and for lookup resources, you have to specify the permission, and it returns the resources the subject has that permision to