Google provided the freeradius mailing lists more promenently and also an exerpt from a book as a first page result. IIRC between those two and some "unlang" references I found the answer.
Not that it helps, but I was looking for a way to reject a radius request that had an incorrect subdomain in an eduroam SSID.
authorize {
if (&Aruba-Essid-Name == "eduroam" && &User-Name =~ /@.*\.domain\.edu$/i) {
reject
}
elsif (&Aruba-Essid-Name == "eduroam" && &User-Name !~ /@domain\.edu$/i) {
It's been two weeks, so the google results have already changed (should have taken a screenshot) and I've forgotten the specific details.
Now that I'm looking back over the kagi results (and with more freeradius/unlang knowledge), I see that the 19th result (https://www.oreilly.com/library/view/freeradius-beginners-guide/9781849514088/ch12s06.html) has enough to anwser my query, but at that time it wasn't sufficient.