Section 5.2.6 mentions "Claim instance" a few times. This wording is vague to whether it implies the entire Bundle or just the Claim resource within the Bundle. 

In section 5.2.6.2 the IG states "Because this Claim instance doesn't represent the 'full' authorization request, but only a subset, the Claim instance SHALL also declare a security tag with a value of SUBSETTED to make clear that the resource is incomplete." As a developer Claim instance implies singular Claim resource, however the wording here seems to imply the entire bundle. Furthermore the example differential request provided has the security tag on the Bundle.meta and not the Claim.meta. 

Proposed wording: "Because this PASBundle doesn't represent the 'full' authorization request, but only a subset, the Bundle SHALL also declare a security tag with a value of SUBSETTED to make clear that the resource is incomplete."