Forticlient support for DACL

Please excuse any noob questions on this one. I am rusty on this.

One of our managers asked if the Foritclient is capable of aggregating user access rights where that user is in multiple AD groups and each group would either allow or restrict additional objects. I understand this as a DACL, but I could be way off. So for example, we have a domain user who is in the admin staff group and the marketing group would have access to certain resources when connected via VPN. 

To me this is a basic function and should work, but I have to ask.