Right, so I get that it would be represented as another tuple, but then in https://authzed.com/blog/acl-filtering-in-authzed/ it says "intersection and exclusion, however, cannot be computed without all child paths themselves having been computed, meaning that we’d have to perform the equivalent of a “reduce” operation at any intersection or union. Fortunately, this led to a natural solution: map, then reduce." and I didn't understand how this works