if for lookup resources, you'd actually have an org-scoped subject like

org_user:someorg-123