for (keys %online_users) {
 if (policy_is_expired($_)) {
  &logoff_user;
 }
}