In the XenApp or Presentation Server policy console, you'll see an option to apply policies to connections originating through Access Gateway. A very important point to note when doing so is the policy name must match the virtual server name in the CAGEE (NetScaler) or the policy will be completely ignored. I'm not aware of where this is documented so I figured I'd post it here.