ACCESS::session data get - not available on 10.2.2?

The ACCESS_ACL_ALLOWED event is synonymous with the HTTP_REQUEST event, except that it fires AFTER access policy completion (and on every request beyond access policy evaluation), so the session.ldap.last.attr.memberOf session variable would be guaranteed to exist there if the LDAP query succeeded. Any command that you would run in HTTP_REQUEST (ie. data group lookup, URI evaluation, etc.) could also be done in ACCESS_ACL_ALLOWED.

I can't speak to why 10.2 is reporting invalidity in the current context, but generally speaking the HTTP_REQUEST event fires irrespective of the access policy, so you would have to take extra measures to use ACCESS commands there.