[xacml-comment] Multiple Request Subject elements

From reading the spec I'm unclear as to whether every Subject (if more than
one is specified) in the request must have a match in the policy (Target or
Rule/Target) for the Target to be applicable in terms of the Subject. It was
my gut feeling that the answer is yes, but looking at test IIB028 would lead
my to believe otherwise. It seems to me that this could lead to problems
with security. Can anyone shed some light on this issue?

Thanks for your time.

Wes