Hello, The documentation/wiki for rlm_python module https://wiki.freeradius.org/modules/Rlm_python says, that module can return tuple of 3 elements (return code, reply attributes, config attributes) For debug purposes I added additional instructions in raddb/polici.d/debug debug_config { if("%{debug_attr:config:}" == '') { noop } } And noticed in debug output this (6) policy debug_config { (6) if ("%{debug_attr:config:}" == '') { (6) Attributes matching "config:" (6) &control:Auth-Type = MS-CHAP (6) &control:Cleartext-Password = testing (6) EXPAND %{debug_attr:config:} (6) --> (6) if ("%{debug_attr:config:}" == '') -> TRUE (6) if ("%{debug_attr:config:}" == '') { (6) [noop] = noop (6) } # if ("%{debug_attr:config:}" == '') = noop (6) } # policy debug_config = noop and debug_control policy return the same results (6) policy debug_control { (6) if ("%{debug_attr:control:}" == '') { (6) Attributes matching "control:" (6) &control:Auth-Type = MS-CHAP (6) &control:Cleartext-Password = testing (6) EXPAND %{debug_attr:control:} (6) --> (6) if ("%{debug_attr:control:}" == '') -> TRUE (6) if ("%{debug_attr:control:}" == '') { (6) [noop] = noop (6) } # if ("%{debug_attr:control:}" == '') = noop (6) } # policy debug_control = noop Is this means what control and config lists are equal?