chore: rename IAM to instance (#11351)

# Which Problems Are Solved In many cases IAM was used where instance was meant. # How the Problems Are Solved - Rename wrong usage of IAM to instance all over the code base. - Add an agents.md which explains the terms used in Zitadel's architecture. # Additional Context - closes #11280 --------- Co-authored-by: Copilot <[email protected]> Co-authored-by: muhlemmer <[email protected]> Co-authored-by: Copilot <[email protected]> Co-authored-by: Marco A. <[email protected]>
2026-10-18 05:52:51 +00:00 · 2026-02-10 20:25:39 +01:00
parent 67a02a6aeb
commit 5a2181bcec
110 changed files with 392 additions and 478 deletions
@@ -0,0 +1 @@
+Always respect the terminology defined in the 'Technical Glossary' section of agents.md when generating UI text or documentation.
@@ -423,7 +423,7 @@ If you don't want to build and run a local API, you can just run the Login devel

 ```env
 ZITADEL_API_URL=https://[your-cloud-instance-domain]
-ZITADEL_SERVICE_USER_TOKEN=[personal access token for an IAM Login Client]
+ZITADEL_SERVICE_USER_TOKEN=[personal access token for an instance Login Client]
 ```

 3. Start the development server.
@@ -0,0 +1,45 @@
+## ZITADEL Domain & Multi-Tenancy Logic
+
+### 1. Hierarchy & Ownership
+
+ZITADEL follows a strict hierarchical containment model. When generating code, logic, or translations, adhere to this structure:
+
+- **System (Installation):** The entire ZITADEL deployment. Global settings are applied through runtime configuration files or environment variables. See `cmd/defaults.yaml`.
+- **Instance (The "Identity System"):** 
+  - **Definition:** A logical partition/virtual tenant. It is a "System inside a System."
+  - **Isolation:** Data and configurations are strictly isolated between instances.
+  - **Translation Rule:** NEVER translate as "Example" or "Case." Use technical terms like "Tenant," "Environment," or the local equivalent of "Logical System Entity."
+- **Organization:** A group within an Instance. It owns Users, Projects, and Roles.
+- **Project:** A collection of Applications and Auth Policies within an Org.
+
+### 2. Permission Scoping (The "Administrative" Context)
+
+- **System User:** Manages the entire Installation and creates Instances over the system API.
+- **Instance Admin:** Manages Instance-wide policies (Password complexity, Identity Providers, Organizations).
+- **Organization Admin:** Manages users and access within a specific Organization.
+
+### 3. Language & Tone Guidelines
+
+- **Avoid Ambiguity:** When referring to an 'Instance', the context is always infrastructure/tenancy.
+- **Technical Precision:** In UI strings, prefer clarity over brevity if "Instance" is likely to be misinterpreted in the target language.
+
+### 4. Technical Glossary & Localization Mapping
+
+| Language             | Technical Term (SaaS/Cloud) | Why this term?                                            | "Avoid this (The ""Example"" Trap)" |
+| -------------------- | --------------------------- | --------------------------------------------------------- | ----------------------------------- |
+| Chinese (Simplified) | 实例 (Shílì)                | Standard for a cloud resource/entity.                     | 例子 (Lìzi)                         |
+| Japanese             | インスタンス (Insutansu)    | Katakana transliteration; industry standard.              | 例 (Rei)                            |
+| Korean               | 인스턴스 (Inseuteonseu)     | Hangul transliteration; industry standard.                | 예 (Ye)                             |
+| German               | Instanz                     | Matches English but implies a technical occurrence.       | Beispiel                            |
+| French               | Instance                    | "Standard but often requires ""de ZITADEL"" for clarity." | Exemple                             |
+| Spanish              | Instancia                   | Technical entity in software architecture.                | Ejemplo                             |
+| Portuguese           | Instância                   | Standard technical terminology.                           | Exemplo                             |
+| Russian              | Инстанс (Instans)           | Modern SaaS jargon (transliterated).                      | Пример (Primer)                     |
+
+#### Translation Guardrails
+If a translation is requested for a language not listed above, follow these priority rules for the word 'Instance':
+
+1. **Priority 1 (Transliteration):** Use the phonetic transliteration into the local script (common in Japanese/Korean/Russian).
+2. **Priority 2 (System Entity):** Use a term that implies a "running process" or "logical environment."
+3. **Priority 3 (Tenant):** If 'Instance' is ambiguous, use the local word for 'Tenant' (e.g., 租户 in Chinese).
+4. **Strict Ban:** NEVER use words that mean "an illustration", "a case", "a sample", or "an example."
@@ -16,11 +16,11 @@ FirstInstance:
    LoginClient:
      Machine:
        Username: login-client
-        Name: Automatically Initialized IAM Login Client
+        Name: Automatically Initialized instance Login Client
      Pat.ExpirationDate: 2099-01-01T00:00:00Z
    Machine:
      Machine:
        Username: admin
-        Name: Automatically Initialized IAM admin Client
+        Name: Automatically Initialized instance admin Client
      Pat.ExpirationDate: 2099-01-01T00:00:00Z
 DefaultInstance.Features.LoginV2.BaseURI: http://localhost:3000/ui/v2/login
@@ -111,7 +111,7 @@ API Reference:

 ### Management

-The management API is as the name states the interface where systems can mutate IAM objects like, organizations, projects, applications, users and so on if they have the necessary access rights.
+The management API is as the name states the interface where systems can mutate instance objects like, organizations, projects, applications, users and so on if they have the necessary access rights.
 To identify the current organization you can send a header `x-zitadel-orgid` or if no header is set, the organization of the authenticated user is set.

 </div>
@@ -3,7 +3,7 @@ title: Scopes in ZITADEL
 sidebar_label: Scopes
 ---

-ZITADEL supports the usage of scopes as way of requesting information from the IAM and also instruct ZITADEL to do certain operations.
+ZITADEL supports the usage of scopes as way of requesting information from the instance and also instruct ZITADEL to do certain operations.

 ## Standard Scopes

@@ -3,9 +3,9 @@ title: SCIM v2.0 (Preview)
 ---

 The Zitadel [SCIM v2](https://scim.cloud/) service provider interface enables seamless integration of identity and
-access management (IAM) systems with Zitadel,
+access management (instance) systems with Zitadel,
 following the System for Cross-domain Identity Management (SCIM) v2.0 specification.
-This interface allows standardized management of IAM resources, making it easier to automate user provisioning and
+This interface allows standardized management of instance resources, making it easier to automate user provisioning and
 deprovisioning.

 ## Supported endpoints
@@ -31,7 +31,7 @@ Simply steer traffic by path, hostname, IP address or any other metadata to the

 ### Single Cluster / Region

-A Zitadel Cluster is a highly available IAM system with each component critical for serving traffic laid out at least three times.
+A Zitadel Cluster is a highly available instance system with each component critical for serving traffic laid out at least three times.
 Our storage layer (Postgres) is built for single region deployments.
 Hence our reference design for Kubernetes is to have three application nodes and one storage node.

@@ -1,7 +1,7 @@
 ZITADEL is organized around the idea that:

 * Multiple organizations can be managed within one [instance](/concepts/structure/instance).
-* organizations can grant each other rights to self-manage certain aspects of the IAM (eg, roles for access management)
+* organizations can grant each other rights to self-manage certain aspects of the instance (eg, roles for access management)
 * organizations are vessels for users and projects

 ![](../../../public/img/concepts/objects/organization.png)
@@ -433,7 +433,7 @@ This gives us a response with the ID token in the `access_token` field and the `
 With impersonation we can let one user assume the role of another user.

 <Callout>
-Currently impersonated tokens cannot be used for the ZITADEL API. This is to prevent privilege escalation where a impersonator could become an IAM owner, for example. We might enable the use of impersonated tokens in the future.
+Currently impersonated tokens cannot be used for the ZITADEL API. This is to prevent privilege escalation where a impersonator could become an instance owner, for example. We might enable the use of impersonated tokens in the future.
 </Callout>

 ### Preparation
@@ -452,8 +452,8 @@ Next we need to configure which users are allowed to impersonate other users. ZI

 | Name                   | Role                      | Description                                                       |
 | ---------------------- | ------------------------- | ----------------------------------------------------------------- |
-| IAM Admin Impersonator | IAM_ADMIN_IMPERSONATOR    | Allow impersonation of admin and end users from all organizations |
-| IAM Impersonator       | IAM_END_USER_IMPERSONATOR | Allow impersonation of end users from all organizations           |
+| Instance Admin Impersonator | IAM_ADMIN_IMPERSONATOR    | Allow impersonation of admin and end users from all organizations |
+| Instance Impersonator       | IAM_END_USER_IMPERSONATOR | Allow impersonation of end users from all organizations           |
 | Org Admin Impersonator | ORG_ADMIN_IMPERSONATOR    | Allow impersonation of admin and end users from the organization  |
 | Org Impersonator       | ORG_END_USER_IMPERSONATOR | Allow impersonation of end users from the organization            |

@@ -65,7 +65,7 @@ Via APIs23: * [Create User (Machine)](/reference/api/management/zitadel.manageme
 ZITADEL Managers are Users who have permission to manage ZITADEL itself.
 There are some different levels for managers.

- **IAM Managers**: This is the highest level. Users with IAM Administrator roles are able to manage the whole instance.
+- **Instance Managers**: This is the highest level. Users with IAM Administrator roles are able to manage the whole instance.
 - **Org Managers**: Managers in the Organization Level are able to manage everything within the granted Organization.
 - **Project Managers**: At this level, the user is able to manage a project.
 - **Project Grant Manager**: The project grant manager is for projects, which are granted of another organization.
@@ -21,13 +21,13 @@ In the right part of the management console you can find **MANAGERS** in the det

 | Name                          | Role                          | Description                                                                                                  |
 | ----------------------------- | ----------------------------- | ------------------------------------------------------------------------------------------------------------ |
-| IAM Owner                     | IAM_OWNER                     | Manage the IAM, manage all organizations with their content                                                  |
-| IAM Owner Viewer              | IAM_OWNER_VIEWER              | View the IAM and view all organizations with their content                                                   |
-| IAM Org Manager               | IAM_ORG_MANAGER               | Manage all organizations including their policies, projects and users                                        |
-| IAM User Manager              | IAM_USER_MANAGER              | Manage all users and their authorizations over all organizations                                             |
-| IAM Admin Impersonator        | IAM_ADMIN_IMPERSONATOR        | Allow impersonation of admin and end users from all organizations                                            |
-| IAM Impersonator              | IAM_END_USER_IMPERSONATOR     | Allow impersonation of end users from all organizations                                                      |
-| IAM Login Client              | IAM_LOGIN_CLIENT              | Get all permissions needed to implement your own Login UI.                                                    |
+| Instance Owner                | IAM_OWNER                     | Manage the Instance, manage all organizations with their content                                             |
+| Instance Owner Viewer         | IAM_OWNER_VIEWER              | View the Instance and view all organizations with their content                                              |
+| Instance Org Manager          | IAM_ORG_MANAGER               | Manage all organizations including their policies, projects and users                                        |
+| Instance User Manager         | IAM_USER_MANAGER              | Manage all users and their authorizations over all organizations                                             |
+| Instance Admin Impersonator   | IAM_ADMIN_IMPERSONATOR        | Allow impersonation of admin and end users from all organizations                                            |
+| Instance Impersonator         | IAM_END_USER_IMPERSONATOR     | Allow impersonation of end users from all organizations                                                      |
+| Instance Login Client         | IAM_LOGIN_CLIENT              | Get all permissions needed to implement your own Login UI.                                                   |
 | Org Owner                     | ORG_OWNER                     | Manage everything within an organization                                                                     |
 | Org Owner Viewer              | ORG_OWNER_VIEWER              | View everything within an organization                                                                       |
 | Org User Manager              | ORG_USER_MANAGER              | Manage users and their authorizations within an organization                                                 |
@@ -2,7 +2,7 @@
 title: SCIM v2.0
 ---

-Zitadel’s **[SCIM v2](https://scim.cloud/) service provider interface** enables standardized provisioning and lifecycle management of users and other IAM resources.
+Zitadel’s **[SCIM v2](https://scim.cloud/) service provider interface** enables standardized provisioning and lifecycle management of users and other instance resources.
 By implementing the official *System for Cross-domain Identity Management (SCIM) v2.0* specification, Zitadel allows seamless and automated user creation, updates, deactivation, and deprovisioning across systems.

 ## API
@@ -14,7 +14,7 @@ This guide explains how to migrate from ZITADEL, this includes
 The following scripts don't include:

 - Global policies
- IAM members
+- Instance members
 - Global IDPs
 - Global second factor / multi-factors
 - Machine keys
@@ -30,7 +30,7 @@ Note that the resources will be migrated without the event stream. This means th

 ## Authorization

-You need a PAT from a service user with IAM Owner permissions in both the source and target system.
+You need a PAT from a service user with instance Owner permissions in both the source and target system.

 ### Source system

@@ -38,7 +38,7 @@ You need a PAT from a service user with IAM Owner permissions in both the source
 2. Create a service user "import_user" with Access Token Type "Bearer"
 3. Create a [personal access token](/guides/integrate/service-accounts/personal-access-token)
 4. Go to the Default settings
-5. Add the import_user as [manager](/guides/manage/console/managers) with the role "IAM Owner"
+5. Add the import_user as [manager](/guides/manage/console/managers) with the role "instance Owner"

 Save the PAT to the environment variable `PAT_EXPORT_TOKEN` and the source domain as `ZITADEL_EXPORT_DOMAIN` to run the following scripts.

@@ -48,7 +48,7 @@ Save the PAT to the environment variable `PAT_EXPORT_TOKEN` and the source domai
 2. Create a service user "export_user" with Access Token Type "Bearer"
 3. Create a [personal access token](/guides/integrate/service-accounts/personal-access-token)
 4. Go to the Default settings
-5. Add the export_user as [manager](/guides/manage/console/managers) with the role "IAM Owner"
+5. Add the export_user as [manager](/guides/manage/console/managers) with the role "instance Owner"

 Save the PAT to the environment variable `PAT_IMPORT_TOKEN` and the source domain as `ZITADEL_IMPORT_DOMAIN` to run the following scripts.

@@ -171,7 +171,7 @@ Topics of the onboarding term may include
 <Tabs>
    <Tab value="in" label="Topics in scope">
      <ul>
-        <li>IAM Configuration</li>
+        <li>Instance Configuration</li>
        <li>Walk-though all features</li>
        <li>Users / Manuals</li>
        <li>Authentication & Management APIs</li>
@@ -68,7 +68,7 @@ To use private information — such as a database admin credential — without s

 All configuration properties are configurable using environment variables.
 ZITADEL environment variable keys are prefixed with `ZITADEL_`.
-For example, to configure the default ZITADEL IAM admin username and password set the `zitadel` binary runtime environment variables `ZITADEL_FIRSTINSTANCE_ORG_HUMAN_USERNAME` and `ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD`.
+For example, to configure the default ZITADEL instance admin username and password set the `zitadel` binary runtime environment variables `ZITADEL_FIRSTINSTANCE_ORG_HUMAN_USERNAME` and `ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD`.
 All supported environment variables are listed in the [runtime configuration file](#runtime-configuration-file) and the [database initialization file](#database-initialization-file).

 ### Proxy configuration
@@ -17,7 +17,7 @@ In the following URLs, replace the base URL and the user ID according to your en
 1. Create a new machine user, for example at http://localhost:8080/ui/console/users/create-machine
 2. Create a PAT, for example at http://localhost:8080/ui/console/users/332169800719532035?new=true&id=pat
 3. Save the PAT to a file, for example `/path/on/your/host/login-client.pat`
-4. Make sure the user has the `Iam Login Client` role (internally called `IAM_LOGIN_CLIENT`), for example at http://localhost:8080/ui/console/instance/members
+4. Make sure the user has the `Instance Login Client` role (internally called `IAM_LOGIN_CLIENT`), for example at http://localhost:8080/ui/console/instance/members

 # Configure the Login UI

@@ -32,9 +32,9 @@ docker run -p 3000:3000 -v /path/on/your/host/login-client.pat:/path/in/containe
 # Enable the Login UI for all users

 <Callout type="warn">
-Before doing this, make sure you have a working PAT for an Iam Owner user.
+Before doing this, make sure you have a working PAT for an instance Owner user.
 In case something goes wrong and you lock yourself out from the login screen, you can revert the changes.
-Create a machine user PAT like you created the [login client PAT above](#create-login-client), but give the user the Iam Owner role (internally called `IAM_OWNER`).
+Create a machine user PAT like you created the [login client PAT above](#create-login-client), but give the user the instance Owner role (internally called `IAM_OWNER`).
 </Callout>

 Enable the `Login V2` feature flag, for example at the bottom of http://localhost:8080/ui/console/instance?id=features.
@@ -78,7 +78,7 @@ services:
      # Set up a service account with IAM_LOGIN_CLIENT role and write the PAT to the file ./login-client.pat
      ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH: /current-dir/login-client.pat
      ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_MACHINE_USERNAME: login-client
-      ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_MACHINE_NAME: Automatically Initialized IAM Login Client
+      ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_MACHINE_NAME: Automatically Initialized instance Login Client
      ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_PAT_EXPIRATIONDATE: '2029-01-01T00:00:00Z'
      # The master key is used to
    networks:
@@ -141,7 +141,7 @@ var validSAMLMetadata2 = []byte(`<?xml version="1.0" encoding="UTF-8"?>
 func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 	instanceID := Instance.ID()

-	t.Run("test iam idp add reduces", func(t *testing.T) {
+	t.Run("test instance idp add reduces", func(t *testing.T) {
 		name := gofakeit.Name()

 		before := time.Now()
@@ -177,7 +177,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		}, retryDuration, tick)
 	})

-	t.Run("test iam idp update reduces", func(t *testing.T) {
+	t.Run("test instance idp update reduces", func(t *testing.T) {
 		name := gofakeit.Name()

 		addOIDC, err := AdminClient.AddOIDCIDP(IAMCTX, defaultOIDCIDReq(name, true))
@@ -215,7 +215,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		}, retryDuration, tick)
 	})

-	t.Run("test iam idp deactivate reduces", func(t *testing.T) {
+	t.Run("test instance idp deactivate reduces", func(t *testing.T) {
 		name := gofakeit.Name()

 		addOIDC, err := AdminClient.AddOIDCIDP(IAMCTX, defaultOIDCIDReq(name, true))
@@ -247,7 +247,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		}, retryDuration, tick)
 	})

-	t.Run("test iam idp config reactivate reduces", func(t *testing.T) {
+	t.Run("test instance idp config reactivate reduces", func(t *testing.T) {
 		name := gofakeit.Name()

 		addOIDC, err := AdminClient.AddOIDCIDP(IAMCTX, defaultOIDCIDReq(name, true))
@@ -298,7 +298,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		}, retryDuration, tick)
 	})

-	t.Run("test iam idp config remove reduces", func(t *testing.T) {
+	t.Run("test instance idp config remove reduces", func(t *testing.T) {
 		name := gofakeit.Name()

 		// add idp
@@ -326,7 +326,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		}, retryDuration, tick)
 	})

-	t.Run("test iam idp oidc added reduces", func(t *testing.T) {
+	t.Run("test instance idp oidc added reduces", func(t *testing.T) {
 		name := gofakeit.Name()

 		// add oidc
@@ -425,7 +425,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		}, retryDuration, tick)
 	})

-	t.Run("test iam idp jwt added reduces", func(t *testing.T) {
+	t.Run("test instance idp jwt added reduces", func(t *testing.T) {
 		name := gofakeit.Name()

 		// add jwt
@@ -468,7 +468,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		}, retryDuration, tick)
 	})

-	t.Run("test iam idp jwt changed reduces", func(t *testing.T) {
+	t.Run("test instance idp jwt changed reduces", func(t *testing.T) {
 		name := gofakeit.Name()

 		// add jwt
@@ -2308,7 +2308,7 @@ func TestServer_TestIDProviderInstanceReduces(t *testing.T) {
 		}, retryDuration, tick)
 	})

-	t.Run("test instance iam remove reduces", func(t *testing.T) {
+	t.Run("test instance idp remove reduces", func(t *testing.T) {
 		name := gofakeit.Name()

 		// add idp
@@ -25,7 +25,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 	instanceID := Instance.ID()
 	orgID := Instance.DefaultOrg.Id

-	t.Run("test iam idp add reduces", func(t *testing.T) {
+	t.Run("test instance idp add reduces", func(t *testing.T) {
 		name := gofakeit.Name()

 		before := time.Now()
@@ -71,7 +71,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		}, retryDuration, tick)
 	})

-	// t.Run("test iam idp update reduces", func(t *testing.T) {
+	// t.Run("test instance idp update reduces", func(t *testing.T) {
 	// 	name := gofakeit.Name()

 	// 	addOIDC, err := MgmtClient.AddOrgOIDCIDP(IAMCTX, &management.AddOrgOIDCIDPRequest{
@@ -119,7 +119,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 	// 	}, retryDuration, tick)
 	// })

-	t.Run("test iam idp deactivate reduces", func(t *testing.T) {
+	t.Run("test instance idp deactivate reduces", func(t *testing.T) {
 		name := gofakeit.Name()

 		addOIDC, err := MgmtClient.AddOrgOIDCIDP(IAMCTX, &management.AddOrgOIDCIDPRequest{
@@ -161,7 +161,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		}, retryDuration, tick)
 	})

-	t.Run("test iam idp reactivate reduces", func(t *testing.T) {
+	t.Run("test instance idp reactivate reduces", func(t *testing.T) {
 		name := gofakeit.Name()

 		addOIDC, err := MgmtClient.AddOrgOIDCIDP(IAMCTX, &management.AddOrgOIDCIDPRequest{
@@ -222,7 +222,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		}, retryDuration, tick)
 	})

-	t.Run("test iam idp remove reduces", func(t *testing.T) {
+	t.Run("test instance idp remove reduces", func(t *testing.T) {
 		name := gofakeit.Name()

 		// add idp
@@ -260,7 +260,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		}, retryDuration, tick)
 	})

-	t.Run("test iam idp oidc added reduces", func(t *testing.T) {
+	t.Run("test instance idp oidc added reduces", func(t *testing.T) {
 		name := gofakeit.Name()

 		// add oidc
@@ -307,7 +307,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		}, retryDuration, tick)
 	})

-	t.Run("test iam idp oidc changed reduces", func(t *testing.T) {
+	t.Run("test instance idp oidc changed reduces", func(t *testing.T) {
 		name := gofakeit.Name()

 		// add oidc
@@ -379,7 +379,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		}, retryDuration, tick)
 	})

-	t.Run("test iam idp jwt added reduces", func(t *testing.T) {
+	t.Run("test instance idp jwt added reduces", func(t *testing.T) {
 		name := gofakeit.Name()

 		// add jwt
@@ -422,7 +422,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		}, retryDuration, tick)
 	})

-	t.Run("test iam idp jwt changed reduces", func(t *testing.T) {
+	t.Run("test instance idp jwt changed reduces", func(t *testing.T) {
 		name := gofakeit.Name()

 		// add jwt
@@ -2298,7 +2298,7 @@ func TestServer_TestIDProviderOrgReduces(t *testing.T) {
 		}, retryDuration, tick)
 	})

-	t.Run("test org iam remove reduces", func(t *testing.T) {
+	t.Run("test org instance remove reduces", func(t *testing.T) {
 		name := gofakeit.Name()

 		// add idp
@@ -427,7 +427,7 @@
    "MACHINEUSERS": "مستخدمو الخدمة",
    "LOGOUT": "تسجيل خروج جميع المستخدمين",
    "NEWORG": "منظمة جديدة",
-    "IAMADMIN": "أنت مسؤول IAM. لاحظ أن لديك أذونات موسعة.",
+    "IAMADMIN": "أنت مسؤول instance. لاحظ أن لديك أذونات موسعة.",
    "SHOWORGS": "إظهار جميع المنظمات",
    "GRANTS": "التفويضات",
    "ACTIONS": "الإجراءات",
@@ -1154,7 +1154,7 @@
    },
    "MEMBERSHIPS": {
      "TITLE": "أدوار مدير ZITADEL",
-      "DESCRIPTION": "هذه هي جميع منح الأعضاء للمستخدم. يمكنك تعديلها أيضاً في صفحات تفاصيل المنظمة أو المشروع أو IAM.",
+      "DESCRIPTION": "هذه هي جميع منح الأعضاء للمستخدم. يمكنك تعديلها أيضاً في صفحات تفاصيل المنظمة أو المشروع أو instance.",
      "ORGCONTEXT": "أنت ترى جميع المنظمات والمشاريع المرتبطة بالمنظمة المحددة حالياً.",
      "USERCONTEXT": "أنت ترى جميع المنظمات والمشاريع التي لديك تفويض لها. بما في ذلك المنظمات الأخرى.",
      "CREATIONDATE": "تاريخ الإنشاء",
@@ -1260,7 +1260,7 @@
      "DESCRIPTION": "إدارة السياسات العالمية وإعدادات الوصول الإداري."
    },
    "EVENTSTORE": {
-      "TITLE": "إدارة تخزين IAM",
+      "TITLE": "إدارة تخزين Instance",
      "DESCRIPTION": "إدارة مشاهدات ZITADEL والأحداث الفاشلة."
    },
    "MEMBER": {
@@ -2788,7 +2788,7 @@
    "ADD": "إضافة مدير",
    "CREATIONTYPE": "نوع الإنشاء",
    "CREATIONTYPES": {
-      "3": "IAM",
+      "3": "Instance",
      "2": "منظمة",
      "0": "مشروع مملوك",
      "1": "مشروع ممنوح",
@@ -427,7 +427,7 @@
    "MACHINEUSERS": "Потребители на услугата",
    "LOGOUT": "Излезте всички потребители",
    "NEWORG": "Нова организация",
-    "IAMADMIN": "Вие сте IAM администратор. ",
+    "IAMADMIN": "Вие сте инстанс администратор. ",
    "SHOWORGS": "Показване на всички организации",
    "GRANTS": "Разрешения",
    "ACTIONS": "Действия",
@@ -1266,7 +1266,7 @@
      "DESCRIPTION": "Управлявайте своите глобални правила и настройки за достъп до управление."
    },
    "EVENTSTORE": {
-      "TITLE": "Администриране на IAM съхранение",
+      "TITLE": "Администриране на Инстанс съхранение",
      "DESCRIPTION": "Управлявайте вашите Zitadel изгледи и неуспешни събития."
    },
    "MEMBER": {
@@ -2799,7 +2799,7 @@
      "0": "Собствен проект",
      "1": "Приет проект",
      "2": "Организация",
-      "3": "АЗ СЪМ",
+      "3": "Инстанс",
      "4": "Проект"
    },
    "EDITROLE": "Редактирайте ролите",
@@ -427,7 +427,7 @@
    "MACHINEUSERS": "Systémoví uživatelé",
    "LOGOUT": "Odhlásit všechny uživatele",
    "NEWORG": "Nová organizace",
-    "IAMADMIN": "Jste administrátor IAM. Vezměte prosím na vědomí, že máte rozšířená oprávnění.",
+    "IAMADMIN": "Jste administrátor instance. Vezměte prosím na vědomí, že máte rozšířená oprávnění.",
    "SHOWORGS": "Zobrazit všechny organizace",
    "GRANTS": "Autorizace",
    "ACTIONS": "Akce",
@@ -1161,7 +1161,7 @@
    },
    "MEMBERSHIPS": {
      "TITLE": "Role správce Zitadel",
-      "DESCRIPTION": "Zde jsou všechna členská oprávnění uživatele. Můžete je upravovat také na stránkách detailů organizace, projektu nebo IAM.",
+      "DESCRIPTION": "Zde jsou všechna členská oprávnění uživatele. Můžete je upravovat také na stránkách detailů organizace, projektu nebo instance.",
      "ORGCONTEXT": "Vidíte všechny organizace a projekty, které souvisí s aktuálně vybranou organizací.",
      "USERCONTEXT": "Vidíte všechny organizace a projekty, na které máte oprávnění. Včetně jiných organizací.",
      "CREATIONDATE": "Datum vytvoření",
@@ -1267,7 +1267,7 @@
      "DESCRIPTION": "Spravujte vaše globální politiky a nastavení přístupu k managementu."
    },
    "EVENTSTORE": {
-      "TITLE": "Administrace úložiště systému IAM",
+      "TITLE": "Administrace úložiště systému Instance",
      "DESCRIPTION": "Správa nastavení ukládání systému ZIDATEL."
    },
    "MEMBER": {
@@ -2778,7 +2778,7 @@
    "ADD": "Přidat manažera",
    "CREATIONTYPE": "Typ vytvoření",
    "CREATIONTYPES": {
-      "3": "IAM",
+      "3": "Instance",
      "2": "Organizace",
      "0": "Vlastní projekt",
      "1": "Přidělený projekt",
@@ -427,7 +427,7 @@
    "MACHINEUSERS": "Service-Benutzer",
    "LOGOUT": "Alle Benutzer abmelden",
    "NEWORG": "Neue Organisation",
-    "IAMADMIN": "Du bist ein IAM-Administrator. Beachte, dass Du erhöhte Rechte besitzt.",
+    "IAMADMIN": "Du bist ein Instanz-Administrator. Beachte, dass Du erhöhte Rechte besitzt.",
    "SHOWORGS": "Alle Organisationen anzeigen",
    "GRANTS": "Berechtigungen",
    "ACTIONS": "Aktionen",
@@ -1161,7 +1161,7 @@
    },
    "MEMBERSHIPS": {
      "TITLE": "Zitadel-Administratorrollen",
-      "DESCRIPTION": "Dies sind alle Mitgliedschaften des Benutzers. Du kannst die entsprechenden Rechte auch auf der Organisations-, Projekt-, oder IAM-Detailseite aufrufen und modifizieren.",
+      "DESCRIPTION": "Dies sind alle Mitgliedschaften des Benutzers. Du kannst die entsprechenden Rechte auch auf der Organisations-, Projekt-, oder Instanz-Detailseite aufrufen und modifizieren.",
      "ORGCONTEXT": "Sie sehen alle Organisationen und Projekte, die mit der aktuell gewählten Organisation in Verbindung stehen.",
      "USERCONTEXT": "Sie sehen alle Organisationen und Projekte auf denen Sie berechtigt sind inklusive aller zur Auswahl stehenden Organisationen.",
      "CREATIONDATE": "Erstellungsdatum",
@@ -1267,7 +1267,7 @@
      "DESCRIPTION": "Verwalte die globalen Richtlinien und Zugangseinstellungen."
    },
    "EVENTSTORE": {
-      "TITLE": "IAM Speicher Administration",
+      "TITLE": "Instanz Speicher Administration",
      "DESCRIPTION": "Verwalte Speicher-Einstellungen von Zitadel."
    },
    "MEMBER": {
@@ -2769,7 +2769,7 @@
    "ADD": "Manager hinzufügen",
    "CREATIONTYPE": "Erstelltyp",
    "CREATIONTYPES": {
-      "3": "IAM",
+      "3": "Instanz",
      "2": "Organisation",
      "0": "Eigenes Projekt",
      "1": "Berechtigtes Projekt",
@@ -427,7 +427,7 @@
    "MACHINEUSERS": "Usuarios del servicio",
    "LOGOUT": "Cerrar sesión para todos los usuarios",
    "NEWORG": "Nueva organización",
-    "IAMADMIN": "Eres un administrador IAM. Ten en cuenta que tienes permisos ampliados.",
+    "IAMADMIN": "Eres un administrador instancia. Ten en cuenta que tienes permisos ampliados.",
    "SHOWORGS": "Mostrar todas las organizaciones",
    "GRANTS": "Autorizaciones",
    "ACTIONS": "Acciones",
@@ -1161,7 +1161,7 @@
    },
    "MEMBERSHIPS": {
      "TITLE": "Roles del administrador de Zitadel",
-      "DESCRIPTION": "Estas son todas las concesiones de membresía del usuario. Puedes modificarlas también en las páginas de organización, proyecto o detalles IAM.",
+      "DESCRIPTION": "Estas son todas las concesiones de membresía del usuario. Puedes modificarlas también en las páginas de organización, proyecto o detalles instancia.",
      "ORGCONTEXT": "Puedes ver todas las organizaciones y proyectos que están relacionados con la organización seleccionada actualmente.",
      "USERCONTEXT": "Puedes ver todas las organizaciones y proyectos para los que estás autorizado. Incluyendo otras organizaciones.",
      "CREATIONDATE": "Fecha de creación",
@@ -1267,7 +1267,7 @@
      "DESCRIPTION": "Gestiona tus políticas globales y tus ajustes de gestión de accesos."
    },
    "EVENTSTORE": {
-      "TITLE": "Administración del almacenamiento IAM",
+      "TITLE": "Administración del almacenamiento Instancia",
      "DESCRIPTION": "Gestionar tus vistas de Zitadel y tus eventos fallidos."
    },
    "MEMBER": {
@@ -2766,7 +2766,7 @@
    "ADD": "Añadir un Mánager",
    "CREATIONTYPE": "Tipo de creación",
    "CREATIONTYPES": {
-      "3": "IAM",
+      "3": "Instancia",
      "2": "Organización",
      "0": "Proyecto propio",
      "1": "Proyecto con acceso concedido",
@@ -427,7 +427,7 @@
    "MACHINEUSERS": "Utilisateurs de services",
    "LOGOUT": "Déconnexion de tous les utilisateurs",
    "NEWORG": "Nouvelle organisation",
-    "IAMADMIN": "Vous êtes un administrateur IAM. Notez que vous disposez de permissions étendues.",
+    "IAMADMIN": "Vous êtes un administrateur d'instance. Notez que vous disposez de permissions étendues.",
    "SHOWORGS": "Afficher toutes les organisations",
    "GRANTS": "Autorisations",
    "ACTIONS": "Actions",
@@ -1161,7 +1161,7 @@
    },
    "MEMBERSHIPS": {
      "TITLE": "Rôles d'administrateur Zitadel",
-      "DESCRIPTION": "Il s'agit de toutes les attributions des membres de l'utilisateur. Vous pouvez également les modifier sur les pages de détails de l'organisation, du projet ou de l'IAM.",
+      "DESCRIPTION": "Il s'agit de toutes les attributions des membres de l'utilisateur. Vous pouvez également les modifier sur les pages de détails de l'organisation, du projet ou de l'instance.",
      "ORGCONTEXT": "Vous voyez toutes les organisations et tous les projets qui sont liés à l'organisation actuellement sélectionnée.",
      "USERCONTEXT": "Vous voyez toutes les organisations et tous les projets auxquels vous êtes autorisé. Y compris les autres organisations.",
      "CREATIONDATE": "Date de création",
@@ -1267,7 +1267,7 @@
      "DESCRIPTION": "Gérer vos politiques globales et vos paramètres d'accès à la gestion."
    },
    "EVENTSTORE": {
-      "TITLE": "Administration du stockage IAM",
+      "TITLE": "Administration du stockage instance",
      "DESCRIPTION": "Gérez vos vues Zitadel et les événements échoués."
    },
    "MEMBER": {
@@ -2770,7 +2770,7 @@
    "ADD": "Ajouter un responsable",
    "CREATIONTYPE": "Type de création",
    "CREATIONTYPES": {
-      "3": "IAM",
+      "3": "Instance",
      "2": "Organisation",
      "0": "Projet Détenu",
      "1": "Projet Octroyé",
@@ -427,7 +427,7 @@
    "MACHINEUSERS": "Szolgáltatási Felhasználók",
    "LOGOUT": "Minden Felhasználó Kijelentkezése",
    "NEWORG": "Új Szervezet",
-    "IAMADMIN": "Te egy IAM Adminisztrátor vagy. Ne felejtsd el, hogy kibővített jogosultságokkal rendelkezel.",
+    "IAMADMIN": "Te egy példány Adminisztrátor vagy. Ne felejtsd el, hogy kibővített jogosultságokkal rendelkezel.",
    "SHOWORGS": "Show All Organizations",
    "GRANTS": "Engedélyek",
    "ACTIONS": "Műveletek",
@@ -1161,7 +1161,7 @@
    },
    "MEMBERSHIPS": {
      "TITLE": "Zitadel rendszergazdai szerepkörök",
-      "DESCRIPTION": "Ezek a felhasználó összes tagsági jogosultságai. Ezeket módosíthatod szervezet, projekt vagy IAM részletező oldalakon is.",
+      "DESCRIPTION": "Ezek a felhasználó összes tagsági jogosultságai. Ezeket módosíthatod szervezet, projekt vagy példány részletező oldalakon is.",
      "ORGCONTEXT": "Láthatod az összes szervezetet és projektet, amelyek a jelenleg kiválasztott szervezethez kapcsolódnak.",
      "USERCONTEXT": "Láthatod az összes szervezetet és projektet, amelyekhez jogosultságod van, beleértve más szervezeteket is.",
      "CREATIONDATE": "Létrehozás dátuma",
@@ -1267,7 +1267,7 @@
      "DESCRIPTION": "Kezeld a globális szabályzatokat és a hozzáférési beállításokat."
    },
    "EVENTSTORE": {
-      "TITLE": "IAM tárhely adminisztráció",
+      "TITLE": "Példány tárhely adminisztráció",
      "DESCRIPTION": "Kezeld a Zitadel nézeteidet és a sikertelen eseményeket."
    },
    "MEMBER": {
@@ -2793,7 +2793,7 @@
    "ADD": "Hozzáadás egy menedzsert",
    "CREATIONTYPE": "Létrehozás típusa",
    "CREATIONTYPES": {
-      "3": "IAM",
+      "3": "Példány",
      "2": "Szervezet",
      "0": "Saját projekt",
      "1": "Engedélyezett Projekt",
@@ -427,7 +427,7 @@
    "MACHINEUSERS": "Pengguna Layanan",
    "LOGOUT": "Logout Semua Pengguna",
    "NEWORG": "Organisasi Baru",
-    "IAMADMIN": "Anda adalah Administrator IAM. Perhatikan bahwa Anda memiliki izin yang diperluas.",
+    "IAMADMIN": "Anda adalah Administrator instance. Perhatikan bahwa Anda memiliki izin yang diperluas.",
    "SHOWORGS": "Tampilkan Semua Organisasi",
    "GRANTS": "Otorisasi",
    "ACTIONS": "Tindakan",
@@ -1161,7 +1161,7 @@
    },
    "MEMBERSHIPS": {
      "TITLE": "Peran Administrator Zitadel",
-      "DESCRIPTION": "Ini semua adalah hibah anggota dari pengguna. Anda juga dapat memodifikasinya di halaman detail organisasi, proyek, atau IAM.",
+      "DESCRIPTION": "Ini semua adalah hibah anggota dari pengguna. Anda juga dapat memodifikasinya di halaman detail organisasi, proyek, atau instance.",
      "ORGCONTEXT": "Anda melihat semua organisasi dan proyek yang terkait dengan organisasi yang dipilih saat ini.",
      "USERCONTEXT": "Anda melihat semua organisasi dan proyek yang Anda izinkan. Termasuk organisasi lain.",
      "CREATIONDATE": "Tanggal Pembuatan",
@@ -1267,7 +1267,7 @@
      "DESCRIPTION": "Kelola Kebijakan global dan Pengaturan Akses Manajemen Anda."
    },
    "EVENTSTORE": {
-      "TITLE": "Administrasi Penyimpanan IAM",
+      "TITLE": "Administrasi Penyimpanan Instance",
      "DESCRIPTION": "Kelola tampilan Zitadel Anda dan acara yang gagal."
    },
    "MEMBER": {
@@ -2796,7 +2796,7 @@
      "0": "Proyek Milik",
      "1": "Proyek yang Diberikan",
      "2": "Organisasi",
-      "3": "SAYA",
+      "3": "Instance",
      "4": "Proyek"
    },
    "EDITROLE": "Edit peran",
@@ -427,7 +427,7 @@
    "MACHINEUSERS": "Utenti di servizio",
    "LOGOUT": "Esci con tutti gli utenti",
    "NEWORG": "Nuova organizzazione",
-    "IAMADMIN": "Sei un amministratore IAM. Nota che hai autorizzazioni estese.",
+    "IAMADMIN": "Sei un amministratore d'istanza. Nota che hai autorizzazioni estese.",
    "SHOWORGS": "Mostra tutte le organizzazioni",
    "GRANTS": "Autorizzazioni",
    "ACTIONS": "Azioni",
@@ -1160,7 +1160,7 @@
    },
    "MEMBERSHIPS": {
      "TITLE": "Ruoli dell'amministratore Zitadel",
-      "DESCRIPTION": "Questi sono tutti i member grant dell'utente. Puoi modificarli anche nelle pagine di dettaglio dell'organizzazione, del progetto o di sistema.",
+      "DESCRIPTION": "Questi sono tutti i permessi membro dell'utente. Puoi modificarli anche nelle pagine di dettaglio dell'organizzazione, del progetto o dell'istanza.",
      "ORGCONTEXT": "Vedi tutti i progetti che sono collegati all'organizzazione attualmente selezionata.",
      "USERCONTEXT": "Vedi tutte le organizzazioni e i progetti a cui sei autorizzato. Comprese le altre organizzazioni.",
      "CREATIONDATE": "Data di creazione",
@@ -1266,7 +1266,7 @@
      "DESCRIPTION": "Gestisci le impostazioni del sistema e le impostazioni d'accesso."
    },
    "EVENTSTORE": {
-      "TITLE": "IAM Eventstore",
+      "TITLE": "Istanza Eventstore",
      "DESCRIPTION": "Gestisci i view di Zitadel e gli eventi falliti."
    },
    "MEMBER": {
@@ -2770,7 +2770,7 @@
    "ADD": "Aggiungi un manager",
    "CREATIONTYPE": "Tipo di creazione",
    "CREATIONTYPES": {
-      "3": "IAM",
+      "3": "Istanza",
      "2": "Organizzazione",
      "0": "Progetto proprio",
      "1": "Progetto delegato",
@@ -427,7 +427,7 @@
    "MACHINEUSERS": "サービスユーザー",
    "LOGOUT": "すべてのユーザーをログアウトする",
    "NEWORG": "新しい組織",
-    "IAMADMIN": "あなたはIAM管理者です。広範囲の権限があることに注意してください。",
+    "IAMADMIN": "あなたはインスタンス管理者です。広範囲の権限があることに注意してください。",
    "SHOWORGS": "すべての組織を表示する",
    "GRANTS": "認可",
    "ACTIONS": "アクション",
@@ -1161,7 +1161,7 @@
    },
    "MEMBERSHIPS": {
      "TITLE": "Zitadel管理者ロール",
-      "DESCRIPTION": "ユーザーのメンバーグラント一覧です。組織、プロジェクト、IAMの詳細ページでも変更することができます。",
+      "DESCRIPTION": "ユーザーのメンバーグラント一覧です。組織、プロジェクト、インスタンスの詳細ページでも変更することができます。",
      "ORGCONTEXT": "現在選択されている組織に関連するすべての組織とプロジェクトが表示されます。",
      "USERCONTEXT": "自分が権限を持つすべての組織やプロジェクトが表示されます。他の組織も含みます。",
      "CREATIONDATE": "作成日",
@@ -1267,7 +1267,7 @@
      "DESCRIPTION": "グローバルポリシーと管理アクセス設定を管理します。"
    },
    "EVENTSTORE": {
-      "TITLE": "IAMストレージ管理",
+      "TITLE": "インスタンスストレージ管理",
      "DESCRIPTION": "Zitadelのビューと失敗したイベントを管理します。"
    },
    "MEMBER": {
@@ -2798,7 +2798,7 @@
      "0": "所有プロジェクト",
      "1": "グラントされたプロジェクト",
      "2": "組織",
-      "3": "IAM",
+      "3": "インスタンス",
      "4": "プロジェクト"
    },
    "EDITROLE": "ロールを編集する",
@@ -427,7 +427,7 @@
    "MACHINEUSERS": "서비스 사용자",
    "LOGOUT": "모든 사용자 로그아웃",
    "NEWORG": "새 조직",
-    "IAMADMIN": "IAM 관리자입니다. 확장된 권한이 부여되었습니다.",
+    "IAMADMIN": "인스턴스 관리자입니다. 확장된 권한이 부여되었습니다.",
    "SHOWORGS": "모든 조직 보기",
    "GRANTS": "권한",
    "ACTIONS": "작업",
@@ -1161,7 +1161,7 @@
    },
    "MEMBERSHIPS": {
      "TITLE": "Zitadel 관리자 역할",
-      "DESCRIPTION": "이 사용자의 모든 멤버 권한입니다. 조직, 프로젝트 또는 IAM 세부 페이지에서 수정할 수도 있습니다.",
+      "DESCRIPTION": "이 사용자의 모든 멤버 권한입니다. 조직, 프로젝트 또는 인스턴스 세부 페이지에서 수정할 수도 있습니다.",
      "ORGCONTEXT": "현재 선택된 조직과 관련된 모든 조직과 프로젝트를 볼 수 있습니다.",
      "USERCONTEXT": "사용 권한이 있는 모든 조직과 프로젝트를 볼 수 있습니다. 다른 조직도 포함됩니다.",
      "CREATIONDATE": "생성 날짜",
@@ -1267,7 +1267,7 @@
      "DESCRIPTION": "전역 정책 및 관리 액세스 설정을 관리합니다."
    },
    "EVENTSTORE": {
-      "TITLE": "IAM 스토리지 관리",
+      "TITLE": "인스턴스 스토리지 관리",
      "DESCRIPTION": "Zitadel 뷰 및 실패한 이벤트를 관리합니다."
    },
    "MEMBER": {
@@ -2791,7 +2791,7 @@
    "ADD": "매니저 추가",
    "CREATIONTYPE": "생성 유형",
    "CREATIONTYPES": {
-      "3": "IAM",
+      "3": "인스턴스",
      "2": "조직",
      "0": "소유 프로젝트",
      "1": "부여된 프로젝트",
@@ -427,7 +427,7 @@
    "MACHINEUSERS": "Сервисни корисници",
    "LOGOUT": "Одјави ги сите корисници",
    "NEWORG": "Нова организација",
-    "IAMADMIN": "Вие сте администратор на IAM. Имате проширени овластувања.",
+    "IAMADMIN": "Вие сте администратор на инстанс. Имате проширени овластувања.",
    "SHOWORGS": "Прикажи ги сите организации",
    "GRANTS": "Овластувања",
    "ACTIONS": "Акции",
@@ -1161,7 +1161,7 @@
    },
    "MEMBERSHIPS": {
      "TITLE": "Улоги на администраторите на Zitadel",
-      "DESCRIPTION": "Овие се сите овластувања за членување на корисникот. Истите може да ги менувате и на страните за детали за организација, проект или IAM.",
+      "DESCRIPTION": "Овие се сите овластувања за членување на корисникот. Истите може да ги менувате и на страните за детали за организација, проект или инстанс.",
      "ORGCONTEXT": "Ги гледате сите организации и проекти поврзани со тековно избраната организација.",
      "USERCONTEXT": "Ги гледате сите организации и проекти до кои имате овластување, вклучувајќи и други организации.",
      "CREATIONDATE": "Датум на креирање",
@@ -1267,7 +1267,7 @@
      "DESCRIPTION": "Управувајте со глобалните политики и подесувањата за пристап до управување."
    },
    "EVENTSTORE": {
-      "TITLE": "Управување со складиштето на IAM",
+      "TITLE": "Управување со складиштето на Инстанс",
      "DESCRIPTION": "Управувајте со прегледите на Zitadel и неуспешните настани."
    },
    "MEMBER": {
@@ -2766,7 +2766,7 @@
    "ADD": "Додај Менаџер",
    "CREATIONTYPE": "Тип на креирање",
    "CREATIONTYPES": {
-      "3": "IAM",
+      "3": "Инстанс",
      "2": "Организација",
      "0": "Сопствен Проект",
      "1": "Доделен Проект",
@@ -427,7 +427,7 @@
    "MACHINEUSERS": "Servicegebruikers",
    "LOGOUT": "Alle gebruikers uitloggen",
    "NEWORG": "Nieuwe organisatie",
-    "IAMADMIN": "U bent een IAM-beheerder. Let op: u heeft uitgebreide rechten.",
+    "IAMADMIN": "U bent een instantie-beheerder. Let op: u heeft uitgebreide rechten.",
    "SHOWORGS": "Toon alle organisaties",
    "GRANTS": "Machtigingen",
    "ACTIONS": "Acties",
@@ -1161,7 +1161,7 @@
    },
    "MEMBERSHIPS": {
      "TITLE": "Zitadel Beheerdersrollen",
-      "DESCRIPTION": "Dit zijn alle lidmaatschapstoewijzingen van de gebruiker. U kunt ze ook wijzigen op de detailpagina's van organisaties, projecten of IAM.",
+      "DESCRIPTION": "Dit zijn alle lidmaatschapstoewijzingen van de gebruiker. U kunt ze ook wijzigen op de detailpagina's van organisaties, projecten of instantie.",
      "ORGCONTEXT": "U ziet alle organisaties en projecten die gerelateerd zijn aan de momenteel geselecteerde organisatie.",
      "USERCONTEXT": "U ziet alle organisaties en projecten waarvoor u gemachtigd bent. Inclusief andere organisaties.",
      "CREATIONDATE": "Aanmaakdatum",
@@ -1267,7 +1267,7 @@
      "DESCRIPTION": "Beheer uw wereldwijde beleid en beheer toegangsinstellingen."
    },
    "EVENTSTORE": {
-      "TITLE": "IAM Opslagbeheer",
+      "TITLE": "Instantie Opslagbeheer",
      "DESCRIPTION": "Beheer uw Zitadel-weergaven en mislukte evenementen."
    },
    "MEMBER": {
@@ -2788,7 +2788,7 @@
    "ADD": "Voeg een Manager toe",
    "CREATIONTYPE": "Creatietype",
    "CREATIONTYPES": {
-      "3": "IAM",
+      "3": "Instantie",
      "2": "Organisatie",
      "0": "Eigendom Project",
      "1": "Verleend Project",
@@ -427,7 +427,7 @@
    "MACHINEUSERS": "Użytkownicy usług",
    "LOGOUT": "Wyloguj Wszystkich Użytkowników",
    "NEWORG": "Nowa Organizacja",
-    "IAMADMIN": "Jesteś administratorem IAM. Zauważ, że masz rozszerzone uprawnienia.",
+    "IAMADMIN": "Jesteś administratorem instancja. Zauważ, że masz rozszerzone uprawnienia.",
    "SHOWORGS": "Pokaż wszystkie organizacje",
    "GRANTS": "Autoryzacje",
    "ACTIONS": "Akcje",
@@ -1160,7 +1160,7 @@
    },
    "MEMBERSHIPS": {
      "TITLE": "Role administratora Zitadel",
-      "DESCRIPTION": "To są wszystkie uprawnienia członków użytkownika. Możesz je również modyfikować na stronach szczegółów organizacji, projektu lub IAM.",
+      "DESCRIPTION": "To są wszystkie uprawnienia członków użytkownika. Możesz je również modyfikować na stronach szczegółów organizacji, projektu lub instancja.",
      "ORGCONTEXT": "Widzisz wszystkie organizacje i projekty, które są związane z aktualnie wybraną organizacją.",
      "USERCONTEXT": "Widzisz wszystkie organizacje i projekty, do których masz dostęp. Włączając inne organizacje.",
      "CREATIONDATE": "Data utworzenia",
@@ -1266,7 +1266,7 @@
      "DESCRIPTION": "Zarządzaj swoimi globalnymi politykami i ustawieniami dostępu do zarządzania."
    },
    "EVENTSTORE": {
-      "TITLE": "Administracja magazynem IAM",
+      "TITLE": "Administracja magazynem Instancja",
      "DESCRIPTION": "Zarządzaj swoimi widokami Zitadel i nieudanymi zdarzeniami."
    },
    "MEMBER": {
@@ -2769,7 +2769,7 @@
    "ADD": "Dodaj managera",
    "CREATIONTYPE": "Typ utworzenia",
    "CREATIONTYPES": {
-      "3": "IAM",
+      "3": "Instancja",
      "2": "Organizacja",
      "0": "Własny projekt",
      "1": "Nadany projekt",
@@ -427,7 +427,7 @@
    "MACHINEUSERS": "Usuários de Serviço",
    "LOGOUT": "Encerrar Sessão de Todos os Usuários",
    "NEWORG": "Nova Organização",
-    "IAMADMIN": "Você é um Administrador IAM. Observe que você possui permissões estendidas.",
+    "IAMADMIN": "Você é um Administrador de instância. Observe que você possui permissões estendidas.",
    "SHOWORGS": "Mostrar Todas as Organizações",
    "GRANTS": "Autorizações",
    "ACTIONS": "Ações",
@@ -1161,7 +1161,7 @@
    },
    "MEMBERSHIPS": {
      "TITLE": "Funções de administrador do Zitadel",
-      "DESCRIPTION": "Essas são todas as permissões de membros do usuário. Você também pode modificá-las nas páginas de detalhes da organização, projeto ou IAM.",
+      "DESCRIPTION": "Essas são todas as permissões de membros do usuário. Você também pode modificá-las nas páginas de detalhes da organização, projeto ou instância.",
      "ORGCONTEXT": "Você vê todas as organizações e projetos relacionados à organização atualmente selecionada.",
      "USERCONTEXT": "Você vê todas as organizações e projetos para os quais está autorizado. Incluindo outras organizações.",
      "CREATIONDATE": "Data de Criação",
@@ -1267,7 +1267,7 @@
      "DESCRIPTION": "Gerencie as políticas globais e configurações de acesso à gerência."
    },
    "EVENTSTORE": {
-      "TITLE": "Administração de armazenamento IAM",
+      "TITLE": "Administração de armazenamento Instância",
      "DESCRIPTION": "Gerencie as visualizações do Zitadel e eventos falhados."
    },
    "MEMBER": {
@@ -2765,7 +2765,7 @@
    "ADD": "Adicionar um Gerente",
    "CREATIONTYPE": "Tipo de Criação",
    "CREATIONTYPES": {
-      "3": "IAM",
+      "3": "Instância",
      "2": "Organização",
      "0": "Projeto Próprio",
      "1": "Projeto Concedido",
@@ -427,7 +427,7 @@
    "MACHINEUSERS": "Utilizatori de servicii",
    "LOGOUT": "Deconectați toți utilizatorii",
    "NEWORG": "Organizație nouă",
-    "IAMADMIN": "Sunteți administrator IAM. Rețineți că aveți permisiuni extinse.",
+    "IAMADMIN": "Sunteți administrator de instanță. Rețineți că aveți permisiuni extinse.",
    "SHOWORGS": "Afișați toate organizațiile",
    "GRANTS": "Autorizații",
    "ACTIONS": "Acțiuni",
@@ -1159,7 +1159,7 @@
    },
    "MEMBERSHIPS": {
      "TITLE": "Rolurile administratorilor Zitadel",
-      "DESCRIPTION": "Acestea sunt toate granturile de membru ale utilizatorului. Puteți să le modificați și în paginile de detalii ale organizației, proiectului sau IAM.",
+      "DESCRIPTION": "Acestea sunt toate granturile de membru ale utilizatorului. Puteți să le modificați și în paginile de detalii ale organizației, proiectului sau instanță.",
      "ORGCONTEXT": "Vedeți toate organizațiile și proiectele care sunt legate de organizația selectată în prezent.",
      "USERCONTEXT": "Vedeți toate organizațiile și proiectele la care sunteți autorizat. Inclusiv alte organizații.",
      "CREATIONDATE": "Data creării",
@@ -1265,7 +1265,7 @@
      "DESCRIPTION": "Gestionați-vă politicile globale și setările de acces pentru gestionare."
    },
    "EVENTSTORE": {
-      "TITLE": "Administrarea stocării IAM",
+      "TITLE": "Administrarea stocării Instanță",
      "DESCRIPTION": "Gestionați-vă vizualizările Zitadel și evenimentele eșuate."
    },
    "MEMBER": {
@@ -2791,7 +2791,7 @@
    "ADD": "Adăugați un manager",
    "CREATIONTYPE": "Tip creare",
    "CREATIONTYPES": {
-      "3": "IAM",
+      "3": "Instanță",
      "2": "Organizație",
      "0": "Proiect deținut",
      "1": "Proiect acordat",
@@ -435,7 +435,7 @@
    "MACHINEUSERS": "Служебные пользователи",
    "LOGOUT": "Выйти из всех пользователей",
    "NEWORG": "Новая организация",
-    "IAMADMIN": "Вы являетесь администратором IAM. Обратите внимание, что вы обладаете расширенными разрешениями.",
+    "IAMADMIN": "Вы являетесь администратором Инстанс. Обратите внимание, что вы обладаете расширенными разрешениями.",
    "SHOWORGS": "Показать все организации",
    "GRANTS": "Авторизации",
    "ACTIONS": "Действия",
@@ -1188,7 +1188,7 @@
    },
    "MEMBERSHIPS": {
      "TITLE": "Роли администратора Zitadel",
-      "DESCRIPTION": "Это все допуски пользователя. Вы также можете изменить их на страницах сведений об организации, проекте или в управлении идентификацией и доступом (IAM).",
+      "DESCRIPTION": "Это все допуски пользователя. Вы также можете изменить их на страницах сведений об организации, проекте или в управлении идентификацией и доступом (Инстанс).",
      "ORGCONTEXT": "Вы видите все организации и проекты, связанные с выбранной в данный момент организацией.",
      "USERCONTEXT": "Вы видите все организации и проекты, в которых вы авторизованы. В том числе и другие организации.",
      "CREATIONDATE": "Дата создания",
@@ -1303,7 +1303,7 @@
      "DESCRIPTION": "Управляйте своими глобальными Политиками и настройками доступа к управлению."
    },
    "EVENTSTORE": {
-      "TITLE": "Администрирование хранилища IAM",
+      "TITLE": "Администрирование хранилища Инстанс",
      "DESCRIPTION": "Управляйте просмотрами Zitadel и ошибками."
    },
    "MEMBER": {
@@ -2883,7 +2883,7 @@
    "ADD": "Добавить менеджера",
    "CREATIONTYPE": "Тип создания",
    "CREATIONTYPES": {
-      "3": "IAM",
+      "3": "Инстанс",
      "2": "Организация",
      "0": "Собственный проект",
      "1": "Допуск проекта",
@@ -427,7 +427,7 @@
    "MACHINEUSERS": "Tjänsteanvändare",
    "LOGOUT": "Logga ut alla användare",
    "NEWORG": "Ny Organisation",
-    "IAMADMIN": "Du är en IAM-administratör. Observera att du har utökade behörigheter.",
+    "IAMADMIN": "Du är en instans-administratör. Observera att du har utökade behörigheter.",
    "SHOWORGS": "Visa Alla Organisationer",
    "GRANTS": "Behörigheter",
    "ACTIONS": "Åtgärder",
@@ -1161,7 +1161,7 @@
    },
    "MEMBERSHIPS": {
      "TITLE": "Zitadel-administratörsroller",
-      "DESCRIPTION": "Detta är alla medlemsbeviljanden för användaren. Du kan också ändra dem på organisations-, projekt- eller IAM-detaljsidor.",
+      "DESCRIPTION": "Detta är alla medlemsbeviljanden för användaren. Du kan också ändra dem på organisations-, projekt- eller instans-detaljsidor.",
      "ORGCONTEXT": "Du ser alla organisationer och projekt som är relaterade till den för närvarande valda organisationen.",
      "USERCONTEXT": "Du ser alla organisationer och projekt som du är auktoriserad till. Inklusive andra organisationer.",
      "CREATIONDATE": "Skapelsedatum",
@@ -1267,7 +1267,7 @@
      "DESCRIPTION": "Hantera dina globala policyer och åtkomstinställningar."
    },
    "EVENTSTORE": {
-      "TITLE": "IAM Lagringsadministration",
+      "TITLE": "Instans Lagringsadministration",
      "DESCRIPTION": "Hantera dina Zitadel-vyer och misslyckade händelser."
    },
    "MEMBER": {
@@ -2798,7 +2798,7 @@
    "ADD": "Lägg till en administratör",
    "CREATIONTYPE": "Skapandetyp",
    "CREATIONTYPES": {
-      "3": "IAM",
+      "3": "Instans",
      "2": "Organisation",
      "0": "Eget Projekt",
      "1": "Beviljat Projekt",
@@ -427,7 +427,7 @@
    "MACHINEUSERS": "Servis Kullanıcıları",
    "LOGOUT": "Tüm Kullanıcıları Çıkış Yap",
    "NEWORG": "Yeni Organizasyon",
-    "IAMADMIN": "IAM Yöneticisisiniz. Genişletilmiş izinleriniz olduğunu unutmayın.",
+    "IAMADMIN": "instans Yöneticisisiniz. Genişletilmiş izinleriniz olduğunu unutmayın.",
    "SHOWORGS": "Tüm Organizasyonları Göster",
    "GRANTS": "Yetkilendirmeler",
    "ACTIONS": "Eylemler",
@@ -1161,7 +1161,7 @@
    },
    "MEMBERSHIPS": {
      "TITLE": "Zitadel Yönetici Rolleri",
-      "DESCRIPTION": "Bunlar kullanıcının tüm üyelik yetkileridir. Bunları organizasyon, proje veya IAM detay sayfalarında da değiştirebilirsiniz.",
+      "DESCRIPTION": "Bunlar kullanıcının tüm üyelik yetkileridir. Bunları organizasyon, proje veya instans detay sayfalarında da değiştirebilirsiniz.",
      "ORGCONTEXT": "Şu anda seçili organizasyonla ilişkili tüm organizasyonları ve projeleri görüyorsunuz.",
      "USERCONTEXT": "Yetkiniz olan tüm organizasyonları ve projeleri görüyorsunuz. Diğer organizasyonlar dahil.",
      "CREATIONDATE": "Oluşturma Tarihi",
@@ -1267,7 +1267,7 @@
      "DESCRIPTION": "Küresel Politikalarınızı ve Yönetim Erişim Ayarlarınızı yönetin."
    },
    "EVENTSTORE": {
-      "TITLE": "IAM Depolama Yönetimi",
+      "TITLE": "İnstans Depolama Yönetimi",
      "DESCRIPTION": "Zitadel görünümlerinizi ve başarısız olaylarınızı yönetin."
    },
    "MEMBER": {
@@ -2798,7 +2798,7 @@
    "ADD": "Yönetici Ekle",
    "CREATIONTYPE": "Oluşturma Türü",
    "CREATIONTYPES": {
-      "3": "IAM",
+      "3": "İnstans",
      "2": "Organizasyon",
      "0": "Sahip Olunan Proje",
      "1": "Verilen Proje",
@@ -427,7 +427,7 @@
    "MACHINEUSERS": "Сервісні користувачі",
    "LOGOUT": "Вийти з усіх користувачів",
    "NEWORG": "Нова організація",
-    "IAMADMIN": "Ви адміністратор IAM. Зверніть увагу, що у вас є розширені дозволи.",
+    "IAMADMIN": "Ви адміністратор інстанс. Зверніть увагу, що у вас є розширені дозволи.",
    "SHOWORGS": "Показати всі організації",
    "GRANTS": "Авторизації",
    "ACTIONS": "Дії",
@@ -1162,7 +1162,7 @@
    },
    "MEMBERSHIPS": {
      "TITLE": "Ролі адміністратора Zitadel",
-      "DESCRIPTION": "Це всі гранти членства користувача. Ви також можете змінювати їх на сторінках деталей організації, проекту або IAM.",
+      "DESCRIPTION": "Це всі гранти членства користувача. Ви також можете змінювати їх на сторінках деталей організації, проекту або інстанс.",
      "ORGCONTEXT": "Ви бачите всі організації та проекти, пов'язані з поточно обраною організацією.",
      "USERCONTEXT": "Ви бачите всі організації та проекти, до яких у вас є авторизація. Включаючи інші організації.",
      "CREATIONDATE": "Дата створення",
@@ -1268,7 +1268,7 @@
      "DESCRIPTION": "Управління вашими глобальними політиками та налаштуваннями доступу до управління."
    },
    "EVENTSTORE": {
-      "TITLE": "Адміністрування сховища IAM",
+      "TITLE": "Адміністрування сховища Інстанс",
      "DESCRIPTION": "Управління вашими представленнями Zitadel та невдалими подіями."
    },
    "MEMBER": {
@@ -2801,7 +2801,7 @@
    "ADD": "Додати менеджера",
    "CREATIONTYPE": "Тип створення",
    "CREATIONTYPES": {
-      "3": "IAM",
+      "3": "Інстанс",
      "2": "Організація",
      "0": "Власний проект",
      "1": "Наданий проект",
@@ -427,7 +427,7 @@
    "MACHINEUSERS": "服务用户",
    "LOGOUT": "退出所有账户",
    "NEWORG": "创建组织",
-    "IAMADMIN": "您是 IAM 管理员。请注意您具有扩展权限。",
+    "IAMADMIN": "您是实例管理员。请注意您具有扩展权限。",
    "SHOWORGS": "查看所有组织",
    "GRANTS": "授权",
    "ACTIONS": "认证流程",
@@ -1161,7 +1161,7 @@
    },
    "MEMBERSHIPS": {
      "TITLE": "Zitadel 管理员角色",
-      "DESCRIPTION": "这些都是用户成员授权。您还可以在组织、项目或 IAM 详细信息页面上修改它们。",
+      "DESCRIPTION": "这些都是用户成员授权。您还可以在组织、项目或实例详细信息页面上修改它们。",
      "ORGCONTEXT": "您会看到与当前所选组织相关的所有组织和项目。",
      "USERCONTEXT": "您会看到您被授权的所有组织和项目。包括其他组织。",
      "CREATIONDATE": "创建于",
@@ -1267,7 +1267,7 @@
      "DESCRIPTION": "管理您的全局策略和管理访问设置。"
    },
    "EVENTSTORE": {
-      "TITLE": "IAM 存储管理",
+      "TITLE": "实例存储管理",
      "DESCRIPTION": "管理您的 Zitadel 视图和失败的事件。"
    },
    "MEMBER": {
@@ -2802,7 +2802,7 @@
    "ADD": "添加管理者",
    "CREATIONTYPE": "创建类型",
    "CREATIONTYPES": {
-      "3": "IAM",
+      "3": "实例",
      "2": "Organization",
      "0": "Owned Project",
      "1": "Granted Project",
@@ -10,7 +10,7 @@
    <link rel="manifest" href="manifest.webmanifest" />
    <meta name="theme-color" content="#e6768b" />

-    <meta property="description" content="Console Management Platform for ZITADEL IAM" />
+    <meta property="description" content="Console Management Platform for ZITADEL instance" />
    <meta property="og:type" content="website" />
    <meta property="og:title" content="ZITADEL Management Console" />
    <meta property="og:description" content="Console Management Platform for ZITADEL IAM" />
@@ -105,7 +105,7 @@ func TestGetInstance(t *testing.T) {
 				inputContext:      ctxWithSysAuthZ,
 				inputInstanceID:   "invalid",
 				expectedErrorCode: codes.NotFound,
-				expectedErrorMsg:  "Errors.IAM.NotFound (QUERY-n0wng)",
+				expectedErrorMsg:  "Errors.Instance.NotFound (QUERY-n0wng)",
 			},
 		}

@@ -168,7 +168,7 @@ func TestServer_AddOrgMember(t *testing.T) {
 			wantErr: true,
 		},
 		{
-			name: "iam role error",
+			name: "instance role error",
 			args: args{
 				ctx: OrgCTX,
 				req: &mgmt_pb.AddOrgMemberRequest{
@@ -249,7 +249,7 @@ func TestServer_UpdateOrgMember(t *testing.T) {
 			wantErr: true,
 		},
 		{
-			name: "iam role error",
+			name: "instance role error",
 			args: args{
 				ctx: OrgCTX,
 				req: &mgmt_pb.UpdateOrgMemberRequest{
@@ -89,7 +89,7 @@ func setInstance(ctx context.Context, verifier authz.InstanceVerifier) (_ contex

 	requestContext := zitadel_http.DomainContext(ctx)
 	if requestContext.InstanceDomain() == "" {
-		return nil, zerrors.ThrowNotFound(err, "INST-zWq7X", "Errors.IAM.NotFound")
+		return nil, zerrors.ThrowNotFound(err, "INST-zWq7X", "Errors.Instance.NotFound")
 	}
 	instance, err := verifier.InstanceByHost(authCtx, requestContext.InstanceDomain(), requestContext.RequestedDomain())
 	if err != nil {
@@ -399,7 +399,7 @@ func TestServer_TokenExchangeImpersonation(t *testing.T) {
 			wantErr: true,
 		},
 		{
-			name: "IAM IMPERSONATION: subject: userID, actor: access token, success",
+			name: "Instance IMPERSONATION: subject: userID, actor: access token, success",
 			args: args{
 				SubjectToken:       userResp.GetUserId(),
 				SubjectTokenType:   oidc_api.UserIDTokenType,
@@ -564,7 +564,7 @@ func TestImpersonation_API_Call(t *testing.T) {
 	iamUserID, iamImpersonatorPAT := createMachineUserPATWithMembership(ctx, t, instance, "IAM_ADMIN_IMPERSONATOR")
 	iamOwner := instance.Users.Get(integration.UserTypeIAMOwner)

-	// impersonating the IAM owner!
+	// impersonating the instance owner!
 	resp, err := tokenexchange.ExchangeToken(ctx, exchanger, iamOwner.Token, oidc.AccessTokenType, iamImpersonatorPAT, oidc.AccessTokenType, nil, nil, nil, oidc.AccessTokenType)
 	require.NoError(t, err)
 	accessTokenVerifier(ctx, resourceServer, iamOwner.ID, iamUserID)
@@ -229,7 +229,7 @@ func TestReplaceUser(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			// use iam owner => we don't want to test permissions of the create endpoint.
+			// use instance owner => we don't want to test permissions of the create endpoint.
 			createdUser, err := Instance.Client.SCIM.Users.Create(Instance.WithAuthorization(CTX, integration.UserTypeIAMOwner), Instance.DefaultOrg.Id, withUsername(fullUserJson, integration.Username()))
 			require.NoError(t, err)

@@ -37,14 +37,14 @@ func (c *Commands) SetCustomInstanceLoginText(ctx context.Context, loginText *do

 func (c *Commands) RemoveCustomInstanceLoginTexts(ctx context.Context, lang language.Tag) (*domain.ObjectDetails, error) {
 	if lang == language.Und {
-		return nil, zerrors.ThrowInvalidArgument(nil, "IAM-Gfbg3", "Errors.CustomText.Invalid")
+		return nil, zerrors.ThrowInvalidArgument(nil, "INST-Gfbg3", "Errors.CustomText.Invalid")
 	}
 	customText, err := c.defaultLoginTextWriteModelByID(ctx, lang)
 	if err != nil {
 		return nil, err
 	}
 	if customText.State == domain.PolicyStateUnspecified || customText.State == domain.PolicyStateRemoved {
-		return nil, zerrors.ThrowNotFound(nil, "IAM-fru44", "Errors.CustomText.NotFound")
+		return nil, zerrors.ThrowNotFound(nil, "INST-fru44", "Errors.CustomText.NotFound")
 	}
 	iamAgg := InstanceAggregateFromWriteModel(&customText.WriteModel)
 	pushedEvents, err := c.eventstore.Push(ctx, instance.NewCustomTextTemplateRemovedEvent(ctx, iamAgg, domain.LoginCustomText, lang))
@@ -35,7 +35,7 @@ func (c *Commands) addDefaultDebugNotificationFile(ctx context.Context, instance
 		return nil, err
 	}
 	if addedWriteModel.State.Exists() {
-		return nil, zerrors.ThrowAlreadyExists(nil, "INSTANCE-d93nfs", "Errors.IAM.DebugNotificationProvider.AlreadyExists")
+		return nil, zerrors.ThrowAlreadyExists(nil, "INSTANCE-d93nfs", "Errors.Instance.DebugNotificationProvider.AlreadyExists")
 	}

 	events := []eventstore.Command{
@@ -70,7 +70,7 @@ func (c *Commands) changeDefaultDebugNotificationProviderFile(ctx context.Contex
 		return nil, err
 	}
 	if !existingProvider.State.Exists() {
-		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-fm9wl", "Errors.IAM.DebugNotificationProvider.NotFound")
+		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-fm9wl", "Errors.Instance.DebugNotificationProvider.NotFound")
 	}
 	events := make([]eventstore.Command, 0)
 	changedEvent, hasChanged := existingProvider.NewChangedEvent(ctx,
@@ -80,7 +80,7 @@ func (c *Commands) changeDefaultDebugNotificationProviderFile(ctx context.Contex
 		events = append(events, changedEvent)
 	}
 	if len(events) == 0 {
-		return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-5M9vdd", "Errors.IAM.LoginPolicy.NotChanged")
+		return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-5M9vdd", "Errors.Instance.LoginPolicy.NotChanged")

 	}
 	return events, nil
@@ -94,7 +94,7 @@ func (c *Commands) RemoveDefaultNotificationFile(ctx context.Context) (*domain.O
 		return nil, err
 	}
 	if !existingProvider.State.Exists() {
-		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-dj9ew", "Errors.IAM.DebugNotificationProvider.NotFound")
+		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-dj9ew", "Errors.Instance.DebugNotificationProvider.NotFound")
 	}

 	events, err := c.eventstore.Push(ctx, iam_repo.NewDebugNotificationProviderFileRemovedEvent(ctx, instanceAgg))
@@ -35,7 +35,7 @@ func (c *Commands) addDefaultDebugNotificationLog(ctx context.Context, instanceA
 		return nil, err
 	}
 	if addedWriteModel.State.Exists() {
-		return nil, zerrors.ThrowAlreadyExists(nil, "INSTANCE-3h0fs", "Errors.IAM.DebugNotificationProvider.AlreadyExists")
+		return nil, zerrors.ThrowAlreadyExists(nil, "INSTANCE-3h0fs", "Errors.Instance.DebugNotificationProvider.AlreadyExists")
 	}

 	events := []eventstore.Command{
@@ -70,13 +70,13 @@ func (c *Commands) changeDefaultDebugNotificationProviderLog(ctx context.Context
 		return nil, err
 	}
 	if !existingProvider.State.Exists() {
-		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-2h0s3", "Errors.IAM.DebugNotificationProvider.NotFound")
+		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-2h0s3", "Errors.Instance.DebugNotificationProvider.NotFound")
 	}
 	changedEvent, hasChanged := existingProvider.NewChangedEvent(ctx,
 		instanceAgg,
 		fileSystemProvider.Compact)
 	if !hasChanged {
-		return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-fn9p3", "Errors.IAM.LoginPolicy.NotChanged")
+		return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-fn9p3", "Errors.Instance.LoginPolicy.NotChanged")
 	}
 	return changedEvent, nil
 }
@@ -89,7 +89,7 @@ func (c *Commands) RemoveDefaultNotificationLog(ctx context.Context) (*domain.Ob
 		return nil, err
 	}
 	if !existingProvider.State.Exists() {
-		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-39lse", "Errors.IAM.DebugNotificationProvider.NotFound")
+		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-39lse", "Errors.Instance.DebugNotificationProvider.NotFound")
 	}

 	events, err := c.eventstore.Push(ctx, instance.NewDebugNotificationProviderLogRemovedEvent(ctx, instanceAgg))
@@ -90,7 +90,7 @@ func (c *Commands) ChangeDefaultIDPConfig(ctx context.Context, config *domain.ID
 	instanceAgg := InstanceAggregateFromWriteModel(&existingIDP.WriteModel)
 	changedEvent, hasChanged := existingIDP.NewChangedEvent(ctx, instanceAgg, config.IDPConfigID, config.Name, config.StylingType, config.AutoRegister)
 	if !hasChanged {
-		return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-3k0fs", "Errors.IAM.IDPConfig.NotChanged")
+		return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-3k0fs", "Errors.Instance.IDPConfig.NotChanged")
 	}
 	pushedEvents, err := c.eventstore.Push(ctx, changedEvent)
 	if err != nil {
@@ -109,7 +109,7 @@ func (c *Commands) DeactivateDefaultIDPConfig(ctx context.Context, idpID string)
 		return nil, err
 	}
 	if existingIDP.State != domain.IDPConfigStateActive {
-		return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-2n0fs", "Errors.IAM.IDPConfig.NotActive")
+		return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-2n0fs", "Errors.Instance.IDPConfig.NotActive")
 	}
 	instanceAgg := InstanceAggregateFromWriteModel(&existingIDP.WriteModel)
 	pushedEvents, err := c.eventstore.Push(ctx, instance.NewIDPConfigDeactivatedEvent(ctx, instanceAgg, idpID))
@@ -129,7 +129,7 @@ func (c *Commands) ReactivateDefaultIDPConfig(ctx context.Context, idpID string)
 		return nil, err
 	}
 	if existingIDP.State != domain.IDPConfigStateInactive {
-		return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-5Mo0d", "Errors.IAM.IDPConfig.NotInactive")
+		return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-5Mo0d", "Errors.Instance.IDPConfig.NotInactive")
 	}
 	instanceAgg := InstanceAggregateFromWriteModel(&existingIDP.WriteModel)
 	pushedEvents, err := c.eventstore.Push(ctx, instance.NewIDPConfigReactivatedEvent(ctx, instanceAgg, idpID))
@@ -18,7 +18,7 @@ func (c *Commands) ChangeDefaultIDPJWTConfig(ctx context.Context, config *domain
 	}

 	if existingConfig.State == domain.IDPConfigStateRemoved || existingConfig.State == domain.IDPConfigStateUnspecified {
-		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-2m00d", "Errors.IAM.IDPConfig.AlreadyExists")
+		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-2m00d", "Errors.Instance.IDPConfig.AlreadyExists")
 	}

 	instanceAgg := InstanceAggregateFromWriteModel(&existingConfig.WriteModel)
@@ -34,7 +34,7 @@ func (c *Commands) ChangeDefaultIDPJWTConfig(ctx context.Context, config *domain
 		return nil, err
 	}
 	if !hasChanged {
-		return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-3n9gg", "Errors.IAM.IDPConfig.NotChanged")
+		return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-3n9gg", "Errors.Instance.IDPConfig.NotChanged")
 	}

 	pushedEvents, err := c.eventstore.Push(ctx, changedEvent)
@@ -18,7 +18,7 @@ func (c *Commands) ChangeDefaultIDPOIDCConfig(ctx context.Context, config *domai
 	}

 	if existingConfig.State == domain.IDPConfigStateRemoved || existingConfig.State == domain.IDPConfigStateUnspecified {
-		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-67J9d", "Errors.IAM.IDPConfig.AlreadyExists")
+		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-67J9d", "Errors.Instance.IDPConfig.AlreadyExists")
 	}

 	instanceAgg := InstanceAggregateFromWriteModel(&existingConfig.WriteModel)
@@ -39,7 +39,7 @@ func (c *Commands) ChangeDefaultIDPOIDCConfig(ctx context.Context, config *domai
 		return nil, err
 	}
 	if !hasChanged {
-		return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-d8kwF", "Errors.IAM.IDPConfig.NotChanged")
+		return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-d8kwF", "Errors.Instance.IDPConfig.NotChanged")
 	}

 	pushedEvents, err := c.eventstore.Push(ctx, changedEvent)
@@ -19,7 +19,7 @@ func (c *Commands) AddInstanceMemberCommand(a *instance.Aggregate, userID string
 			return nil, zerrors.ThrowInvalidArgument(nil, "INSTA-SDSfs", "Errors.Invalid.Argument")
 		}
 		if len(domain.CheckForInvalidRoles(roles, domain.IAMRolePrefix, c.zitadelRoles)) > 0 {
-			return nil, zerrors.ThrowInvalidArgument(nil, "INSTANCE-4m0fS", "Errors.IAM.MemberInvalid")
+			return nil, zerrors.ThrowInvalidArgument(nil, "INSTANCE-4m0fS", "Errors.Instance.MemberInvalid")
 		}
 		return func(ctx context.Context, filter preparation.FilterToQueryReducer) ([]eventstore.Command, error) {
 				if exists, err := ExistsUser(ctx, filter, userID, "", false); err != nil || !exists {
@@ -105,10 +105,10 @@ type ChangeInstanceMember struct {

 func (i *ChangeInstanceMember) IsValid(zitadelRoles []authz.RoleMapping) error {
 	if i.InstanceID == "" || i.UserID == "" || len(i.Roles) == 0 {
-		return zerrors.ThrowInvalidArgument(nil, "INSTANCE-LiaZi", "Errors.IAM.MemberInvalid")
+		return zerrors.ThrowInvalidArgument(nil, "INSTANCE-LiaZi", "Errors.Instance.MemberInvalid")
 	}
 	if len(domain.CheckForInvalidRoles(i.Roles, domain.IAMRolePrefix, zitadelRoles)) > 0 {
-		return zerrors.ThrowInvalidArgument(nil, "INSTANCE-3m9fs", "Errors.IAM.MemberInvalid")
+		return zerrors.ThrowInvalidArgument(nil, "INSTANCE-3m9fs", "Errors.Instance.MemberInvalid")
 	}
 	return nil
 }
@@ -49,7 +49,7 @@ func (c *Commands) getDefaultDomainPolicy(ctx context.Context) (*domain.DomainPo
 		return nil, err
 	}
 	if !policyWriteModel.State.Exists() {
-		return nil, zerrors.ThrowInvalidArgument(nil, "INSTANCE-3n8fs", "Errors.IAM.PasswordComplexityPolicy.NotFound")
+		return nil, zerrors.ThrowInvalidArgument(nil, "INSTANCE-3n8fs", "Errors.Instance.PasswordComplexityPolicy.NotFound")
 	}
 	policy := writeModelToDomainPolicy(policyWriteModel)
 	policy.Default = true
@@ -72,7 +72,7 @@ func (wm *InstanceDomainPolicyWriteModel) NewChangedEvent(
 		changes = append(changes, policy.ChangeSMTPSenderAddressMatchesInstanceDomain(smtpSenderAddresssMatchesInstanceDomain))
 	}
 	if len(changes) == 0 {
-		return nil, false, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-pl9fN", "Errors.IAM.DomainPolicy.NotChanged")
+		return nil, false, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-pl9fN", "Errors.Instance.DomainPolicy.NotChanged")
 	}
 	changedEvent, err = instance.NewDomainPolicyChangedEvent(ctx, aggregate, changes)
 	return changedEvent, usernameChange, err
@@ -22,7 +22,7 @@ func (c *Commands) ChangeDefaultLabelPolicy(ctx context.Context, policy *domain.
 	}

 	if existingPolicy.State == domain.PolicyStateUnspecified || existingPolicy.State == domain.PolicyStateRemoved {
-		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-0K9dq", "Errors.IAM.LabelPolicy.NotFound")
+		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-0K9dq", "Errors.Instance.LabelPolicy.NotFound")
 	}
 	instanceAgg := InstanceAggregateFromWriteModel(&existingPolicy.LabelPolicyWriteModel.WriteModel)
 	changedEvent, hasChanged := existingPolicy.NewChangedEvent(
@@ -41,7 +41,7 @@ func (c *Commands) ChangeDefaultLabelPolicy(ctx context.Context, policy *domain.
 		policy.DisableWatermark,
 		policy.ThemeMode)
 	if !hasChanged {
-		return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-28fHe", "Errors.IAM.LabelPolicy.NotChanged")
+		return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-28fHe", "Errors.Instance.LabelPolicy.NotChanged")
 	}

 	pushedEvents, err := c.eventstore.Push(ctx, changedEvent)
@@ -75,7 +75,7 @@ func (c *Commands) AddLogoDefaultLabelPolicy(ctx context.Context, upload *AssetU
 	}

 	if existingPolicy.State == domain.PolicyStateUnspecified || existingPolicy.State == domain.PolicyStateRemoved {
-		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-Qw0pd", "Errors.IAM.LabelPolicy.NotFound")
+		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-Qw0pd", "Errors.Instance.LabelPolicy.NotFound")
 	}
 	asset, err := c.uploadAsset(ctx, upload)
 	if err != nil {
@@ -100,7 +100,7 @@ func (c *Commands) RemoveLogoDefaultLabelPolicy(ctx context.Context) (*domain.Ob
 	}

 	if existingPolicy.State == domain.PolicyStateUnspecified || existingPolicy.State == domain.PolicyStateRemoved {
-		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-Xc8Kf", "Errors.IAM.LabelPolicy.NotFound")
+		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-Xc8Kf", "Errors.Instance.LabelPolicy.NotFound")
 	}

 	err = c.removeAsset(ctx, authz.GetInstance(ctx).InstanceID(), existingPolicy.LogoKey)
@@ -126,7 +126,7 @@ func (c *Commands) AddIconDefaultLabelPolicy(ctx context.Context, upload *AssetU
 	}

 	if existingPolicy.State == domain.PolicyStateUnspecified || existingPolicy.State == domain.PolicyStateRemoved {
-		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-1yMx0", "Errors.IAM.LabelPolicy.NotFound")
+		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-1yMx0", "Errors.Instance.LabelPolicy.NotFound")
 	}
 	asset, err := c.uploadAsset(ctx, upload)
 	if err != nil {
@@ -151,7 +151,7 @@ func (c *Commands) RemoveIconDefaultLabelPolicy(ctx context.Context) (*domain.Ob
 	}

 	if existingPolicy.State == domain.PolicyStateUnspecified || existingPolicy.State == domain.PolicyStateRemoved {
-		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-4M0qw", "Errors.IAM.LabelPolicy.NotFound")
+		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-4M0qw", "Errors.Instance.LabelPolicy.NotFound")
 	}
 	err = c.removeAsset(ctx, authz.GetInstance(ctx).InstanceID(), existingPolicy.IconKey)
 	if err != nil {
@@ -30,7 +30,7 @@ func (c *Commands) ChangeDefaultLoginPolicy(ctx context.Context, policy *ChangeL

 func (c *Commands) AddIDPProviderToDefaultLoginPolicy(ctx context.Context, idpProvider *domain.IDPProvider) (*domain.IDPProvider, error) {
 	if !idpProvider.IsValid() {
-		return nil, zerrors.ThrowInvalidArgument(nil, "INSTANCE-9nf88", "Errors.IAM.LoginPolicy.IDP.Invalid")
+		return nil, zerrors.ThrowInvalidArgument(nil, "INSTANCE-9nf88", "Errors.Instance.LoginPolicy.IDP.Invalid")
 	}
 	existingPolicy := NewInstanceLoginPolicyWriteModel(ctx)
 	err := c.defaultLoginPolicyWriteModelByID(ctx, existingPolicy)
@@ -38,7 +38,7 @@ func (c *Commands) AddIDPProviderToDefaultLoginPolicy(ctx context.Context, idpPr
 		return nil, err
 	}
 	if existingPolicy.State == domain.PolicyStateUnspecified || existingPolicy.State == domain.PolicyStateRemoved {
-		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-GVDfe", "Errors.IAM.LoginPolicy.NotFound")
+		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-GVDfe", "Errors.Instance.LoginPolicy.NotFound")
 	}

 	exists, err := ExistsInstanceIDP(ctx, c.eventstore.Filter, idpProvider.IDPConfigID)
@@ -51,7 +51,7 @@ func (c *Commands) AddIDPProviderToDefaultLoginPolicy(ctx context.Context, idpPr
 		return nil, err
 	}
 	if idpModel.State == domain.IdentityProviderStateActive {
-		return nil, zerrors.ThrowAlreadyExists(nil, "INSTANCE-2B0ps", "Errors.IAM.LoginPolicy.IDP.AlreadyExists")
+		return nil, zerrors.ThrowAlreadyExists(nil, "INSTANCE-2B0ps", "Errors.Instance.LoginPolicy.IDP.AlreadyExists")
 	}

 	instanceAgg := InstanceAggregateFromWriteModel(&idpModel.WriteModel)
@@ -68,7 +68,7 @@ func (c *Commands) AddIDPProviderToDefaultLoginPolicy(ctx context.Context, idpPr

 func (c *Commands) RemoveIDPProviderFromDefaultLoginPolicy(ctx context.Context, idpProvider *domain.IDPProvider) (*domain.ObjectDetails, error) {
 	if !idpProvider.IsValid() {
-		return nil, zerrors.ThrowInvalidArgument(nil, "INSTANCE-66m9s", "Errors.IAM.LoginPolicy.IDP.Invalid")
+		return nil, zerrors.ThrowInvalidArgument(nil, "INSTANCE-66m9s", "Errors.Instance.LoginPolicy.IDP.Invalid")
 	}
 	existingPolicy := NewInstanceLoginPolicyWriteModel(ctx)
 	err := c.defaultLoginPolicyWriteModelByID(ctx, existingPolicy)
@@ -76,7 +76,7 @@ func (c *Commands) RemoveIDPProviderFromDefaultLoginPolicy(ctx context.Context,
 		return nil, err
 	}
 	if existingPolicy.State == domain.PolicyStateUnspecified || existingPolicy.State == domain.PolicyStateRemoved {
-		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-Dfg4t", "Errors.IAM.LoginPolicy.NotFound")
+		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-Dfg4t", "Errors.Instance.LoginPolicy.NotFound")
 	}

 	idpModel := NewInstanceIdentityProviderWriteModel(ctx, idpProvider.IDPConfigID)
@@ -85,7 +85,7 @@ func (c *Commands) RemoveIDPProviderFromDefaultLoginPolicy(ctx context.Context,
 		return nil, err
 	}
 	if idpModel.State == domain.IdentityProviderStateUnspecified || idpModel.State == domain.IdentityProviderStateRemoved {
-		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-39fjs", "Errors.IAM.LoginPolicy.IDP.NotExisting")
+		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-39fjs", "Errors.Instance.LoginPolicy.IDP.NotExisting")
 	}

 	instanceAgg := InstanceAggregateFromWriteModel(&idpModel.IdentityProviderWriteModel.WriteModel)
@@ -135,7 +135,7 @@ func (c *Commands) AddSecondFactorToDefaultLoginPolicy(ctx context.Context, seco

 func (c *Commands) RemoveSecondFactorFromDefaultLoginPolicy(ctx context.Context, secondFactor domain.SecondFactorType) (*domain.ObjectDetails, error) {
 	if !secondFactor.Valid() {
-		return nil, zerrors.ThrowInvalidArgument(nil, "INSTANCE-55n8s", "Errors.IAM.LoginPolicy.MFA.Unspecified")
+		return nil, zerrors.ThrowInvalidArgument(nil, "INSTANCE-55n8s", "Errors.Instance.LoginPolicy.MFA.Unspecified")
 	}
 	secondFactorModel := NewInstanceSecondFactorWriteModel(ctx, secondFactor)
 	err := c.eventstore.FilterToQueryReducer(ctx, secondFactorModel)
@@ -143,7 +143,7 @@ func (c *Commands) RemoveSecondFactorFromDefaultLoginPolicy(ctx context.Context,
 		return nil, err
 	}
 	if secondFactorModel.State == domain.FactorStateUnspecified || secondFactorModel.State == domain.FactorStateRemoved {
-		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-3M9od", "Errors.IAM.LoginPolicy.MFA.NotExisting")
+		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-3M9od", "Errors.Instance.LoginPolicy.MFA.NotExisting")
 	}
 	instanceAgg := InstanceAggregateFromWriteModel(&secondFactorModel.SecondFactorWriteModel.WriteModel)
 	pushedEvents, err := c.eventstore.Push(ctx, instance.NewLoginPolicySecondFactorRemovedEvent(ctx, instanceAgg, secondFactor))
@@ -172,7 +172,7 @@ func (c *Commands) AddMultiFactorToDefaultLoginPolicy(ctx context.Context, multi

 func (c *Commands) RemoveMultiFactorFromDefaultLoginPolicy(ctx context.Context, multiFactor domain.MultiFactorType) (*domain.ObjectDetails, error) {
 	if !multiFactor.Valid() {
-		return nil, zerrors.ThrowInvalidArgument(nil, "INSTANCE-33m9F", "Errors.IAM.LoginPolicy.MFA.Unspecified")
+		return nil, zerrors.ThrowInvalidArgument(nil, "INSTANCE-33m9F", "Errors.Instance.LoginPolicy.MFA.Unspecified")
 	}
 	multiFactorModel := NewInstanceMultiFactorWriteModel(ctx, multiFactor)
 	err := c.eventstore.FilterToQueryReducer(ctx, multiFactorModel)
@@ -180,7 +180,7 @@ func (c *Commands) RemoveMultiFactorFromDefaultLoginPolicy(ctx context.Context,
 		return nil, err
 	}
 	if multiFactorModel.State == domain.FactorStateUnspecified || multiFactorModel.State == domain.FactorStateRemoved {
-		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-3M9df", "Errors.IAM.LoginPolicy.MFA.NotExisting")
+		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-3M9df", "Errors.Instance.LoginPolicy.MFA.NotExisting")
 	}
 	instanceAgg := InstanceAggregateFromWriteModel(&multiFactorModel.MultiFactorWriteModel.WriteModel)
 	pushedEvents, err := c.eventstore.Push(ctx, instance.NewLoginPolicyMultiFactorRemovedEvent(ctx, instanceAgg, multiFactor))
@@ -215,7 +215,7 @@ func (c *Commands) getDefaultLoginPolicy(ctx context.Context) (*domain.LoginPoli
 func prepareChangeDefaultLoginPolicy(a *instance.Aggregate, policy *ChangeLoginPolicy) preparation.Validation {
 	return func() (preparation.CreateCommands, error) {
 		if ok := domain.ValidateDefaultRedirectURI(policy.DefaultRedirectURI); !ok {
-			return nil, zerrors.ThrowInvalidArgument(nil, "IAM-SFdqd", "Errors.IAM.LoginPolicy.RedirectURIInvalid")
+			return nil, zerrors.ThrowInvalidArgument(nil, "INST-SFdqd", "Errors.Instance.LoginPolicy.RedirectURIInvalid")
 		}
 		return func(ctx context.Context, filter preparation.FilterToQueryReducer) ([]eventstore.Command, error) {
 			wm := NewInstanceLoginPolicyWriteModel(ctx)
@@ -223,7 +223,7 @@ func prepareChangeDefaultLoginPolicy(a *instance.Aggregate, policy *ChangeLoginP
 				return nil, err
 			}
 			if !wm.State.Exists() {
-				return nil, zerrors.ThrowNotFound(nil, "INSTANCE-M0sif", "Errors.IAM.LoginPolicy.NotFound")
+				return nil, zerrors.ThrowNotFound(nil, "INSTANCE-M0sif", "Errors.Instance.LoginPolicy.NotFound")
 			}
 			changedEvent, hasChanged := wm.NewChangedEvent(ctx, &a.Aggregate,
 				policy.AllowUsernamePassword,
@@ -244,7 +244,7 @@ func prepareChangeDefaultLoginPolicy(a *instance.Aggregate, policy *ChangeLoginP
 				policy.SecondFactorCheckLifetime,
 				policy.MultiFactorCheckLifetime)
 			if !hasChanged {
-				return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-5M9vdd", "Errors.IAM.LoginPolicy.NotChanged")
+				return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-5M9vdd", "Errors.Instance.LoginPolicy.NotChanged")
 			}
 			return []eventstore.Command{changedEvent}, nil
 		}, nil
@@ -32,14 +32,14 @@ func (c *Commands) AddDefaultMailTemplate(ctx context.Context, policy *domain.Ma

 func (c *Commands) addDefaultMailTemplate(ctx context.Context, instanceAgg *eventstore.Aggregate, addedPolicy *InstanceMailTemplateWriteModel, policy *domain.MailTemplate) (eventstore.Command, error) {
 	if !policy.IsValid() {
-		return nil, zerrors.ThrowInvalidArgument(nil, "INSTANCE-fm9sd", "Errors.IAM.MailTemplate.Invalid")
+		return nil, zerrors.ThrowInvalidArgument(nil, "INSTANCE-fm9sd", "Errors.Instance.MailTemplate.Invalid")
 	}
 	err := c.eventstore.FilterToQueryReducer(ctx, addedPolicy)
 	if err != nil {
 		return nil, err
 	}
 	if addedPolicy.State == domain.PolicyStateActive {
-		return nil, zerrors.ThrowAlreadyExists(nil, "INSTANCE-5n8fs", "Errors.IAM.MailTemplate.AlreadyExists")
+		return nil, zerrors.ThrowAlreadyExists(nil, "INSTANCE-5n8fs", "Errors.Instance.MailTemplate.AlreadyExists")
 	}

 	return instance.NewMailTemplateAddedEvent(ctx, instanceAgg, policy.Template), nil
@@ -63,7 +63,7 @@ func (c *Commands) ChangeDefaultMailTemplate(ctx context.Context, policy *domain

 func (c *Commands) changeDefaultMailTemplate(ctx context.Context, policy *domain.MailTemplate) (*InstanceMailTemplateWriteModel, eventstore.Command, error) {
 	if !policy.IsValid() {
-		return nil, nil, zerrors.ThrowInvalidArgument(nil, "INSTANCE-4m9ds", "Errors.IAM.MailTemplate.Invalid")
+		return nil, nil, zerrors.ThrowInvalidArgument(nil, "INSTANCE-4m9ds", "Errors.Instance.MailTemplate.Invalid")
 	}
 	existingPolicy, err := c.defaultMailTemplateWriteModelByID(ctx)
 	if err != nil {
@@ -71,13 +71,13 @@ func (c *Commands) changeDefaultMailTemplate(ctx context.Context, policy *domain
 	}

 	if existingPolicy.State == domain.PolicyStateUnspecified || existingPolicy.State == domain.PolicyStateRemoved {
-		return nil, nil, zerrors.ThrowNotFound(nil, "INSTANCE-2N8fs", "Errors.IAM.MailTemplate.NotFound")
+		return nil, nil, zerrors.ThrowNotFound(nil, "INSTANCE-2N8fs", "Errors.Instance.MailTemplate.NotFound")
 	}

 	instanceAgg := InstanceAggregateFromWriteModel(&existingPolicy.MailTemplateWriteModel.WriteModel)
 	changedEvent, hasChanged := existingPolicy.NewChangedEvent(ctx, instanceAgg, policy.Template)
 	if !hasChanged {
-		return nil, nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-3nfsG", "Errors.IAM.MailTemplate.NotChanged")
+		return nil, nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-3nfsG", "Errors.Instance.MailTemplate.NotChanged")
 	}

 	return existingPolicy, changedEvent, nil
@@ -78,11 +78,11 @@ func prepareChangeDefaultNotificationPolicy(
 			}

 			if writeModel.State == domain.PolicyStateUnspecified || writeModel.State == domain.PolicyStateRemoved {
-				return nil, zerrors.ThrowNotFound(nil, "INSTANCE-x891na", "Errors.IAM.NotificationPolicy.NotFound")
+				return nil, zerrors.ThrowNotFound(nil, "INSTANCE-x891na", "Errors.Instance.NotificationPolicy.NotFound")
 			}
 			change, hasChanged := writeModel.NewChangedEvent(ctx, &a.Aggregate, passwordChange)
 			if !hasChanged {
-				return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-29x02n", "Errors.IAM.NotificationPolicy.NotChanged")
+				return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-29x02n", "Errors.Instance.NotificationPolicy.NotChanged")
 			}
 			return []eventstore.Command{
 				change,
@@ -31,13 +31,13 @@ func (c *Commands) ChangeDefaultPasswordAgePolicy(ctx context.Context, policy *d
 		return nil, err
 	}
 	if existingPolicy.State == domain.PolicyStateUnspecified || existingPolicy.State == domain.PolicyStateRemoved {
-		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-0oPew", "Errors.IAM.PasswordAgePolicy.NotFound")
+		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-0oPew", "Errors.Instance.PasswordAgePolicy.NotFound")
 	}

 	instanceAgg := InstanceAggregateFromWriteModel(&existingPolicy.PasswordAgePolicyWriteModel.WriteModel)
 	changedEvent, hasChanged := existingPolicy.NewChangedEvent(ctx, instanceAgg, policy.ExpireWarnDays, policy.MaxAgeDays)
 	if !hasChanged {
-		return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-180sf", "Errors.IAM.PasswordAgePolicy.NotChanged")
+		return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-180sf", "Errors.Instance.PasswordAgePolicy.NotChanged")
 	}

 	pushedEvents, err := c.eventstore.Push(ctx, changedEvent)
@@ -35,13 +35,13 @@ func (c *Commands) ChangeDefaultPasswordComplexityPolicy(ctx context.Context, po
 		return nil, err
 	}
 	if existingPolicy.State == domain.PolicyStateUnspecified || existingPolicy.State == domain.PolicyStateRemoved {
-		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-0oPew", "Errors.IAM.PasswordComplexityPolicy.NotFound")
+		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-0oPew", "Errors.Instance.PasswordComplexityPolicy.NotFound")
 	}

 	instanceAgg := InstanceAggregateFromWriteModel(&existingPolicy.PasswordComplexityPolicyWriteModel.WriteModel)
 	changedEvent, hasChanged := existingPolicy.NewChangedEvent(ctx, instanceAgg, policy.MinLength, policy.HasLowercase, policy.HasUppercase, policy.HasNumber, policy.HasSymbol)
 	if !hasChanged {
-		return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-9jlsf", "Errors.IAM.PasswordComplexityPolicy.NotChanged")
+		return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-9jlsf", "Errors.Instance.PasswordComplexityPolicy.NotChanged")
 	}
 	pushedEvents, err := c.eventstore.Push(ctx, changedEvent)
 	if err != nil {
@@ -99,7 +99,7 @@ func (c *Commands) getDefaultPasswordComplexityPolicy(ctx context.Context) (*dom
 		return nil, err
 	}
 	if !policyWriteModel.State.Exists() {
-		return nil, zerrors.ThrowInvalidArgument(nil, "INSTANCE-M0gsf", "Errors.IAM.PasswordComplexityPolicy.NotFound")
+		return nil, zerrors.ThrowInvalidArgument(nil, "INSTANCE-M0gsf", "Errors.Instance.PasswordComplexityPolicy.NotFound")
 	}
 	policy := writeModelToPasswordComplexityPolicy(&policyWriteModel.PasswordComplexityPolicyWriteModel)
 	policy.Default = true
@@ -37,7 +37,7 @@ func (c *Commands) ChangeDefaultLockoutPolicy(ctx context.Context, policy *domai
 		return nil, err
 	}
 	if existingPolicy.State == domain.PolicyStateUnspecified || existingPolicy.State == domain.PolicyStateRemoved {
-		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-0oPew", "Errors.IAM.LockoutPolicy.NotFound")
+		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-0oPew", "Errors.Instance.LockoutPolicy.NotFound")
 	}

 	instanceAgg := InstanceAggregateFromWriteModel(&existingPolicy.LockoutPolicyWriteModel.WriteModel)
@@ -49,7 +49,7 @@ func (c *Commands) ChangeDefaultLockoutPolicy(ctx context.Context, policy *domai
 		policy.ShowLockOutFailures,
 	)
 	if !hasChanged {
-		return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-0psjF", "Errors.IAM.LockoutPolicy.NotChanged")
+		return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-0psjF", "Errors.Instance.LockoutPolicy.NotChanged")
 	}

 	pushedEvents, err := c.eventstore.Push(ctx, changedEvent)
@@ -58,13 +58,13 @@ func (c *Commands) ChangeDefaultPrivacyPolicy(ctx context.Context, policy *domai
 		return nil, err
 	}
 	if existingPolicy.State == domain.PolicyStateUnspecified || existingPolicy.State == domain.PolicyStateRemoved {
-		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-0oPew", "Errors.IAM.PrivacyPolicy.NotFound")
+		return nil, zerrors.ThrowNotFound(nil, "INSTANCE-0oPew", "Errors.Instance.PrivacyPolicy.NotFound")
 	}

 	instanceAgg := InstanceAggregateFromWriteModel(&existingPolicy.PrivacyPolicyWriteModel.WriteModel)
 	changedEvent, hasChanged := existingPolicy.NewChangedEvent(ctx, instanceAgg, policy.TOSLink, policy.PrivacyLink, policy.HelpLink, policy.SupportEmail, policy.DocsLink, policy.CustomLink, policy.CustomLinkText)
 	if !hasChanged {
-		return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-9jJfs", "Errors.IAM.PrivacyPolicy.NotChanged")
+		return nil, zerrors.ThrowPreconditionFailed(nil, "INSTANCE-9jJfs", "Errors.Instance.PrivacyPolicy.NotChanged")
 	}
 	pushedEvents, err := c.eventstore.Push(ctx, changedEvent)
 	if err != nil {
@@ -96,7 +96,7 @@ func (c *Commands) getDefaultPrivacyPolicy(ctx context.Context) (*domain.Privacy
 		return nil, err
 	}
 	if !policyWriteModel.State.Exists() {
-		return nil, zerrors.ThrowInvalidArgument(nil, "INSTANCE-559os", "Errors.IAM.PrivacyPolicy.NotFound")
+		return nil, zerrors.ThrowInvalidArgument(nil, "INSTANCE-559os", "Errors.Instance.PrivacyPolicy.NotFound")
 	}
 	policy := writeModelToPrivacyPolicy(&policyWriteModel.PrivacyPolicyWriteModel)
 	policy.Default = true
@@ -123,7 +123,7 @@ func (c *ChangeOrgMember) IsValid(zitadelRoles []authz.RoleMapping) error {
 		return zerrors.ThrowInvalidArgument(nil, "Org-LiaZi", "Errors.Org.MemberInvalid")
 	}
 	if len(domain.CheckForInvalidRoles(c.Roles, domain.OrgRolePrefix, zitadelRoles)) > 0 {
-		return zerrors.ThrowInvalidArgument(nil, "IAM-m9fG8", "Errors.Org.MemberInvalid")
+		return zerrors.ThrowInvalidArgument(nil, "INST-m9fG8", "Errors.Org.MemberInvalid")
 	}

 	return nil
@@ -143,7 +143,7 @@ func (c *Commands) AddLogoLabelPolicy(ctx context.Context, orgID string, upload
 	}
 	asset, err := c.uploadAsset(ctx, upload)
 	if err != nil {
-		return nil, zerrors.ThrowInternal(err, "IAM-4N3nf", "Errors.Assets.Object.PutFailed")
+		return nil, zerrors.ThrowInternal(err, "INST-4N3nf", "Errors.Assets.Object.PutFailed")
 	}
 	orgAgg := OrgAggregateFromWriteModel(&existingPolicy.LabelPolicyWriteModel.WriteModel)
 	pushedEvents, err := c.eventstore.Push(ctx, org.NewLabelPolicyLogoAddedEvent(ctx, orgAgg, asset.Name))
@@ -199,7 +199,7 @@ func (c *Commands) AddIconLabelPolicy(ctx context.Context, orgID string, upload
 	}
 	asset, err := c.uploadAsset(ctx, upload)
 	if err != nil {
-		return nil, zerrors.ThrowInternal(err, "IAM-4BS7f", "Errors.Assets.Object.PutFailed")
+		return nil, zerrors.ThrowInternal(err, "INST-4BS7f", "Errors.Assets.Object.PutFailed")
 	}
 	orgAgg := OrgAggregateFromWriteModel(&existingPolicy.LabelPolicyWriteModel.WriteModel)
 	pushedEvents, err := c.eventstore.Push(ctx, org.NewLabelPolicyIconAddedEvent(ctx, orgAgg, asset.Name))
@@ -256,7 +256,7 @@ func (c *Commands) AddLogoDarkLabelPolicy(ctx context.Context, orgID string, upl
 	}
 	asset, err := c.uploadAsset(ctx, upload)
 	if err != nil {
-		return nil, zerrors.ThrowInternal(err, "IAM-3S7fN", "Errors.Assets.Object.PutFailed")
+		return nil, zerrors.ThrowInternal(err, "INST-3S7fN", "Errors.Assets.Object.PutFailed")
 	}
 	orgAgg := OrgAggregateFromWriteModel(&existingPolicy.LabelPolicyWriteModel.WriteModel)
 	pushedEvents, err := c.eventstore.Push(ctx, org.NewLabelPolicyLogoDarkAddedEvent(ctx, orgAgg, asset.Name))
@@ -312,7 +312,7 @@ func (c *Commands) AddIconDarkLabelPolicy(ctx context.Context, orgID string, upl
 	}
 	asset, err := c.uploadAsset(ctx, upload)
 	if err != nil {
-		return nil, zerrors.ThrowInternal(err, "IAM-4B7cs", "Errors.Assets.Object.PutFailed")
+		return nil, zerrors.ThrowInternal(err, "INST-4B7cs", "Errors.Assets.Object.PutFailed")
 	}
 	orgAgg := OrgAggregateFromWriteModel(&existingPolicy.LabelPolicyWriteModel.WriteModel)
 	pushedEvents, err := c.eventstore.Push(ctx, org.NewLabelPolicyIconDarkAddedEvent(ctx, orgAgg, asset.Name))
@@ -19,7 +19,7 @@ func GetStylingByAggregateIDAndState(db *gorm.DB, table, aggregateID, instanceID
 	query := repository.PrepareGetByQuery(table, aggregateIDQuery, stateQuery, instanceIDQuery, ownerRemovedQuery)
 	err := query(db, policy)
 	if zerrors.IsNotFound(err) {
-		return nil, zerrors.ThrowNotFound(nil, "VIEW-68G11", "Errors.IAM.LabelPolicy.NotExisting")
+		return nil, zerrors.ThrowNotFound(nil, "VIEW-68G11", "Errors.Instance.LabelPolicy.NotExisting")
 	}
 	return policy, err
 }
@@ -92,7 +92,7 @@ func SetupMapper(event eventstore.Event) (eventstore.Event, error) {
 	}
 	err := event.Unmarshal(step)
 	if err != nil {
-		return nil, zerrors.ThrowInternal(err, "IAM-hYp7M", "unable to unmarshal step")
+		return nil, zerrors.ThrowInternal(err, "INST-hYp7M", "unable to unmarshal step")
 	}

 	return step, nil
@@ -447,7 +447,7 @@ func prepareInstanceDomainQuery() (sq.SelectBuilder, func(*sql.Rows) (*Instance,
 				})
 			}
 			if instance.ID == "" {
-				return nil, zerrors.ThrowNotFound(nil, "QUERY-n0wng", "Errors.IAM.NotFound")
+				return nil, zerrors.ThrowNotFound(nil, "QUERY-n0wng", "Errors.Instance.NotFound")
 			}
 			instance.DefaultLang = language.Make(lang)
 			if err := rows.Close(); err != nil {
@@ -538,7 +538,7 @@ func (i *authzInstance) checkDomain(instanceDomain, publicDomain string) error {
 		return nil
 	}
 	if !slices.Contains(i.TrustedDomains, publicDomain) {
-		return zerrors.ThrowNotFound(fmt.Errorf(errPublicDomain, publicDomain), "QUERY-IuGh1", "Errors.IAM.NotFound")
+		return zerrors.ThrowNotFound(fmt.Errorf(errPublicDomain, publicDomain), "QUERY-IuGh1", "Errors.Instance.NotFound")
 	}
 	return nil
 }
@@ -585,7 +585,7 @@ func scanAuthzInstance() (*authzInstance, func(row *sql.Row) error) {
 			&executionTargetsBytes,
 		)
 		if errors.Is(err, sql.ErrNoRows) {
-			return zerrors.ThrowNotFound(nil, "QUERY-1kIjX", "Errors.IAM.NotFound")
+			return zerrors.ThrowNotFound(nil, "QUERY-1kIjX", "Errors.Instance.NotFound")
 		}
 		if err != nil {
 			return zerrors.ThrowInternal(err, "QUERY-d3fas", "Errors.Internal")
@@ -172,7 +172,7 @@ func prepareLockoutPolicyQuery() (sq.SelectBuilder, func(*sql.Row) (*LockoutPoli
 			)
 			if err != nil {
 				if errors.Is(err, sql.ErrNoRows) {
-					return nil, zerrors.ThrowNotFound(err, "QUERY-38pZnUemLP", "Errors.IAM.PasswordLockoutPolicy.NotFound")
+					return nil, zerrors.ThrowNotFound(err, "QUERY-38pZnUemLP", "Errors.Instance.PasswordLockoutPolicy.NotFound")
 				}
 				return nil, zerrors.ThrowInternal(err, "QUERY-PJURxRUoYG", "Errors.Internal")
 			}
@@ -175,7 +175,7 @@ func preparePasswordAgePolicyQuery() (sq.SelectBuilder, func(*sql.Row) (*Passwor
 			)
 			if err != nil {
 				if errors.Is(err, sql.ErrNoRows) {
-					return nil, zerrors.ThrowNotFound(err, "QUERY-ShCWRnWJfH", "Errors.IAM.PasswordAgePolicy.NotFound")
+					return nil, zerrors.ThrowNotFound(err, "QUERY-ShCWRnWJfH", "Errors.Instance.PasswordAgePolicy.NotFound")
 				}
 				return nil, zerrors.ThrowInternal(err, "QUERY-6nj7Bm4fxT", "Errors.Internal")
 			}
@@ -197,7 +197,7 @@ func preparePasswordComplexityPolicyQuery() (sq.SelectBuilder, func(*sql.Row) (*
 			)
 			if err != nil {
 				if errors.Is(err, sql.ErrNoRows) {
-					return nil, zerrors.ThrowNotFound(err, "QUERY-hgA9vuM0qg", "Errors.IAM.PasswordComplexityPolicy.NotFound")
+					return nil, zerrors.ThrowNotFound(err, "QUERY-hgA9vuM0qg", "Errors.Instance.PasswordComplexityPolicy.NotFound")
 				}
 				return nil, zerrors.ThrowInternal(err, "QUERY-TvvW9Uij7M", "Errors.Internal")
 			}
@@ -22,7 +22,7 @@ func TestIDPLoginPolicyLinkProjection_reduces(t *testing.T) {
 		want   wantReduce
 	}{
 		{
-			name: "iam reduceAdded",
+			name: "Instance reduceAdded",
 			args: args{
 				event: getEvent(
 					testEvent(
@@ -58,7 +58,7 @@ func TestIDPLoginPolicyLinkProjection_reduces(t *testing.T) {
 			},
 		},
 		{
-			name: "iam reduceRemoved",
+			name: "Instance reduceRemoved",
 			args: args{
 				event: getEvent(
 					testEvent(
@@ -89,7 +89,7 @@ func TestIDPLoginPolicyLinkProjection_reduces(t *testing.T) {
 			},
 		},
 		{
-			name: "iam reduceCascadeRemoved",
+			name: "Instance reduceCascadeRemoved",
 			args: args{
 				event: getEvent(
 					testEvent(
@@ -301,7 +301,7 @@ func TestIDPLoginPolicyLinkProjection_reduces(t *testing.T) {
 			},
 		},
 		{
-			name: "iam IDPConfigRemovedEvent",
+			name: "Instance IDPConfigRemovedEvent",
 			args: args{
 				event: getEvent(
 					testEvent(
@@ -360,7 +360,7 @@ func TestIDPLoginPolicyLinkProjection_reduces(t *testing.T) {
 			},
 		},
 		{
-			name: "iam IDPRemovedEvent",
+			name: "Instance IDPRemovedEvent",
 			args: args{
 				event: getEvent(
 					testEvent(
@@ -304,7 +304,7 @@ func TestIDPUserLinkProjection_reduces(t *testing.T) {
 			},
 		},
 		{
-			name: "iam IDPConfigRemovedEvent",
+			name: "Instance IDPConfigRemovedEvent",
 			args: args{
 				event: getEvent(
 					testEvent(
@@ -409,7 +409,7 @@ func TestLoginNameProjection_reduces(t *testing.T) {
 			},
 		},
 		{
-			name: "iam OrgDomainPolicyAddedEventType",
+			name: "Instance OrgDomainPolicyAddedEventType",
 			args: args{
 				event: getEvent(
 					testEvent(
@@ -440,7 +440,7 @@ func TestLoginNameProjection_reduces(t *testing.T) {
 			},
 		},
 		{
-			name: "iam OrgDomainPolicyChangedEventType",
+			name: "Instance OrgDomainPolicyChangedEventType",
 			args: args{
 				event: getEvent(
 					testEvent(
@@ -470,7 +470,7 @@ func TestLoginNameProjection_reduces(t *testing.T) {
 			},
 		},
 		{
-			name: "iam OrgDomainPolicyChangedEventType no change",
+			name: "Instance OrgDomainPolicyChangedEventType no change",
 			args: args{
 				event: getEvent(
 					testEvent(
@@ -48,7 +48,7 @@ func DefaultLanguageSetMapper(event eventstore.Event) (eventstore.Event, error)
 	}
 	err := event.Unmarshal(e)
 	if err != nil {
-		return nil, zerrors.ThrowInternal(err, "IAM-3j9fs", "unable to unmarshal default language set")
+		return nil, zerrors.ThrowInternal(err, "INST-3j9fs", "unable to unmarshal default language set")
 	}

 	return e, nil
@@ -47,7 +47,7 @@ func ProjectSetMapper(event eventstore.Event) (eventstore.Event, error) {
 	}
 	err := event.Unmarshal(e)
 	if err != nil {
-		return nil, zerrors.ThrowInternal(err, "IAM-cdFZH", "unable to unmarshal global org set")
+		return nil, zerrors.ThrowInternal(err, "INST-cdFZH", "unable to unmarshal global org set")
 	}

 	return e, nil
@@ -91,7 +91,7 @@ func ManagementConsoleSetMapper(event eventstore.Event) (eventstore.Event, error
 	}
 	err := event.Unmarshal(e)
 	if err != nil {
-		return nil, zerrors.ThrowInternal(err, "IAM-cdFZH", "unable to unmarshal management console set")
+		return nil, zerrors.ThrowInternal(err, "INST-cdFZH", "unable to unmarshal management console set")
 	}

 	return e, nil
@@ -46,7 +46,7 @@ func DefaultOrgSetMapper(event eventstore.Event) (eventstore.Event, error) {
 	}
 	err := event.Unmarshal(e)
 	if err != nil {
-		return nil, zerrors.ThrowInternal(err, "IAM-cdFZH", "unable to unmarshal default org set")
+		return nil, zerrors.ThrowInternal(err, "INST-cdFZH", "unable to unmarshal default org set")
 	}

 	return e, nil
@@ -58,7 +58,7 @@ func OIDCSettingsAddedEventMapper(event eventstore.Event) (eventstore.Event, err
 	}
 	err := event.Unmarshal(oidcSettingsAdded)
 	if err != nil {
-		return nil, zerrors.ThrowInternal(err, "IAM-soiwj", "unable to unmarshal oidc config added")
+		return nil, zerrors.ThrowInternal(err, "INST-soiwj", "unable to unmarshal oidc config added")
 	}

 	return oidcSettingsAdded, nil
@@ -87,7 +87,7 @@ func NewOIDCSettingsChangeEvent(
 	changes []OIDCSettingsChanges,
 ) (*OIDCSettingsChangedEvent, error) {
 	if len(changes) == 0 {
-		return nil, zerrors.ThrowPreconditionFailed(nil, "IAM-dnlwe", "Errors.NoChangesFound")
+		return nil, zerrors.ThrowPreconditionFailed(nil, "INST-dnlwe", "Errors.NoChangesFound")
 	}
 	changeEvent := &OIDCSettingsChangedEvent{
 		BaseEvent: *eventstore.NewBaseEventForPush(
@@ -135,7 +135,7 @@ func OIDCSettingsChangedEventMapper(event eventstore.Event) (eventstore.Event, e

 	err := event.Unmarshal(e)
 	if err != nil {
-		return nil, zerrors.ThrowInternal(err, "IAM-f98uf", "unable to unmarshal oidc settings changed")
+		return nil, zerrors.ThrowInternal(err, "INST-f98uf", "unable to unmarshal oidc settings changed")
 	}

 	return e, nil
@@ -81,7 +81,7 @@ func SecurityPolicySetEventMapper(event eventstore.Event) (eventstore.Event, err
 	}
 	err := event.Unmarshal(securityPolicyAdded)
 	if err != nil {
-		return nil, zerrors.ThrowInternal(err, "IAM-soiwj", "unable to unmarshal oidc config added")
+		return nil, zerrors.ThrowInternal(err, "INST-soiwj", "unable to unmarshal oidc config added")
 	}

 	return securityPolicyAdded, nil
@@ -83,7 +83,7 @@ func SecretGeneratorAddedEventMapper(event eventstore.Event) (eventstore.Event,
 	}
 	err := event.Unmarshal(secretGeneratorAdded)
 	if err != nil {
-		return nil, zerrors.ThrowInternal(err, "IAM-en9f4", "unable to unmarshal secret generator added")
+		return nil, zerrors.ThrowInternal(err, "INST-en9f4", "unable to unmarshal secret generator added")
 	}

 	return secretGeneratorAdded, nil
@@ -116,7 +116,7 @@ func NewSecretGeneratorChangeEvent(
 	changes []SecretGeneratorChanges,
 ) (*SecretGeneratorChangedEvent, error) {
 	if len(changes) == 0 {
-		return nil, zerrors.ThrowPreconditionFailed(nil, "IAM-j2jfw", "Errors.NoChangesFound")
+		return nil, zerrors.ThrowPreconditionFailed(nil, "INST-j2jfw", "Errors.NoChangesFound")
 	}
 	changeEvent := &SecretGeneratorChangedEvent{
 		BaseEvent: *eventstore.NewBaseEventForPush(
@@ -177,7 +177,7 @@ func SecretGeneratorChangedEventMapper(event eventstore.Event) (eventstore.Event

 	err := event.Unmarshal(e)
 	if err != nil {
-		return nil, zerrors.ThrowInternal(err, "IAM-2m09e", "unable to unmarshal secret generator changed")
+		return nil, zerrors.ThrowInternal(err, "INST-2m09e", "unable to unmarshal secret generator changed")
 	}

 	return e, nil
@@ -219,7 +219,7 @@ func SecretGeneratorRemovedEventMapper(event eventstore.Event) (eventstore.Event

 	err := event.Unmarshal(e)
 	if err != nil {
-		return nil, zerrors.ThrowInternal(err, "IAM-m09ke", "unable to unmarshal secret generator removed")
+		return nil, zerrors.ThrowInternal(err, "INST-m09ke", "unable to unmarshal secret generator removed")
 	}

 	return e, nil
@@ -90,7 +90,7 @@ func NewSMSConfigTwilioChangedEvent(
 	changes []SMSConfigTwilioChanges,
 ) (*SMSConfigTwilioChangedEvent, error) {
 	if len(changes) == 0 {
-		return nil, zerrors.ThrowPreconditionFailed(nil, "IAM-smn8e", "Errors.NoChangesFound")
+		return nil, zerrors.ThrowPreconditionFailed(nil, "INST-smn8e", "Errors.NoChangesFound")
 	}
 	changeEvent := &SMSConfigTwilioChangedEvent{
 		BaseEvent: eventstore.NewBaseEventForPush(
@@ -238,7 +238,7 @@ func NewSMSConfigHTTPChangedEvent(
 	changes []SMSConfigHTTPChanges,
 ) (*SMSConfigHTTPChangedEvent, error) {
 	if len(changes) == 0 {
-		return nil, zerrors.ThrowPreconditionFailed(nil, "IAM-smn8e", "Errors.NoChangesFound")
+		return nil, zerrors.ThrowPreconditionFailed(nil, "INST-smn8e", "Errors.NoChangesFound")
 	}
 	changeEvent := &SMSConfigHTTPChangedEvent{
 		BaseEvent: eventstore.NewBaseEventForPush(
@@ -157,7 +157,7 @@ func NewSMTPConfigChangeEvent(
 	changes []SMTPConfigChanges,
 ) (*SMTPConfigChangedEvent, error) {
 	if len(changes) == 0 {
-		return nil, zerrors.ThrowPreconditionFailed(nil, "IAM-o0pWf", "Errors.NoChangesFound")
+		return nil, zerrors.ThrowPreconditionFailed(nil, "INST-o0pWf", "Errors.NoChangesFound")
 	}
 	changeEvent := &SMTPConfigChangedEvent{
 		BaseEvent: eventstore.NewBaseEventForPush(
@@ -356,7 +356,7 @@ func NewSMTPConfigHTTPChangeEvent(
 	changes []SMTPConfigHTTPChanges,
 ) (*SMTPConfigHTTPChangedEvent, error) {
 	if len(changes) == 0 {
-		return nil, zerrors.ThrowPreconditionFailed(nil, "IAM-o0pWf", "Errors.NoChangesFound")
+		return nil, zerrors.ThrowPreconditionFailed(nil, "INST-o0pWf", "Errors.NoChangesFound")
 	}
 	changeEvent := &SMTPConfigHTTPChangedEvent{
 		BaseEvent: eventstore.NewBaseEventForPush(
@@ -284,10 +284,6 @@ Errors:
      Empty: "سياسة عمر كلمة المرور فارغة"
      NotExisting: "سياسة عمر كلمة المرور غير موجودة"
      AlreadyExists: "سياسة عمر كلمة المرور موجودة بالفعل"
-    OrgIAMPolicy:
-      Empty: "سياسة IAM للمنظمة فارغة"
-      NotExisting: "سياسة IAM للمنظمة غير موجودة"
-      AlreadyExists: "سياسة IAM للمنظمة موجودة بالفعل"
    NotificationPolicy:
      NotFound: "سياسة الإشعارات غير موجودة"
      NotChanged: "سياسة الإشعارات لم تتغير"
@@ -349,7 +345,7 @@ Errors:
      HasNotExistingRole: "يوجد دور غير موجود في المشروع"
      NotActive: "منحة المشروع غير نشطة"
      NotInactive: "منحة المشروع غير معطلة"
-  IAM:
+  Instance:
    NotFound: "المثيل غير موجود. تأكد من أن النطاق صحيح. تحقق من https://zitadel.com/docs/apis/introduction#domains"
    Member:
      RolesNotChanged: "الأدوار لم تتغير"
@@ -357,8 +353,6 @@ Errors:
    MemberAlreadyExisting: "العضو موجود بالفعل"
    MemberNotExisting: "العضو غير موجود"
    IDMissing: "المعرف مفقود"
-    IAMProjectIDMissing: "معرف مشروع IAM مفقود"
-    IamProjectAlreadySet: "تم تعيين معرف مشروع IAM بالفعل"
    IdpInvalid: "تكوين IDP غير صالح"
    IdpNotExisting: "تكوين IDP غير موجود"
    OIDCConfigInvalid: "تكوين OIDC IDP غير صالح"
@@ -283,10 +283,6 @@ Errors:
      Empty: "Правилата за възрастта на паролата са празни"
      NotExisting: "Правилата за възрастта на паролата не съществуват"
      AlreadyExists: "Вече съществува политика за възрастта на паролата"
-    OrgIAMPolicy:
-      Empty: "Правилата за IAM на организацията са празни"
-      NotExisting: "IAM политиката на организацията не съществува"
-      AlreadyExists: "Политиката за IAM на организацията вече съществува"
    NotificationPolicy:
      NotFound: "Правилата за уведомяване не са намерени"
      NotChanged: "Правилата за уведомяване не са променени"
@@ -348,7 +344,7 @@ Errors:
      HasNotExistingRole: "Една роля не съществува в проекта"
      NotActive: "Грантът по проекта не е активен"
      NotInactive: "Грантът по проекта не е неактивен"
-  IAM:
+  Instance:
    NotFound: "IAM не е намерен. Уверете се, че сте получили правилния домейн. Вижте https://zitadel.com/docs/apis/introduction#domains"
    Member:
      RolesNotChanged: "Ролите не са сменени"
@@ -356,8 +352,6 @@ Errors:
    MemberAlreadyExisting: "Член вече съществува"
    MemberNotExisting: "Членът не съществува"
    IDMissing: "ID липсва"
-    IAMProjectIDMissing: "Липсва идентификатор на IAM проект"
-    IamProjectAlreadySet: "Идентификаторът на IAM проект вече е зададен"
    IdpInvalid: "IDP конфигурацията е невалидна"
    IdpNotExisting: "IDP конфигурация не съществува"
    OIDCConfigInvalid: "OIDC IDP конфигурацията е невалидна"
@@ -283,10 +283,6 @@ Errors:
      Empty: "Politika stáří hesla je prázdná"
      NotExisting: "Politika stáří hesla neexistuje"
      AlreadyExists: "Politika stáří hesla již existuje"
-    OrgIAMPolicy:
-      Empty: "Politika IAM organizace je prázdná"
-      NotExisting: "Politika IAM organizace neexistuje"
-      AlreadyExists: "Politika IAM organizace již existuje"
    NotificationPolicy:
      NotFound: "Politika oznámení nenalezena"
      NotChanged: "Politika oznámení nezměněna"
@@ -348,7 +344,7 @@ Errors:
      HasNotExistingRole: "Jedna z rolí v projektu neexistuje"
      NotActive: "Grant projektu není aktivní"
      NotInactive: "Grant projektu není neaktivní"
-  IAM:
+  Instance:
    NotFound: "Instance nebyla nalezena. Ujistěte se, že jste získali správnou doménu. Podívejte se na https://zitadel.com/docs/apis/introduction#domains"
    Member:
      RolesNotChanged: "Role nebyly změněny"
@@ -356,8 +352,6 @@ Errors:
    MemberAlreadyExisting: "Člen již existuje"
    MemberNotExisting: "Člen neexistuje"
    IDMissing: "Chybí Id"
-    IAMProjectIDMissing: "Chybí Id IAM projektu"
-    IamProjectAlreadySet: "Id IAM projektu bylo již nastaveno"
    IdpInvalid: "Konfigurace IDP je neplatná"
    IdpNotExisting: "Konfigurace IDP neexistuje"
    OIDCConfigInvalid: "Konfigurace OIDC IDP je neplatná"
@@ -283,10 +283,6 @@ Errors:
      Empty: "Passwort Age Policy ist leer"
      NotExisting: "Passwort Age Policy existiert nicht"
      AlreadyExists: "Passwort Age Policy existiert bereits"
-    OrgIAMPolicy:
-      Empty: "Org IAM Policy ist leer"
-      NotExisting: "Org IAM Policy existiert nicht"
-      AlreadyExists: "Org IAM Policy existiert bereits"
    NotificationPolicy:
      NotFound: "Notification Policy konnte nicht gefunden werden"
      NotChanged: "Notification Policy wurde nicht verändert"
@@ -348,7 +344,7 @@ Errors:
      HasNotExistingRole: "Eine der Rollen existiert nicht auf dem Projekt"
      NotActive: "Projekt Grant ist nicht aktiv"
      NotInactive: "Projekt Grant ist nicht inaktiv"
-  IAM:
+  Instance:
    NotFound: "Instanz nicht gefunden. Stelle sicher, dass Du die richtige Domain hast. Schau unter https://zitadel.com/docs/apis/introduction#domains"
    Member:
      RolesNotChanged: "Rollen wurden nicht verändert"
@@ -356,8 +352,6 @@ Errors:
    MemberAlreadyExisting: "Member existiert bereits"
    MemberNotExisting: "Member existiert nicht"
    IDMissing: "ID fehlt"
-    IAMProjectIDMissing: "IAM Project ID fehlt"
-    IamProjectAlreadySet: "IAM Project ID wurde bereits gesetzt"
    IdpInvalid: "IDP Konfiguration ist ungültig"
    IdpNotExisting: "IDP Konfiguration existiert nicht"
    OIDCConfigInvalid: "OIDC IDP Konfiguration ist ungültig"
@@ -284,10 +284,6 @@ Errors:
      Empty: "Password Age Policy is empty"
      NotExisting: "Password Age Policy doesn't exist"
      AlreadyExists: "Password Age Policy already exists"
-    OrgIAMPolicy:
-      Empty: "Org IAM Policy is empty"
-      NotExisting: "Org IAM Policy doesn't exist"
-      AlreadyExists: "Org IAM Policy already exists"
    NotificationPolicy:
      NotFound: "Notification Policy not found"
      NotChanged: "Notification Policy not changed"
@@ -349,7 +345,7 @@ Errors:
      HasNotExistingRole: "One role doesn't exist on project"
      NotActive: "Project Grant is not active"
      NotInactive: "Project Grant is not inactive"
-  IAM:
+  Instance:
    NotFound: "Instance not found. Make sure you got the domain right. Check out https://zitadel.com/docs/apis/introduction#domains"
    Member:
      RolesNotChanged: "Roles have not been changed"
@@ -357,8 +353,6 @@ Errors:
    MemberAlreadyExisting: "Member already exists"
    MemberNotExisting: "Member does not exist"
    IDMissing: "Id missing"
-    IAMProjectIDMissing: "IAM project id missing"
-    IamProjectAlreadySet: "IAM project id has already been set"
    IdpInvalid: "IDP configuration is invalid"
    IdpNotExisting: "IDP configuration does not exist"
    OIDCConfigInvalid: "OIDC IDP configuration is invalid"
@@ -416,11 +410,11 @@ Errors:
      Empty: "Default Password Lockout Policy empty"
      NotChanged: "Default Password Lockout Policy has not been changed"
    DomainPolicy:
-      NotFound: "Org IAM Policy not found"
-      Empty: "Org IAM Policy is empty"
-      NotExisting: "Org IAM Policy not existing"
-      AlreadyExists: "Org IAM Policy already exists"
-      NotChanged: "Org IAM Policy has not been changed"
+      NotFound: "Organization Domain Policy not found"
+      Empty: "The Organization Domain Policy is empty"
+      NotExisting: "Organization Domain Policy not existing"
+      AlreadyExists: "Organization Domain Policy already exists"
+      NotChanged: "Organization Domain Policy has not been changed"
    NotificationPolicy:
      NotFound: "Default Notification Policy not found"
      NotChanged: "Default Notification Policy not changed"
@@ -283,10 +283,6 @@ Errors:
      Empty: "La política de antigüedad de la contraseña está vacía"
      NotExisting: "La política de antigüedad de la contraseña no existe"
      AlreadyExists: "La política de antigüedad de la contraseña ya existe"
-    OrgIAMPolicy:
-      Empty: "La política de IAM de la organización está vacía"
-      NotExisting: "La política de IAM de la organización no existe"
-      AlreadyExists: "La política de IAM de la organización ya existe"
    NotificationPolicy:
      NotFound: "Política de notificación no encontrada"
      NotChanged: "La política de notificación no ha cambiado"
@@ -348,7 +344,7 @@ Errors:
      HasNotExistingRole: "Un rol no existe en el proyecto"
      NotActive: "La concesión del proyecto no está activa"
      NotInactive: "La concesión del proyecto no está inactiva"
-  IAM:
+  Instance:
    NotFound: "Instancia no encontrada. Asegúrate de que tienes el dominio correcto. Consulta https://zitadel.com/docs/apis/introduction#domains"
    Member:
      RolesNotChanged: "Los roles no han cambiado"
@@ -356,8 +352,6 @@ Errors:
    MemberAlreadyExisting: "El miembro ya existe"
    MemberNotExisting: "El miembro no existe"
    IDMissing: "Falta Id"
-    IAMProjectIDMissing: "Falta id del proyecto IAM"
-    IamProjectAlreadySet: "El id del proyecto IAM ya se ha establecido"
    IdpInvalid: "La configuración IDP no es válida"
    IdpNotExisting: "La configuración IDP no existe"
    OIDCConfigInvalid: "La configuración OIDC IDP no es válida"
@@ -283,10 +283,6 @@ Errors:
      Empty: "La politique d'âge du mot de passe est vide"
      NotExisting: "La politique d'âge des mots de passe n'existe pas"
      AlreadyExists: "La politique relative à l'âge du mot de passe existe déjà"
-    OrgIAMPolicy:
-      Empty: "La politique IAM d'Org est vide"
-      NotExisting: "La politique Org IAM n'existe pas"
-      AlreadyExists: "La politique IAM d'Org existe déjà"
    NotificationPolicy:
      NotFound: "La politique notification n'a pas été trouvée"
      NotChanged: "La politique notification n'a pas été modifiée"
@@ -348,7 +344,7 @@ Errors:
      HasNotExistingRole: "Un rôle n'existe pas sur le projet"
      NotActive: "La concession du projet n'est pas active"
      NotInactive: "La concession du projet n'est pas inactive"
-  IAM:
+  Instance:
    NotFound: "IAM non trouvé. Assurez-vous que vous avez la bonne organisation. Vérifiez https://zitadel.com/docs/apis/introduction#organizations"
    Member:
      RolesNotChanged: "Les rôles n'ont pas été modifiés"
@@ -356,8 +352,6 @@ Errors:
    MemberAlreadyExisting: "Le membre existe déjà"
    MemberNotExisting: "Le membre n'existe pas"
    IDMissing: "Id manquant"
-    IAMProjectIDMissing: "Id de projet IAM manquant"
-    IamProjectAlreadySet: "L'identifiant du projet IAM a déjà été défini"
    IdpInvalid: "La configuration IDP n'est pas valide"
    IdpNotExisting: "La configuration IDP n'existe pas"
    OIDCConfigInvalid: "La configuration IDP de l'OIDC n'est pas valide"
@@ -415,11 +409,11 @@ Errors:
      Empty: "Politique de verrouillage par mot de passe par défaut vide"
      NotChanged: "La politique de verrouillage par mot de passe par défaut n'a pas été modifiée."
    DomainPolicy:
-      NotFound: "Politique IAM Org non trouvée"
-      Empty: "La politique Org IAM est vide"
-      NotExisting: "La politique IAM d'Org n'existe pas"
-      AlreadyExists: "La politique IAM d'Org existe déjà"
-      NotChanged: "La politique IAM d'Org n'a pas été modifiée"
+      NotFound: "Politique de domaine de l'organisation non trouvée"
+      Empty: "La politique de domaine de l'organisation est vide"
+      NotExisting: "La politique de domaine de l'organisation n'existe pas"
+      AlreadyExists: "La politique de domaine de l'organisation existe déjà"
+      NotChanged: "La politique de domaine de l'organisation n'a pas été modifiée"
    NotificationPolicy:
      NotFound: "La politique de notification par défaut n'a pas été trouvée"
      NotChanged: "La politique de notification par défaut n'a pas été modifiée"
@@ -283,10 +283,6 @@ Errors:
      Empty: "A jelszó korhatár szabályzat üres"
      NotExisting: "A jelszó korhatár szabályzat nem létezik"
      AlreadyExists: "A jelszó korhatár szabályzat már létezik"
-    OrgIAMPolicy:
-      Empty: "Az Org IAM Policy üres"
-      NotExisting: "Az Org IAM Policy nem létezik"
-      AlreadyExists: "Az Org IAM Policy már létezik"
    NotificationPolicy:
      NotFound: "A Notification Policy nem található"
      NotChanged: "A Notification Policy nem változott"
@@ -348,7 +344,7 @@ Errors:
      HasNotExistingRole: "Egy szerepkör nem létezik a projektben"
      NotActive: "A projekt engedélye nem aktív"
      NotInactive: "A projekt engedélye nem inaktív"
-  IAM:
+  Instance:
    NotFound: "Instance nem található. Győződj meg róla, hogy a domain helyes. Nézd meg itt: https://zitadel.com/docs/apis/introduction#domains"
    Member:
      RolesNotChanged: "A szerepkörök nem változtak"
@@ -356,8 +352,6 @@ Errors:
    MemberAlreadyExisting: "Tag már létezik"
    MemberNotExisting: "A tag nem létezik"
    IDMissing: "Az azonosító hiányzik"
-    IAMProjectIDMissing: "Az IAM projekt azonosító hiányzik"
-    IamProjectAlreadySet: "Az IAM projekt azonosító már be van állítva"
    IdpInvalid: "Az IDP konfiguráció érvénytelen"
    IdpNotExisting: "Az IDP konfiguráció nem létezik"
    OIDCConfigInvalid: "Az OIDC IDP konfiguráció érvénytelen"
@@ -283,10 +283,6 @@ Errors:
      Empty: "Kebijakan Usia Kata Sandi kosong"
      NotExisting: "Kebijakan Usia Kata Sandi tidak ada"
      AlreadyExists: "Kebijakan Usia Kata Sandi sudah ada"
-    OrgIAMPolicy:
-      Empty: "Kebijakan IAM Organisasi kosong"
-      NotExisting: "Kebijakan IAM Organisasi tidak ada"
-      AlreadyExists: "Kebijakan IAM Organisasi sudah ada"
    NotificationPolicy:
      NotFound: "Kebijakan Pemberitahuan tidak ditemukan"
      NotChanged: "Kebijakan Pemberitahuan tidak diubah"
@@ -348,16 +344,14 @@ Errors:
      HasNotExistingRole: "Satu peran tidak ada di proyek"
      NotActive: "Hibah proyek tidak aktif"
      NotInactive: "Hibah proyek bukannya tidak aktif"
-  IAM:
-    NotFound: "Contoh tidak ditemukan. "
+  Instance:
+    NotFound: "Instans tidak ditemukan. Pastikan Anda memiliki domain yang benar. Lihat https://zitadel.com/docs/apis/introduction#domains"
    Member:
      RolesNotChanged: "Peran belum diubah"
    MemberInvalid: "Anggota tidak valid"
    MemberAlreadyExisting: "Anggota sudah ada"
    MemberNotExisting: "Anggota tidak ada"
    IDMissing: "Aku hilang"
-    IAMProjectIDMissing: "ID proyek IAM tidak ada"
-    IamProjectAlreadySet: "Id proyek IAM telah ditetapkan"
    IdpInvalid: "Konfigurasi IDP tidak valid"
    IdpNotExisting: "Konfigurasi IDP tidak ada"
    OIDCConfigInvalid: "Konfigurasi IDP OIDC tidak valid"
@@ -415,11 +409,11 @@ Errors:
      Empty: "Kebijakan Penguncian Kata Sandi Default kosong"
      NotChanged: "Kebijakan Penguncian Kata Sandi Default belum diubah"
    DomainPolicy:
-      NotFound: "Kebijakan IAM Organisasi tidak ditemukan"
-      Empty: "Kebijakan IAM Organisasi kosong"
-      NotExisting: "Kebijakan IAM Organisasi tidak ada"
-      AlreadyExists: "Kebijakan IAM Organisasi sudah ada"
-      NotChanged: "Kebijakan IAM Organisasi belum diubah"
+      NotFound: "Kebijakan Domain Organisasi tidak ditemukan"
+      Empty: "Kebijakan Domain Organisasi kosong"
+      NotExisting: "Kebijakan Domain Organisasi tidak ada"
+      AlreadyExists: "Kebijakan Domain Organisasi sudah ada"
+      NotChanged: "Kebijakan Domain Organisasi belum diubah"
    NotificationPolicy:
      NotFound: "Kebijakan Pemberitahuan Default tidak ditemukan"
      NotChanged: "Kebijakan Pemberitahuan Default tidak diubah"
@@ -283,10 +283,6 @@ Errors:
      Empty: "Impostazioni di validità della password mancanti"
      NotExisting: "Impostazioni di validità della password non esistenti"
      AlreadyExists: "Impostazioni di validità della password sono già esistenti"
-    OrgIAMPolicy:
-      Empty: "Mancano le impostazioni Org IAM"
-      NotExisting: "Impostazioni Org IAM non esistenti"
-      AlreadyExists: "Impostazioni Org IAM già esistenti"
    NotificationPolicy:
      NotFound: "Impostazioni di notifica non trovate"
      NotChanged: "Impostazioni di notifica non è stato cambiato"
@@ -348,16 +344,14 @@ Errors:
      HasNotExistingRole: "Uno dei ruoli assegnati nel progetto non esiste"
      NotActive: "Il permesso di progetto non è attivo"
      NotInactive: "Il permesso di progetto non è disattivato"
-  IAM:
-    NotFound: "IAM non trovato. Assicurati di avere il dominio corretto. Guarda su https://zitadel.com/docs/apis/introduction#domains"
+  Instance:
+    NotFound: "Istanza non trovata. Assicurati di avere il dominio corretto. Guarda su https://zitadel.com/docs/apis/introduction#domains"
    Member:
      RolesNotChanged: "I ruoli non sono stati cambiati"
    MemberInvalid: "Il membro non è valido"
    MemberAlreadyExisting: "Il membro già esistente"
    MemberNotExisting: "Il membro non esistente"
    IDMissing: "ID mancante"
-    IAMProjectIDMissing: "Manca l'ID del progetto IAM"
-    IamProjectAlreadySet: "L'ID del progetto IAM è già stato impostato"
    IdpInvalid: "La configurazione dell'IDP non è valida"
    IdpNotExisting: "La configurazione IDP non esiste"
    OIDCConfigInvalid: "La configurazione OIDC IDP non è valida"
@@ -415,11 +409,11 @@ Errors:
      Empty: "Impostazioni di blocco della password predefinite sono vuote"
      NotChanged: "Le impostazioni di blocco della password predefinite non sono state cambiate"
    DomainPolicy:
-      NotFound: "Impostazioni Org IAM non trovate"
-      Empty: "Impostazioni Org IAM mancanti"
-      NotExisting: "Impostazioni Org IAM non esistenti"
-      AlreadyExists: "Impostazioni Org IAM già esistenti"
-      NotChanged: "Impostazioni Org IAM non sono state cambiate"
+      NotFound: "Impostazioni di dominio dell'organizzazione non trovate"
+      Empty: "Impostazioni di dominio dell'organizzazione mancanti"
+      NotExisting: "Impostazioni di dominio dell'organizzazione non esistenti"
+      AlreadyExists: "Le impostazioni di dominio dell'organizzazione esistono già"
+      NotChanged: "Le impostazioni di dominio dell'organizzazione non sono state cambiate"
    NotificationPolicy:
      NotFound: "Impostazioni di notifica predefinite non trovate"
      NotChanged: "Impostazioni di notifica predefinite non è stato cambiato"
@@ -284,10 +284,6 @@ Errors:
      Empty: "パスワード期限ポリシーは空です"
      NotExisting: "パスワード期限ポリシーは存在しません"
      AlreadyExists: "パスワード期限ポリシーはすでに存在しています"
-    OrgIAMPolicy:
-      Empty: "組織IAMポリシーは空です"
-      NotExisting: "組織IAMポリシーは存在しません"
-      AlreadyExists: "組織IAMポリシーはすでに存在しています"
    NotificationPolicy:
      NotFound: "通知ポリシーが見つかりません"
      NotChanged: "通知ポリシーは変更されていません"
@@ -349,16 +345,14 @@ Errors:
      HasNotExistingRole: "プロジェクトに1つのロールが存在しません"
      NotActive: "プロジェクトグラントはアクティブではありません"
      NotInactive: "プロジェクトグラントは非アクティブではありません"
-  IAM:
-    NotFound: "IAMが見つかりません。正しいドメインを持っていることを確認してください。 https://zitadel.com/docs/apis/introduction#domains を参照してください"
+  Instance:
+    NotFound: "インスタンスが見つかりません。正しいドメインを持っていることを確認してください。 https://zitadel.com/docs/apis/introduction#domains を参照してください"
    Member:
      RolesNotChanged: "ロールは変更されていません"
    MemberInvalid: "無効なメンバーです"
    MemberAlreadyExisting: "メンバーはすでに存在します"
    MemberNotExisting: "メンバーは存在しません"
    IDMissing: "IDがありません"
-    IAMProjectIDMissing: "IAMプロジェクトIDがありません"
-    IamProjectAlreadySet: "IAMプロジェクトIDはすでに設定されています"
    IdpInvalid: "無効なIDP構成です"
    IdpNotExisting: "IDP構成は存在しません"
    OIDCConfigInvalid: "無効なOIDC IDP構成です"
@@ -416,11 +410,11 @@ Errors:
      Empty: "デフォルトのパスワードロックアウトポリシーが空です"
      NotChanged: "デフォルトのパスワードロックアウトポリシーは変更されていません"
    DomainPolicy:
-      NotFound: "組織IAMポリシーは見つかりません"
-      Empty: "組織IAMポリシーは空です"
-      NotExisting: "組織IAMポリシーは存在しません"
-      AlreadyExists: "組織IAMポリシーはすでに存在しています"
-      NotChanged: "組織IAMポリシーは変更されていません"
+      NotFound: "組織ドメインポリシーは見つかりません"
+      Empty: "組織ドメインポリシーは空です"
+      NotExisting: "組織ドメインポリシーは存在しません"
+      AlreadyExists: "組織ドメインポリシーはすでに存在しています"
+      NotChanged: "組織ドメインポリシーは変更されていません"
    NotificationPolicy:
      NotFound: "デフォルトの通知ポリシーが見つかりません"
      NotChanged: "デフォルトの通知ポリシーは変更されていません"
@@ -284,10 +284,6 @@ Errors:
      Empty: "비밀번호 만료 정책이 비어 있습니다"
      NotExisting: "비밀번호 만료 정책이 존재하지 않습니다"
      AlreadyExists: "비밀번호 만료 정책이 이미 존재합니다"
-    OrgIAMPolicy:
-      Empty: "조직 IAM 정책이 비어 있습니다"
-      NotExisting: "조직 IAM 정책이 존재하지 않습니다"
-      AlreadyExists: "조직 IAM 정책이 이미 존재합니다"
    NotificationPolicy:
      NotFound: "알림 정책을 찾을 수 없습니다"
      NotChanged: "알림 정책이 변경되지 않았습니다"
@@ -349,7 +345,7 @@ Errors:
      HasNotExistingRole: "프로젝트에 존재하지 않는 역할이 있습니다"
      NotActive: "프로젝트 권한이 활성 상태가 아닙니다"
      NotInactive: "프로젝트 권한이 비활성 상태가 아닙니다"
-  IAM:
+  Instance:
    NotFound: "인스턴스를 찾을 수 없습니다. 도메인이 올바른지 확인하십시오. https://zitadel.com/docs/apis/introduction#domains 를 참조하세요"
    Member:
      RolesNotChanged: "역할이 변경되지 않았습니다"
@@ -357,8 +353,6 @@ Errors:
    MemberAlreadyExisting: "구성원이 이미 존재합니다"
    MemberNotExisting: "구성원이 존재하지 않습니다"
    IDMissing: "ID가 누락되었습니다"
-    IAMProjectIDMissing: "IAM 프로젝트 ID가 누락되었습니다"
-    IamProjectAlreadySet: "IAM 프로젝트 ID가 이미 설정되었습니다"
    IdpInvalid: "IDP 설정이 유효하지 않습니다"
    IdpNotExisting: "IDP 설정이 존재하지 않습니다"
    OIDCConfigInvalid: "OIDC IDP 설정이 유효하지 않습니다"
@@ -416,11 +410,11 @@ Errors:
      Empty: "기본 비밀번호 잠금 정책이 비어 있습니다"
      NotChanged: "기본 비밀번호 잠금 정책이 변경되지 않았습니다"
    DomainPolicy:
-      NotFound: "조직 IAM 정책을 찾을 수 없습니다"
-      Empty: "조직 IAM 정책이 비어 있습니다"
-      NotExisting: "조직 IAM 정책이 존재하지 않습니다"
-      AlreadyExists: "조직 IAM 정책이 이미 존재합니다"
-      NotChanged: "조직 IAM 정책이 변경되지 않았습니다"
+      NotFound: "조직 도메인 정책을 찾을 수 없습니다"
+      Empty: "조직 도메인 정책이 비어 있습니다"
+      NotExisting: "조직 도메인 정책이 존재하지 않습니다"
+      AlreadyExists: "조직 도메인 정책이 이미 존재합니다"
+      NotChanged: "조직 도메인 정책이 변경되지 않았습니다"
    NotificationPolicy:
      NotFound: "기본 알림 정책을 찾을 수 없습니다"
      NotChanged: "기본 알림 정책이 변경되지 않았습니다"
@@ -282,10 +282,6 @@ Errors:
      Empty: "Политиката за важност на лозинката е празна"
      NotExisting: "Политиката за важност на лозинката не постои"
      AlreadyExists: "Политиката за важност на лозинката веќе постои"
-    OrgIAMPolicy:
-      Empty: "Политиката за IAM на организацијата е празна"
-      NotExisting: "Политиката за IAM на организацијата не постои"
-      AlreadyExists: "Политиката за IAM на организацијата веќе постои"
    NotificationPolicy:
      NotFound: "Политиката за известување не е пронајдена"
      NotChanged: "Политиката за известување не е променета"
@@ -347,16 +343,14 @@ Errors:
      HasNotExistingRole: "Една улога не постои на проектот"
      NotActive: "Овластувањето за проектот не е активно"
      NotInactive: "Овластувањето за проектот не е неактивно"
-  IAM:
-    NotFound: "IAM не е пронајден. Проверете дали имате точен домен. Погледнете на https://zitadel.com/docs/apis/introduction#domains"
+  Instance:
+    NotFound: "Инстанцата не е пронајдена. Проверете дали имате точен домен. Погледнете на https://zitadel.com/docs/apis/introduction#domains"
    Member:
      RolesNotChanged: "Улогите не се променети"
    MemberInvalid: "Членот е невалиден"
    MemberAlreadyExisting: "Членот веќе постои"
    MemberNotExisting: "Членот не постои"
    IDMissing: "ID недостасува"
-    IAMProjectIDMissing: "ID на IAM проектот недостасува"
-    IamProjectAlreadySet: "ID на IAM проектот веќе е поставена"
    IdpInvalid: "IDP конфигурацијата е невалидна"
    IdpNotExisting: "IDP конфигурацијата не постои"
    OIDCConfigInvalid: "OIDC конфигурацијата е невалидна"
@@ -414,11 +408,11 @@ Errors:
      Empty: "Стандардната политика за заклучување на лозинка е празна"
      NotChanged: "Стандардната политика за заклучување на лозинка не е променета"
    DomainPolicy:
-      NotFound: "Политиката на IAM за организацијата не е пронајдена"
-      Empty: "Политиката на IAM за организацијата е празна"
-      NotExisting: "Политиката на IAM за организацијата не постои"
-      AlreadyExists: "Политиката на IAM за организацијата веќе постои"
-      NotChanged: "Политиката на IAM за организацијата не е променета"
+      NotFound: "Политиката на домените на организацијата не е пронајдена"
+      Empty: "Политиката на домените на организацијата е празна"
+      NotExisting: "Политиката на домените на организацијата не постои"
+      AlreadyExists: "Политиката на домените на организацијата веќе постои"
+      NotChanged: "Политиката на домените на организацијата не е променета"
    NotificationPolicy:
      NotFound: "Стандардната политика за известување не е пронајдена"
      NotChanged: "Стандардната политика за известување не е променета"
@@ -283,10 +283,6 @@ Errors:
      Empty: "Standaard Wachtwoord Leeftijd Beleid is leeg"
      NotExisting: "Standaard Wachtwoord Leeftijd Beleid bestaat niet"
      AlreadyExists: "Standaard Wachtwoord Leeftijd Beleid bestaat al"
-    OrgIAMPolicy:
-      Empty: "Org IAM Beleid is leeg"
-      NotExisting: "Org IAM Beleid bestaat niet"
-      AlreadyExists: "Org IAM Beleid bestaat al"
    NotificationPolicy:
      NotFound: "Standaard Notificatie Beleid niet gevonden"
      NotChanged: "Standaard Notificatie Beleid is niet veranderd"
@@ -348,16 +344,14 @@ Errors:
      HasNotExistingRole: "Een rol bestaat niet op project"
      NotActive: "Projecttoekenning is niet actief"
      NotInactive: "Projecttoekenning is niet gedeactiveerd"
-  IAM:
-    NotFound: "IAM niet gevonden. Zorg ervoor dat u het juiste domein heeft. Kijk op https://zitadel.com/docs/apis/introduction#domains"
+  Instance:
+    NotFound: "Instantie niet gevonden. Zorg ervoor dat u het juiste domein heeft. Kijk op https://zitadel.com/docs/apis/introduction#domains"
    Member:
      RolesNotChanged: "Rollen zijn niet veranderd"
    MemberInvalid: "Lid is ongeldig"
    MemberAlreadyExisting: "Lid bestaat al"
    MemberNotExisting: "Lid bestaat niet"
    IDMissing: "ID ontbreekt"
-    IAMProjectIDMissing: "IAM project id ontbreekt"
-    IamProjectAlreadySet: "IAM project id is al ingesteld"
    IdpInvalid: "IDP-configuratie is ongeldig"
    IdpNotExisting: "IDP-configuratie bestaat niet"
    OIDCConfigInvalid: "OIDC IDP-configuratie is ongeldig"
@@ -415,11 +409,11 @@ Errors:
      Empty: "Standaard Wachtwoord Lockout Beleid is leeg"
      NotChanged: "Standaard Wachtwoord Lockout Beleid is niet veranderd"
    DomainPolicy:
-      NotFound: "Org IAM Beleid niet gevonden"
-      Empty: "Org IAM Beleid is leeg"
-      NotExisting: "Org IAM Beleid bestaat niet"
-      AlreadyExists: "Org IAM Beleid bestaat al"
-      NotChanged: "Org IAM Beleid is niet veranderd"
+      NotFound: "Organisatie Domein Beleid niet gevonden"
+      Empty: "Organisatie Domein Beleid is leeg"
+      NotExisting: "Organisatie Domein Beleid bestaat niet"
+      AlreadyExists: "Organisatie Domein Beleid bestaat al"
+      NotChanged: "Organisatie Domein Beleid is niet veranderd"
    NotificationPolicy:
      NotFound: "Standaard Notificatie Beleid niet gevonden"
      NotChanged: "Standaard Notificatie Beleid is niet veranderd"
@@ -283,10 +283,6 @@ Errors:
      Empty: "Polityka wieku hasła jest pusta"
      NotExisting: "Polityka wieku hasła nie istnieje"
      AlreadyExists: "Polityka wieku hasła już istnieje"
-    OrgIAMPolicy:
-      Empty: "Polityka IAM organizacji jest pusta"
-      NotExisting: "Polityka IAM organizacji nie istnieje"
-      AlreadyExists: "Polityka IAM organizacji już istnieje"
    NotificationPolicy:
      NotFound: "Polityka powiadomień nie znaleziona"
      NotChanged: "Polityka powiadomień nie zmieniona"
@@ -348,16 +344,14 @@ Errors:
      HasNotExistingRole: "Jedna rola nie istnieje w projekcie"
      NotActive: "Grant projektu jest nieaktywny"
      NotInactive: "Grant projektu nie jest nieaktywny"
-  IAM:
-    NotFound: "IAM nie znaleziony. Upewnij się, że masz poprawną domenę. Sprawdź https://zitadel.com/docs/apis/introduction#domains"
+  Instance:
+    NotFound: "Instancja nie znaleziona. Upewnij się, że masz poprawną domenę. Sprawdź https://zitadel.com/docs/apis/introduction#domains"
    Member:
      RolesNotChanged: "Role nie zmienione"
    MemberInvalid: "Członek jest nieprawidłowy"
    MemberAlreadyExisting: "Członek już istnieje"
    MemberNotExisting: "Członek nie istnieje"
    IDMissing: "Id brakuje"
-    IAMProjectIDMissing: "Brak identyfikatora projektu IAM"
-    IamProjectAlreadySet: "Identyfikator projektu IAM został już ustawiony"
    IdpInvalid: "Konfiguracja IDP jest nieprawidłowa"
    IdpNotExisting: "Konfiguracja IDP nie istnieje"
    OIDCConfigInvalid: "Konfiguracja OIDC IDP jest nieprawidłowa"
@@ -415,11 +409,11 @@ Errors:
      Empty: "Domyślna polityka blokowania hasła jest pusta"
      NotChanged: "Domyślna polityka blokowania hasła nie została zmieniona"
    DomainPolicy:
-      NotFound: "Polityka IAM organizacji nie znaleziona"
-      Empty: "Polityka IAM organizacji jest pusta"
-      NotExisting: "Polityka IAM organizacji nie istnieje"
-      AlreadyExists: "Polityka IAM organizacji już istnieje"
-      NotChanged: "Polityka IAM organizacji nie została zmieniona"
+      NotFound: "Polityka domen organizacji nie znaleziona"
+      Empty: "Polityka domen organizacji jest pusta"
+      NotExisting: "Polityka domen organizacji nie istnieje"
+      AlreadyExists: "Polityka domen organizacji już istnieje"
+      NotChanged: "Polityka domen organizacji nie została zmieniona"
    NotificationPolicy:
      NotFound: "Domyślna polityka powiadomień nie znaleziona"
      NotChanged: "Domyślna polityka powiadomień nie zmieniona"
@@ -282,10 +282,6 @@ Errors:
      Empty: "A Política de Idade de Senha está vazia"
      NotExisting: "A Política de Idade de Senha não existe"
      AlreadyExists: "A Política de Idade de Senha já existe"
-    OrgIAMPolicy:
-      Empty: "A Política de IAM da Organização está vazia"
-      NotExisting: "A Política de IAM da Organização não existe"
-      AlreadyExists: "A Política de IAM da Organização já existe"
    NotificationPolicy:
      NotFound: "Política de Notificação não encontrada"
      NotChanged: "Política de Notificação não alterada"
@@ -347,16 +343,14 @@ Errors:
      HasNotExistingRole: "Uma função não existe no projeto"
      NotActive: "A concessão do projeto não está ativa"
      NotInactive: "A concessão do projeto não está inativa"
-  IAM:
-    NotFound: "IAM não encontrado. Verifique se você tem o domínio correto. Consulte https://zitadel.com/docs/apis/introduction#domains"
+  Instance:
+    NotFound: "Instância não encontrada. Verifique se você tem o domínio correto. Consulte https://zitadel.com/docs/apis/introduction#domains"
    Member:
      RolesNotChanged: "As funções não foram alteradas"
    MemberInvalid: "O membro é inválido"
    MemberAlreadyExisting: "O membro já existe"
    MemberNotExisting: "O membro não existe"
    IDMissing: "ID ausente"
-    IAMProjectIDMissing: "ID do projeto IAM ausente"
-    IamProjectAlreadySet: "O ID do projeto IAM já foi definido"
    IdpInvalid: "A configuração de IDP é inválida"
    IdpNotExisting: "A configuração de IDP não existe"
    OIDCConfigInvalid: "A configuração de IDP OIDC é inválida"
@@ -414,11 +408,11 @@ Errors:
      Empty: "Política de Bloqueio de Senha Padrão vazia"
      NotChanged: "Política de Bloqueio de Senha Padrão não foi alterada"
    DomainPolicy:
-      NotFound: "Política IAM da Organização não encontrada"
-      Empty: "Política IAM da Organização está vazia"
-      NotExisting: "Política IAM da Organização não existente"
-      AlreadyExists: "Política IAM da Organização já existe"
-      NotChanged: "Política IAM da Organização não foi alterada"
+      NotFound: "Política de Domínio da Organização não encontrada"
+      Empty: "Política de Domínio da Organização está vazia"
+      NotExisting: "Política de Domínio da Organização não existente"
+      AlreadyExists: "Política de Domínio da Organização já existe"
+      NotChanged: "Política de Domínio da Organização não foi alterada"
    NotificationPolicy:
      NotFound: "Política de Notificação Padrão não encontrada"
      NotChanged: "Política de Notificação Padrão não foi alterada"
@@ -284,10 +284,6 @@ Errors:
      Empty: "Politica de vârstă a parolei este goală"
      NotExisting: "Politica de vârstă a parolei nu există"
      AlreadyExists: "Politica de vârstă a parolei există deja"
-    OrgIAMPolicy:
-      Empty: "Politica IAM a organizației este goală"
-      NotExisting: "Politica IAM a organizației nu există"
-      AlreadyExists: "Politica IAM a organizației există deja"
    NotificationPolicy:
      NotFound: "Politica de notificare nu a fost găsită"
      NotChanged: "Politica de notificare nu a fost schimbată"
@@ -349,7 +345,7 @@ Errors:
      HasNotExistingRole: "Un rol nu există în proiect"
      NotActive: "Acordarea proiectului nu este activă"
      NotInactive: "Acordarea proiectului nu este inactivă"
-  IAM:
+  Instance:
    NotFound: "Instanța nu a fost găsită. Asigurați-vă că aveți domeniul corect. Consultați https://zitadel.com/docs/apis/introduction#domains"
    Member:
      RolesNotChanged: "Rolurile nu au fost schimbate"
@@ -357,8 +353,6 @@ Errors:
    MemberAlreadyExisting: "Membrul există deja"
    MemberNotExisting: "Membrul nu există"
    IDMissing: "Id lipsă"
-    IAMProjectIDMissing: "ID-ul proiectului IAM lipsește"
-    IamProjectAlreadySet: "ID-ul proiectului IAM a fost deja setat"
    IdpInvalid: "Configurația IDP este invalidă"
    IdpNotExisting: "Configurația IDP nu există"
    OIDCConfigInvalid: "Configurația OIDC IDP este invalidă"
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`Always respect the terminology defined in the 'Technical Glossary' section of agents.md when generating UI text or documentation.`