tcl logic in SAML Attribute value field possible?

Hi.

We're running BigIP as a SAML IDP.

Can I somehow issue tcl logic in a SAML attributes?

I'm talking about the Access ›› Federation : SAML Identity Provider : Local IdP Services, editing an object, under SAML Attributes.
Based on what's in the memberOf attribute, I need to issue as a value either empty string or "SpecificValue".

I am familiar with the %{session.variable} construct, but I don't want to clutter the session with more variables if I can avoid it, as that impacts all sessions using our IDP (30 or so federated services on the same VIP and AP).

I tried these two approches:
%{ set result {} ; if { [mcget {session.ad.last.attr.memberOf}] contains {| CN=SpecificGroup,OU=Resource groups,OU=Groups,DC=Domain,DC=com |}} { set result {SpecificValue} } ; return $result }

expr { set result {} ; if { [mcget {session.ad.last.attr.memberOf}] contains {| CN=SpecificGroup,OU=Resource groups,OU=Groups,DC=Domain,DC=com |}} { set result {SpecificValue} } ; return $result }

Expected result:
An issued claim with the value "" or "SpecificValue"

Actual result:
An issued claim with the above code as the value

As I mentioned, we've set it up using one VIP that is hosting 30 or so services. We're running 16.1.3.1.
They are using the same SSO configuration and there's an iRule triggerd at ACCESS_POLICY_AGENT_EVENT, which does some magic to extract issuer and suchlike, and that helps to make decisions later in the Access Policy.
It also populates a few session variables under the session.custom namespace for use in the Access Policy.
Additional session variables are being populated in the Access Policy, such as resolved manager and their email address.
I have looked briefly at the ASSERT::saml functions, but even if it would be possible to manipulate that way, I wish to keep this set up as stream lined as possible and with as few new "special cases" in an iRule. So while I appreciate pointers along that route as well, I would first of all like to know if there is a way to do it natively in the SAML attribute value field.

And if there are any options I have not yet explored here?