it can answer "what subjects have this permission on this object?"