it can answer "what objects does this subject have permissions on?"