one way to approach it would be to break up the relation or permission in such a way that you can ask for the subjects via group membership directly