Warning! Some applications (e.g., services) run under system account. They do not run under user accounts like usual applications (e.g., MS Word).
In order to create rules for them, such applications must be members of a system group (e.g., $KnownSystemApps). Otherwise the rules created for such applications are not functional.
A system group is one whose name starts with $.