protected Map<String, List<Object>> resolveAttributesFromAttributeDefinitionStore(
        final RegisteredServiceAttributeReleasePolicyContext context,
        final Map<String, List<Object>> principalAttributes) {
        if (context.getApplicationContext().containsBean(AttributeDefinitionStore.BEAN_NAME)) {
            LOGGER.trace("Retrieving attribute definition store and attribute definitions...");
            val definitionStore = context.getApplicationContext().getBean(AttributeDefinitionStore.BEAN_NAME, AttributeDefinitionStore.class);
            val availableAttributes = new LinkedHashMap<>(principalAttributes);
            availableAttributes.putAll(context.getReleasingAttributes());
            if (definitionStore.isEmpty()) {
                LOGGER.trace("No attribute definitions are defined in the attribute definition "
                    + "store, or no attribute definitions are requested.");
                return availableAttributes;
            }
            val requestedDefinitions = new LinkedHashSet<>(determineRequestedAttributeDefinitions(context));
            requestedDefinitions.addAll(principalAttributes.keySet());

            LOGGER.debug("Finding requested attribute definitions [{}] based on available attributes [{}]",
                requestedDefinitions, availableAttributes);
            return definitionStore.resolveAttributeValues(requestedDefinitions, availableAttributes,
                context.getPrincipal(), context.getRegisteredService(), context.getService());
        }
        LOGGER.trace("No attribute definition store is available in application context");
        return principalAttributes;
    }
Post load, after having loaded the bean via JPA, etc.
core/cas-server-core-authentication-attributes/src/main/java/org/apereo/cas/services/AbstractRegisteredServiceAttributeReleasePolicy.java