so your LookupSubjects is in fact to permission

read

for the resource group