Alan,

Apparently I am misunderstood the rlm_sql docs.  I see that it is running the mysql group check and reply queries. 

/doc/rlm_sql reads:

>5. For each group this user is a member of, the corresponding check items
>are pulled from radgroupcheck table and compared with the request. If
>there is a match, the reply items for this group are pulled from the
>radgroupreply table and applied.

If no attributes in the radgroupcheck table are matched I have a group with a higher priority number to act as an implicit deny.  One last question, is there a max priority for groups?  The mysql field allows 11 characters, so the max priority I could store would be 99999999999, but I wasn't sure if there was anything that would limit it other than that character limit.

Thanks,

Craig