For each rule defined, a precedence is assigned to resolve conflicting rules for applications and application categories. A deny rule is exclusive, as no other action can be combined with a deny. An allow rule is redundant with other actions, since the default action is allow. An allow rule is useful when you want to deny packets for an application category, but allow a few applications in the same category to proceed. In such a cases, add an allow rule for applications with a higher precedence than a deny rule for that category.
Mark actions will mark packets for a recognized application and category with DSCP/8021p values used for QoS. Rate limits create a rate-limiter applied to packets recognized for an application and category. Inbound and outbound rates can be specified for the rate-limiter, but both are not required. Mark and rate-limit are the only two actions that can be combined for an application and category. All other combinations are invalid.