With complex jexl, you don't have access to the actual group and subject. You only have the string values that are the defined set of things the engine thinks you want. So you can't get the parent folder for groups, or arbitrary attributes for subjects in the main section where the attributes are being computed. You can only do it in the section 2 caches, which is extra work, plus you only have 3-4 values before you run out of buckets.