sure, it checks that for every resource/subject pair that appears in a lookup result, the corresponding check also passes, among other things