Alternatively, if my client could provide multiple subjects to CheckPermissionRequest, I could supply the user as well as a list of "Member of Group X" subjects?