@Override
    public Map<String, List<Object>> getAttributes(final RegisteredServiceAttributeReleasePolicyContext context) throws Throwable {
        val attributesToRelease = new TreeMap<String, List<Object>>(String.CASE_INSENSITIVE_ORDER);
        if (supports(context)) {
            LOGGER.debug("Initiating attributes release phase via [{}] for principal [{}] "
                    + "accessing service [{}] defined by registered service [{}]...",
                getClass().getSimpleName(), context.getPrincipal().getId(),
                context.getService(), context.getRegisteredService().getServiceId());

            val principalAttributes = resolveAttributesFromPrincipalAttributeRepository(context);
            LOGGER.debug("Found principal attributes [{}] for [{}]", principalAttributes, context.getPrincipal().getId());

            val availableAttributes = resolveAttributesFromAttributeDefinitionStore(context, principalAttributes);
            LOGGER.trace("Resolved principal attributes [{}] for [{}] from attribute definition store",
                availableAttributes, context.getPrincipal().getId());

            val repository = getRegisteredServicePrincipalAttributesRepository(context);
            LOGGER.trace("Updating principal attributes repository cache for [{}] with [{}]", context.getPrincipal().getId(), availableAttributes);
            repository.update(context.getPrincipal().getId(), availableAttributes, context);

            LOGGER.trace("Calling attribute policy [{}] to process attributes for [{}]",
                getClass().getSimpleName(), context.getPrincipal().getId());
            val policyAttributes = getAttributesInternal(context, availableAttributes);
            LOGGER.debug("Attribute policy [{}] allows release of [{}] for [{}]",
                getClass().getSimpleName(), policyAttributes, context.getPrincipal().getId());

            LOGGER.trace("Attempting to merge policy attributes and default attributes");
            if (isExcludeDefaultAttributes()) {
                LOGGER.debug("Ignoring default attribute policy attributes");
            } else {
                LOGGER.trace("Checking default attribute policy attributes");
                val defaultAttributes = getReleasedByDefaultAttributes(context, availableAttributes);
                LOGGER.debug("Default attributes found to be released are [{}]", defaultAttributes);
                if (!defaultAttributes.isEmpty()) {
                    LOGGER.debug("Adding default attributes first to the released set of attributes");
                    attributesToRelease.putAll(defaultAttributes);
                }
            }
            LOGGER.trace("Adding policy attributes to the released set of attributes");
            attributesToRelease.putAll(policyAttributes);
            insertPrincipalIdAsAttributeIfNeeded(context, attributesToRelease);
            if (getAttributeFilter() != null) {
                LOGGER.debug("Invoking attribute filter [{}] on the final set of attributes", getAttributeFilter());
                return getAttributeFilter().filter(attributesToRelease);
            }
            LOGGER.debug("Finalizing attributes release phase for principal [{}] accessing service [{}] defined by registered service [{}]...",
                context.getPrincipal().getId(), context.getService(), context.getRegisteredService().getServiceId());
            return returnFinalAttributesCollection(attributesToRelease, context.getRegisteredService());
        }
        return attributesToRelease;
    }
Post load, after having loaded the bean via JPA, etc.
core/cas-server-core-authentication-attributes/src/main/java/org/apereo/cas/services/AbstractRegisteredServiceAttributeReleasePolicy.java