Thanks for pointing me in the right direction, I forgot about the bindings.
The data provided here is however very scarce, I wonder if really only those few values are passed to the form, or if there is an object with more useful metadata. The "Requested By" binding only delivers the username without the domain name, which is surprising for a product that can be bound to a multi-domain environment.
The vRO Workflow Custom Form in a catalog provides a few more fields: __username and __userdisplayname, the values are the same though and both reference the service account used to launch the workflow and not the user that requests the service:
I do not know what to make of "props". I wanted to pass "props" as an object to vRO, but a field where you fill the value by "external source" does not allow binding with any values from "Request info fields". You can bind "Key" or "Value" to a single input field of type "string", but not both "Key" and "Value" to columns of a Data Grid element.
Overall, compared to vRA7, this is pretty disappointing. I don't understand why vmware has taken a step back here and does provide such a limited amount of request metadata information in the input form.
edit: sadly the list of request info properties will not be expanded with 8.9: Using and Managing vRealize Automation Service Broker - vRealize Automation 8.9 (vmware.com)