diff --git a/internal/api/grpc/management/project.go b/internal/api/grpc/management/project.go
index be196d14c..9a7cb13bd 100644
--- a/internal/api/grpc/management/project.go
+++ b/internal/api/grpc/management/project.go
@@ -11,6 +11,7 @@ import (
 	"github.com/zitadel/zitadel/internal/eventstore"
 	"github.com/zitadel/zitadel/internal/query"
 	"github.com/zitadel/zitadel/internal/repository/project"
+	"github.com/zitadel/zitadel/internal/zerrors"
 	mgmt_pb "github.com/zitadel/zitadel/pkg/grpc/management"
 )
 
@@ -19,6 +20,9 @@ func (s *Server) GetProjectByID(ctx context.Context, req *mgmt_pb.GetProjectByID
 	if err != nil {
 		return nil, err
 	}
+	if project.ResourceOwner != authz.GetCtxData(ctx).OrgID {
+		return nil, zerrors.ThrowNotFound(nil, "MANAG-SFf2a", "Errors.Project.NotFound")
+	}
 	return &mgmt_pb.GetProjectByIDResponse{
 		Project: project_grpc.ProjectViewToPb(project),
 	}, nil
@@ -29,6 +33,9 @@ func (s *Server) GetGrantedProjectByID(ctx context.Context, req *mgmt_pb.GetGran
 	if err != nil {
 		return nil, err
 	}
+	if !(grant.ResourceOwner == authz.GetCtxData(ctx).OrgID || grant.GrantedOrgID == authz.GetCtxData(ctx).OrgID) {
+		return nil, zerrors.ThrowNotFound(nil, "MANAG-drt2a", "Errors.ProjectGrant.NotFound")
+	}
 	return &mgmt_pb.GetGrantedProjectByIDResponse{
 		GrantedProject: project_grpc.GrantedProjectViewToPb(grant),
 	}, nil
diff --git a/internal/api/grpc/management/project_application.go b/internal/api/grpc/management/project_application.go
index a5526d3cb..50129f225 100644
--- a/internal/api/grpc/management/project_application.go
+++ b/internal/api/grpc/management/project_application.go
@@ -11,6 +11,7 @@ import (
 	"github.com/zitadel/zitadel/internal/eventstore"
 	"github.com/zitadel/zitadel/internal/query"
 	"github.com/zitadel/zitadel/internal/repository/project"
+	"github.com/zitadel/zitadel/internal/zerrors"
 	mgmt_pb "github.com/zitadel/zitadel/pkg/grpc/management"
 )
 
@@ -19,13 +20,16 @@ func (s *Server) GetAppByID(ctx context.Context, req *mgmt_pb.GetAppByIDRequest)
 	if err != nil {
 		return nil, err
 	}
+	if app.ResourceOwner != authz.GetCtxData(ctx).OrgID {
+		return nil, zerrors.ThrowNotFound(nil, "MANAG-SFf2a", "Errors.Project.App.NotFound")
+	}
 	return &mgmt_pb.GetAppByIDResponse{
 		App: project_grpc.AppToPb(app),
 	}, nil
 }
 
 func (s *Server) ListApps(ctx context.Context, req *mgmt_pb.ListAppsRequest) (*mgmt_pb.ListAppsResponse, error) {
-	queries, err := ListAppsRequestToModel(req)
+	queries, err := ListAppsRequestToModel(ctx, req)
 	if err != nil {
 		return nil, err
 	}
diff --git a/internal/api/grpc/management/project_application_converter.go b/internal/api/grpc/management/project_application_converter.go
index fa3156544..5021870b3 100644
--- a/internal/api/grpc/management/project_application_converter.go
+++ b/internal/api/grpc/management/project_application_converter.go
@@ -16,7 +16,7 @@ import (
 	mgmt_pb "github.com/zitadel/zitadel/pkg/grpc/management"
 )
 
-func ListAppsRequestToModel(req *mgmt_pb.ListAppsRequest) (*query.AppSearchQueries, error) {
+func ListAppsRequestToModel(ctx context.Context, req *mgmt_pb.ListAppsRequest) (*query.AppSearchQueries, error) {
 	offset, limit, asc := object.ListQueryToModel(req.Query)
 	queries, err := app_grpc.AppQueriesToModel(req.Queries)
 	if err != nil {
@@ -26,7 +26,11 @@ func ListAppsRequestToModel(req *mgmt_pb.ListAppsRequest) (*query.AppSearchQueri
 	if err != nil {
 		return nil, err
 	}
-	queries = append(queries, projectQuery)
+	resourceOwner, err := query.NewAppResourceOwnerSearchQuery(authz.GetCtxData(ctx).OrgID)
+	if err != nil {
+		return nil, err
+	}
+	queries = append(queries, projectQuery, resourceOwner)
 	return &query.AppSearchQueries{
 		SearchRequest: query.SearchRequest{
 			Offset: offset,
diff --git a/internal/api/grpc/management/project_grant.go b/internal/api/grpc/management/project_grant.go
index 615991fc8..8adf7796e 100644
--- a/internal/api/grpc/management/project_grant.go
+++ b/internal/api/grpc/management/project_grant.go
@@ -9,6 +9,7 @@ import (
 	object_grpc "github.com/zitadel/zitadel/internal/api/grpc/object"
 	proj_grpc "github.com/zitadel/zitadel/internal/api/grpc/project"
 	"github.com/zitadel/zitadel/internal/query"
+	"github.com/zitadel/zitadel/internal/zerrors"
 	mgmt_pb "github.com/zitadel/zitadel/pkg/grpc/management"
 )
 
@@ -17,6 +18,9 @@ func (s *Server) GetProjectGrantByID(ctx context.Context, req *mgmt_pb.GetProjec
 	if err != nil {
 		return nil, err
 	}
+	if !(grant.ResourceOwner == authz.GetCtxData(ctx).OrgID || grant.GrantedOrgID == authz.GetCtxData(ctx).OrgID) {
+		return nil, zerrors.ThrowNotFound(nil, "MANAG-d3g31", "Errors.ProjectGrant.NotFound")
+	}
 	return &mgmt_pb.GetProjectGrantByIDResponse{
 		ProjectGrant: proj_grpc.GrantedProjectViewToPb(grant),
 	}, nil
diff --git a/internal/api/grpc/management/user.go b/internal/api/grpc/management/user.go
index 79df85bff..4e525ffc1 100644
--- a/internal/api/grpc/management/user.go
+++ b/internal/api/grpc/management/user.go
@@ -613,6 +613,10 @@ func (s *Server) ListHumanAuthFactors(ctx context.Context, req *mgmt_pb.ListHuma
 	if err != nil {
 		return nil, err
 	}
+	err = query.AppendResourceOwnerQuery(authz.GetCtxData(ctx).OrgID)
+	if err != nil {
+		return nil, err
+	}
 	authMethods, err := s.query.SearchUserAuthMethods(ctx, query, nil)
 	if err != nil {
 		return nil, err
@@ -676,6 +680,10 @@ func (s *Server) ListHumanPasswordless(ctx context.Context, req *mgmt_pb.ListHum
 	if err != nil {
 		return nil, err
 	}
+	err = query.AppendResourceOwnerQuery(authz.GetCtxData(ctx).OrgID)
+	if err != nil {
+		return nil, err
+	}
 	authMethods, err := s.query.SearchUserAuthMethods(ctx, query, nil)
 	if err != nil {
 		return nil, err
diff --git a/internal/query/app.go b/internal/query/app.go
index 99c68b929..d07a7aa1a 100644
--- a/internal/query/app.go
+++ b/internal/query/app.go
@@ -682,6 +682,10 @@ func NewAppClientIDSearchQuery(clientID string) (SearchQuery, error) {
 	return NewOrQuery(oidcClientIDQuery, apiClientIDQuery)
 }
 
+func NewAppResourceOwnerSearchQuery(resourceOwner string) (SearchQuery, error) {
+	return NewTextQuery(AppColumnResourceOwner, resourceOwner, TextEquals)
+}
+
 func NewAppSAMLEntityIDSearchQuery(entityID string) (SearchQuery, error) {
 	return NewTextQuery(AppSAMLConfigColumnEntityID, entityID, TextEquals)
 }