Which is a problem for me because I would like to use the policy module to add an attribute in certain circumstances in post-auth However my NAS will kick the user if that attribute follows another. It needs to be first. So would it be a good idea to extend the policy module to be able to specify a insert at head or a insert at $HERE , where here would be a vp that matches? And any tips on how to go about this Thanks, Joe