Suggestion: Would be helpful to run LookupResources and LookupSubjects in the playground. Feels like it would be a great way to validate the schema you're working on, by checking permissions in both ways. What users can access this thing? What things does this user have access to?