code: func subjectMatches(p abac.Policy, user user.Info) bool {
  	matched := false
  
  	if user == nil {
  		return false
  	}
  	username := user.GetName()
  	groups := user.GetGroups()
  
  	// If the policy specified a user, ensure it matches
  	if len(p.Spec.User) > 0 {
  		if p.Spec.User == "*" {
  			matched = true
  		} else {
  			matched = p.Spec.User == username
  			if !matched {
  				return false
  			}
  		}
  	}
  
  	// If the policy specified a group, ensure it matches
  	if len(p.Spec.Group) > 0 {
  		if p.Spec.Group == "*" {
  			matched = true
  		} else {
  			matched = false
  			for _, group := range groups {
  				if p.Spec.Group == group {
  					matched = true
  				}
  			}
  			if !matched {
  				return false
  			}
  		}
  	}
  
  	return matched
  }
docs: // subjectMatches returns true if specified user and group properties in the policy match the attributes