can you query an ldap group for its members in an irule

If you have APM provisioned/licensed, you could fairly easily build an access policy with VPE visual policy editor to check the machine info, make an LDAP or AD query for group membership and then assign proper pool resource based on the query result, possibly without any iRule involved. Is the client "human" or machine (ie client application) in your case?