Access Policy Manager (APM) generally handles access at higher layers in the OSI model, including application-level access control. Layer 7 (Application Layer) and Layer 3 (Network Layer) are typically involved in such controls. Layer 7 is responsible for application-specific traffic, while Layer 3 is responsible for routing and addressing. Therefore, APM is most likely to provide access control lists at these two layers.