Russ Smoak just answered your same question on his blog thread that you mention in your post. Was that a satisfactory answer or can we help clarify more?
For completeteness, I reproduce the post here:
You can use access lists tune outbound policies initiated by hosts on higher security level interfaces to lower security level interfaces. As an example, you might want to block any outbound session initiation except to update servers that would be hosted on the internet which is a lower security interface. By default, all traffic is allowed to source from higher security interfaces to lower security interfac
