[Question] How do you model two RBAC hierarchies (one for subject and one for resource) with domains? #898