code: func ruleCovers(ownerRule, subRule rbacv1.PolicyRule) bool {
  	verbMatches := has(ownerRule.Verbs, rbacv1.VerbAll) || hasAll(ownerRule.Verbs, subRule.Verbs)
  	groupMatches := has(ownerRule.APIGroups, rbacv1.APIGroupAll) || hasAll(ownerRule.APIGroups, subRule.APIGroups)
  	resourceMatches := resourceCoversAll(ownerRule.Resources, subRule.Resources)
  	nonResourceURLMatches := nonResourceURLsCoversAll(ownerRule.NonResourceURLs, subRule.NonResourceURLs)
  
  	resourceNameMatches := false
  
  	if len(subRule.ResourceNames) == 0 {
  		resourceNameMatches = (len(ownerRule.ResourceNames) == 0)
  	} else {
  		resourceNameMatches = (len(ownerRule.ResourceNames) == 0) || hasAll(ownerRule.ResourceNames, subRule.ResourceNames)
  	}
  
  	return verbMatches && groupMatches && resourceMatches && resourceNameMatches && nonResourceURLMatches
  }
docs: // ruleCovers determines whether the ownerRule (which may have multiple verbs, resources, and resourceNames) covers
  // the subrule (which may only contain at most one verb, resource, and resourceName)