add method to generate elasticsearch-subquery from workspace-permissions