A rulestack defines the NGFW's advanced access control (APP-ID, URL Filtering) and threat prevention behavior.