if !matchesASubject(digest.User, policyRule.Subjects) {
		return false
	}
	if digest.RequestInfo.IsResourceRequest {
		return matchesAResourceRule(digest.RequestInfo, policyRule.ResourceRules)
	}
	return matchesANonResourceRule(digest.RequestInfo, policyRule.NonResourceRules)
}

func matchesASubject(user user.Info, subjects []flowcontrol.Subject) bool {
	for _, subject := range subjects {
		if matchesSubject(user, subject) {