it can answer "does this subject have this permission on this object?"