Currently, the expected "In" condition is the following:

"In": {
     "administrator": "(*array)${USER.capabilities}"
 }

The left part is the scalar value, while the right part is an array of scalar values.

It would be nice to extend this type of condition by allowing the left part to be an array too. This way we can build an "array intersect" condition when the condition evaluates to true if ALL values in the left array are found in the right array.

The perfect example is the statement that is applicable ONLY if user belongs to two roles:

{
    "Effect": "deny",
    "Resource": "Post:project:posts:read",
    "Condition": {
        "In": {
            "(*array)${USER.roles}": ["subscriber", "reader"]
        }
    }
}

or something like:

{
    "Effect": "deny",
    "Resource": "Post:project:posts:read",
    "Condition": {
        "In": {
            "(*array)[\"subscriber\", \"reader\"]": "(*array)${USER.roles}"
        }
    }
}