Meridian Electric Cooperative wants to block essentially every application in the Peer-to-Peer category on back-office workstations, but allow one specific internal file-transfer application even though it happens to fall into that same category. How does an application control profile support this?

An application control profile lets an administrator set a default action for an entire category, such as Peer-to-Peer, and then add a specific override entry for one named application within that category that sets its own action independently of the category default. That combination — category-level Block plus an application-level Allow override — is exactly the mechanism needed to keep a category mostly locked down while carving out one exception. The claim that a category supports only one action for every application in it ignores the override capability entirely, and moving the application to a different category isn't how Fortinet's signature-based categorization works — applications aren't manually reassigned between vendor-defined categories. Using a static URL filter entry is the wrong tool altogether, since that mechanism matches URLs, not signature-identified applications, and wouldn't reliably control this application's traffic. Setting the whole category to Allow abandons the actual goal, which is to keep Peer-to-Peer blocked in general. A caveat: an override entry only takes effect if application control's signature database actually recognizes and names that specific internal application; a fully custom, unrecognized application may not get a distinct signature to override at all. Confirm the override is firing by checking the application control log for the named application showing an Allow action distinct from its category's Block.