On BorderManager 3.9 the NDS object rules don't seem to be working for me.

For my test, I created a rule to allow http originating from a specific IP
address on my network. Yes, I can browse to http://www.google.com

Changed the rule from IP address to the user NDS object. Had to 'Apply
Changes' twice before it took effect (but that's a different bug). Now I
get 403 forbidden trying to browse to google.

Changed the rule back to source ip address, rather than nds object. Applied
Changes twice. Browsing works again.

clntrust.exe is running on the browsing PC. It does not show that any
failed requests occurred.