Advanced policy management
Trace an example connection on paper before reading the rule base. For an outbound application, write down the original client address, service and destination. Add a second row for the addresses the remote system should see. This separates the decision to allow the connection from the decision to translate its addresses.
For manual NAT, inspect rules in order using the original packet fields. A broad match above a host-specific exception can change the source before traffic leaves. For a cloud service whose published addresses change, consider an Updatable Object supported for that service. Check the object's update history separately from the task that first installed the policy.