APM continuous/regular policy check

I've got the following scenario to implement with APM: when a user gets disabled in AD (through an HR-Idm automation system.. after being fired for example), any running session he may have on APM (such as NA) must be killed. 1. is there a way to run regularly a check in the Access Policy (AD status for the user) AFTER the user successfully logged in? It doesn't seem to me but... maybe iCall could help? 2. could that be implemented on the Idm system side? With REST... a script connects to the APM and look if there's a user's session open. If yes, kill it. Is REST an option with APM (yet)? Thanks for any input