Help pulling multiple Attribute tag names and values out of XML and setting to custom variables.

You'd capture and store the values from the request in the ACCESS_POLICY_COMPLETED event.

ACCESS::session data set session.custom.attrlist $attr_list

And then use that session variable in the ACCESS_ACL_ALLOWED event

when ACCESS_ACL_ALLOWED {
    if { [ACCESS::session data get session.custom.attrlist] ne "" } {
        foreach x [ACCESS::session data get session.custom.attrlist] {
             ...do stuff
        }
    }
}