What does an administrator use to validate whether a session is matching an expected NAT policy?

An administrator would like to use App-ID's deny action for an application and would like that action updated with dynamic updates as new content becomes available.
Which security policy action causes this?