I gave on trying this. I am now just using this in the permission check on Oathkeeper.

{
  "namespace": "Group",
  "object": "mysite-admins",
  "relation": "members",
  "subject_id": "{{print .Extra.identity.id }}"
}