The one place for your designs
To enable design management, you'll need to meet the requirements. If you need help, reach out to our support team for assistance.
client class added by hooks and expressions
A client class added by a hook in pkt4_receive can't be used in an expression because the main classification is done before the callout. This means it can be used only directly for subnet selection, e.g. if the hook adds the class "foo" you can guard a subnet by "foo" but not by a class "not-foo" defined by the expression "not member('foo')".
The case of pool guard is more complex because it is possible to move to the host identifier classification point using "KNOWN" or "UNKNOWN" in the expression. Of course it is simpler for required classes which are evaluated late.
This is not beyond repair but if we want to change this IMHO it is better to reconsider the whole classification design as explained in #1028.