George Beitis wrote: > ... I will use a policy engine to do that > and i want to overwrite the final decision if the user is not authorized > based on my policy. > > Is postauth the right place to do this? Yes. But you can't turn a reject into an accept. You can only turn an accept into a reject. Alan DeKok.