Disable the Identity, BUT tunneler still able to connect to overlay network

Hey Openziti Supports,

I'm looking for a feature time based access policy for the Identity, but current OpenZiti doesn't seems have this feature. As an alternative, i set up a external scheduler job to invoke ziti API to enable/disable Identity base on setup time.

I use ziti-edge-tunnel to connect to overlay network, BUT i realized that after i disabled identity, the tunneler still connected to the overlay network, until i shutdown the tunnler and restart the tunnler then i will hit auth failure.

Question:
Is there a way to force tunneler disconnect after i disable the identity? Any API available for ziti controller to disconnect after identity was disabled?