[Question] - domain inheritance with pattern matching

I want to have a RBAC model where there are multiple domains and subdomains. The roles across all domains can be the same with access to the same resources, but they should only be allowed access within a specific subdomain/domain

**Your model:**

```ini
r = sub, dom, obj, act

[policy_definition]
p = sub, dom, obj, act

[role_definition]
g = _, _, _
g2 = _, _

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = (g(r.sub, p.sub, r.dom) || g2(r.dom, p.dom)) && \
r.obj == p.obj && \
r.act == p.act
```

**Your policy:**

```
p, user, *, data, read
p, user, *, data, write
p, admin, *, data, read
p, admin, *, data, write

g, alice, user, subdomain1
g, bob, admin, domain1

g2, subdomain1, domain1
g2, subdomain2, domain1

```

**Your request(s):**

```
alice, subdomain1, data, read --> true (expected true)
bob, domain1, data, read --> true (expected true)
bob, subdomain1, data, read --> false( expected true)
bob, subdomain2, data, read --> false (expected true
```

In this case, bob is an admin of domain1, and subdomain1 and subdomain2 are part of domain1, which he should automatically inherit access to. How can I get the `|| g2(r.dom, p.dom)` part of to use `keyMatch`. It is changing subdomain1 in the request to domain1, but then matching domain1 and *, which only match through keyMatch