fix(eventstore): add owners to unique constraints (#12740)

<!-- CURSOR_AGENT_PR_BODY_BEGIN -->
# Which Problems Are Solved

Bulk unique-constraint deletes (org, IDP with many links, user, project)
reconstruct every uniqueness key in Go and emit N `DELETE`s. That can
OOM on large tenants.

A one-shot owner backfill is also not enough: during a rolling deploy,
older binaries still insert `owners = '{}'`, so a later owner-only
delete would miss those rows.

Owner-only org/user/grant delete only matches rows whose `owners` bag
contains that tag. Several grant and member types stamped the aggregate
resource owner, which is not always the user’s home org or the granted
org. Username-scope rewrites also dropped `user:` tags, so owner-only
user delete could miss rewritten username rows.

Command must not switch to owner-only delete on the first 79 of a
version, because leftover `'{}'` rows from rolling-update overlap are
only backfilled on a later 79. A failed 79 must not turn owner-delete
on, and backfill joins must not stamp the wrong org (unverified domains,
org-scoped usernames colliding with instance-scoped ones).

# How the Problems Are Solved

Uniqueness stays the existing primary key `(instance_id, unique_type,
unique_field)`. `owners` is only a lifecycle bag of tags (`org:<id>`,
`user:<id>`, `idp:<id>`, `project:<id>`, `grant:<id>`).

- Add `owners TEXT[] NOT NULL DEFAULT '{}'` on
`eventstore.unique_constraints` (init SQL for greenfield, setup 78 for
existing clusters).
- Create `unique_constraints_owners_gin` with `CREATE INDEX
CONCURRENTLY` **outside a transaction** (same pattern as step 76).
Built-in `GIN (owners)` only; no `btree_gin`.
- Stamp `WithOwners` on **add** events. Field-level removes ignore
owners. `RemoveByOwner` stores the tag in `Owners` and both v1/v3 and v2
pushers run `DELETE … WHERE instance_id = $1 AND owners @>
ARRAY[$tag]::text[]`.
- Setup 79 backfills `owners` from projections via numbered
`cmd/setup/79/*.sql` files. Table names are interpolated from
`internal/query/projection` constants. Matches use `unique_field IN (x,
lower(x))` so the primary key can be used. Missing projection tables
(`42P01`) are skipped.
- Org domains are tagged only when `is_verified`. Instance-scoped
usernames join only users that are not org-scoped (organization settings
or domain policy `user_login_must_be_domain`). Every username row still
gets `org:` + `user:` of that user.
- 79 is a **repeatable** migration. `Check` re-runs when
`lastRun["version"]` changed or when setup-only `ForceFinalize` is set
and `lastRun["finalized"]` is still false. `Finalized` is written only
after Execute succeeds.
- Failed setup events keep the last successful `lastRun`. Command reads
`finalized` only from `system.migration.repeatable.done`.
- Org / user / project remove skip N-key event replay **when that
`finalized` bit is true**. Otherwise they keep today’s N-key lists
**and** still emit `RemoveByOwner`. The “ready” result is cached in
memory once true.

Setup writes `finalized` on the 79 repeatable.done payload:

- First 79 of a version: backfill only, `finalized=false` (unless
`ForceFinalize` is already set).
- Later 79: version change or
`BackfillUniqueConstraintOwners.ForceFinalize` /
`ZITADEL_BACKFILLUNIQUECONSTRAINTOWNERS_FORCEFINALIZE` after the rolling
update is done. That run backfills leftovers and writes
`finalized=true`.

Member and grant owner bags now include every org that should delete the
row:

- Instance, org, and project members also stamp
`org:<user_resource_owner>`.
- User grants stamp grant, user, project, and granted orgs.
- Project grant members stamp the project org, user org, and granted
org.
- Project grants stamp both orgs plus `grant:<id>`. Grant remove emits
`RemoveByOwner(grant)`.
- Username-scope rewrites keep `user:<id>` as well as `org:`.
- User/grant orgs are carried as unexported add-event fields (not
persisted JSON). `WithOwners` skips empty and duplicate tags.

# Additional Changes

- Table-driven owner-tag tests, including project grant (two `org:` tags
plus `grant:`), cross-org members, user grants, and username-scope
rewrite `user:` tags.
- Table-driven 79 `Check` + `finalizeAfterSuccess` tests for version
change, sequential version bumps, ForceFinalize restart, and
already-finalized skip.
- Command tests: a failed 79 event with `finalized=true` does not enable
owner-delete.
- Integration fixtures (verified vs unverified org domain;
instance-scoped `bob` vs org-scoped `bob`).
- Instance-only and global unique types stay untagged (`'{}'`). Instance
wipe still uses `UniqueConstraintInstanceRemove`.
- Pusher owner cases live in `eventstore_pusher_owners_test.go` so
`eventstore_pusher_test.go` stays under 1k lines.

# Additional Context

A later cleanup can delete the N-key replay helpers once a release that
ran 79 a second time (or an operator who set `ForceFinalize`) is in
production. That is not required for correctness.

<!-- CURSOR_AGENT_PR_BODY_END -->

<div><a
href="https://cursor.com/agents/bc-44f9bc9b-9a93-4cd9-8dd1-663a7b9aad2a?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-web-light.png"><img
alt="Open in Web" width="114" height="28"
src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a>&nbsp;<a
href="https://cursor.com/background-agent?bcId=bc-44f9bc9b-9a93-4cd9-8dd1-663a7b9aad2a&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img
alt="Open in Cursor" width="131" height="28"
src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a>&nbsp;</div>

---------

Co-authored-by: Cursor Agent <[email protected]>
Co-authored-by: Silvan <[email protected]>

internal/command/command.go

@@ -14,6 +14,7 @@ import (
 	"strconv"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/go-jose/go-jose/v4"
@@ -109,6 +110,9 @@ type Commands struct {
 	loginPaths       LoginPaths
 	ipLookupFunction internal_net.IPLookupFunc
 	denyList         []denylist.AddressChecker
+
+	ownerDeleteReady       func(context.Context) (bool, error)
+	ownerDeleteReadyCached atomic.Bool
 }
 
 //go:generate mockgen -package command -destination ./mock_login_paths.go . LoginPaths
@@ -239,6 +243,8 @@ func StartCommands(
 		denyList:         denyList,
 	}
 
+	repo.ownerDeleteReady = repo.uniqueConstraintOwnersBackfillFinalized
+
 	if defaultSecretGenerators != nil && defaultSecretGenerators.ClientSecret != nil {
 		repo.newHashedSecret = newHashedSecretWithDefault(secretHasher, defaultSecretGenerators.ClientSecret)
 	}

internal/command/instance_member.go

@@ -22,13 +22,14 @@ func (c *Commands) AddInstanceMemberCommand(a *instance.Aggregate, userID string
 			return nil, zerrors.ThrowInvalidArgument(nil, "INSTANCE-4m0fS", "Errors.Instance.MemberInvalid")
 		}
 		return func(ctx context.Context, filter preparation.FilterToQueryReducer) ([]eventstore.Command, error) {
-				if exists, err := ExistsUser(ctx, filter, userID, "", false); err != nil || !exists {
+				userResourceOwner, exists, err := existingUser(ctx, filter, userID, "", false)
+				if err != nil || !exists {
 					return nil, zerrors.ThrowPreconditionFailed(err, "INSTA-GSXOn", "Errors.User.NotFound")
 				}
 				if isMember, err := IsInstanceMember(ctx, filter, a.ID, userID); err != nil || isMember {
 					return nil, zerrors.ThrowAlreadyExists(err, "INSTA-pFDwe", "Errors.Instance.Member.AlreadyExists")
 				}
-				return []eventstore.Command{instance.NewMemberAddedEvent(ctx, &a.Aggregate, userID, roles...)}, nil
+				return []eventstore.Command{instance.NewMemberAddedEvent(ctx, &a.Aggregate, userID, roles...).WithUserResourceOwner(userResourceOwner)}, nil
 			},
 			nil
 	}

internal/command/instance_member_test.go

@@ -161,7 +161,7 @@ func TestCommandSide_AddInstanceMember(t *testing.T) {
 							&instance.NewAggregate("INSTANCE").Aggregate,
 							"user1",
 							[]string{"IAM_OWNER"}...,
-						),
+						).WithUserResourceOwner("org1"),
 					),
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
@@ -209,7 +209,7 @@ func TestCommandSide_AddInstanceMember(t *testing.T) {
 							&instance.NewAggregate("INSTANCE").Aggregate,
 							"user1",
 							[]string{"IAM_OWNER"}...,
-						),
+						).WithUserResourceOwner("org1"),
 					),
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
@@ -339,7 +339,7 @@ func TestCommandSide_EnsureInstanceMemberRolesFromLogin(t *testing.T) {
 							&instance.NewAggregate("INSTANCE").Aggregate,
 							"user1",
 							[]string{"IAM_OWNER_VIEWER"}...,
-						),
+						).WithUserResourceOwner("org1"),
 					),
 				),
 				checkPermission: newMockPermissionCheckNotAllowed(),
@@ -614,7 +614,7 @@ func TestCommandSide_ChangeInstanceMember(t *testing.T) {
 								&instance.NewAggregate("INSTANCE").Aggregate,
 								"user1",
 								[]string{"IAM_OWNER"}...,
-							),
+							).WithUserResourceOwner("org1"),
 						),
 					),
 				),
@@ -648,7 +648,7 @@ func TestCommandSide_ChangeInstanceMember(t *testing.T) {
 								&instance.NewAggregate("INSTANCE").Aggregate,
 								"user1",
 								[]string{"IAM_OWNER"}...,
-							),
+							).WithUserResourceOwner("org1"),
 						),
 					),
 					expectPush(
@@ -692,7 +692,7 @@ func TestCommandSide_ChangeInstanceMember(t *testing.T) {
 								&instance.NewAggregate("INSTANCE").Aggregate,
 								"user1",
 								[]string{"IAM_OWNER"}...,
-							),
+							).WithUserResourceOwner("org1"),
 						),
 					),
 				),
@@ -800,7 +800,7 @@ func TestCommandSide_RemoveInstanceMember(t *testing.T) {
 								&instance.NewAggregate("INSTANCE").Aggregate,
 								"user1",
 								[]string{"IAM_OWNER"}...,
-							),
+							).WithUserResourceOwner("org1"),
 						),
 					),
 					expectPush(
@@ -832,7 +832,7 @@ func TestCommandSide_RemoveInstanceMember(t *testing.T) {
 								&instance.NewAggregate("INSTANCE").Aggregate,
 								"user1",
 								[]string{"IAM_OWNER"}...,
-							),
+							).WithUserResourceOwner("org1"),
 						),
 					),
 				),

internal/command/instance_test.go

@@ -663,8 +663,8 @@ func humanEvents(ctx context.Context, instanceID, orgID, userID string) []events
 	return []eventstore.Command{
 		addHumanEvent(ctx, orgID, userID),
 		user.NewHumanEmailVerifiedEvent(ctx, &agg.Aggregate),
-		org.NewMemberAddedEvent(ctx, &orgAgg.Aggregate, userID, domain.RoleOrgOwner),
-		instance.NewMemberAddedEvent(ctx, &instanceAgg.Aggregate, userID, domain.RoleIAMOwner),
+		org.NewMemberAddedEvent(ctx, &orgAgg.Aggregate, userID, domain.RoleOrgOwner).WithUserResourceOwner(orgID),
+		instance.NewMemberAddedEvent(ctx, &instanceAgg.Aggregate, userID, domain.RoleIAMOwner).WithUserResourceOwner(orgID),
 	}
 }
 
@@ -707,8 +707,8 @@ func machineEvents(ctx context.Context, instanceID, orgID, userID, patID string)
 		)
 	}
 	return append(events,
-		org.NewMemberAddedEvent(ctx, &orgAgg.Aggregate, userID, domain.RoleOrgOwner),
-		instance.NewMemberAddedEvent(ctx, &instanceAgg.Aggregate, userID, domain.RoleIAMOwner),
+		org.NewMemberAddedEvent(ctx, &orgAgg.Aggregate, userID, domain.RoleOrgOwner).WithUserResourceOwner(orgID),
+		instance.NewMemberAddedEvent(ctx, &instanceAgg.Aggregate, userID, domain.RoleIAMOwner).WithUserResourceOwner(orgID),
 	)
 }
 
@@ -730,7 +730,7 @@ func loginClientEvents(ctx context.Context, instanceID, orgID, userID, patID str
 	instanceAgg := instance.NewAggregate(instanceID)
 	events := []eventstore.Command{
 		addLoginClientEvent(ctx, orgID, userID),
-		instance.NewMemberAddedEvent(ctx, &instanceAgg.Aggregate, userID, domain.RoleIAMLoginClient),
+		instance.NewMemberAddedEvent(ctx, &instanceAgg.Aggregate, userID, domain.RoleIAMLoginClient).WithUserResourceOwner(orgID),
 	}
 	if patID != "" {
 		events = append(events,

internal/command/org.go

@@ -395,7 +395,7 @@ func (c *Commands) addOrgWithIDAndMember(ctx context.Context, name, userID, reso
 	if err != nil {
 		return nil, err
 	}
-	_, err = c.checkUserExists(ctx, userID, resourceOwner)
+	userResourceOwner, err := c.checkUserExists(ctx, userID, resourceOwner)
 	if err != nil {
 		return nil, err
 	}
@@ -403,7 +403,7 @@ func (c *Commands) addOrgWithIDAndMember(ctx context.Context, name, userID, reso
 	if err := addMember.IsValid(c.zitadelRoles); err != nil {
 		return nil, err
 	}
-	events = append(events, org.NewMemberAddedEvent(ctx, orgAgg, addMember.UserID, addMember.Roles...))
+	events = append(events, org.NewMemberAddedEvent(ctx, orgAgg, addMember.UserID, addMember.Roles...).WithUserResourceOwner(userResourceOwner))
 	if setOrgInactive {
 		deactivateOrgEvent := org.NewOrgDeactivatedEvent(ctx, orgAgg)
 		events = append(events, deactivateOrgEvent)
@@ -578,6 +578,14 @@ func (c *Commands) prepareRemoveOrg(a *org.Aggregate, permissionCheck Organizati
 				return nil, nil
 			}
 
+			ownerDeleteReady, err := c.isUniqueConstraintOwnerDeleteReady(ctx)
+			if err != nil {
+				return nil, err
+			}
+			if ownerDeleteReady {
+				return []eventstore.Command{org.NewOrgRemovedEvent(ctx, &a.Aggregate, writeModel.Name, nil, false, nil, nil, nil)}, nil
+			}
+
 			domainPolicy, err := domainPolicyWriteModel(ctx, filter, a.ID)
 			if err != nil {
 				return nil, err
@@ -588,10 +596,14 @@ func (c *Commands) prepareRemoveOrg(a *org.Aggregate, permissionCheck Organizati
 				return nil, err
 			}
 
-			usernames, err := OrgUsers(ctx, filter, a.ID)
+			orgUsers, err := OrgUsers(ctx, filter, a.ID)
 			if err != nil {
 				return nil, err
 			}
+			usernames := make([]string, len(orgUsers))
+			for i, u := range orgUsers {
+				usernames[i] = u.Username
+			}
 			domains, err := OrgDomains(ctx, filter, a.ID)
 			if err != nil {
 				return nil, err
@@ -733,12 +745,7 @@ func OrgDomains(ctx context.Context, filter preparation.FilterToQueryReducer, or
 	return names, nil
 }
 
-type userIDName struct {
-	name string
-	id   string
-}
-
-func OrgUsers(ctx context.Context, filter preparation.FilterToQueryReducer, orgID string) ([]string, error) {
+func OrgUsers(ctx context.Context, filter preparation.FilterToQueryReducer, orgID string) ([]user.UsernameChange, error) {
 	events, err := filter(ctx, eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent).
 		InstanceID(authz.GetInstance(ctx).InstanceID()).
 		ResourceOwner(orgID).
@@ -757,30 +764,30 @@ func OrgUsers(ctx context.Context, filter preparation.FilterToQueryReducer, orgI
 		return nil, err
 	}
 
-	users := make([]userIDName, 0)
+	users := make([]user.UsernameChange, 0)
 	for _, event := range events {
 		switch eventTyped := event.(type) {
 		case *user.HumanAddedEvent:
-			users = append(users, userIDName{eventTyped.UserName, eventTyped.Aggregate().ID})
+			users = append(users, user.UsernameChange{Username: eventTyped.UserName, UserID: eventTyped.Aggregate().ID})
 		case *user.MachineAddedEvent:
-			users = append(users, userIDName{eventTyped.UserName, eventTyped.Aggregate().ID})
+			users = append(users, user.UsernameChange{Username: eventTyped.UserName, UserID: eventTyped.Aggregate().ID})
 		case *user.HumanRegisteredEvent:
-			users = append(users, userIDName{eventTyped.UserName, eventTyped.Aggregate().ID})
+			users = append(users, user.UsernameChange{Username: eventTyped.UserName, UserID: eventTyped.Aggregate().ID})
 		case *user.DomainClaimedEvent:
 			for i := range users {
-				if users[i].id == eventTyped.Aggregate().ID {
-					users[i].name = eventTyped.UserName
+				if users[i].UserID == eventTyped.Aggregate().ID {
+					users[i].Username = eventTyped.UserName
 				}
 			}
 		case *user.UsernameChangedEvent:
 			for i := range users {
-				if users[i].id == eventTyped.Aggregate().ID {
-					users[i].name = eventTyped.UserName
+				if users[i].UserID == eventTyped.Aggregate().ID {
+					users[i].Username = eventTyped.UserName
 				}
 			}
 		case *user.UserRemovedEvent:
 			for i := range users {
-				if users[i].id == eventTyped.Aggregate().ID {
+				if users[i].UserID == eventTyped.Aggregate().ID {
 					users[i] = users[len(users)-1]
 					users = users[:len(users)-1]
 					break
@@ -788,11 +795,7 @@ func OrgUsers(ctx context.Context, filter preparation.FilterToQueryReducer, orgI
 			}
 		}
 	}
-	names := make([]string, len(users))
-	for i := range users {
-		names[i] = users[i].name
-	}
-	return names, nil
+	return users, nil
 }
 
 func ExistsOrg(ctx context.Context, filter preparation.FilterToQueryReducer, id string) (exists bool, err error) {

internal/command/org_member.go

@@ -22,13 +22,14 @@ func (c *Commands) AddOrgMemberCommand(member *AddOrgMember) preparation.Validat
 				ctx, span := tracing.NewSpan(ctx)
 				defer func() { span.EndWithError(err) }()
 
-				if exists, err := ExistsUser(ctx, filter, member.UserID, "", false); err != nil || !exists {
+				userResourceOwner, exists, err := existingUser(ctx, filter, member.UserID, "", false)
+				if err != nil || !exists {
 					return nil, zerrors.ThrowPreconditionFailed(err, "ORG-GoXOn", "Errors.User.NotFound")
 				}
 				if isMember, err := IsOrgMember(ctx, filter, member.OrgID, member.UserID); err != nil || isMember {
 					return nil, zerrors.ThrowAlreadyExists(err, "ORG-poWwe", "Errors.Org.Member.AlreadyExists")
 				}
-				return []eventstore.Command{org.NewMemberAddedEvent(ctx, &org.NewAggregate(member.OrgID).Aggregate, member.UserID, member.Roles...)}, nil
+				return []eventstore.Command{org.NewMemberAddedEvent(ctx, &org.NewAggregate(member.OrgID).Aggregate, member.UserID, member.Roles...).WithUserResourceOwner(userResourceOwner)}, nil
 			},
 			nil
 	}

internal/command/org_member_test.go

@@ -165,7 +165,7 @@ func TestAddMember(t *testing.T) {
 			},
 			want: Want{
 				Commands: []eventstore.Command{
-					org.NewMemberAddedEvent(ctx, &org.NewAggregate("test").Aggregate, "userID", "ORG_OWNER"),
+					org.NewMemberAddedEvent(ctx, &org.NewAggregate("test").Aggregate, "userID", "ORG_OWNER").WithUserResourceOwner("ro"),
 				},
 			},
 		},
@@ -482,7 +482,7 @@ func TestCommandSide_AddOrgMember(t *testing.T) {
 							&org.NewAggregate("org1").Aggregate,
 							"user1",
 							[]string{"ORG_OWNER"}...,
-						),
+						).WithUserResourceOwner("org1"),
 					),
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
@@ -537,7 +537,7 @@ func TestCommandSide_AddOrgMember(t *testing.T) {
 							&org.NewAggregate("org1").Aggregate,
 							"user1",
 							[]string{"ORG_OWNER"}...,
-						),
+						).WithUserResourceOwner("org1"),
 					),
 				),
 				checkPermission: newMockPermissionCheckAllowed(),

internal/command/org_test.go

@@ -213,7 +213,7 @@ func TestCommandSide_AddOrg(t *testing.T) {
 							context.Background(),
 							&org.NewAggregate("org2").Aggregate,
 							"user1", domain.RoleOrgOwner,
-						),
+						).WithUserResourceOwner("org1"),
 					),
 				),
 				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "org2"),
@@ -279,7 +279,7 @@ func TestCommandSide_AddOrg(t *testing.T) {
 							context.Background(),
 							&org.NewAggregate("org2").Aggregate,
 							"user1", domain.RoleOrgOwner,
-						),
+						).WithUserResourceOwner("org1"),
 					),
 				),
 				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "org2"),
@@ -340,7 +340,7 @@ func TestCommandSide_AddOrg(t *testing.T) {
 							&org.NewAggregate("org2").Aggregate,
 							"user1",
 							domain.RoleOrgOwner,
-						),
+						).WithUserResourceOwner("org1"),
 					),
 				),
 				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "org2"),
@@ -409,7 +409,7 @@ func TestCommandSide_AddOrg(t *testing.T) {
 							&org.NewAggregate("org2").Aggregate,
 							"user1",
 							domain.RoleOrgOwner,
-						),
+						).WithUserResourceOwner("org1"),
 					),
 				),
 				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "org2"),
@@ -1493,6 +1493,29 @@ func TestCommandSide_RemoveOrg(t *testing.T) {
 	}
 }
 
+func TestCommandSide_RemoveOrgOwnerDeleteReady(t *testing.T) {
+	r := &Commands{
+		eventstore: expectEventstore(
+			expectFilter(), // zitadel project check
+			expectFilter(
+				eventFromEventPusher(
+					org.NewOrgAddedEvent(context.Background(),
+						&org.NewAggregate("org1").Aggregate,
+						"org"),
+				),
+			),
+			expectPush(
+				org.NewOrgRemovedEvent(
+					context.Background(), &org.NewAggregate("org1").Aggregate, "org", nil, false, nil, nil, nil,
+				),
+			),
+		)(t),
+		ownerDeleteReady: func(context.Context) (bool, error) { return true, nil },
+	}
+	_, err := r.RemoveOrg(context.Background(), "org1", nil, false)
+	assert.NoError(t, err)
+}
+
 func TestCommandSide_SetUpOrg(t *testing.T) {
 	type fields struct {
 		eventstore   func(t *testing.T) *eventstore.Eventstore

internal/command/organization_settings.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/zitadel/zitadel/internal/command/preparation"
 	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/repository/user"
 	"github.com/zitadel/zitadel/internal/telemetry/tracing"
 	"github.com/zitadel/zitadel/internal/zerrors"
 )
@@ -127,14 +128,14 @@ func (c *Commands) getOrganizationScopedUsernamesWriteModelByID(ctx context.Cont
 	return wm, nil
 }
 
-func (c *Commands) getOrganizationScopedUsernames(ctx context.Context, id string) ([]string, error) {
+func (c *Commands) getOrganizationScopedUsernames(ctx context.Context, id string) ([]user.UsernameChange, error) {
 	wm, err := c.getOrganizationScopedUsernamesWriteModelByID(ctx, id)
 	if err != nil {
 		return nil, err
 	}
-	usernames := make([]string, len(wm.Users))
-	for i, user := range wm.Users {
-		usernames[i] = user.username
+	usernames := make([]user.UsernameChange, len(wm.Users))
+	for i, u := range wm.Users {
+		usernames[i] = user.UsernameChange{Username: u.username, UserID: u.id}
 	}
 	return usernames, nil
 }

internal/command/organization_settings_model.go

@@ -98,7 +98,7 @@ func (wm *OrganizationSettingsWriteModel) NewSet(
 	ctx context.Context,
 	organizationScopedUsernames *bool,
 	userLoginMustBeDomain bool,
-	usernamesF func(ctx context.Context, orgID string) ([]string, error),
+	usernamesF func(ctx context.Context, orgID string) ([]user.UsernameChange, error),
 ) (_ []eventstore.Command, err error) {
 	if err := wm.checkPermissionWrite(ctx, wm.ResourceOwner, wm.AggregateID); err != nil {
 		return nil, err
@@ -108,7 +108,7 @@ func (wm *OrganizationSettingsWriteModel) NewSet(
 		return nil, nil
 	}
 
-	var usernames []string
+	var usernames []user.UsernameChange
 	if (wm.OrganizationScopedUsernames || userLoginMustBeDomain) != (*organizationScopedUsernames || userLoginMustBeDomain) {
 		usernames, err = usernamesF(ctx, wm.AggregateID)
 		if err != nil {
@@ -129,13 +129,13 @@ func (wm *OrganizationSettingsWriteModel) NewSet(
 func (wm *OrganizationSettingsWriteModel) NewRemoved(
 	ctx context.Context,
 	userLoginMustBeDomain bool,
-	usernamesF func(ctx context.Context, orgID string) ([]string, error),
+	usernamesF func(ctx context.Context, orgID string) ([]user.UsernameChange, error),
 ) (_ []eventstore.Command, err error) {
 	if err := wm.checkPermissionDelete(ctx, wm.ResourceOwner, wm.AggregateID); err != nil {
 		return nil, err
 	}
 
-	var usernames []string
+	var usernames []user.UsernameChange
 	if userLoginMustBeDomain != wm.OrganizationScopedUsernames {
 		usernames, err = usernamesF(ctx, wm.AggregateID)
 		if err != nil {

internal/command/organization_settings_test.go

@@ -103,7 +103,7 @@ func TestCommandSide_SetSettingsOrganization(t *testing.T) {
 					expectPush(
 						settings.NewOrganizationSettingsAddedEvent(context.Background(),
 							&settings.NewAggregate("org1", "org1").Aggregate,
-							[]string{"username1", "username2", "username3"},
+							[]user.UsernameChange{{Username: "username1", UserID: "username1"}, {Username: "username2", UserID: "username2"}, {Username: "username3", UserID: "username3"}},
 							true,
 							false,
 						),
@@ -155,7 +155,7 @@ func TestCommandSide_SetSettingsOrganization(t *testing.T) {
 					expectPush(
 						settings.NewOrganizationSettingsAddedEvent(context.Background(),
 							&settings.NewAggregate("org1", "org1").Aggregate,
-							[]string{"username1", "username2", "username3"},
+							[]user.UsernameChange{{Username: "username1", UserID: "username1"}, {Username: "username2", UserID: "username2"}, {Username: "username3", UserID: "username3"}},
 							true,
 							false,
 						),
@@ -209,7 +209,7 @@ func TestCommandSide_SetSettingsOrganization(t *testing.T) {
 					expectPush(
 						settings.NewOrganizationSettingsAddedEvent(context.Background(),
 							&settings.NewAggregate("org1", "org1").Aggregate,
-							[]string{"username1", "username2", "username3"},
+							[]user.UsernameChange{{Username: "username1", UserID: "username1"}, {Username: "username2", UserID: "username2"}, {Username: "username3", UserID: "username3"}},
 							true,
 							true,
 						),
@@ -314,7 +314,7 @@ func TestCommandSide_DeleteSettingsOrganization(t *testing.T) {
 					expectPush(
 						settings.NewOrganizationSettingsRemovedEvent(context.Background(),
 							&settings.NewAggregate("org1", "org1").Aggregate,
-							[]string{"username1", "username2", "username3"},
+							[]user.UsernameChange{{Username: "username1", UserID: "username1"}, {Username: "username2", UserID: "username2"}, {Username: "username3", UserID: "username3"}},
 							false,
 							true,
 						),
@@ -342,7 +342,7 @@ func TestCommandSide_DeleteSettingsOrganization(t *testing.T) {
 					expectPush(
 						settings.NewOrganizationSettingsRemovedEvent(context.Background(),
 							&settings.NewAggregate("org1", "org1").Aggregate,
-							[]string{"username1", "username2", "username3"},
+							[]user.UsernameChange{{Username: "username1", UserID: "username1"}, {Username: "username2", UserID: "username2"}, {Username: "username3", UserID: "username3"}},
 							false,
 							false,
 						),
@@ -371,7 +371,7 @@ func TestCommandSide_DeleteSettingsOrganization(t *testing.T) {
 					expectPush(
 						settings.NewOrganizationSettingsRemovedEvent(context.Background(),
 							&settings.NewAggregate("org1", "org1").Aggregate,
-							[]string{"username1", "username2", "username3"},
+							[]user.UsernameChange{{Username: "username1", UserID: "username1"}, {Username: "username2", UserID: "username2"}, {Username: "username3", UserID: "username3"}},
 							true,
 							true,
 						),
@@ -399,7 +399,7 @@ func TestCommandSide_DeleteSettingsOrganization(t *testing.T) {
 					expectPush(
 						settings.NewOrganizationSettingsRemovedEvent(context.Background(),
 							&settings.NewAggregate("org1", "org1").Aggregate,
-							[]string{"username1", "username2", "username3"},
+							[]user.UsernameChange{{Username: "username1", UserID: "username1"}, {Username: "username2", UserID: "username2"}, {Username: "username3", UserID: "username3"}},
 							true,
 							true,
 						),
@@ -497,7 +497,7 @@ func expectFilterOrganizationSettingsEvents(ctx context.Context, orgID string, s
 			eventFromEventPusher(
 				settings.NewOrganizationSettingsAddedEvent(ctx,
 					&settings.NewAggregate(orgID, orgID).Aggregate,
-					[]string{},
+					nil,
 					orgScopedUsernames,
 					!orgScopedUsernames,
 				),

internal/command/project.go

@@ -327,16 +327,11 @@ func (c *Commands) RemoveProject(ctx context.Context, projectID, resourceOwner s
 		return nil, zerrors.ThrowNotFound(nil, "COMMAND-3M9sd", "Errors.Project.NotFound")
 	}
 
-	samlEntityIDsAgg, err := c.getSAMLEntityIdsWriteModelByProjectID(ctx, projectID, resourceOwner)
+	uniqueConstraints, err := c.projectRemovedUniqueConstraints(ctx, projectID, resourceOwner)
 	if err != nil {
 		return nil, err
 	}
 
-	uniqueConstraints := make([]*eventstore.UniqueConstraint, len(samlEntityIDsAgg.EntityIDs))
-	for i, entityID := range samlEntityIDsAgg.EntityIDs {
-		uniqueConstraints[i] = project.NewRemoveSAMLConfigEntityIDUniqueConstraint(entityID.EntityID)
-	}
-
 	events := []eventstore.Command{
 		project.NewProjectRemovedEvent(ctx,
 			ProjectAggregateFromWriteModelWithCTX(ctx, &existingProject.WriteModel),
@@ -381,15 +376,10 @@ func (c *Commands) DeleteProject(ctx context.Context, id, resourceOwner string,
 		return time.Time{}, err
 	}
 
-	samlEntityIDsAgg, err := c.getSAMLEntityIdsWriteModelByProjectID(ctx, id, resourceOwner)
+	uniqueConstraints, err := c.projectRemovedUniqueConstraints(ctx, id, resourceOwner)
 	if err != nil {
 		return time.Time{}, err
 	}
-
-	uniqueConstraints := make([]*eventstore.UniqueConstraint, len(samlEntityIDsAgg.EntityIDs))
-	for i, entityID := range samlEntityIDsAgg.EntityIDs {
-		uniqueConstraints[i] = project.NewRemoveSAMLConfigEntityIDUniqueConstraint(entityID.EntityID)
-	}
 	events := []eventstore.Command{
 		project.NewProjectRemovedEvent(ctx,
 			ProjectAggregateFromWriteModelWithCTX(ctx, &existing.WriteModel),
@@ -412,6 +402,25 @@ func (c *Commands) DeleteProject(ctx context.Context, id, resourceOwner string,
 	return existing.WriteModel.ChangeDate, nil
 }
 
+func (c *Commands) projectRemovedUniqueConstraints(ctx context.Context, projectID, resourceOwner string) ([]*eventstore.UniqueConstraint, error) {
+	ownerDeleteReady, err := c.isUniqueConstraintOwnerDeleteReady(ctx)
+	if err != nil {
+		return nil, err
+	}
+	if ownerDeleteReady {
+		return nil, nil
+	}
+	samlEntityIDsAgg, err := c.getSAMLEntityIdsWriteModelByProjectID(ctx, projectID, resourceOwner)
+	if err != nil {
+		return nil, err
+	}
+	uniqueConstraints := make([]*eventstore.UniqueConstraint, len(samlEntityIDsAgg.EntityIDs))
+	for i, entityID := range samlEntityIDsAgg.EntityIDs {
+		uniqueConstraints[i] = project.NewRemoveSAMLConfigEntityIDUniqueConstraint(entityID.EntityID)
+	}
+	return uniqueConstraints, nil
+}
+
 func (c *Commands) getProjectWriteModelByID(ctx context.Context, projectID, resourceOwner string) (_ *ProjectWriteModel, err error) {
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()

internal/command/project_grant_member.go

@@ -38,7 +38,7 @@ func (c *Commands) AddProjectGrantMember(ctx context.Context, member *AddProject
 	if err := member.IsValid(c.zitadelRoles); err != nil {
 		return nil, err
 	}
-	_, err = c.checkUserExists(ctx, member.UserID, "")
+	userResourceOwner, err := c.checkUserExists(ctx, member.UserID, "")
 	if err != nil {
 		return nil, err
 	}
@@ -76,7 +76,7 @@ func (c *Commands) AddProjectGrantMember(ctx context.Context, member *AddProject
 			member.UserID,
 			member.ProjectGrantID,
 			member.Roles...,
-		))
+		).WithOwnerOrgs(userResourceOwner, grantedOrgID))
 	if err != nil {
 		return nil, err
 	}

internal/command/project_grant_member_test.go

@@ -130,7 +130,7 @@ func TestCommandSide_AddProjectGrantMember(t *testing.T) {
 							"user1",
 							"projectgrant1",
 							[]string{"PROJECT_GRANT_OWNER"}...,
-						),
+						).WithOwnerOrgs("org1", "grantedorg1"),
 					),
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
@@ -190,7 +190,7 @@ func TestCommandSide_AddProjectGrantMember(t *testing.T) {
 							"user1",
 							"projectgrant1",
 							[]string{"PROJECT_GRANT_OWNER"}...,
-						),
+						).WithOwnerOrgs("org1", "grantedorg1"),
 					),
 				),
 				checkPermission: newMockPermissionCheckAllowed(),

internal/command/project_member.go

@@ -36,7 +36,7 @@ func (c *Commands) AddProjectMember(ctx context.Context, member *AddProjectMembe
 	if err := member.IsValid(c.zitadelRoles); err != nil {
 		return nil, err
 	}
-	_, err = c.checkUserExists(ctx, member.UserID, "")
+	userResourceOwner, err := c.checkUserExists(ctx, member.UserID, "")
 	if err != nil {
 		return nil, err
 	}
@@ -68,7 +68,7 @@ func (c *Commands) AddProjectMember(ctx context.Context, member *AddProjectMembe
 			ProjectAggregateFromWriteModelWithCTX(ctx, &addedMember.WriteModel),
 			member.UserID,
 			member.Roles...,
-		),
+		).WithUserResourceOwner(userResourceOwner),
 	)
 	if err != nil {
 		return nil, err

internal/command/project_member_test.go

@@ -193,7 +193,7 @@ func TestCommandSide_AddProjectMember(t *testing.T) {
 							&project.NewAggregate("project1", "org1").Aggregate,
 							"user1",
 							[]string{"PROJECT_OWNER"}...,
-						),
+						).WithUserResourceOwner("org1"),
 					),
 				),
 				checkPermission: newMockPermissionCheckAllowed(),
@@ -254,7 +254,7 @@ func TestCommandSide_AddProjectMember(t *testing.T) {
 							&project.NewAggregate("project1", "org1").Aggregate,
 							"user1",
 							[]string{"PROJECT_OWNER"}...,
-						),
+						).WithUserResourceOwner("org1"),
 					),
 				),
 				checkPermission: newMockPermissionCheckAllowed(),

internal/command/project_test.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/muhlemmer/gu"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	"github.com/zitadel/zitadel/internal/api/authz"
 	"github.com/zitadel/zitadel/internal/domain"
@@ -1246,6 +1247,32 @@ func TestCommandSide_RemoveProject(t *testing.T) {
 	}
 }
 
+func TestCommandSide_RemoveProjectOwnerDeleteReady(t *testing.T) {
+	r := &Commands{
+		eventstore: expectEventstore(
+			expectFilter(
+				eventFromEventPusher(
+					project.NewProjectAddedEvent(context.Background(),
+						&project.NewAggregate("project1", "org1").Aggregate,
+						"project", true, true, true,
+						domain.PrivateLabelingSettingAllowLoginUserResourceOwnerPolicy),
+				),
+			),
+			expectPush(
+				project.NewProjectRemovedEvent(context.Background(),
+					&project.NewAggregate("project1", "org1").Aggregate,
+					"project",
+					nil),
+			),
+		)(t),
+		checkPermission:  newMockPermissionCheckAllowed(),
+		ownerDeleteReady: func(context.Context) (bool, error) { return true, nil },
+	}
+	got, err := r.RemoveProject(context.Background(), "project1", "org1")
+	require.NoError(t, err)
+	assertObjectDetails(t, &domain.ObjectDetails{ResourceOwner: "org1"}, got)
+}
+
 func TestCommandSide_DeleteProject(t *testing.T) {
 	type fields struct {
 		eventstore      func(t *testing.T) *eventstore.Eventstore

internal/command/unique_constraint_owners.go

@@ -0,0 +1,70 @@
+package command
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/migration"
+)
+
+var _ eventstore.QueryReducer = (*uniqueConstraintOwnersBackfillState)(nil)
+
+func (c *Commands) isUniqueConstraintOwnerDeleteReady(ctx context.Context) (bool, error) {
+	if c.ownerDeleteReadyCached.Load() {
+		return true, nil
+	}
+	if c.ownerDeleteReady == nil {
+		return false, nil
+	}
+	ready, err := c.ownerDeleteReady(ctx)
+	if err != nil {
+		return false, err
+	}
+	if ready {
+		c.ownerDeleteReadyCached.Store(true)
+	}
+	return ready, nil
+}
+
+func (c *Commands) uniqueConstraintOwnersBackfillFinalized(ctx context.Context) (bool, error) {
+	var state uniqueConstraintOwnersBackfillState
+	if err := c.eventstore.FilterToQueryReducer(ctx, &state); err != nil {
+		return false, err
+	}
+	return state.finalized, nil
+}
+
+type uniqueConstraintOwnersBackfillState struct {
+	eventstore.ReadModel
+	finalized bool
+}
+
+func (*uniqueConstraintOwnersBackfillState) Query() *eventstore.SearchQueryBuilder {
+	return eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent).
+		InstanceID("").
+		AddQuery().
+		AggregateTypes(migration.SystemAggregate).
+		AggregateIDs(migration.SystemAggregateID).
+		EventTypes(eventstore.EventType("system.migration.repeatable.done")).
+		Builder()
+}
+
+func (s *uniqueConstraintOwnersBackfillState) Reduce() error {
+	for _, event := range s.Events {
+		if event.Type() != eventstore.EventType("system.migration.repeatable.done") {
+			continue
+		}
+		step, ok := event.(*migration.SetupStep)
+		if !ok || step.Name != eventstore.UniqueConstraintOwnersBackfillStep {
+			continue
+		}
+		lastRun, _ := step.LastRun.(map[string]interface{})
+		if lastRun == nil {
+			s.finalized = false
+			continue
+		}
+		finalized, _ := lastRun["finalized"].(bool)
+		s.finalized = finalized
+	}
+	return s.ReadModel.Reduce()
+}

internal/command/unique_constraint_owners_test.go

@@ -0,0 +1,165 @@
+package command
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/zitadel/zitadel/internal/api/authz"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/eventstore/repository"
+	"github.com/zitadel/zitadel/internal/migration"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+func TestIsUniqueConstraintOwnerDeleteReady(t *testing.T) {
+	t.Run("nil checker is not ready", func(t *testing.T) {
+		c := &Commands{}
+		ready, err := c.isUniqueConstraintOwnerDeleteReady(t.Context())
+		require.NoError(t, err)
+		assert.False(t, ready)
+	})
+
+	t.Run("ready is cached", func(t *testing.T) {
+		calls := 0
+		c := &Commands{
+			ownerDeleteReady: func(context.Context) (bool, error) {
+				calls++
+				return true, nil
+			},
+		}
+		ready, err := c.isUniqueConstraintOwnerDeleteReady(t.Context())
+		require.NoError(t, err)
+		assert.True(t, ready)
+		ready, err = c.isUniqueConstraintOwnerDeleteReady(t.Context())
+		require.NoError(t, err)
+		assert.True(t, ready)
+		assert.Equal(t, 1, calls)
+	})
+
+	t.Run("not ready is not cached", func(t *testing.T) {
+		calls := 0
+		c := &Commands{
+			ownerDeleteReady: func(context.Context) (bool, error) {
+				calls++
+				return false, nil
+			},
+		}
+		_, err := c.isUniqueConstraintOwnerDeleteReady(t.Context())
+		require.NoError(t, err)
+		_, err = c.isUniqueConstraintOwnerDeleteReady(t.Context())
+		require.NoError(t, err)
+		assert.Equal(t, 2, calls)
+	})
+}
+
+func TestUniqueConstraintOwnersBackfillFinalized(t *testing.T) {
+	t.Run("no backfill event", func(t *testing.T) {
+		c := &Commands{eventstore: expectEventstore(expectFilter())(t)}
+		ready, err := c.uniqueConstraintOwnersBackfillFinalized(t.Context())
+		require.NoError(t, err)
+		assert.False(t, ready)
+	})
+
+	t.Run("finalized false is not ready", func(t *testing.T) {
+		c := &Commands{eventstore: expectEventstore(
+			expectFilter(uniqueConstraintOwnersBackfillDoneEvent("v2.0.0", false)),
+		)(t)}
+		ready, err := c.uniqueConstraintOwnersBackfillFinalized(t.Context())
+		require.NoError(t, err)
+		assert.False(t, ready)
+	})
+
+	t.Run("finalized true is ready", func(t *testing.T) {
+		c := &Commands{eventstore: expectEventstore(
+			expectFilter(uniqueConstraintOwnersBackfillDoneEvent("other-version", true)),
+		)(t)}
+		ready, err := c.uniqueConstraintOwnersBackfillFinalized(t.Context())
+		require.NoError(t, err)
+		assert.True(t, ready)
+	})
+
+	t.Run("missing finalized key is not ready", func(t *testing.T) {
+		c := &Commands{eventstore: expectEventstore(
+			expectFilter(uniqueConstraintOwnersBackfillDoneEventLastRun(map[string]any{"version": "v2.0.0"})),
+		)(t)}
+		ready, err := c.uniqueConstraintOwnersBackfillFinalized(t.Context())
+		require.NoError(t, err)
+		assert.False(t, ready)
+	})
+
+	t.Run("failed event with finalized true is not ready", func(t *testing.T) {
+		c := &Commands{eventstore: expectEventstore(
+			expectFilter(uniqueConstraintOwnersBackfillFailedEvent("v2.0.0", true)),
+		)(t)}
+		ready, err := c.uniqueConstraintOwnersBackfillFinalized(t.Context())
+		require.NoError(t, err)
+		assert.False(t, ready)
+	})
+
+	t.Run("failed then done finalized is ready", func(t *testing.T) {
+		c := &Commands{eventstore: expectEventstore(
+			expectFilter(
+				uniqueConstraintOwnersBackfillFailedEvent("v2.0.0", true),
+				uniqueConstraintOwnersBackfillDoneEvent("v2.0.0", true),
+			),
+		)(t)}
+		ready, err := c.uniqueConstraintOwnersBackfillFinalized(t.Context())
+		require.NoError(t, err)
+		assert.True(t, ready)
+	})
+
+	t.Run("filter error", func(t *testing.T) {
+		c := &Commands{eventstore: expectEventstore(
+			expectFilterError(zerrors.ThrowInternal(nil, "id", "err")),
+		)(t)}
+		_, err := c.uniqueConstraintOwnersBackfillFinalized(t.Context())
+		assert.Error(t, err)
+	})
+}
+
+func uniqueConstraintOwnersBackfillDoneEvent(version string, finalized bool) *repository.Event {
+	return uniqueConstraintOwnersBackfillEvent(eventstore.EventType("system.migration.repeatable.done"), map[string]any{
+		"version":   version,
+		"finalized": finalized,
+	})
+}
+
+func uniqueConstraintOwnersBackfillFailedEvent(version string, finalized bool) *repository.Event {
+	return uniqueConstraintOwnersBackfillEvent(eventstore.EventType("system.migration.failed"), map[string]any{
+		"version":   version,
+		"finalized": finalized,
+	})
+}
+
+func uniqueConstraintOwnersBackfillDoneEventLastRun(lastRun map[string]any) *repository.Event {
+	return uniqueConstraintOwnersBackfillEvent(eventstore.EventType("system.migration.repeatable.done"), lastRun)
+}
+
+func uniqueConstraintOwnersBackfillEvent(typ eventstore.EventType, lastRun map[string]any) *repository.Event {
+	ctx := authz.WithInstanceID(context.Background(), "")
+	cmd := &migration.SetupStep{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			eventstore.NewAggregate(ctx, migration.SystemAggregateID, migration.SystemAggregate, "v1"),
+			typ,
+		),
+		Name:    eventstore.UniqueConstraintOwnersBackfillStep,
+		LastRun: lastRun,
+	}
+	data, err := eventstore.EventData(cmd)
+	if err != nil {
+		panic(err)
+	}
+	return &repository.Event{
+		InstanceID:    cmd.Aggregate().InstanceID,
+		Typ:           cmd.Type(),
+		Data:          data,
+		EditorUser:    cmd.Creator(),
+		Version:       cmd.Aggregate().Version,
+		AggregateID:   cmd.Aggregate().ID,
+		AggregateType: cmd.Aggregate().Type,
+	}
+}

internal/command/user.go

@@ -200,7 +200,19 @@ func (c *Commands) RemoveUser(ctx context.Context, userID, resourceOwner string,
 	}
 	var events []eventstore.Command
 	userAgg := UserAggregateFromWriteModel(&existingUser.WriteModel)
-	events = append(events, user.NewUserRemovedEvent(ctx, userAgg, existingUser.UserName, existingUser.IDPLinks, domainPolicy.UserLoginMustBeDomain || orgScopedUsername))
+	userName := existingUser.UserName
+	idpLinks := existingUser.IDPLinks
+	orgScoped := domainPolicy.UserLoginMustBeDomain || orgScopedUsername
+	ownerDeleteReady, err := c.isUniqueConstraintOwnerDeleteReady(ctx)
+	if err != nil {
+		return nil, err
+	}
+	if ownerDeleteReady {
+		userName = ""
+		idpLinks = nil
+		orgScoped = false
+	}
+	events = append(events, user.NewUserRemovedEvent(ctx, userAgg, userName, idpLinks, orgScoped))
 
 	for _, grantID := range cascadingGrantIDs {
 		removeEvent, _, err := c.removeUserGrant(ctx, grantID, "", true, false, nil)
@@ -387,6 +399,11 @@ func (c *Commands) userWriteModelByID(ctx context.Context, userID, resourceOwner
 }
 
 func ExistsUser(ctx context.Context, filter preparation.FilterToQueryReducer, id, resourceOwner string, machineOnly bool) (exists bool, err error) {
+	_, exists, err = existingUser(ctx, filter, id, resourceOwner, machineOnly)
+	return exists, err
+}
+
+func existingUser(ctx context.Context, filter preparation.FilterToQueryReducer, id, resourceOwner string, machineOnly bool) (userResourceOwner string, exists bool, err error) {
 	eventTypes := []eventstore.EventType{
 		user.MachineAddedEventType,
 		user.UserRemovedType,
@@ -408,19 +425,21 @@ func ExistsUser(ctx context.Context, filter preparation.FilterToQueryReducer, id
 		EventTypes(eventTypes...).
 		Builder())
 	if err != nil {
-		return false, err
+		return "", false, err
 	}
 
 	for _, event := range events {
 		switch event.(type) {
 		case *user.HumanRegisteredEvent, *user.HumanAddedEvent, *user.MachineAddedEvent:
 			exists = true
+			userResourceOwner = event.Aggregate().ResourceOwner
 		case *user.UserRemovedEvent:
 			exists = false
+			userResourceOwner = ""
 		}
 	}
 
-	return exists, nil
+	return userResourceOwner, exists, nil
 }
 
 func (c *Commands) newUserInitCode(ctx context.Context, filter preparation.FilterToQueryReducer, alg crypto.EncryptionAlgorithm) (*EncryptedCode, error) {

internal/command/user_grant.go

@@ -42,7 +42,7 @@ func (c *Commands) addUserGrant(ctx context.Context, userGrant *domain.UserGrant
 	if !userGrant.IsValid() {
 		return nil, nil, zerrors.ThrowInvalidArgument(nil, "COMMAND-kVfMa", "Errors.UserGrant.Invalid")
 	}
-	err = c.checkUserGrantPreCondition(ctx, userGrant, check)
+	owners, err := c.checkUserGrantPreCondition(ctx, userGrant, check)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -60,7 +60,7 @@ func (c *Commands) addUserGrant(ctx context.Context, userGrant *domain.UserGrant
 		userGrant.ProjectID,
 		userGrant.ProjectGrantID,
 		userGrant.RoleKeys,
-	)
+	).WithOwnerOrgs(owners.userResourceOwner, owners.projectResourceOwner, owners.grantedOrg)
 	return command, addedUserGrant, nil
 }
 
@@ -88,7 +88,7 @@ func (c *Commands) ChangeUserGrant(ctx context.Context, userGrant *domain.UserGr
 	userGrant.ProjectGrantID = existingUserGrant.ProjectGrantID
 	userGrant.ResourceOwner = existingUserGrant.ResourceOwner
 
-	err = c.checkUserGrantPreCondition(ctx, userGrant, check)
+	_, err = c.checkUserGrantPreCondition(ctx, userGrant, check)
 	if err != nil {
 		return nil, err
 	}
@@ -119,7 +119,7 @@ func (c *Commands) removeRoleFromUserGrant(ctx context.Context, userGrantID stri
 	if existingUserGrant.State == domain.UserGrantStateUnspecified || existingUserGrant.State == domain.UserGrantStateRemoved {
 		return nil, zerrors.ThrowNotFound(nil, "COMMAND-3M9sd", "Errors.UserGrant.NotFound")
 	}
-	
+
 	beforeLen := len(existingUserGrant.RoleKeys)
 	existingUserGrant.RoleKeys = slices.DeleteFunc(existingUserGrant.RoleKeys, func(role string) bool {
 		return roleKeysToRemove[role]
@@ -302,7 +302,13 @@ func (c *Commands) userGrantWriteModelByID(ctx context.Context, userGrantID stri
 	return writeModel, nil
 }
 
-func (c *Commands) checkUserGrantPreCondition(ctx context.Context, usergrant *domain.UserGrant, check UserGrantPermissionCheck) (err error) {
+type userGrantOwners struct {
+	userResourceOwner    string
+	projectResourceOwner string
+	grantedOrg           string
+}
+
+func (c *Commands) checkUserGrantPreCondition(ctx context.Context, usergrant *domain.UserGrant, check UserGrantPermissionCheck) (owners userGrantOwners, err error) {
 	if !authz.GetFeatures(ctx).ShouldUseImprovedPerformance(feature.ImprovedPerformanceTypeUserGrant) {
 		return c.checkUserGrantPreConditionOld(ctx, usergrant, check)
 	}
@@ -310,13 +316,14 @@ func (c *Commands) checkUserGrantPreCondition(ctx context.Context, usergrant *do
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()
 
-	if _, err := c.checkUserExists(ctx, usergrant.UserID, ""); err != nil {
-		return err
+	userResourceOwner, err := c.checkUserExists(ctx, usergrant.UserID, "")
+	if err != nil {
+		return userGrantOwners{}, err
 	}
 	if usergrant.ProjectGrantID != "" || usergrant.ResourceOwner == "" {
 		projectOwner, grantID, err := c.searchProjectOwnerAndGrantID(ctx, usergrant.ProjectID, "")
 		if err != nil {
-			return err
+			return userGrantOwners{}, err
 		}
 		if usergrant.ResourceOwner == "" {
 			usergrant.ResourceOwner = projectOwner
@@ -324,18 +331,28 @@ func (c *Commands) checkUserGrantPreCondition(ctx context.Context, usergrant *do
 		if usergrant.ProjectGrantID == "" {
 			usergrant.ProjectGrantID = grantID
 		}
+		owners.projectResourceOwner = projectOwner
+	}
+	if owners.projectResourceOwner == "" {
+		owners.projectResourceOwner = usergrant.ResourceOwner
 	}
 	existingRoleKeys, err := c.searchUserGrantPreConditionState(ctx, usergrant)
 	if err != nil {
-		return err
+		return userGrantOwners{}, err
 	}
 	if usergrant.HasInvalidRoles(existingRoleKeys) {
-		return zerrors.ThrowPreconditionFailed(err, "COMMAND-mm9F4", "Errors.Project.Role.NotFound")
+		return userGrantOwners{}, zerrors.ThrowPreconditionFailed(err, "COMMAND-mm9F4", "Errors.Project.Role.NotFound")
 	}
 	if check != nil {
-		return check(usergrant.ProjectID, usergrant.ProjectGrantID)(usergrant.ResourceOwner, "")
+		if err := check(usergrant.ProjectID, usergrant.ProjectGrantID)(usergrant.ResourceOwner, ""); err != nil {
+			return userGrantOwners{}, err
+		}
 	}
-	return nil
+	owners.userResourceOwner = userResourceOwner
+	if usergrant.ProjectGrantID != "" {
+		owners.grantedOrg = usergrant.ResourceOwner
+	}
+	return owners, nil
 }
 
 // this code needs to be rewritten anyways as soon as we improved the fields handling
@@ -451,14 +468,14 @@ func (c *Commands) searchUserGrantPreConditionState(ctx context.Context, userGra
 	return existingRoleKeys, nil
 }
 
-func (c *Commands) checkUserGrantPreConditionOld(ctx context.Context, usergrant *domain.UserGrant, check UserGrantPermissionCheck) (err error) {
+func (c *Commands) checkUserGrantPreConditionOld(ctx context.Context, usergrant *domain.UserGrant, check UserGrantPermissionCheck) (owners userGrantOwners, err error) {
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()
 
 	preConditions := NewUserGrantPreConditionReadModel(usergrant.UserID, usergrant.ProjectID, usergrant.ProjectGrantID, usergrant.ResourceOwner)
 	err = c.eventstore.FilterToQueryReducer(ctx, preConditions)
 	if err != nil {
-		return err
+		return userGrantOwners{}, err
 	}
 	if usergrant.ResourceOwner == "" {
 		usergrant.ResourceOwner = preConditions.ProjectResourceOwner
@@ -467,23 +484,30 @@ func (c *Commands) checkUserGrantPreConditionOld(ctx context.Context, usergrant
 		usergrant.ProjectGrantID = preConditions.FoundGrantID
 	}
 	if !preConditions.UserExists {
-		return zerrors.ThrowPreconditionFailed(err, "COMMAND-4f8sg", "Errors.User.NotFound")
+		return userGrantOwners{}, zerrors.ThrowPreconditionFailed(err, "COMMAND-4f8sg", "Errors.User.NotFound")
 	}
 	projectIsOwned := usergrant.ResourceOwner == "" || usergrant.ResourceOwner == preConditions.ProjectResourceOwner
 	if projectIsOwned && !preConditions.ProjectExists {
-		return zerrors.ThrowPreconditionFailed(err, "COMMAND-3n77S", "Errors.Project.NotFound")
+		return userGrantOwners{}, zerrors.ThrowPreconditionFailed(err, "COMMAND-3n77S", "Errors.Project.NotFound")
 	}
 	if !projectIsOwned && preConditions.FoundGrantID == "" {
-		return zerrors.ThrowPreconditionFailed(err, "COMMAND-4m9ff", "Errors.Project.Grant.NotFound")
+		return userGrantOwners{}, zerrors.ThrowPreconditionFailed(err, "COMMAND-4m9ff", "Errors.Project.Grant.NotFound")
 	}
 	// Either check roles from project or project grant
 	if usergrant.HasInvalidRoles(preConditions.existingRoles()) {
-		return zerrors.ThrowPreconditionFailed(err, "COMMAND-mm9F4", "Errors.Project.Role.NotFound")
+		return userGrantOwners{}, zerrors.ThrowPreconditionFailed(err, "COMMAND-mm9F4", "Errors.Project.Role.NotFound")
 	}
 	if check != nil {
-		return check(usergrant.ProjectID, usergrant.ProjectGrantID)(usergrant.ResourceOwner, "")
+		if err := check(usergrant.ProjectID, usergrant.ProjectGrantID)(usergrant.ResourceOwner, ""); err != nil {
+			return userGrantOwners{}, err
+		}
 	}
-	return nil
+	owners.userResourceOwner = preConditions.UserResourceOwner
+	owners.projectResourceOwner = preConditions.ProjectResourceOwner
+	if usergrant.ProjectGrantID != "" {
+		owners.grantedOrg = usergrant.ResourceOwner
+	}
+	return owners, nil
 }
 
 func (c *Commands) searchProjectOwnerAndGrantID(ctx context.Context, projectID string, grantedOrgID string) (projectOwner string, grantID string, err error) {

internal/command/user_grant_model.go

@@ -95,6 +95,7 @@ type UserGrantPreConditionReadModel struct {
 	ProjectGrantID          string
 	FoundGrantID            string
 	ResourceOwner           string
+	UserResourceOwner       string
 	UserExists              bool
 	ProjectExists           bool
 	ExistingRoleKeysProject []string
@@ -121,12 +122,16 @@ func (wm *UserGrantPreConditionReadModel) Reduce() error {
 		switch e := event.(type) {
 		case *user.HumanAddedEvent:
 			wm.UserExists = true
+			wm.UserResourceOwner = e.Aggregate().ResourceOwner
 		case *user.HumanRegisteredEvent:
 			wm.UserExists = true
+			wm.UserResourceOwner = e.Aggregate().ResourceOwner
 		case *user.MachineAddedEvent:
 			wm.UserExists = true
+			wm.UserResourceOwner = e.Aggregate().ResourceOwner
 		case *user.UserRemovedEvent:
 			wm.UserExists = false
+			wm.UserResourceOwner = ""
 		case *project.ProjectAddedEvent:
 			if projectExistsOnOrganization(wm.ResourceOwner, e.Aggregate().ResourceOwner) {
 				wm.ProjectExists = true

internal/command/user_grant_test.go

@@ -462,7 +462,7 @@ func TestCommandSide_AddUserGrant(t *testing.T) {
 							"project1",
 							"",
 							[]string{"rolekey1"},
-						),
+						).WithOwnerOrgs("org1", "org1", ""),
 					),
 				),
 				idGenerator: func(t *testing.T) id.Generator {
@@ -550,7 +550,7 @@ func TestCommandSide_AddUserGrant(t *testing.T) {
 							"project1",
 							"",
 							[]string{"rolekey1"},
-						),
+						).WithOwnerOrgs("org1", "org1", ""),
 					),
 				),
 				idGenerator: func(t *testing.T) id.Generator {
@@ -631,7 +631,7 @@ func TestCommandSide_AddUserGrant(t *testing.T) {
 							"project1",
 							"projectgrant1",
 							[]string{"rolekey1"},
-						),
+						).WithOwnerOrgs("org1", "org1", "org1"),
 					),
 				),
 				idGenerator: func(t *testing.T) id.Generator {
@@ -705,7 +705,7 @@ func TestCommandSide_AddUserGrant(t *testing.T) {
 							"project1",
 							"",
 							[]string{"rolekey1"},
-						),
+						).WithOwnerOrgs("org1", "org1", ""),
 					),
 				),
 				idGenerator: func(t *testing.T) id.Generator {
@@ -783,7 +783,7 @@ func TestCommandSide_AddUserGrant(t *testing.T) {
 							"project1",
 							"projectgrant1",
 							[]string{"rolekey1"},
-						),
+						).WithOwnerOrgs("org1", "org2", "org1"),
 					),
 				),
 				idGenerator: func(t *testing.T) id.Generator {
@@ -866,7 +866,7 @@ func TestCommandSide_AddUserGrant(t *testing.T) {
 							"project1",
 							"projectgrant1",
 							[]string{"rolekey1"},
-						),
+						).WithOwnerOrgs("org1", "org1", "org2"),
 					),
 				),
 				idGenerator: func(t *testing.T) id.Generator {
@@ -3225,31 +3225,31 @@ func TestCommandSide_removeRoleFromUserGrant(t *testing.T) {
 		{
 			name:             "advisory scenario, remove two adjacent leading roles",
 			existingRoleKeys: []string{"admin", "viewer", "editor"},
-			roleKeysToRemove: map[string]bool{"admin":true, "viewer":true},
+			roleKeysToRemove: map[string]bool{"admin": true, "viewer": true},
 			want:             []string{"editor"},
 		},
 		{
 			name:             "remove first two of four",
 			existingRoleKeys: []string{"a", "b", "c", "d"},
-			roleKeysToRemove: map[string]bool{"a":true, "b":true},
+			roleKeysToRemove: map[string]bool{"a": true, "b": true},
 			want:             []string{"c", "d"},
 		},
 		{
 			name:             "remove two adjacent middle roles",
 			existingRoleKeys: []string{"a", "b", "c", "d"},
-			roleKeysToRemove: map[string]bool{"b":true, "c":true},
+			roleKeysToRemove: map[string]bool{"b": true, "c": true},
 			want:             []string{"a", "d"},
 		},
 		{
 			name:             "remove two non-adjacent roles",
 			existingRoleKeys: []string{"a", "b", "c", "d"},
-			roleKeysToRemove: map[string]bool{"a":true, "c":true},
+			roleKeysToRemove: map[string]bool{"a": true, "c": true},
 			want:             []string{"b", "d"},
 		},
 		{
 			name:             "remove all roles",
 			existingRoleKeys: []string{"x", "y", "z"},
-			roleKeysToRemove: map[string]bool{"x":true, "y":true, "z":true},
+			roleKeysToRemove: map[string]bool{"x": true, "y": true, "z": true},
 			want:             []string{},
 		},
 	}

internal/command/user_test.go

@@ -6,6 +6,7 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"golang.org/x/text/language"
 
 	"github.com/zitadel/zitadel/internal/command/preparation"
@@ -1600,6 +1601,53 @@ func TestCommandSide_RemoveUser(t *testing.T) {
 	}
 }
 
+func TestCommandSide_RemoveUserOwnerDeleteReady(t *testing.T) {
+	r := &Commands{
+		eventstore: expectEventstore(
+			expectFilter(
+				eventFromEventPusher(
+					user.NewHumanAddedEvent(context.Background(),
+						&user.NewAggregate("user1", "org1").Aggregate,
+						"username",
+						"firstname",
+						"lastname",
+						"nickname",
+						"displayname",
+						language.German,
+						domain.GenderUnspecified,
+						"[email protected]",
+						true,
+					),
+				),
+			),
+			expectFilter(),
+			expectFilter(
+				eventFromEventPusher(
+					instance.NewDomainPolicyAddedEvent(context.Background(),
+						&user.NewAggregate("user1", "org1").Aggregate,
+						true,
+						true,
+						true,
+					),
+				),
+			),
+			expectFilterOrganizationSettings("org1", false, false),
+			expectPush(
+				user.NewUserRemovedEvent(context.Background(),
+					&user.NewAggregate("user1", "org1").Aggregate,
+					"",
+					nil,
+					false,
+				),
+			),
+		)(t),
+		ownerDeleteReady: func(context.Context) (bool, error) { return true, nil },
+	}
+	got, err := r.RemoveUser(context.Background(), "user1", "org1", nil, nil, nil)
+	require.NoError(t, err)
+	assertObjectDetails(t, &domain.ObjectDetails{ResourceOwner: "org1"}, got)
+}
+
 func TestCommands_RevokeAccessToken(t *testing.T) {
 	type fields struct {
 		eventstore func(t *testing.T) *eventstore.Eventstore

internal/command/user_v2.go

@@ -152,7 +152,19 @@ func (c *Commands) RemoveUserV2(ctx context.Context, userID, resourceOwner strin
 	}
 
 	var events []eventstore.Command
-	events = append(events, user.NewUserRemovedEvent(ctx, &existingUser.Aggregate().Aggregate, existingUser.UserName, existingUser.IDPLinks, domainPolicy.UserLoginMustBeDomain || organizationScopedUsername))
+	userName := existingUser.UserName
+	idpLinks := existingUser.IDPLinks
+	orgScoped := domainPolicy.UserLoginMustBeDomain || organizationScopedUsername
+	ownerDeleteReady, err := c.isUniqueConstraintOwnerDeleteReady(ctx)
+	if err != nil {
+		return nil, err
+	}
+	if ownerDeleteReady {
+		userName = ""
+		idpLinks = nil
+		orgScoped = false
+	}
+	events = append(events, user.NewUserRemovedEvent(ctx, &existingUser.Aggregate().Aggregate, userName, idpLinks, orgScoped))
 
 	for _, grantID := range cascadingGrantIDs {
 		removeEvent, _, err := c.removeUserGrant(ctx, grantID, "", true, true, nil)