I just found this post that mentions some nuances in the metadata
When using {{identity.entity.aliases.auth_jwt_abcdef12.metadata.meta_key}} it returns the value from the first alias in the entity’s alias map, not the value from the alias that generated the token.
This should be considered when using a token for more than one set of Kratos + Keto requests. I think at the moment a token is only good for a single namespace + object.