Tip for anybody who wants to get serious with Application Control...

Fortigate WebUI sucks - you'll get more millage from a FortiManager!

You get fine-grain for each AppControl Profile, you can select which Protocols or Rating in that category you want to block.  Likewise you can have multiple sequenced rules in each Profile.  An example usage of this might be, you want to monitor Browser-based Email, but Block client-server based email..  

Hey Fortinet... 2005 just called, they want their WebUI back!  Grrr never had these problems with Palo Alto...  OK rant over!