X_FLAG_SUBJECT_REQUIRED
Means
a flag decides by a subject the evaluation context does not carry
Typical cause
targeting names a subject kind — an org, or an app record such as bank — but the actor carries no orgId, or the call site passed no record for that kind. Answered as an error rather than a silent default, which would decide the wrong way and never say so
Fix
mint the actor with its tenant — userActor({ id, orgId }) — for org; for an app kind, pass the record at the call site: isEnabled('<key>', actor, { <kind>: '<id>' })