Threat prevention policy

[SAROU237]

For access control policy:

When a packet arrives at the gateway, the gateway checks it against the rules in the top Policy Layer, sequentially from top to bottom, and enforces the first rule that matches a packet.

For threat prevention policy what is the step?

First IPS, after threat emulation after ?

Could you please explain me the step

[PhoneBoy]

It's a little more complicated than that.
But in general, Access Control is first, then Threat Prevention, which happens as part of the Content Inspection process that involves multiple blades.
You can see a representation of the logical packet flow here: https://community.checkpoint.com/t5/General-Topics/R80-x-Security-Gateway-Architecture-Logical-Pack... 

[_Val_]

This is a rough but pretty accurate visualisation for the layered policy enforcement

Mind, with Unified Policy, you might conditionally match several rules, before the final AC/URLF decision is made.