Correct - SpiceDB has to walk through the subscriber to find the user, and the subscriber itself is an indirect to the user, which means it cannot fast-path check for the subscriber with the user (it has to walk all of the subscriptions)