Currently the only way to achieve that would actually storing those pairs or make multiple check calls to see if the subject has access to either the specific resource or the group