaxed, only that nobody happened to stop you that time. Government buildings tend to apply the dress code more strictly than malls or souks, so what passes unremarked while shopping can still get you turned away at a counter for an official errand.