protected Map<String, List<Object>> authorizeReleaseOfAllowedAttributes(
        final RegisteredServiceAttributeReleasePolicyContext context,
        final Map<String, List<Object>> attributes) {
        val resolvedAttributes = new TreeMap<String, List<Object>>(String.CASE_INSENSITIVE_ORDER);
        resolvedAttributes.putAll(attributes);
        val attributesToRelease = new HashMap<String, List<Object>>();

        val scriptFactory = ExecutableCompiledScriptFactory.findExecutableCompiledScriptFactory();
        getAllowedAttributes().forEach(attr -> {
            if (resolvedAttributes.containsKey(attr)) {
                LOGGER.debug("Found attribute [{}] in the list of allowed attributes", attr);
                attributesToRelease.put(attr, resolvedAttributes.get(attr));
            } else if (CasRuntimeHintsRegistrar.notInNativeImage() && scriptFactory.isPresent()) {
                attributesToRelease.putAll(executeInlineGroovyScript(context, attributes, attr));
            }
        });
        return attributesToRelease;
    }
Return only the collection of allowed attributes out of what's resolved
for the principal.

@author Misagh Moayyed
@since 4.1.0
core/cas-server-core-authentication-attributes/src/main/java/org/apereo/cas/services/ReturnAllowedAttributeReleasePolicy.java