This Sentinel Policy shows an example of doing some validation of values in the custom_metadata field of KV2 metadata. It has a regex matching example as well as a value-in-list example.
This Sentinel Policy shows an example of limiting access to create/update/delete only 1 custom_metadata field called "expire_date". Any create/update/delete operations requested for any other custom_metadata fields will be denied.
This Sentinel Policy shows an example of allowing only one secret key per secret and enforces that the key name should be the same as the secret name.