If you’re just trying to include the additional attributes as part of the request payload, please take a look at this blogpost, which tells you how to get send attributes without attempting to provision them:
You can technically update the provisioningPlan in your before operation rule, but I wouldn’t recommend it. You won’t have access to the Identity object at that stage (this occurs on the VA).
A better place to update the ProvisioningPlan would be in the Before Provision rule (which runs on the cloud, and provides access to Identity and Account information).