Combine ACCESS_POLICY_AGENT_EVENT and http_request

Yes exactly. ACCESS_ACL_ALLOWED is the event that should be used to manipulate client's requests once the policy is complete and the user is making requests. This exact example is covered also in page 88 of the APM Operations Guide, here:

https://support.f5.com/content/kb/en-us/products/big-ip_apm/manuals/product/f5-apm-operations-guide/_jcr_content/pdfAttach/download/file.res/f5-apm-operations-guide.pdf