After cert-manager/approver-policy#799 is merged now, the username and groups field of the CertificateRequest are put into the cr map given to CEL validations as well.
Currently the website only shows that the namespace and name are exposed.
I'm going to open a PR that adds the two other fields to the documentation and it can be merged when the approver-policy sees a new release (because I don't think the website versioning for the approver-policy separate from the cert-manager release).