What happens if the identity of a user is known?

Traffic is not automatically dropped just because a user does not match an Access Role in one rule - the gateway must reach an explicit Drop rule or the default policy action before dropping.

A sandbox is not a standard response to an Access Role mismatch - sandboxing applies to file inspection (Threat Emulation), not identity policy evaluation.

Check Point Identity Awareness enforces Access Roles as match conditions within a rule. If the gateway has identified the user but that user does not satisfy the Access Role defined in a rule, the rule is treated as a non-match and the gateway continues processing subsequent rules in order - the same way any other non-matching rule condition (source IP, destination, service) is handled.

The Captive Portal is displayed when the user's identity is unknown and needs to be authenticated, not when the identity is already known but does not match a specific Access Role.