It's a "virtual" or "overlay" central reference monitor for the whole network --- imagine collapsing an entire campus network down to a single firewall --- which makes it really easy to draw arbitrary internal perimeters. The real customers for these products all tend to have group-based policies.

If you remember NAC products from back in the day (policy-driven 802.1x and filtering, all designed to deal with the "chewy center" problem), this is like the overlay network version of that, and because it's all software it's much easier to deploy and manage.