Provide Guidance and Examples for Edge Cases in Complex Subject Matching

Section 8.1.3.1 (Subject Matching) defines rules for matching Complex Subjects, stating that two subjects match if all fields are undefined or identical. However, it lacks guidance on edge cases, such as nested Complex Subjects or fields with multiple values (e.g., ip-addresses).
This could lead to inconsistent matching logic.

Nested Complex Subjects

Subject 1:
{
"format": "complex",
"tenant": {
"format": "opaque",
"id": "example-a38h4792-uw2"
},
"user": {
"format": "complex",
"email": {
"format": "email",
"email": "jdoe@example.com"
}
}
}

Subject 2:
{
"format": "complex",
"tenant": {
"format": "opaque",
"id": "example-a38h4792-uw2"
},
"user": {
"format": "complex",
"email": {
"format": "email",
"email": "jdoe@example.com"
},
"role": {
"format": "opaque",
"id": "admin"
}
}
}

IP Address:

Subject 1:
{
"format": "complex",
"device": {
"format": "ip-addresses",
"ip-addresses": ["10.29.37.75", "10.29.37.76"]
}
}

Subject 2:
{
"format": "complex",
"device": {
"format": "ip-addresses",
"ip-addresses": ["10.29.37.75"]
}
}