diff --git a/apps/docs/content/concepts/eventstore/implementation.mdx b/apps/docs/content/concepts/eventstore/implementation.mdx
index b09d92d44..d6a47f95e 100644
--- a/apps/docs/content/concepts/eventstore/implementation.mdx
+++ b/apps/docs/content/concepts/eventstore/implementation.mdx
@@ -27,7 +27,7 @@ An event has the following data:
 | creation_date                    | timestamp when the event was created                                                                                                                                                                                               | 2022-07-05 13:57:56.358774+00           |
 | editor_user                      | The editor user contains mostly an unique identifier of a user. And tells who did the request that led to this event. Sometimes this can also be a name of a system within ZITADEL.                                                | 165460784409638965, NOTIFICATION, LOGIN |
 | editor_service                   | The service defines which API was called when the event got created. If the event was created from the system itself this is empty.                                                                                                | Admin-API                               |
-| resource_owner                   | The resource owner defines to which organization/resource_owner the event belongs. This is an id generated by ZITADEL as sonyflake id                                                                                              | 168051083313153168                      |
+| resource_owner                   | The resource owner is either the organization or instance ID the event belongs to. This is an id generated by ZITADEL as sonyflake id                                                                                              | 168051083313153168                      |
 | instance_id                      | ZITADEL is capable of containing multiple ZITADEL instances withing the system. This id is the unique identifier of the Instance and is generated by ZITADEL as sonyflake id.                                                      | 165460784409737865                      |
 
 ## Schemas
diff --git a/backend/v3/domain/id_provider.go b/backend/v3/domain/id_provider.go
index dbcfbbc88..4998b6f44 100644
--- a/backend/v3/domain/id_provider.go
+++ b/backend/v3/domain/id_provider.go
@@ -271,7 +271,7 @@ type IDPSAML struct {
 
 // IDPIdentifierCondition is used to help specify a single identity_provider,
 // it will either be used as the  identity_provider ID or identity_provider name,
-// as identity_provider can be identified either using (instanceID + OrgID + ID) OR (instanceID + OrgID + name)
+// as identity_provider can be identified either using (instanceID + OrganizationID + ID) OR (instanceID + OrganizationID + name)
 type IDPIdentifierCondition interface {
 	database.Condition
 }
diff --git a/internal/api/grpc/system/instance.go b/internal/api/grpc/system/instance.go
index f4cabf8e5..061104aa8 100644
--- a/internal/api/grpc/system/instance.go
+++ b/internal/api/grpc/system/instance.go
@@ -103,8 +103,7 @@ func (s *Server) ListIAMMembers(ctx context.Context, req *system_pb.ListIAMMembe
 	}
 	return &system_pb.ListIAMMembersResponse{
 		Details: object.ToListDetails(res.Count, res.Sequence, res.LastRun),
-		//TODO: resource owner of user of the member instead of the membership resource owner
-		Result: member.MembersToPb("", res.Members),
+		Result:  member.MembersToPb("", res.Members),
 	}, nil
 }
 
diff --git a/internal/api/ui/login/custom_action.go b/internal/api/ui/login/custom_action.go
index fe0c440b5..99f7835fb 100644
--- a/internal/api/ui/login/custom_action.go
+++ b/internal/api/ui/login/custom_action.go
@@ -40,7 +40,7 @@ func (l *Login) runPostExternalAuthenticationActions(
 		// so let's do a workaround and resourceOwnerOfUserIDPLink if there would be a IDP link
 		resourceOwner, err = l.resourceOwnerOfUserIDPLink(ctx, authRequest.SelectedIDPConfigID, user.ExternalUserID)
 		logging.WithFields("authReq", authRequest.ID, "idpID", authRequest.SelectedIDPConfigID).OnError(err).
-			Warn("could not determine resource owner for runPostExternalAuthenticationActions, fall back to default org id")
+			Warn("could not determine Organization ID for runPostExternalAuthenticationActions, fall back to default org id")
 	}
 	// fallback to default org id
 	if resourceOwner == "" {
diff --git a/internal/command/org_custom_message_text_test.go b/internal/command/org_custom_message_text_test.go
index f102b1093..1c34b2295 100644
--- a/internal/command/org_custom_message_text_test.go
+++ b/internal/command/org_custom_message_text_test.go
@@ -33,7 +33,7 @@ func TestCommandSide_SetCustomMessageText(t *testing.T) {
 		res    res
 	}{
 		{
-			name: "no resource owner, error",
+			name: "no Organization ID, error",
 			fields: fields{
 				eventstore: eventstoreExpect(t),
 			},
@@ -383,7 +383,7 @@ func TestCommandSide_RemoveCustomMessageText(t *testing.T) {
 		res    res
 	}{
 		{
-			name: "no resource owner, error",
+			name: "no Organization ID, error",
 			fields: fields{
 				eventstore: eventstoreExpect(
 					t,
diff --git a/internal/command/project_grant_member.go b/internal/command/project_grant_member.go
index b7f2cf02f..f04f3dfaa 100644
--- a/internal/command/project_grant_member.go
+++ b/internal/command/project_grant_member.go
@@ -57,8 +57,8 @@ func (c *Commands) AddProjectGrantMember(ctx context.Context, member *AddProject
 	if err != nil {
 		return nil, err
 	}
-	// TODO: change e2e tests to use correct resourceowner, wrong resource owner is corrected through aggregate
-	// error if provided resourceowner is not equal to the resourceowner of the project grant
+	// TODO: change e2e tests to use correct organization ID, wrong organization ID is corrected through aggregate
+	// error if provided organization ID is not equal to the organization ID of the project grant
 	//if projectGrantResourceOwner != addedMember.ResourceOwner {
 	//	return nil, zerrors.ThrowPreconditionFailed(nil, "PROJECT-0l10S9OmZV", "Errors.Project.Grant.Invalid")
 	//}
diff --git a/internal/command/session.go b/internal/command/session.go
index f5ff0802f..547b5d520 100644
--- a/internal/command/session.go
+++ b/internal/command/session.go
@@ -408,14 +408,14 @@ func (c *Commands) updateSession(ctx context.Context, checks *SessionCommands, m
 }
 
 // checkSessionWritePermission will check that the caller is granted the "session.write" permission on the resource owner of the authenticated user.
-// In case the user is not set, and the userResourceOwner is not set (also the case for the session creation),
+// In case the user is not set, and the userOrganizationID is not set (also the case for the session creation),
 // it will check permission on the instance.
 func (c *Commands) checkSessionWritePermission(ctx context.Context, model *SessionWriteModel) error {
-	userResourceOwner, err := c.sessionUserResourceOwner(ctx, model)
+	userOrganizationID, err := c.sessionUserResourceOwner(ctx, model)
 	if err != nil {
 		return err
 	}
-	return c.checkPermission(ctx, domain.PermissionSessionWrite, userResourceOwner, model.UserID)
+	return c.checkPermission(ctx, domain.PermissionSessionWrite, userOrganizationID, model.UserID)
 }
 
 // checkSessionTerminationPermission will check that the provided sessionToken is correct or
diff --git a/internal/command/user_grant_test.go b/internal/command/user_grant_test.go
index 6299b04ed..3662a6ea5 100644
--- a/internal/command/user_grant_test.go
+++ b/internal/command/user_grant_test.go
@@ -663,7 +663,7 @@ func TestCommandSide_AddUserGrant(t *testing.T) {
 			},
 		},
 		{
-			name: "usergrant without resource owner on project, ok",
+			name: "usergrant without Organization ID on project, ok",
 			fields: fields{
 				eventstore: expectEventstore(
 					expectFilter(
@@ -816,7 +816,7 @@ func TestCommandSide_AddUserGrant(t *testing.T) {
 			},
 		},
 		{
-			name: "usergrant for granted resource owner, ok",
+			name: "usergrant for granted Organization ID, ok",
 			fields: fields{
 				eventstore: expectEventstore(
 					expectFilter(
@@ -1717,7 +1717,7 @@ func TestCommandSide_ChangeUserGrant(t *testing.T) {
 			},
 		},
 		{
-			name: "usergrant for projectgrant same resource owner, ok",
+			name: "usergrant for projectgrant same Organization ID, ok",
 			fields: fields{
 				eventstore: expectEventstore(
 					expectFilter(
@@ -1813,7 +1813,7 @@ func TestCommandSide_ChangeUserGrant(t *testing.T) {
 			},
 		},
 		{
-			name: "usergrant for project without resource owner, ok",
+			name: "usergrant for project without Organization ID, ok",
 			fields: fields{
 				eventstore: expectEventstore(
 					expectFilter(
diff --git a/internal/query/permission_example_test.go b/internal/query/permission_example_test.go
index 6211ad0bb..ce4d92e02 100644
--- a/internal/query/permission_example_test.go
+++ b/internal/query/permission_example_test.go
@@ -11,7 +11,7 @@ import (
 )
 
 // ExamplePermissionClause_org shows how to use the PermissionClause function to filter
-// permitted records based on the resource owner and the user's instance or organization membership.
+// permitted records based on the Organization ID and the user's instance or organization membership.
 func ExamplePermissionClause_org() {
 	// These variables are typically set in the middleware of Zitadel.
 	// They do not influence the generation of the clause, just what
@@ -23,7 +23,7 @@ func ExamplePermissionClause_org() {
 
 	join, args := PermissionClause(
 		ctx,
-		UserResourceOwnerCol, // match the resource owner column
+		UserResourceOwnerCol, // match the Organization ID column
 		domain.PermissionUserRead,
 		SingleOrgPermissionOption([]SearchQuery{
 			mustSearchQuery(NewUserDisplayNameSearchQuery("zitadel", TextContains)),
@@ -44,7 +44,7 @@ func ExamplePermissionClause_org() {
 }
 
 // ExamplePermissionClause_project shows how to use the PermissionClause function to filter
-// permitted records based on the resource owner and the user's instance or organization membership.
+// permitted records based on the Organization ID and the user's instance or organization membership.
 // Additionally, it allows returning records based on the project ID and project membership.
 func ExamplePermissionClause_project() {
 	// These variables are typically set in the middleware of Zitadel.
@@ -57,7 +57,7 @@ func ExamplePermissionClause_project() {
 
 	join, args := PermissionClause(
 		ctx,
-		ProjectColumnResourceOwner, // match the resource owner column
+		ProjectColumnResourceOwner, // match the Organization ID column
 		"project.read",
 		WithProjectsPermissionOption(ProjectColumnID),
 		SingleOrgPermissionOption([]SearchQuery{
diff --git a/internal/query/project_grant_test.go b/internal/query/project_grant_test.go
index 2801e0b23..e4cfdbf9b 100644
--- a/internal/query/project_grant_test.go
+++ b/internal/query/project_grant_test.go
@@ -243,7 +243,7 @@ func Test_ProjectGrantPrepares(t *testing.T) {
 			},
 		},
 		{
-			name:    "prepareProjectGrantsQuery no resource owner",
+			name:    "prepareProjectGrantsQuery no Organization ID",
 			prepare: prepareProjectGrantsQuery,
 			want: want{
 				sqlExpectations: mockQueries(
@@ -476,7 +476,7 @@ func Test_ProjectGrantPrepares(t *testing.T) {
 			},
 		},
 		{
-			name:    "prepareProjectGrantQuery no resource owner",
+			name:    "prepareProjectGrantQuery no Organization ID",
 			prepare: prepareProjectGrantQuery,
 			want: want{
 				sqlExpectations: mockQuery(
diff --git a/internal/query/user_grant_test.go b/internal/query/user_grant_test.go
index ddd39d1c4..102d32000 100644
--- a/internal/query/user_grant_test.go
+++ b/internal/query/user_grant_test.go
@@ -67,7 +67,7 @@ var (
 		"user_id",
 		"username",
 		"type",
-		"resource_owner", //user resource owner
+		"resource_owner", // user Organization ID
 		"name",
 		"primary_domain",
 		"first_name",
@@ -76,12 +76,12 @@ var (
 		"display_name",
 		"avatar_key",
 		"login_name",
-		"resource_owner", //user_grant resource owner
-		"name",           //org name
+		"resource_owner", // user_grant Organization ID
+		"name",           // org name
 		"primary_domain",
 		"project_id",
 		"name",           // project name
-		"resource_owner", // project_grant resource owner
+		"resource_owner", // project_grant Organization ID
 		"id",             // granted org id
 		"name",           // granted org name
 		"primary_domain", // granted org domain
diff --git a/proto/zitadel/org/v2beta/org_service.proto b/proto/zitadel/org/v2beta/org_service.proto
index 51a72382f..bc060cd43 100644
--- a/proto/zitadel/org/v2beta/org_service.proto
+++ b/proto/zitadel/org/v2beta/org_service.proto
@@ -629,7 +629,7 @@ message CreateOrganizationResponse{
 }
 
 message UpdateOrganizationRequest {
-  // Organization Id for the Organization to be updated
+  // Organization ID for the Organization to be updated
   string id = 1 [
     (validate.rules).string = {min_len: 1, max_len: 200},
     (google.api.field_behavior) = REQUIRED,
@@ -680,7 +680,7 @@ message ListOrganizationsResponse {
 
 message DeleteOrganizationRequest {
 
-  // Organization Id for the Organization to be deleted
+  // Organization ID for the Organization to be deleted
   string id = 1 [
     (validate.rules).string = {min_len: 1, max_len: 200},
     (google.api.field_behavior) = REQUIRED,
@@ -702,7 +702,7 @@ message DeleteOrganizationResponse {
 }
 
 message DeactivateOrganizationRequest {
-  // Organization Id for the Organization to be deactivated
+  // Organization ID for the Organization to be deactivated
   string id = 1 [
     (validate.rules).string = {min_len: 1, max_len: 200},
     (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
@@ -723,7 +723,7 @@ message DeactivateOrganizationResponse {
 }
 
 message ActivateOrganizationRequest {
-  // Organization Id for the Organization to be activated
+  // Organization ID for the Organization to be activated
   string id = 1 [
     (validate.rules).string = {min_len: 1, max_len: 200},
     (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
@@ -744,7 +744,7 @@ message ActivateOrganizationResponse {
 }
 
 message AddOrganizationDomainRequest {
-  // Organization Id for the Organization for which the domain is to be added to.
+  // Organization ID for the Organization for which the domain is to be added to.
   string organization_id = 1 [
     (validate.rules).string = {min_len: 1, max_len: 200},
     (google.api.field_behavior) = REQUIRED,
@@ -776,7 +776,7 @@ message AddOrganizationDomainResponse {
 }
 
 message ListOrganizationDomainsRequest {
-  // Organization Id for the Organization which domains are to be listed.
+  // Organization ID for the Organization which domains are to be listed.
   string organization_id = 1 [
     (validate.rules).string = {min_len: 1, max_len: 200},
     (google.api.field_behavior) = REQUIRED,
@@ -801,7 +801,7 @@ message ListOrganizationDomainsResponse {
 }
 
 message DeleteOrganizationDomainRequest {
-  // Organization Id for the Organization which domain is to be deleted.
+  // Organization ID for the Organization which domain is to be deleted.
   string organization_id = 1 [
     (validate.rules).string = {min_len: 1, max_len: 200},
     (google.api.field_behavior) = REQUIRED,
@@ -832,7 +832,7 @@ message DeleteOrganizationDomainResponse {
 }
 
 message GenerateOrganizationDomainValidationRequest {
-  // Organization Id for the Organization which doman to be validated.
+  // Organization ID for the Organization which domain to be validated.
   string organization_id = 1 [
 
     (validate.rules).string = {min_len: 1, max_len: 200},
@@ -872,7 +872,7 @@ message GenerateOrganizationDomainValidationResponse {
 }
 
 message VerifyOrganizationDomainRequest {
-  // Organization Id for the Organization doman to be verified.
+  // Organization ID for the Organization domain to be verified.
   string organization_id = 1 [
     (validate.rules).string = {min_len: 1, max_len: 200},
     (google.api.field_behavior) = REQUIRED,
@@ -882,7 +882,7 @@ message VerifyOrganizationDomainRequest {
       example: "\"69629012906488334\"";
     }
   ];
-  // Organization Id for the Organization doman to be verified.
+  // The domain to be verified.
   string domain = 2 [
     (validate.rules).string = {min_len: 1, max_len: 200},
     (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {
@@ -909,7 +909,6 @@ message Metadata {
   bytes value = 2 [(validate.rules).bytes = {min_len: 1, max_len: 500000}];
 }
 message SetOrganizationMetadataRequest{
-  // Organization Id for the Organization doman to be verified.
   string organization_id = 1 [
     (validate.rules).string = {min_len: 1, max_len: 200},
     (google.api.field_behavior) = REQUIRED,