Your organization runs a single pooled multi-session AVD host pool used by three departments: Finance, Legal, and Marketing. A specialized accounting application is installed on the shared session host image, but for licensing compliance the application must be visible and launchable only for members of the Finance Active Directory security group. All other users must not see or be able to run the application, even though it is present on the same VMs. You want to enforce this without maintaining separate host pools or images. Which FSLogix capability should you implement?