Tell me, please, what's wrong with simply using:

for my $i (keys %online_users) {
    if (policy_is_expired($i)) {
        logoff_user($i);
    }
}
[download]

Or just continuing to use $_?

Implanting a work-around is just adding unneeded code.