Instead of a list of simple rules which control which packets or sessions should be allowed through, a program accepts the connection, typically performs strong authentication on the user which often requires one-time passwords, and then often prompts the user for information on what host to connect to. However, for most environments it provides much higher security because unlike the other types of gateways, it can perform strong user authentication to ensure that the person on the other end of the IP connection is really who they say they are. Additionally, once you know who you are talking to, you can perform other types of access checks on a per-user basis such as what times they can connect, what hosts they can connect to, what services they can use, etc. Many people only consider application gateways to be true firewall, because of the lack of user authentication in the other two types. The core Brimstone ACL provides application gateway functionality.
Hybrid gateways are ones where the above types are combined.
Quite frequently one finds an application gateway combined with a circuit-level gateways or packet filters, since it can allow internal hosts unencumbered access to unsecured networks while forcing strong security on connects from unsecure networks into the secured internal networks. Recommended Brimstone configuration are a hybrid firewall. There is no one correct answer. Circuit-level gateways and packet filters are very popular for outgoing access where you trust the people on the inside. For installations where you will never need access from external networks to the internal, protected, networks, you may not need anything more than this.