OK, let me first state that we are using SurfControl in our environment. In addition, we are using BM 3.8 SP4 on a NW 6.5 SP5 server.

Now, since BM establishes the first rule (which is to block all internet access) you can handle the "Allow" process in two ways.

You can either allow all access and then start restricting again and allowing "Groups" for specific categories or URLs

Or you can start "allowing" access to "Groups" for specific categories or URLs.

How do you do it????