i am new to dns filter and couldnt find any information on this. my boss wanted to know if we can control (over and above the applied policy ) what a user can access without installing the agent.