To demonstrate how to go about this we should look at an example. In this example we want to allow one user, who is a member of a group which prevents access to social to networking sites, to be able to access facebook.

The following steps will demonstrate how to do this each stage of the way but first it might be useful to outline what we will be doing.

We want to add the user to a new group with a new policy which allows and only allows access to facebook, this will be in addition to the group of which they are already a member. Then we want to disable the most restrictive policy applies option. This will allow the user access to facebook while still being filtered by all the other rules of the original group.

Now the steps to accomplish this

NOTE: if you are managing your users and groups via LDAP/Active directory you must create your group and add the user to it from your active directory server rather than by the method detailed in steps 4 and 5

1. Create a custom category from the 'Policies > Categories' tab, give it a name like 'facebook category', an adequate description and click save.

2. Edit the current policy that is filtering the group by clicking on the pencil icon beside the policy's name in the 'Policies > Filtering Polices' tab. Navigate to the categories option and block the new 'facebook category'.

3. Now from the same tab create a new policy, give it a descriptive name like 'facebook allowed', now configure it to block all other categories but your facebook policy. The quick way to do this is by clicking the Disable all work and all non work buttons in the top right corner and then selecting to allow the facebook category.

4. Now we want to create a new group that follows this policy and add our user to it. Create a new group and select it's associated policy to be 'facebook allowed'.

5. Edit the user's settings from the 'Users & Groups > Users' tab and add the them to this new group.

6. Finally navigate to the 'Policies > Global' settings tab and ensure that the most restrictive policy option is disabled.