APM Certificate authentication - DENY for users who's cert subject does notmatch the regexp grab

Trying to restrict certificate authentication for specific users -

 

Certificate Subject CN=lab.username - the 'lab.' is the unique piece.

 

I'm using this to grab the username in a variable assign: regexp {(?x)(CN)=lab.([^,]+)} [mcget {session.ssl.cert.subject}] match CN USER; return $USER

 

IF a certificate not from lab comes across (CN=Username) I want to deny.

 

The sessions are coming in using clientless mode.

 

I've tried a branch rule on the variable assign using the regexp as it appears above but it doesn't deny the CN=Username certificates.

 

Can I do a match on the certificate authentication for the "CN=lab." only and fail the rest?

 

thanks!