Which software blade enables Access Control policies to accept, drop, or limit web site access based on user, group, and/or machine?

Application Control enables administrators to create granular Access Control policies that accept, drop, or throttle access to specific websites and internet applications. It leverages identity information (often sourced from Identity Awareness) to enforce these policies per user, user group, or machine, making it the blade directly responsible for URL and application-level access decisions.

Data Awareness detects and classifies sensitive data content within files and traffic streams - it does not control website access based on user or group identity.

Identity Awareness identifies and maps users, groups, and machines to IP addresses to supply identity context to other blades, but it does not itself make accept, drop, or limit decisions for web traffic.

Threat Emulation is a threat prevention blade that sandboxes suspicious files to detect malware - it has no role in user or group-based web access control.