if a specific subject XYZ has role admin on resource type X, then that role applies to all resources of type X