Set reject in post-auth

Hi, I've been trying to set reject in the post-auth section if a certain attribute hasn't been set, but it doesn't seem to work (obviously I've messed it up) post-auth { if (!Session-Timeout) { update control { Auth-Type := Reject } } } Am I updating the wrong thing, or is it not possible to perform a reject in the post-auth? thanks, paul