Block/allow outgoing traffic by user or application?

[Frank Beuth]

Is it possible to restrict network access on a per-user or per-application 
(rather than per-port) basis?

pf does not seem to have any capability to do this, maybe I missed something.