AFM rules filtering based on Active Directory Grouping

The basic problem here is the difference between OSI layers 4 and 7. AFM generally operates at layer 4, while any sort of authentication (ie. AD group information) is going to be queried for/obtained/processed in layer 7. In other words, by the time you've queried AD, an AFM policy has already allowed the traffic to pass. Now you could create a block on subsequent requests, based on AD query status, but you'd have to let the first few L7 transactions happen.