we cache them based on

${resourceType}:${resourceId}

on write operation, both the resource and the subject. then on read, we pick newest ZedToken if there's a cached value for both requested resource and subject