strangeness with nested subject in RBAC