...
While there are no specifically "mandated" points at which filters run, the SP generally invokes filtering immdiately immediately prior to the caching of a set of attributes into a user's session. Actually performing the filtering process is typically up to an Assertion Consumer Service handler (in the case of attributes delivered during SSO) or an attribute resolver.
...