Hello Reed,

yes you should be able to do that via the:

org.keycloak.protocol.ProtocolMapperSpi

You can provide your own org.keycloak.protocol.ProtocolMapper 

(org.keycloak.protocol.oidc.mappers.OIDCAccessTokenMapper) to introduce 

computed attributes to the access tokens.

You can find the predefined mappers in the package:

org/keycloak/protocol/oidc/mappers within the keycloak-services project.

Cheers,

Thomas