Group Authorization with FreeRadius

I would like to not only authenticate my users via FreeRadius, but also authorize them by creating some local groups, and running a program to do the authorization check, then pass that back to radius as an attribute (I think). I would have to write the program myself obviously, but is this even possible using the latest FreeRadius software? I'm not sure where to start looking. -Mike