use subscription as resource when authorizing edit access