Zanzibar resolves a path between a resource+permission and a subject; the intermediaries are solely to enable finding the subject