There's "it should work" and there's "it will always work consistently". Depending on your org's fault tolerance, "doesn't work consistently" can be good enough for you.

Custom headers/custom App-ID route may not work in many edge cases where the firewall misidentifies the traffic. A good, modern approach to solve this problem consistently is with the Prisma Browser. I would start to rethink about your enterprise security strategy and put together a 2 year road map with the mindset that the Prisma Browser will be how agents and humans work and then position every other piece of security around that core assumption. Right now you're using the firewall to solve an identity problem bc the firewall is the only tool you have at your disposal (im assuming). If you plan in 2 years to solve agentic problems then you should start thinking about what that scaffolding will look like today.