subjects must have the form namespace:pid