this is because the question of "does this subject have the permission" is answered by a graph walk from the permission to the subject; if a valid path is found, then the permission exists