diff --git a/README.md b/README.md
index 4d03a6d3..9cca4fc4 100644
--- a/README.md
+++ b/README.md
@@ -77,17 +77,17 @@ If you have at least Docker and the Java JDK installed in appropriate versions a
 
     # the following command should return a JSON array with just all customers:
     curl \
-        -H 'current-user: superuser-alex@hostsharing.net' \
+        -H 'current-subject: superuser-alex@hostsharing.net' \
         http://localhost:8080/api/test/customers
 
     # the following command should return a JSON array with just all packages visible for the admin of the customer yyy:
     curl \
-        -H 'current-user: superuser-alex@hostsharing.net' -H 'assumed-roles: test_customer#yyy:ADMIN' \
+        -H 'current-subject: superuser-alex@hostsharing.net' -H 'assumed-roles: test_customer#yyy:ADMIN' \
         http://localhost:8080/api/test/packages
 
     # add a new customer
     curl \
-        -H 'current-user: superuser-alex@hostsharing.net' -H "Content-Type: application/json" \
+        -H 'current-subject: superuser-alex@hostsharing.net' -H "Content-Type: application/json" \
         -d '{ "prefix":"ttt", "reference":80001, "adminUserName":"admin@ttt.example.com" }' \
         -X POST http://localhost:8080/api/test/customers
 
diff --git a/doc/adr/2022-07-18.row-level-security-mechanism.md b/doc/adr/2022-07-18.row-level-security-mechanism.md
index 6276bd4d..e59c7f8a 100644
--- a/doc/adr/2022-07-18.row-level-security-mechanism.md
+++ b/doc/adr/2022-07-18.row-level-security-mechanism.md
@@ -14,9 +14,9 @@ The core problem here is, that in our RBAC system, determining the permissions o
 
 ### Technical Background
 
-The session variable `hsadminng.currentUser` contains the accessing (domain-level) user, which is unrelated to the PostgreSQL user).
+The session variable `hsadminng.currentSubject` contains the accessing (domain-level) user, which is unrelated to the PostgreSQL user).
 
-Given is a stored function `isPermissionGrantedToSubject` which detects if the accessing user has a given permission (e.g. 'view').
+Given is a stored function `isPermissionGrantedToSubject` which detects if the accessing subject has a given permission (e.g. 'view').
 
 Given is also a stored function `queryAllPermissionsOfSubjectId` which returns the flattened view to all permissions assigned to the given accessing user.
 
@@ -38,7 +38,7 @@ In this solution, the database ignores row level visibility and returns all rows
 
 Very flexible access, programmatic, rules could be implemented.
 
-The role-hierarchy and permissions for currently logged-in users user could be cached in the backend.
+The role-hierarchy and permissions for currently logged-in sujects could be cached in the backend.
 
 The access logic can be tested in pure Java unit tests.
 
@@ -74,11 +74,11 @@ For restricted DB-users, which are used by the backend, access to rows is filter
         FOR SELECT
         TO restricted
         USING (
-            isPermissionGrantedToSubject(findEffectivePermissionId('customer', id, 'view'), currentUserUuid())
+            isPermissionGrantedToSubject(findEffectivePermissionId('customer', id, 'view'), currentSubjectUuid())
         );
     
     SET SESSION AUTHORIZATION restricted;
-    SET hsadminng.currentUser TO 'alex@example.com';
+    SET hsadminng.currentSubject TO 'alex@example.com';
     SELECT * from customer; -- will only return visible rows
 
 #### Advantages
@@ -101,10 +101,10 @@ We are bound to PostgreSQL, including integration tests and testing the RBAC sys
     CREATE OR REPLACE RULE "_RETURN" AS
         ON SELECT TO cust_view
         DO INSTEAD
-            SELECT * FROM customer WHERE isPermissionGrantedToSubject(findEffectivePermissionId('customer', id, 'view'), currentUserUuid());
+            SELECT * FROM customer WHERE isPermissionGrantedToSubject(findEffectivePermissionId('customer', id, 'view'), currentSubjectUuid());
 
     SET SESSION AUTHORIZATION restricted;
-    SET hsadminng.currentUser TO 'alex@example.com';
+    SET hsadminng.currentSubject TO 'alex@example.com';
     SELECT * from customer; -- will only return visible rows
 
 #### Advantages
@@ -130,12 +130,12 @@ We do not access the tables directly from the backend, but via views which join
     CREATE OR REPLACE VIEW cust_view AS
         SELECT c.id, c.reference, c.prefix
           FROM customer AS c
-          JOIN queryAllPermissionsOfSubjectId(currentUserUuid()) AS p
+          JOIN queryAllPermissionsOfSubjectId(currentSubjectUuid()) AS p
                ON p.tableName='customer' AND p.rowId=c.id AND p.op='view';
     GRANT ALL PRIVILEGES ON cust_view TO restricted;
     
     SET SESSION SESSION AUTHORIZATION restricted;
-    SET hsadminng.currentUser TO 'alex@example.com';
+    SET hsadminng.currentSubject TO 'alex@example.com';
     SELECT * from cust_view; -- will only return visible rows
 
 Alternatively the JOIN could also be applied in a "ON SELECT DO INSTEAD"-RULE, if there is any advantage for later features.
diff --git a/doc/rbac-performance-analysis.md b/doc/rbac-performance-analysis.md
index fa80dde4..10ec6593 100644
--- a/doc/rbac-performance-analysis.md
+++ b/doc/rbac-performance-analysis.md
@@ -392,9 +392,9 @@ We found some solution approaches:
 
 3. Inverting the recursion of the CTE-query, combined with the type condition.
     
-    Instead of starting the recursion with `currentsubjectsuuids()`, 
+    Instead of starting the recursion with `currentSubjectOrAssumedRolesUuids()`, 
     we could start it with the target table name and row-type,
-    then recurse down to the `currentsubjectsuuids()`.
+    then recurse down to the `currentSubjectOrAssumedRolesUuids()`.
 
     In the end, we need the object UUIDs, though. 
     But if we start with the join of `rbacObject` with `rbacPermission`, 
diff --git a/doc/rbac.md b/doc/rbac.md
index 662bed29..e7cb12d3 100644
--- a/doc/rbac.md
+++ b/doc/rbac.md
@@ -364,10 +364,10 @@ This way, each user can only select the data they have 'SELECT'-permission for,
 
 ### Current User
 
-The current use is taken from the session variable `hsadminng.currentUser` which contains the name of the user as stored in the 
+The current use is taken from the session variable `hsadminng.currentSubject` which contains the name of the user as stored in the 
 *RbacUser*s table. Example:
 
-    SET LOCAL hsadminng.currentUser = 'mike@hostsharing.net';
+    SET LOCAL hsadminng.currentSubject = 'mike@hostsharing.net';
 
 That user is also used for historicization and audit log, but which is a different topic.
 
@@ -388,7 +388,7 @@ A full example is shown here:
 
     BEGIN TRANSACTION;
         SET SESSION SESSION AUTHORIZATION restricted;
-        SET LOCAL hsadminng.currentUser = 'mike@hostsharing.net';
+        SET LOCAL hsadminng.currentSubject = 'mike@hostsharing.net';
         SET LOCAL hsadminng.assumedRoles = 'customer#aab:admin;customer#aac:admin';
         
         SELECT c.prefix, p.name as "package", ema.localPart || '@' || dom.name as "email-address"
@@ -624,7 +624,7 @@ Let's have a look at the two view queries:
          WHERE target.uuid IN (
             SELECT uuid
               FROM queryAccessibleObjectUuidsOfSubjectIds( 
-                'SELECT, 'customer', currentSubjectsUuids()));
+                'SELECT, 'customer', currentSubjectOrAssumedRolesUuids()));
 
 This view should be automatically updatable.
 Where, for updates, we actually have to check for 'UPDATE' instead of 'SELECT' operation, which makes it a bit more complicated.
@@ -642,7 +642,7 @@ Looks like the query optimizer needed some statistics to find the best path.
         SELECT DISTINCT target.*
           FROM customer AS target
           JOIN queryAccessibleObjectUuidsOfSubjectIds( 
-                'SELECT, 'customer', currentSubjectsUuids()) AS allowedObjId
+                'SELECT, 'customer', currentSubjectOrAssumedRolesUuids()) AS allowedObjId
             ON target.uuid = allowedObjId;
 
 This view cannot is not updatable automatically,
diff --git a/sql/historization.sql b/sql/historization.sql
index a240b30b..89dfbe62 100644
--- a/sql/historization.sql
+++ b/sql/historization.sql
@@ -28,7 +28,7 @@ commit;
 set hsadminng.tx_history_txid to '';
 set hsadminng.tx_history_timestamp to '2024-08-29 12:42';
 -- all versions
-select tx_history_txid(), txc.txtimestamp, txc.currentUser, txc.currentTask, haex.*
+select tx_history_txid(), txc.txtimestamp, txc.currentSubject, txc.currentTask, haex.*
     from hs_hosting_asset_ex haex
              join basis.tx_context txc on haex.txid=txc.txid
     where haex.identifier = 'test@thi.example.org';
diff --git a/sql/rbac-view-option-experiments.sql b/sql/rbac-view-option-experiments.sql
index c5c04487..d058ac49 100644
--- a/sql/rbac-view-option-experiments.sql
+++ b/sql/rbac-view-option-experiments.sql
@@ -20,11 +20,11 @@ CREATE POLICY customer_policy ON customer
     TO restricted
     USING (
         -- id=1000
-        isPermissionGrantedToSubject(findEffectivePermissionId('test_customer', id, 'SELECT'), currentUserUuid())
+        isPermissionGrantedToSubject(findEffectivePermissionId('test_customer', id, 'SELECT'), rbac.currentSubjectUuid())
     );
 
 SET SESSION AUTHORIZATION restricted;
-SET hsadminng.currentUser TO 'alex@example.com';
+SET hsadminng.currentSubject TO 'alex@example.com';
 SELECT * from customer;
 
 -- access control via view-rule and isPermissionGrantedToSubject - way too slow (35 s 580 ms for 1 million rows)
@@ -35,7 +35,7 @@ SELECT * FROM customer;
 CREATE OR REPLACE RULE "_RETURN" AS
     ON SELECT TO cust_view
     DO INSTEAD
-    SELECT * FROM customer WHERE isPermissionGrantedToSubject(findEffectivePermissionId('test_customer', id, 'SELECT'), currentUserUuid());
+    SELECT * FROM customer WHERE isPermissionGrantedToSubject(findEffectivePermissionId('test_customer', id, 'SELECT'), rbac.currentSubjectUuid());
 SELECT * from cust_view LIMIT 10;
 
 select queryAllPermissionsOfSubjectId(findRbacUser('superuser-alex@hostsharing.net'));
@@ -51,12 +51,12 @@ CREATE OR REPLACE RULE "_RETURN" AS
     ON SELECT TO cust_view
     DO INSTEAD
     SELECT c.uuid, c.reference, c.prefix FROM customer AS c
-      JOIN queryAllPermissionsOfSubjectId(currentUserUuid()) AS p
+      JOIN queryAllPermissionsOfSubjectId(rbac.currentSubjectUuid()) AS p
            ON p.objectTable='test_customer' AND p.objectUuid=c.uuid;
 GRANT ALL PRIVILEGES ON cust_view TO restricted;
 
 SET SESSION SESSION AUTHORIZATION restricted;
-SET hsadminng.currentUser TO 'alex@example.com';
+SET hsadminng.currentSubject TO 'alex@example.com';
 SELECT * from cust_view;
 
 
@@ -67,14 +67,14 @@ DROP VIEW IF EXISTS cust_view;
 CREATE OR REPLACE VIEW cust_view AS
     SELECT c.uuid, c.reference, c.prefix
       FROM customer AS c
-      JOIN queryAllPermissionsOfSubjectId(currentUserUuid()) AS p
+      JOIN queryAllPermissionsOfSubjectId(rbac.currentSubjectUuid()) AS p
            ON p.objectUuid=c.uuid;
 GRANT ALL PRIVILEGES ON cust_view TO restricted;
 
 SET SESSION SESSION AUTHORIZATION restricted;
--- SET hsadminng.currentUser TO 'alex@example.com';
-SET hsadminng.currentUser TO 'superuser-alex@hostsharing.net';
--- SET hsadminng.currentUser TO 'aaaaouq@example.com';
+-- SET hsadminng.currentSubject TO 'alex@example.com';
+SET hsadminng.currentSubject TO 'superuser-alex@hostsharing.net';
+-- SET hsadminng.currentSubject TO 'aaaaouq@example.com';
 SELECT * from cust_view where reference=1144150;
 
 select rr.uuid, rr.type from RbacGrants g
diff --git a/sql/recursive-cte-experiments-for-accessible-uuids.sql b/sql/recursive-cte-experiments-for-accessible-uuids.sql
index 5e9a7be5..669a6f24 100644
--- a/sql/recursive-cte-experiments-for-accessible-uuids.sql
+++ b/sql/recursive-cte-experiments-for-accessible-uuids.sql
@@ -17,7 +17,7 @@ with recursive
                         1 as level,
                         true
             from rbacgrants
-            where (rbacgrants.ascendantuuid = any (currentsubjectsuuids()))
+            where (rbacgrants.ascendantuuid = any (rbac.currentSubjectOrAssumedRolesUuids()))
               and rbacgrants.assumed
         union all
         select distinct g.descendantuuid,
diff --git a/src/main/java/net/hostsharing/hsadminng/context/Context.java b/src/main/java/net/hostsharing/hsadminng/context/Context.java
index 9c3b6a3f..cf2cf4c4 100644
--- a/src/main/java/net/hostsharing/hsadminng/context/Context.java
+++ b/src/main/java/net/hostsharing/hsadminng/context/Context.java
@@ -38,53 +38,53 @@ public class Context {
     private HttpServletRequest request;
 
     @Transactional(propagation = MANDATORY)
-    public void define(final String currentUser) {
-        define(currentUser, null);
+    public void define(final String currentSubject) {
+        define(currentSubject, null);
     }
 
     @Transactional(propagation = MANDATORY)
-    public void define(final String currentUser, final String assumedRoles) {
-        define(toTask(request), toCurl(request), currentUser, assumedRoles);
+    public void define(final String currentSubject, final String assumedRoles) {
+        define(toTask(request), toCurl(request), currentSubject, assumedRoles);
     }
 
     @Transactional(propagation = MANDATORY)
     public void define(
             final String currentTask,
             final String currentRequest,
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles) {
         final var query = em.createNativeQuery("""
                 call basis.defineContext(
                     cast(:currentTask as varchar(127)),
                     cast(:currentRequest as text),
-                    cast(:currentUser as varchar(63)),
+                    cast(:currentSubject as varchar(63)),
                     cast(:assumedRoles as varchar(1023)));
                 """);
         query.setParameter("currentTask", shortenToMaxLength(currentTask, 127));
         query.setParameter("currentRequest", currentRequest);
-        query.setParameter("currentUser", currentUser);
+        query.setParameter("currentSubject", currentSubject);
         query.setParameter("assumedRoles", assumedRoles != null ? assumedRoles : "");
         query.executeUpdate();
     }
 
-    public String getCurrentTask() {
+    public String fetchCurrentTask() {
         return (String) em.createNativeQuery("select current_setting('hsadminng.currentTask');").getSingleResult();
     }
 
-    public String getCurrentUser() {
-        return String.valueOf(em.createNativeQuery("select currentUser()").getSingleResult());
+    public String fetchCurrentSubject() {
+        return String.valueOf(em.createNativeQuery("select basis.currentSubject()").getSingleResult());
     }
 
-    public UUID getCurrentUserUUid() {
-        return (UUID) em.createNativeQuery("select currentUserUUid()", UUID.class).getSingleResult();
+    public UUID fetchCurrentSubjectUuid() {
+        return (UUID) em.createNativeQuery("select rbac.currentSubjectUuid()", UUID.class).getSingleResult();
     }
 
-    public String[] getAssumedRoles() {
-        return (String[]) em.createNativeQuery("select assumedRoles() as roles", String[].class).getSingleResult();
+    public String[] fetchAssumedRoles() {
+        return (String[]) em.createNativeQuery("select basis.assumedRoles() as roles", String[].class).getSingleResult();
     }
 
-    public UUID[] currentSubjectsUuids() {
-        return (UUID[]) em.createNativeQuery("select currentSubjectsUuids() as uuids", UUID[].class).getSingleResult();
+    public UUID[] fetchCurrentSubjectOrAssumedRolesUuids() {
+        return (UUID[]) em.createNativeQuery("select rbac.currentSubjectOrAssumedRolesUuids() as uuids", UUID[].class).getSingleResult();
     }
 
     public static String getCallerMethodNameFromStackFrame(final int skipFrames) {
diff --git a/src/main/java/net/hostsharing/hsadminng/hs/booking/item/HsBookingItemController.java b/src/main/java/net/hostsharing/hsadminng/hs/booking/item/HsBookingItemController.java
index 01d2e6a5..6afd5219 100644
--- a/src/main/java/net/hostsharing/hsadminng/hs/booking/item/HsBookingItemController.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/booking/item/HsBookingItemController.java
@@ -41,10 +41,10 @@ public class HsBookingItemController implements HsBookingItemsApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<List<HsBookingItemResource>> listBookingItemsByProjectUuid(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID projectUuid) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var entities = bookingItemRepo.findAllByProjectUuid(projectUuid);
 
@@ -55,11 +55,11 @@ public class HsBookingItemController implements HsBookingItemsApi {
     @Override
     @Transactional
     public ResponseEntity<HsBookingItemResource> addBookingItem(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final HsBookingItemInsertResource body) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var entityToSave = mapper.map(body, HsBookingItemRbacEntity.class, RESOURCE_TO_ENTITY_POSTMAPPER);
 
@@ -77,11 +77,11 @@ public class HsBookingItemController implements HsBookingItemsApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<HsBookingItemResource> getBookingItemByUuid(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID bookingItemUuid) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var result = bookingItemRepo.findByUuid(bookingItemUuid);
         result.ifPresent(entity -> em.detach(entity)); // prevent further LAZY-loading
@@ -94,10 +94,10 @@ public class HsBookingItemController implements HsBookingItemsApi {
     @Override
     @Transactional
     public ResponseEntity<Void> deleteBookingIemByUuid(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID bookingItemUuid) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var result = bookingItemRepo.deleteByUuid(bookingItemUuid);
         return result == 0
@@ -108,12 +108,12 @@ public class HsBookingItemController implements HsBookingItemsApi {
     @Override
     @Transactional
     public ResponseEntity<HsBookingItemResource> patchBookingItem(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID bookingItemUuid,
             final HsBookingItemPatchResource body) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var current = bookingItemRepo.findByUuid(bookingItemUuid).orElseThrow();
 
diff --git a/src/main/java/net/hostsharing/hsadminng/hs/booking/project/HsBookingProjectController.java b/src/main/java/net/hostsharing/hsadminng/hs/booking/project/HsBookingProjectController.java
index 9247ff83..55d26b36 100644
--- a/src/main/java/net/hostsharing/hsadminng/hs/booking/project/HsBookingProjectController.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/booking/project/HsBookingProjectController.java
@@ -36,10 +36,10 @@ public class HsBookingProjectController implements HsBookingProjectsApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<List<HsBookingProjectResource>> listBookingProjectsByDebitorUuid(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID debitorUuid) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var entities = bookingProjectRepo.findAllByDebitorUuid(debitorUuid);
 
@@ -50,11 +50,11 @@ public class HsBookingProjectController implements HsBookingProjectsApi {
     @Override
     @Transactional
     public ResponseEntity<HsBookingProjectResource> addBookingProject(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final HsBookingProjectInsertResource body) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var entityToSave = mapper.map(body, HsBookingProjectRbacEntity.class, RESOURCE_TO_ENTITY_POSTMAPPER);
 
@@ -72,11 +72,11 @@ public class HsBookingProjectController implements HsBookingProjectsApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<HsBookingProjectResource> getBookingProjectByUuid(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID bookingProjectUuid) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var result = bookingProjectRepo.findByUuid(bookingProjectUuid);
         return result
@@ -88,10 +88,10 @@ public class HsBookingProjectController implements HsBookingProjectsApi {
     @Override
     @Transactional
     public ResponseEntity<Void> deleteBookingIemByUuid(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID bookingProjectUuid) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var result = bookingProjectRepo.deleteByUuid(bookingProjectUuid);
         return result == 0
@@ -102,12 +102,12 @@ public class HsBookingProjectController implements HsBookingProjectsApi {
     @Override
     @Transactional
     public ResponseEntity<HsBookingProjectResource> patchBookingProject(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID bookingProjectUuid,
             final HsBookingProjectPatchResource body) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var current = bookingProjectRepo.findByUuid(bookingProjectUuid).orElseThrow();
 
diff --git a/src/main/java/net/hostsharing/hsadminng/hs/hosting/asset/HsHostingAssetController.java b/src/main/java/net/hostsharing/hsadminng/hs/hosting/asset/HsHostingAssetController.java
index 26636eb4..8973d0cc 100644
--- a/src/main/java/net/hostsharing/hsadminng/hs/hosting/asset/HsHostingAssetController.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/hosting/asset/HsHostingAssetController.java
@@ -49,12 +49,12 @@ public class HsHostingAssetController implements HsHostingAssetsApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<List<HsHostingAssetResource>> listAssets(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID debitorUuid,
             final UUID parentAssetUuid,
             final HsHostingAssetTypeResource type) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var entities = rbacAssetRepo.findAllByCriteria(debitorUuid, parentAssetUuid, HsHostingAssetType.of(type));
 
@@ -66,11 +66,11 @@ public class HsHostingAssetController implements HsHostingAssetsApi {
     @Override
     @Transactional
     public ResponseEntity<HsHostingAssetResource> addAsset(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final HsHostingAssetInsertResource body) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var entity = mapper.map(body, HsHostingAssetRbacEntity.class, RESOURCE_TO_ENTITY_POSTMAPPER);
 
@@ -94,11 +94,11 @@ public class HsHostingAssetController implements HsHostingAssetsApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<HsHostingAssetResource> getAssetByUuid(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID assetUuid) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var result = rbacAssetRepo.findByUuid(assetUuid);
         return result
@@ -110,10 +110,10 @@ public class HsHostingAssetController implements HsHostingAssetsApi {
     @Override
     @Transactional
     public ResponseEntity<Void> deleteAssetUuid(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID assetUuid) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var result = rbacAssetRepo.deleteByUuid(assetUuid);
         return result == 0
@@ -124,12 +124,12 @@ public class HsHostingAssetController implements HsHostingAssetsApi {
     @Override
     @Transactional
     public ResponseEntity<HsHostingAssetResource> patchAsset(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID assetUuid,
             final HsHostingAssetPatchResource body) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var entity = rbacAssetRepo.findByUuid(assetUuid).orElseThrow();
 
diff --git a/src/main/java/net/hostsharing/hsadminng/hs/office/bankaccount/HsOfficeBankAccountController.java b/src/main/java/net/hostsharing/hsadminng/hs/office/bankaccount/HsOfficeBankAccountController.java
index 9f39767f..50183bf7 100644
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/bankaccount/HsOfficeBankAccountController.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/bankaccount/HsOfficeBankAccountController.java
@@ -32,10 +32,10 @@ public class HsOfficeBankAccountController implements HsOfficeBankAccountsApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<List<HsOfficeBankAccountResource>> listBankAccounts(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final String holder) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var entities = bankAccountRepo.findByOptionalHolderLike(holder);
 
@@ -46,11 +46,11 @@ public class HsOfficeBankAccountController implements HsOfficeBankAccountsApi {
     @Override
     @Transactional
     public ResponseEntity<HsOfficeBankAccountResource> addBankAccount(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final HsOfficeBankAccountInsertResource body) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         IbanUtil.validate(body.getIban());
         BicUtil.validate(body.getBic());
@@ -72,11 +72,11 @@ public class HsOfficeBankAccountController implements HsOfficeBankAccountsApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<HsOfficeBankAccountResource> getBankAccountByUuid(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID bankAccountUuid) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var result = bankAccountRepo.findByUuid(bankAccountUuid);
         if (result.isEmpty()) {
@@ -88,10 +88,10 @@ public class HsOfficeBankAccountController implements HsOfficeBankAccountsApi {
     @Override
     @Transactional
     public ResponseEntity<Void> deleteBankAccountByUuid(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID BankAccountUuid) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var result = bankAccountRepo.deleteByUuid(BankAccountUuid);
         if (result == 0) {
diff --git a/src/main/java/net/hostsharing/hsadminng/hs/office/contact/HsOfficeContactController.java b/src/main/java/net/hostsharing/hsadminng/hs/office/contact/HsOfficeContactController.java
index cee7e28a..17d39b7f 100644
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/contact/HsOfficeContactController.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/contact/HsOfficeContactController.java
@@ -34,10 +34,10 @@ public class HsOfficeContactController implements HsOfficeContactsApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<List<HsOfficeContactResource>> listContacts(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final String caption) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var entities = contactRepo.findContactByOptionalCaptionLike(caption);
 
@@ -48,11 +48,11 @@ public class HsOfficeContactController implements HsOfficeContactsApi {
     @Override
     @Transactional
     public ResponseEntity<HsOfficeContactResource> addContact(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final HsOfficeContactInsertResource body) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var entityToSave = mapper.map(body, HsOfficeContactRbacEntity.class, RESOURCE_TO_ENTITY_POSTMAPPER);
 
@@ -70,11 +70,11 @@ public class HsOfficeContactController implements HsOfficeContactsApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<HsOfficeContactResource> getContactByUuid(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID contactUuid) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var result = contactRepo.findByUuid(contactUuid);
         if (result.isEmpty()) {
@@ -86,10 +86,10 @@ public class HsOfficeContactController implements HsOfficeContactsApi {
     @Override
     @Transactional
     public ResponseEntity<Void> deleteContactByUuid(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID contactUuid) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var result = contactRepo.deleteByUuid(contactUuid);
         if (result == 0) {
@@ -102,12 +102,12 @@ public class HsOfficeContactController implements HsOfficeContactsApi {
     @Override
     @Transactional
     public ResponseEntity<HsOfficeContactResource> patchContact(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID contactUuid,
             final HsOfficeContactPatchResource body) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var current = contactRepo.findByUuid(contactUuid).orElseThrow();
 
diff --git a/src/main/java/net/hostsharing/hsadminng/hs/office/coopassets/HsOfficeCoopAssetsTransactionController.java b/src/main/java/net/hostsharing/hsadminng/hs/office/coopassets/HsOfficeCoopAssetsTransactionController.java
index 8ec1d956..f4cb28a3 100644
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/coopassets/HsOfficeCoopAssetsTransactionController.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/coopassets/HsOfficeCoopAssetsTransactionController.java
@@ -37,12 +37,12 @@ public class HsOfficeCoopAssetsTransactionController implements HsOfficeCoopAsse
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<List<HsOfficeCoopAssetsTransactionResource>> listCoopAssets(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID membershipUuid,
             final @DateTimeFormat(iso = ISO.DATE) LocalDate fromValueDate,
             final @DateTimeFormat(iso = ISO.DATE) LocalDate toValueDate) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var entities = coopAssetsTransactionRepo.findCoopAssetsTransactionByOptionalMembershipUuidAndDateRange(
                 membershipUuid,
@@ -56,11 +56,11 @@ public class HsOfficeCoopAssetsTransactionController implements HsOfficeCoopAsse
     @Override
     @Transactional
     public ResponseEntity<HsOfficeCoopAssetsTransactionResource> addCoopAssetsTransaction(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final HsOfficeCoopAssetsTransactionInsertResource requestBody) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
         validate(requestBody);
 
         final var entityToSave = mapper.map(requestBody, HsOfficeCoopAssetsTransactionEntity.class, RESOURCE_TO_ENTITY_POSTMAPPER);
@@ -79,9 +79,9 @@ public class HsOfficeCoopAssetsTransactionController implements HsOfficeCoopAsse
     @Transactional(readOnly = true)
 
     public ResponseEntity<HsOfficeCoopAssetsTransactionResource> getCoopAssetTransactionByUuid(
-        final String currentUser, final String assumedRoles, final UUID assetTransactionUuid) {
+        final String currentSubject, final String assumedRoles, final UUID assetTransactionUuid) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var result = coopAssetsTransactionRepo.findByUuid(assetTransactionUuid);
         if (result.isEmpty()) {
diff --git a/src/main/java/net/hostsharing/hsadminng/hs/office/coopshares/HsOfficeCoopSharesTransactionController.java b/src/main/java/net/hostsharing/hsadminng/hs/office/coopshares/HsOfficeCoopSharesTransactionController.java
index 78b41c9f..1616568d 100644
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/coopshares/HsOfficeCoopSharesTransactionController.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/coopshares/HsOfficeCoopSharesTransactionController.java
@@ -39,12 +39,12 @@ public class HsOfficeCoopSharesTransactionController implements HsOfficeCoopShar
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<List<HsOfficeCoopSharesTransactionResource>> listCoopShares(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID membershipUuid,
             final @DateTimeFormat(iso = ISO.DATE) LocalDate fromValueDate,
             final @DateTimeFormat(iso = ISO.DATE) LocalDate toValueDate) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var entities = coopSharesTransactionRepo.findCoopSharesTransactionByOptionalMembershipUuidAndDateRange(
                 membershipUuid,
@@ -58,11 +58,11 @@ public class HsOfficeCoopSharesTransactionController implements HsOfficeCoopShar
     @Override
     @Transactional
     public ResponseEntity<HsOfficeCoopSharesTransactionResource> addCoopSharesTransaction(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final HsOfficeCoopSharesTransactionInsertResource requestBody) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
         validate(requestBody);
 
         final var entityToSave = mapper.map(requestBody, HsOfficeCoopSharesTransactionEntity.class, RESOURCE_TO_ENTITY_POSTMAPPER);
@@ -81,9 +81,9 @@ public class HsOfficeCoopSharesTransactionController implements HsOfficeCoopShar
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<HsOfficeCoopSharesTransactionResource> getCoopShareTransactionByUuid(
-        final String currentUser, final String assumedRoles, final UUID shareTransactionUuid) {
+        final String currentSubject, final String assumedRoles, final UUID shareTransactionUuid) {
 
-            context.define(currentUser, assumedRoles);
+            context.define(currentSubject, assumedRoles);
 
             final var result = coopSharesTransactionRepo.findByUuid(shareTransactionUuid);
             if (result.isEmpty()) {
diff --git a/src/main/java/net/hostsharing/hsadminng/hs/office/debitor/HsOfficeDebitorController.java b/src/main/java/net/hostsharing/hsadminng/hs/office/debitor/HsOfficeDebitorController.java
index 73fe78af..17ab0e70 100644
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/debitor/HsOfficeDebitorController.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/debitor/HsOfficeDebitorController.java
@@ -48,11 +48,11 @@ public class HsOfficeDebitorController implements HsOfficeDebitorsApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<List<HsOfficeDebitorResource>> listDebitors(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final String name,
             final Integer debitorNumber) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var entities = debitorNumber != null
                 ? debitorRepo.findDebitorByDebitorNumber(debitorNumber)
@@ -65,11 +65,11 @@ public class HsOfficeDebitorController implements HsOfficeDebitorsApi {
     @Override
     @Transactional
     public ResponseEntity<HsOfficeDebitorResource> addDebitor(
-            String currentUser,
+            String currentSubject,
             String assumedRoles,
             HsOfficeDebitorInsertResource body) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         Validate.isTrue(body.getDebitorRel() == null || body.getDebitorRelUuid() == null,
                 "ERROR: [400] exactly one of debitorRel and debitorRelUuid must be supplied, but found both");
@@ -112,11 +112,11 @@ public class HsOfficeDebitorController implements HsOfficeDebitorsApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<HsOfficeDebitorResource> getDebitorByUuid(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID debitorUuid) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var result = debitorRepo.findByUuid(debitorUuid);
         if (result.isEmpty()) {
@@ -128,10 +128,10 @@ public class HsOfficeDebitorController implements HsOfficeDebitorsApi {
     @Override
     @Transactional
     public ResponseEntity<Void> deleteDebitorByUuid(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID debitorUuid) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var result = debitorRepo.deleteByUuid(debitorUuid);
         if (result == 0) {
@@ -144,12 +144,12 @@ public class HsOfficeDebitorController implements HsOfficeDebitorsApi {
     @Override
     @Transactional
     public ResponseEntity<HsOfficeDebitorResource> patchDebitor(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID debitorUuid,
             final HsOfficeDebitorPatchResource body) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var current = debitorRepo.findByUuid(debitorUuid).orElseThrow();
 
diff --git a/src/main/java/net/hostsharing/hsadminng/hs/office/membership/HsOfficeMembershipController.java b/src/main/java/net/hostsharing/hsadminng/hs/office/membership/HsOfficeMembershipController.java
index 3c783aae..8c87e5fa 100644
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/membership/HsOfficeMembershipController.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/membership/HsOfficeMembershipController.java
@@ -32,11 +32,11 @@ public class HsOfficeMembershipController implements HsOfficeMembershipsApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<List<HsOfficeMembershipResource>> listMemberships(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             UUID partnerUuid,
             Integer memberNumber) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var entities = ( memberNumber != null)
                     ? List.of(membershipRepo.findMembershipByMemberNumber(memberNumber))
@@ -50,11 +50,11 @@ public class HsOfficeMembershipController implements HsOfficeMembershipsApi {
     @Override
     @Transactional
     public ResponseEntity<HsOfficeMembershipResource> addMembership(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final HsOfficeMembershipInsertResource body) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var entityToSave = mapper.map(body, HsOfficeMembershipEntity.class);
 
@@ -73,11 +73,11 @@ public class HsOfficeMembershipController implements HsOfficeMembershipsApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<HsOfficeMembershipResource> getMembershipByUuid(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID membershipUuid) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var result = membershipRepo.findByUuid(membershipUuid);
         if (result.isEmpty()) {
@@ -90,10 +90,10 @@ public class HsOfficeMembershipController implements HsOfficeMembershipsApi {
     @Override
     @Transactional
     public ResponseEntity<Void> deleteMembershipByUuid(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID membershipUuid) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var result = membershipRepo.deleteByUuid(membershipUuid);
         if (result == 0) {
@@ -106,12 +106,12 @@ public class HsOfficeMembershipController implements HsOfficeMembershipsApi {
     @Override
     @Transactional
     public ResponseEntity<HsOfficeMembershipResource> patchMembership(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID membershipUuid,
             final HsOfficeMembershipPatchResource body) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var current = membershipRepo.findByUuid(membershipUuid).orElseThrow();
 
diff --git a/src/main/java/net/hostsharing/hsadminng/hs/office/partner/HsOfficePartnerController.java b/src/main/java/net/hostsharing/hsadminng/hs/office/partner/HsOfficePartnerController.java
index 5965d990..e4da02b8 100644
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/partner/HsOfficePartnerController.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/partner/HsOfficePartnerController.java
@@ -50,10 +50,10 @@ public class HsOfficePartnerController implements HsOfficePartnersApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<List<HsOfficePartnerResource>> listPartners(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final String name) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var entities = partnerRepo.findPartnerByOptionalNameLike(name);
 
@@ -64,11 +64,11 @@ public class HsOfficePartnerController implements HsOfficePartnersApi {
     @Override
     @Transactional
     public ResponseEntity<HsOfficePartnerResource> addPartner(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final HsOfficePartnerInsertResource body) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var entityToSave = createPartnerEntity(body);
 
@@ -86,11 +86,11 @@ public class HsOfficePartnerController implements HsOfficePartnersApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<HsOfficePartnerResource> getPartnerByUuid(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID partnerUuid) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var result = partnerRepo.findByUuid(partnerUuid);
         if (result.isEmpty()) {
@@ -102,10 +102,10 @@ public class HsOfficePartnerController implements HsOfficePartnersApi {
     @Override
     @Transactional
     public ResponseEntity<Void> deletePartnerByUuid(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID partnerUuid) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var partnerToDelete = partnerRepo.findByUuid(partnerUuid);
         if (partnerToDelete.isEmpty()) {
@@ -122,12 +122,12 @@ public class HsOfficePartnerController implements HsOfficePartnersApi {
     @Override
     @Transactional
     public ResponseEntity<HsOfficePartnerResource> patchPartner(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID partnerUuid,
             final HsOfficePartnerPatchResource body) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var current = partnerRepo.findByUuid(partnerUuid).orElseThrow();
         final var previousPartnerRel = current.getPartnerRel();
diff --git a/src/main/java/net/hostsharing/hsadminng/hs/office/person/HsOfficePersonController.java b/src/main/java/net/hostsharing/hsadminng/hs/office/person/HsOfficePersonController.java
index c3a52c50..41d9d441 100644
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/person/HsOfficePersonController.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/person/HsOfficePersonController.java
@@ -31,10 +31,10 @@ public class HsOfficePersonController implements HsOfficePersonsApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<List<HsOfficePersonResource>> listPersons(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final String caption) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var entities = personRepo.findPersonByOptionalNameLike(caption);
 
@@ -45,11 +45,11 @@ public class HsOfficePersonController implements HsOfficePersonsApi {
     @Override
     @Transactional
     public ResponseEntity<HsOfficePersonResource> addPerson(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final HsOfficePersonInsertResource body) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var entityToSave = mapper.map(body, HsOfficePersonEntity.class);
 
@@ -67,11 +67,11 @@ public class HsOfficePersonController implements HsOfficePersonsApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<HsOfficePersonResource> getPersonByUuid(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID personUuid) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var result = personRepo.findByUuid(personUuid);
         if (result.isEmpty()) {
@@ -83,10 +83,10 @@ public class HsOfficePersonController implements HsOfficePersonsApi {
     @Override
     @Transactional
     public ResponseEntity<Void> deletePersonByUuid(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID personUuid) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var result = personRepo.deleteByUuid(personUuid);
         if (result == 0) {
@@ -99,12 +99,12 @@ public class HsOfficePersonController implements HsOfficePersonsApi {
     @Override
     @Transactional
     public ResponseEntity<HsOfficePersonResource> patchPerson(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID personUuid,
             final HsOfficePersonPatchResource body) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var current = personRepo.findByUuid(personUuid).orElseThrow();
 
diff --git a/src/main/java/net/hostsharing/hsadminng/hs/office/relation/HsOfficeRelationController.java b/src/main/java/net/hostsharing/hsadminng/hs/office/relation/HsOfficeRelationController.java
index a3f4d136..f054e563 100644
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/relation/HsOfficeRelationController.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/relation/HsOfficeRelationController.java
@@ -45,11 +45,11 @@ public class HsOfficeRelationController implements HsOfficeRelationsApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<List<HsOfficeRelationResource>> listRelations(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID personUuid,
             final HsOfficeRelationTypeResource relationType) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var entities = relationRbacRepo.findRelationRelatedToPersonUuidAndRelationType(personUuid,
                 mapper.map(relationType, HsOfficeRelationType.class));
@@ -62,11 +62,11 @@ public class HsOfficeRelationController implements HsOfficeRelationsApi {
     @Override
     @Transactional
     public ResponseEntity<HsOfficeRelationResource> addRelation(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final HsOfficeRelationInsertResource body) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var entityToSave = new HsOfficeRelationRbacEntity();
         entityToSave.setType(HsOfficeRelationType.valueOf(body.getType()));
@@ -96,11 +96,11 @@ public class HsOfficeRelationController implements HsOfficeRelationsApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<HsOfficeRelationResource> getRelationByUuid(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID relationUuid) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var result = relationRbacRepo.findByUuid(relationUuid);
         if (result.isEmpty()) {
@@ -112,10 +112,10 @@ public class HsOfficeRelationController implements HsOfficeRelationsApi {
     @Override
     @Transactional
     public ResponseEntity<Void> deleteRelationByUuid(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID relationUuid) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var result = relationRbacRepo.deleteByUuid(relationUuid);
         if (result == 0) {
@@ -128,12 +128,12 @@ public class HsOfficeRelationController implements HsOfficeRelationsApi {
     @Override
     @Transactional
     public ResponseEntity<HsOfficeRelationResource> patchRelation(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID relationUuid,
             final HsOfficeRelationPatchResource body) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var current = relationRbacRepo.findByUuid(relationUuid).orElseThrow();
 
diff --git a/src/main/java/net/hostsharing/hsadminng/hs/office/sepamandate/HsOfficeSepaMandateController.java b/src/main/java/net/hostsharing/hsadminng/hs/office/sepamandate/HsOfficeSepaMandateController.java
index 115b8948..9511bdd6 100644
--- a/src/main/java/net/hostsharing/hsadminng/hs/office/sepamandate/HsOfficeSepaMandateController.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/office/sepamandate/HsOfficeSepaMandateController.java
@@ -39,10 +39,10 @@ public class HsOfficeSepaMandateController implements HsOfficeSepaMandatesApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<List<HsOfficeSepaMandateResource>> listSepaMandatesByIban(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final String iban) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var entities = sepaMandateRepo.findSepaMandateByOptionalIban(iban);
 
@@ -54,11 +54,11 @@ public class HsOfficeSepaMandateController implements HsOfficeSepaMandatesApi {
     @Override
     @Transactional
     public ResponseEntity<HsOfficeSepaMandateResource> addSepaMandate(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final HsOfficeSepaMandateInsertResource body) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var entityToSave = mapper.map(body, HsOfficeSepaMandateEntity.class, SEPA_MANDATE_RESOURCE_TO_ENTITY_POSTMAPPER);
 
@@ -77,11 +77,11 @@ public class HsOfficeSepaMandateController implements HsOfficeSepaMandatesApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<HsOfficeSepaMandateResource> getSepaMandateByUuid(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID sepaMandateUuid) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var result = sepaMandateRepo.findByUuid(sepaMandateUuid);
         if (result.isEmpty()) {
@@ -94,10 +94,10 @@ public class HsOfficeSepaMandateController implements HsOfficeSepaMandatesApi {
     @Override
     @Transactional
     public ResponseEntity<Void> deleteSepaMandateByUuid(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID sepaMandateUuid) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var result = sepaMandateRepo.deleteByUuid(sepaMandateUuid);
         if (result == 0) {
@@ -110,12 +110,12 @@ public class HsOfficeSepaMandateController implements HsOfficeSepaMandatesApi {
     @Override
     @Transactional
     public ResponseEntity<HsOfficeSepaMandateResource> patchSepaMandate(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID sepaMandateUuid,
             final HsOfficeSepaMandatePatchResource body) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var current = sepaMandateRepo.findByUuid(sepaMandateUuid).orElseThrow();
 
diff --git a/src/main/java/net/hostsharing/hsadminng/rbac/rbacdef/InsertTriggerGenerator.java b/src/main/java/net/hostsharing/hsadminng/rbac/rbacdef/InsertTriggerGenerator.java
index 521ba66b..41e9bfc6 100644
--- a/src/main/java/net/hostsharing/hsadminng/rbac/rbacdef/InsertTriggerGenerator.java
+++ b/src/main/java/net/hostsharing/hsadminng/rbac/rbacdef/InsertTriggerGenerator.java
@@ -255,7 +255,7 @@ public class InsertTriggerGenerator {
         plPgSql.writeLn();
         plPgSql.writeLn("""
                 raise exception '[403] insert into ${rawSubTable} values(%) not allowed for current subjects % (%)',
-                        NEW, currentSubjects(), currentSubjectsUuids();
+                        NEW, currentSubjects(), currentSubjectOrAssumedRolesUuids();
             end; $$;
             
             create trigger ${rawSubTable}_insert_permission_check_tg
diff --git a/src/main/java/net/hostsharing/hsadminng/rbac/rbacdef/RolesGrantsAndPermissionsGenerator.java b/src/main/java/net/hostsharing/hsadminng/rbac/rbacdef/RolesGrantsAndPermissionsGenerator.java
index 2089d4d9..238e1208 100644
--- a/src/main/java/net/hostsharing/hsadminng/rbac/rbacdef/RolesGrantsAndPermissionsGenerator.java
+++ b/src/main/java/net/hostsharing/hsadminng/rbac/rbacdef/RolesGrantsAndPermissionsGenerator.java
@@ -580,7 +580,7 @@ class RolesGrantsAndPermissionsGenerator {
 
     private String toPlPgSqlReference(final RbacView.RbacUserReference userRef) {
         return switch (userRef.role) {
-            case CREATOR -> "currentUserUuid()";
+            case CREATOR -> "currentSubjectUuid()";
             default -> throw new IllegalArgumentException("unknown user role: " + userRef);
         };
     }
diff --git a/src/main/java/net/hostsharing/hsadminng/rbac/rbacgrant/RbacGrantController.java b/src/main/java/net/hostsharing/hsadminng/rbac/rbacgrant/RbacGrantController.java
index 9dfaea74..ccdfb38b 100644
--- a/src/main/java/net/hostsharing/hsadminng/rbac/rbacgrant/RbacGrantController.java
+++ b/src/main/java/net/hostsharing/hsadminng/rbac/rbacgrant/RbacGrantController.java
@@ -33,12 +33,12 @@ public class RbacGrantController implements RbacGrantsApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<RbacGrantResource> getGrantById(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID grantedRoleUuid,
             final UUID granteeUserUuid) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var id = new RbacGrantId(granteeUserUuid, grantedRoleUuid);
         final var result = rbacGrantRepository.findById(id);
@@ -51,10 +51,10 @@ public class RbacGrantController implements RbacGrantsApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<List<RbacGrantResource>> listUserGrants(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         return ResponseEntity.ok(mapper.mapList(rbacGrantRepository.findAll(), RbacGrantResource.class));
     }
@@ -62,11 +62,11 @@ public class RbacGrantController implements RbacGrantsApi {
     @Override
     @Transactional
     public ResponseEntity<RbacGrantResource> grantRoleToUser(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final RbacGrantResource body) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var granted = rbacGrantRepository.save(mapper.map(body, RbacGrantEntity.class));
         em.flush();
@@ -83,12 +83,12 @@ public class RbacGrantController implements RbacGrantsApi {
     @Override
     @Transactional
     public ResponseEntity<Void> revokeRoleFromUser(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID grantedRoleUuid,
             final UUID granteeUserUuid) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         rbacGrantRepository.deleteByRbacGrantId(new RbacGrantId(granteeUserUuid, grantedRoleUuid));
 
@@ -101,9 +101,9 @@ public class RbacGrantController implements RbacGrantsApi {
 //            produces = {"text/vnd.mermaid"})
 //    @Transactional(readOnly = true)
 //    public ResponseEntity<String> allGrantsOfUserAsMermaid(
-//            @RequestHeader(name = "current-user") String currentUser,
+//            @RequestHeader(name = "current-subject") String currentSubject,
 //            @RequestHeader(name = "assumed-roles", required = false) String assumedRoles) {
-//        final var graph = RbacGrantsDiagramService.allGrantsToUser(currentUser);
+//        final var graph = RbacGrantsDiagramService.allGrantsToUser(currentSubject);
 //        return ResponseEntity.ok(graph);
 //    }
 
diff --git a/src/main/java/net/hostsharing/hsadminng/rbac/rbacgrant/RbacGrantsDiagramService.java b/src/main/java/net/hostsharing/hsadminng/rbac/rbacgrant/RbacGrantsDiagramService.java
index f1369067..39ee73aa 100644
--- a/src/main/java/net/hostsharing/hsadminng/rbac/rbacgrant/RbacGrantsDiagramService.java
+++ b/src/main/java/net/hostsharing/hsadminng/rbac/rbacgrant/RbacGrantsDiagramService.java
@@ -64,9 +64,9 @@ public class RbacGrantsDiagramService {
 
     private Map<UUID, List<RawRbacGrantEntity>> descendantsByUuid = new HashMap<>();
 
-    public String allGrantsToCurrentUser(final EnumSet<Include> includes) {
+    public String allGrantsTocurrentSubject(final EnumSet<Include> includes) {
         final var graph = new LimitedHashSet<RawRbacGrantEntity>();
-        for ( UUID subjectUuid: context.currentSubjectsUuids() ) {
+        for ( UUID subjectUuid: context.fetchCurrentSubjectOrAssumedRolesUuids() ) {
             traverseGrantsTo(graph, subjectUuid, includes);
             }
         return toMermaidFlowchart(graph, includes);
diff --git a/src/main/java/net/hostsharing/hsadminng/rbac/rbacrole/RbacRoleController.java b/src/main/java/net/hostsharing/hsadminng/rbac/rbacrole/RbacRoleController.java
index 0405fee2..1a5d8108 100644
--- a/src/main/java/net/hostsharing/hsadminng/rbac/rbacrole/RbacRoleController.java
+++ b/src/main/java/net/hostsharing/hsadminng/rbac/rbacrole/RbacRoleController.java
@@ -26,10 +26,10 @@ public class RbacRoleController implements RbacRolesApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<List<RbacRoleResource>> listRoles(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final List<RbacRoleEntity> result = rbacRoleRepository.findAll();
 
diff --git a/src/main/java/net/hostsharing/hsadminng/rbac/rbacuser/RbacUserController.java b/src/main/java/net/hostsharing/hsadminng/rbac/rbacuser/RbacUserController.java
index bcc7844b..e0885a16 100644
--- a/src/main/java/net/hostsharing/hsadminng/rbac/rbacuser/RbacUserController.java
+++ b/src/main/java/net/hostsharing/hsadminng/rbac/rbacuser/RbacUserController.java
@@ -49,11 +49,11 @@ public class RbacUserController implements RbacUsersApi {
     @Override
     @Transactional
     public ResponseEntity<Void> deleteUserByUuid(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID userUuid
     ) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         rbacUserRepository.deleteByUuid(userUuid);
 
@@ -63,11 +63,11 @@ public class RbacUserController implements RbacUsersApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<RbacUserResource> getUserById(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID userUuid) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var result = rbacUserRepository.findByUuid(userUuid);
         if (result == null) {
@@ -79,11 +79,11 @@ public class RbacUserController implements RbacUsersApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<List<RbacUserResource>> listUsers(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final String userName
     ) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         return ResponseEntity.ok(mapper.mapList(rbacUserRepository.findByOptionalNameLike(userName), RbacUserResource.class));
     }
@@ -91,11 +91,11 @@ public class RbacUserController implements RbacUsersApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<List<RbacUserPermissionResource>> listUserPermissions(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID userUuid
     ) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         return ResponseEntity.ok(mapper.mapList(
                 rbacUserRepository.findPermissionsOfUserByUuid(userUuid),
diff --git a/src/main/java/net/hostsharing/hsadminng/rbac/rbacuser/RbacUserRepository.java b/src/main/java/net/hostsharing/hsadminng/rbac/rbacuser/RbacUserRepository.java
index 0c1a168b..3560741e 100644
--- a/src/main/java/net/hostsharing/hsadminng/rbac/rbacuser/RbacUserRepository.java
+++ b/src/main/java/net/hostsharing/hsadminng/rbac/rbacuser/RbacUserRepository.java
@@ -17,7 +17,7 @@ public interface RbacUserRepository extends Repository<RbacUserEntity, UUID> {
     List<RbacUserEntity> findByOptionalNameLike(String userName);
 
     // bypasses the restricted view, to be able to grant rights to arbitrary user
-    @Query(value = "select * from rbacuser where name=:userName", nativeQuery = true)
+    @Query(value = "select * from rbac.subject where name=:userName", nativeQuery = true)
     RbacUserEntity findByName(String userName);
 
     RbacUserEntity findByUuid(UUID uuid);
@@ -28,7 +28,7 @@ public interface RbacUserRepository extends Repository<RbacUserEntity, UUID> {
     /*
         Can't use save/saveAndFlush from SpringData because the uuid is not generated on the entity level,
         but explicitly, and then SpringData check's if it exists using an SQL SELECT.
-        And SQL SELECT needs a currentUser which we don't yet have in the case of self registration.
+        And SQL SELECT needs a currentSubject which we don't yet have in the case of self registration.
      */
     @Modifying
     @Query(value = "insert into RBacUser_RV (uuid, name) values( :#{#newUser.uuid}, :#{#newUser.name})", nativeQuery = true)
diff --git a/src/main/java/net/hostsharing/hsadminng/rbac/test/cust/TestCustomerController.java b/src/main/java/net/hostsharing/hsadminng/rbac/test/cust/TestCustomerController.java
index d0ab74bf..c6bbc115 100644
--- a/src/main/java/net/hostsharing/hsadminng/rbac/test/cust/TestCustomerController.java
+++ b/src/main/java/net/hostsharing/hsadminng/rbac/test/cust/TestCustomerController.java
@@ -32,11 +32,11 @@ public class TestCustomerController implements TestCustomersApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<List<TestCustomerResource>> listCustomers(
-            String currentUser,
+            String currentSubject,
             String assumedRoles,
             String prefix
     ) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var result = testCustomerRepository.findCustomerByOptionalPrefixLike(prefix);
 
@@ -46,11 +46,11 @@ public class TestCustomerController implements TestCustomersApi {
     @Override
     @Transactional
     public ResponseEntity<TestCustomerResource> addCustomer(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final TestCustomerResource customer) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var saved = testCustomerRepository.save(mapper.map(customer, TestCustomerEntity.class));
         final var uri =
diff --git a/src/main/java/net/hostsharing/hsadminng/rbac/test/pac/TestPackageController.java b/src/main/java/net/hostsharing/hsadminng/rbac/test/pac/TestPackageController.java
index 8bb94971..c6ecc7e0 100644
--- a/src/main/java/net/hostsharing/hsadminng/rbac/test/pac/TestPackageController.java
+++ b/src/main/java/net/hostsharing/hsadminng/rbac/test/pac/TestPackageController.java
@@ -29,11 +29,11 @@ public class TestPackageController implements TestPackagesApi {
     @Override
     @Transactional(readOnly = true)
     public ResponseEntity<List<TestPackageResource>> listPackages(
-            String currentUser,
+            String currentSubject,
             String assumedRoles,
             String name
     ) {
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var result = testPackageRepository.findAllByOptionalNameLike(name);
         return ResponseEntity.ok(mapper.mapList(result, TestPackageResource.class));
@@ -42,12 +42,12 @@ public class TestPackageController implements TestPackagesApi {
     @Override
     @Transactional
     public ResponseEntity<TestPackageResource> updatePackage(
-            final String currentUser,
+            final String currentSubject,
             final String assumedRoles,
             final UUID packageUuid,
             final TestPackageUpdateResource body) {
 
-        context.define(currentUser, assumedRoles);
+        context.define(currentSubject, assumedRoles);
 
         final var current = testPackageRepository.findByUuid(packageUuid);
         OptionalFromJson.of(body.getDescription()).ifPresent(current::setDescription);
diff --git a/src/main/resources/api-definition/auth.yaml b/src/main/resources/api-definition/auth.yaml
index 65d491fb..e46f0f38 100644
--- a/src/main/resources/api-definition/auth.yaml
+++ b/src/main/resources/api-definition/auth.yaml
@@ -3,8 +3,8 @@ components:
 
     parameters:
 
-        currentUser:
-            name: current-user
+        currentSubject:
+            name: current-subject
             in: header
             required: true
             schema:
diff --git a/src/main/resources/api-definition/hs-booking/auth.yaml b/src/main/resources/api-definition/hs-booking/auth.yaml
index 65d491fb..e46f0f38 100644
--- a/src/main/resources/api-definition/hs-booking/auth.yaml
+++ b/src/main/resources/api-definition/hs-booking/auth.yaml
@@ -3,8 +3,8 @@ components:
 
     parameters:
 
-        currentUser:
-            name: current-user
+        currentSubject:
+            name: current-subject
             in: header
             required: true
             schema:
diff --git a/src/main/resources/api-definition/hs-booking/hs-booking-items-with-uuid.yaml b/src/main/resources/api-definition/hs-booking/hs-booking-items-with-uuid.yaml
index 3d7567c8..e93cb7b6 100644
--- a/src/main/resources/api-definition/hs-booking/hs-booking-items-with-uuid.yaml
+++ b/src/main/resources/api-definition/hs-booking/hs-booking-items-with-uuid.yaml
@@ -4,7 +4,7 @@ get:
     description: 'Fetch a single booking item its uuid, if visible for the current subject.'
     operationId: getBookingItemByUuid
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: bookingItemUuid
           in: path
@@ -32,7 +32,7 @@ patch:
     description: 'Updates a single booking item identified by its uuid, if permitted for the current subject.'
     operationId: patchBookingItem
     parameters:
-        -   $ref: 'auth.yaml#/components/parameters/currentUser'
+        -   $ref: 'auth.yaml#/components/parameters/currentSubject'
         -   $ref: 'auth.yaml#/components/parameters/assumedRoles'
         -   name: bookingItemUuid
             in: path
@@ -63,7 +63,7 @@ delete:
     description: 'Delete a single booking item identified by its uuid, if permitted for the current subject.'
     operationId: deleteBookingIemByUuid
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: bookingItemUuid
           in: path
diff --git a/src/main/resources/api-definition/hs-booking/hs-booking-items.yaml b/src/main/resources/api-definition/hs-booking/hs-booking-items.yaml
index 40a3d010..fca2209a 100644
--- a/src/main/resources/api-definition/hs-booking/hs-booking-items.yaml
+++ b/src/main/resources/api-definition/hs-booking/hs-booking-items.yaml
@@ -5,7 +5,7 @@ get:
         - hs-booking-items
     operationId: listBookingItemsByProjectUuid
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: projectUuid
           in: query
@@ -34,7 +34,7 @@ post:
         - hs-booking-items
     operationId: addBookingItem
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
     requestBody:
         description: A JSON object describing the new booking item.
diff --git a/src/main/resources/api-definition/hs-booking/hs-booking-projects-with-uuid.yaml b/src/main/resources/api-definition/hs-booking/hs-booking-projects-with-uuid.yaml
index 085205a7..4c41d51c 100644
--- a/src/main/resources/api-definition/hs-booking/hs-booking-projects-with-uuid.yaml
+++ b/src/main/resources/api-definition/hs-booking/hs-booking-projects-with-uuid.yaml
@@ -4,7 +4,7 @@ get:
     description: 'Fetch a single booking project its uuid, if visible for the current subject.'
     operationId: getBookingProjectByUuid
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: bookingProjectUuid
           in: path
@@ -32,7 +32,7 @@ patch:
     description: 'Updates a single booking project identified by its uuid, if permitted for the current subject.'
     operationId: patchBookingProject
     parameters:
-        -   $ref: 'auth.yaml#/components/parameters/currentUser'
+        -   $ref: 'auth.yaml#/components/parameters/currentSubject'
         -   $ref: 'auth.yaml#/components/parameters/assumedRoles'
         -   name: bookingProjectUuid
             in: path
@@ -63,7 +63,7 @@ delete:
     description: 'Delete a single booking project identified by its uuid, if permitted for the current subject.'
     operationId: deleteBookingIemByUuid
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: bookingProjectUuid
           in: path
diff --git a/src/main/resources/api-definition/hs-booking/hs-booking-projects.yaml b/src/main/resources/api-definition/hs-booking/hs-booking-projects.yaml
index bccb7443..e5081a6f 100644
--- a/src/main/resources/api-definition/hs-booking/hs-booking-projects.yaml
+++ b/src/main/resources/api-definition/hs-booking/hs-booking-projects.yaml
@@ -5,7 +5,7 @@ get:
         - hs-booking-projects
     operationId: listBookingProjectsByDebitorUuid
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: debitorUuid
           in: query
@@ -34,7 +34,7 @@ post:
         - hs-booking-projects
     operationId: addBookingProject
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
     requestBody:
         description: A JSON object describing the new booking project.
diff --git a/src/main/resources/api-definition/hs-hosting/auth.yaml b/src/main/resources/api-definition/hs-hosting/auth.yaml
index 65d491fb..e46f0f38 100644
--- a/src/main/resources/api-definition/hs-hosting/auth.yaml
+++ b/src/main/resources/api-definition/hs-hosting/auth.yaml
@@ -3,8 +3,8 @@ components:
 
     parameters:
 
-        currentUser:
-            name: current-user
+        currentSubject:
+            name: current-subject
             in: header
             required: true
             schema:
diff --git a/src/main/resources/api-definition/hs-hosting/hs-hosting-assets-with-uuid.yaml b/src/main/resources/api-definition/hs-hosting/hs-hosting-assets-with-uuid.yaml
index 6630d245..625afdd0 100644
--- a/src/main/resources/api-definition/hs-hosting/hs-hosting-assets-with-uuid.yaml
+++ b/src/main/resources/api-definition/hs-hosting/hs-hosting-assets-with-uuid.yaml
@@ -4,7 +4,7 @@ get:
     description: 'Fetch a single managed asset by its uuid, if visible for the current subject.'
     operationId: getAssetByUuid
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: assetUuid
           in: path
@@ -32,7 +32,7 @@ patch:
     description: 'Updates a single hosting asset identified by its uuid, if permitted for the current subject.'
     operationId: patchAsset
     parameters:
-        -   $ref: 'auth.yaml#/components/parameters/currentUser'
+        -   $ref: 'auth.yaml#/components/parameters/currentSubject'
         -   $ref: 'auth.yaml#/components/parameters/assumedRoles'
         -   name: assetUuid
             in: path
@@ -63,7 +63,7 @@ delete:
     description: 'Delete a single hosting asset identified by its uuid, if permitted for the current subject.'
     operationId: deleteAssetUuid
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: assetUuid
           in: path
diff --git a/src/main/resources/api-definition/hs-hosting/hs-hosting-assets.yaml b/src/main/resources/api-definition/hs-hosting/hs-hosting-assets.yaml
index 8a208c68..6396d2a7 100644
--- a/src/main/resources/api-definition/hs-hosting/hs-hosting-assets.yaml
+++ b/src/main/resources/api-definition/hs-hosting/hs-hosting-assets.yaml
@@ -5,7 +5,7 @@ get:
         - hs-hosting-assets
     operationId: listAssets
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: projectUuid
           in: query
@@ -47,7 +47,7 @@ post:
         - hs-hosting-assets
     operationId: addAsset
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
     requestBody:
         description: A JSON object describing the new hosting asset.
diff --git a/src/main/resources/api-definition/hs-office/hs-office-bankaccounts-with-uuid.yaml b/src/main/resources/api-definition/hs-office/hs-office-bankaccounts-with-uuid.yaml
index 44f89fa1..cdef972a 100644
--- a/src/main/resources/api-definition/hs-office/hs-office-bankaccounts-with-uuid.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-bankaccounts-with-uuid.yaml
@@ -4,7 +4,7 @@ get:
     description: 'Fetch a single bank account by its uuid, if visible for the current subject.'
     operationId: getBankAccountByUuid
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: bankAccountUUID
           in: path
@@ -31,7 +31,7 @@ delete:
     description: 'Delete a single bank account by its uuid, if permitted for the current subject.'
     operationId: deleteBankAccountByUuid
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: bankAccountUUID
           in: path
diff --git a/src/main/resources/api-definition/hs-office/hs-office-bankaccounts.yaml b/src/main/resources/api-definition/hs-office/hs-office-bankaccounts.yaml
index 75380d5d..2207fd9c 100644
--- a/src/main/resources/api-definition/hs-office/hs-office-bankaccounts.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-bankaccounts.yaml
@@ -5,7 +5,7 @@ get:
         - hs-office-bank-accounts
     operationId: listBankAccounts
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: holder
           in: query
@@ -33,7 +33,7 @@ post:
         - hs-office-bank-accounts
     operationId: addBankAccount
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
     requestBody:
         content:
diff --git a/src/main/resources/api-definition/hs-office/hs-office-contacts-with-uuid.yaml b/src/main/resources/api-definition/hs-office/hs-office-contacts-with-uuid.yaml
index 13e96f39..a6561e8d 100644
--- a/src/main/resources/api-definition/hs-office/hs-office-contacts-with-uuid.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-contacts-with-uuid.yaml
@@ -4,7 +4,7 @@ get:
     description: 'Fetch a single business contact by its uuid, if visible for the current subject.'
     operationId: getContactByUuid
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: contactUUID
           in: path
@@ -32,7 +32,7 @@ patch:
     description: 'Updates a single contact by its uuid, if permitted for the current subject.'
     operationId: patchContact
     parameters:
-        -   $ref: 'auth.yaml#/components/parameters/currentUser'
+        -   $ref: 'auth.yaml#/components/parameters/currentSubject'
         -   $ref: 'auth.yaml#/components/parameters/assumedRoles'
         -   name: contactUUID
             in: path
@@ -63,7 +63,7 @@ delete:
     description: 'Delete a single business contact by its uuid, if permitted for the current subject.'
     operationId: deleteContactByUuid
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: contactUUID
           in: path
diff --git a/src/main/resources/api-definition/hs-office/hs-office-contacts.yaml b/src/main/resources/api-definition/hs-office/hs-office-contacts.yaml
index 52d54a87..03a6ff70 100644
--- a/src/main/resources/api-definition/hs-office/hs-office-contacts.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-contacts.yaml
@@ -5,7 +5,7 @@ get:
         - hs-office-contacts
     operationId: listContacts
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: name
           in: query
@@ -33,7 +33,7 @@ post:
         - hs-office-contacts
     operationId: addContact
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
     requestBody:
         content:
diff --git a/src/main/resources/api-definition/hs-office/hs-office-coopassets-with-uuid.yaml b/src/main/resources/api-definition/hs-office/hs-office-coopassets-with-uuid.yaml
index 7fd6d243..51d51c2c 100644
--- a/src/main/resources/api-definition/hs-office/hs-office-coopassets-with-uuid.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-coopassets-with-uuid.yaml
@@ -4,7 +4,7 @@ get:
     description: 'Fetch a single asset transaction by its uuid, if visible for the current subject.'
     operationId: getCoopAssetTransactionByUuid
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: assetTransactionUUID
           in: path
diff --git a/src/main/resources/api-definition/hs-office/hs-office-coopassets.yaml b/src/main/resources/api-definition/hs-office/hs-office-coopassets.yaml
index aa0ae953..24ffd3d1 100644
--- a/src/main/resources/api-definition/hs-office/hs-office-coopassets.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-coopassets.yaml
@@ -5,7 +5,7 @@ get:
     - hs-office-coopAssets
   operationId: listCoopAssets
   parameters:
-    - $ref: 'auth.yaml#/components/parameters/currentUser'
+    - $ref: 'auth.yaml#/components/parameters/currentSubject'
     - $ref: 'auth.yaml#/components/parameters/assumedRoles'
     - name: membershipUuid
       in: query
@@ -48,7 +48,7 @@ post:
     - hs-office-coopAssets
   operationId: addCoopAssetsTransaction
   parameters:
-    - $ref: 'auth.yaml#/components/parameters/currentUser'
+    - $ref: 'auth.yaml#/components/parameters/currentSubject'
     - $ref: 'auth.yaml#/components/parameters/assumedRoles'
   requestBody:
     description: A JSON object describing the new cooperative assets transaction.
diff --git a/src/main/resources/api-definition/hs-office/hs-office-coopshares-with-uuid.yaml b/src/main/resources/api-definition/hs-office/hs-office-coopshares-with-uuid.yaml
index cd7ff827..a37dbf7e 100644
--- a/src/main/resources/api-definition/hs-office/hs-office-coopshares-with-uuid.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-coopshares-with-uuid.yaml
@@ -4,7 +4,7 @@ get:
     description: 'Fetch a single share transaction by its uuid, if visible for the current subject.'
     operationId: getCoopShareTransactionByUuid
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: shareTransactionUUID
           in: path
diff --git a/src/main/resources/api-definition/hs-office/hs-office-coopshares.yaml b/src/main/resources/api-definition/hs-office/hs-office-coopshares.yaml
index 338018ad..a886ab82 100644
--- a/src/main/resources/api-definition/hs-office/hs-office-coopshares.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-coopshares.yaml
@@ -5,7 +5,7 @@ get:
     - hs-office-coopShares
   operationId: listCoopShares
   parameters:
-    - $ref: 'auth.yaml#/components/parameters/currentUser'
+    - $ref: 'auth.yaml#/components/parameters/currentSubject'
     - $ref: 'auth.yaml#/components/parameters/assumedRoles'
     - name: membershipUuid
       in: query
@@ -48,7 +48,7 @@ post:
     - hs-office-coopShares
   operationId: addCoopSharesTransaction
   parameters:
-    - $ref: 'auth.yaml#/components/parameters/currentUser'
+    - $ref: 'auth.yaml#/components/parameters/currentSubject'
     - $ref: 'auth.yaml#/components/parameters/assumedRoles'
   requestBody:
     description: A JSON object describing the new cooperative shares transaction.
diff --git a/src/main/resources/api-definition/hs-office/hs-office-debitors-with-uuid.yaml b/src/main/resources/api-definition/hs-office/hs-office-debitors-with-uuid.yaml
index 09c6d42d..feb8e473 100644
--- a/src/main/resources/api-definition/hs-office/hs-office-debitors-with-uuid.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-debitors-with-uuid.yaml
@@ -4,7 +4,7 @@ get:
     description: 'Fetch a single debitor by its uuid, if visible for the current subject.'
     operationId: getDebitorByUuid
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: debitorUUID
           in: path
@@ -32,7 +32,7 @@ patch:
     description: 'Updates a single debitor by its uuid, if permitted for the current subject.'
     operationId: patchDebitor
     parameters:
-        -   $ref: 'auth.yaml#/components/parameters/currentUser'
+        -   $ref: 'auth.yaml#/components/parameters/currentSubject'
         -   $ref: 'auth.yaml#/components/parameters/assumedRoles'
         -   name: debitorUUID
             in: path
@@ -63,7 +63,7 @@ delete:
     description: 'Delete a single debitor by its uuid, if permitted for the current subject.'
     operationId: deleteDebitorByUuid
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: debitorUUID
           in: path
diff --git a/src/main/resources/api-definition/hs-office/hs-office-debitors.yaml b/src/main/resources/api-definition/hs-office/hs-office-debitors.yaml
index 5936198b..e0327d2f 100644
--- a/src/main/resources/api-definition/hs-office/hs-office-debitors.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-debitors.yaml
@@ -5,7 +5,7 @@ get:
         - hs-office-debitors
     operationId: listDebitors
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: name
           in: query
@@ -39,7 +39,7 @@ post:
         - hs-office-debitors
     operationId: addDebitor
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
     requestBody:
         content:
diff --git a/src/main/resources/api-definition/hs-office/hs-office-memberships-with-uuid.yaml b/src/main/resources/api-definition/hs-office/hs-office-memberships-with-uuid.yaml
index 4bd1b3fb..1511e09f 100644
--- a/src/main/resources/api-definition/hs-office/hs-office-memberships-with-uuid.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-memberships-with-uuid.yaml
@@ -4,7 +4,7 @@ get:
     description: 'Fetch a single membership by its uuid, if visible for the current subject.'
     operationId: getMembershipByUuid
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: membershipUUID
           in: path
@@ -32,7 +32,7 @@ patch:
     description: 'Updates a single membership by its uuid, if permitted for the current subject.'
     operationId: patchMembership
     parameters:
-        -   $ref: 'auth.yaml#/components/parameters/currentUser'
+        -   $ref: 'auth.yaml#/components/parameters/currentSubject'
         -   $ref: 'auth.yaml#/components/parameters/assumedRoles'
         -   name: membershipUUID
             in: path
@@ -63,7 +63,7 @@ delete:
     description: 'Delete a single membership by its uuid, if permitted for the current subject.'
     operationId: deleteMembershipByUuid
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: membershipUUID
           in: path
diff --git a/src/main/resources/api-definition/hs-office/hs-office-memberships.yaml b/src/main/resources/api-definition/hs-office/hs-office-memberships.yaml
index 260dee51..e394faf0 100644
--- a/src/main/resources/api-definition/hs-office/hs-office-memberships.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-memberships.yaml
@@ -6,7 +6,7 @@ get:
         - hs-office-memberships
     operationId: listMemberships
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: partnerUuid
           in: query
@@ -41,7 +41,7 @@ post:
         - hs-office-memberships
     operationId: addMembership
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
     requestBody:
         description: A JSON object describing the new membership.
diff --git a/src/main/resources/api-definition/hs-office/hs-office-partners-with-uuid.yaml b/src/main/resources/api-definition/hs-office/hs-office-partners-with-uuid.yaml
index 914df66b..e19e6cd2 100644
--- a/src/main/resources/api-definition/hs-office/hs-office-partners-with-uuid.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-partners-with-uuid.yaml
@@ -4,7 +4,7 @@ get:
     description: 'Fetch a single business partner by its uuid, if visible for the current subject.'
     operationId: getPartnerByUuid
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: partnerUUID
           in: path
@@ -32,7 +32,7 @@ patch:
     description: 'Updates a single business partner by its uuid, if permitted for the current subject.'
     operationId: patchPartner
     parameters:
-        -   $ref: 'auth.yaml#/components/parameters/currentUser'
+        -   $ref: 'auth.yaml#/components/parameters/currentSubject'
         -   $ref: 'auth.yaml#/components/parameters/assumedRoles'
         -   name: partnerUUID
             in: path
@@ -63,7 +63,7 @@ delete:
     description: 'Delete a single business partner by its uuid, if permitted for the current subject.'
     operationId: deletePartnerByUuid
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: partnerUUID
           in: path
diff --git a/src/main/resources/api-definition/hs-office/hs-office-partners.yaml b/src/main/resources/api-definition/hs-office/hs-office-partners.yaml
index 1f6ee36e..1936a7cb 100644
--- a/src/main/resources/api-definition/hs-office/hs-office-partners.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-partners.yaml
@@ -5,7 +5,7 @@ get:
         - hs-office-partners
     operationId: listPartners
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: name
           in: query
@@ -33,7 +33,7 @@ post:
         - hs-office-partners
     operationId: addPartner
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
     requestBody:
         content:
diff --git a/src/main/resources/api-definition/hs-office/hs-office-persons-with-uuid.yaml b/src/main/resources/api-definition/hs-office/hs-office-persons-with-uuid.yaml
index 1b90c777..fe63c509 100644
--- a/src/main/resources/api-definition/hs-office/hs-office-persons-with-uuid.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-persons-with-uuid.yaml
@@ -4,7 +4,7 @@ get:
     description: 'Fetch a single business person by its uuid, if visible for the current subject.'
     operationId: getPersonByUuid
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: personUUID
           in: path
@@ -32,7 +32,7 @@ patch:
     description: 'Updates a single person by its uuid, if permitted for the current subject.'
     operationId: patchPerson
     parameters:
-        -   $ref: 'auth.yaml#/components/parameters/currentUser'
+        -   $ref: 'auth.yaml#/components/parameters/currentSubject'
         -   $ref: 'auth.yaml#/components/parameters/assumedRoles'
         -   name: personUUID
             in: path
@@ -63,7 +63,7 @@ delete:
     description: 'Delete a single business person by its uuid, if permitted for the current subject.'
     operationId: deletePersonByUuid
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: personUUID
           in: path
diff --git a/src/main/resources/api-definition/hs-office/hs-office-persons.yaml b/src/main/resources/api-definition/hs-office/hs-office-persons.yaml
index f7cba51a..71471c83 100644
--- a/src/main/resources/api-definition/hs-office/hs-office-persons.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-persons.yaml
@@ -5,7 +5,7 @@ get:
         - hs-office-persons
     operationId: listPersons
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: name
           in: query
@@ -33,7 +33,7 @@ post:
         - hs-office-persons
     operationId: addPerson
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
     requestBody:
         content:
diff --git a/src/main/resources/api-definition/hs-office/hs-office-relations-with-uuid.yaml b/src/main/resources/api-definition/hs-office/hs-office-relations-with-uuid.yaml
index 4e8010e7..3dbe1391 100644
--- a/src/main/resources/api-definition/hs-office/hs-office-relations-with-uuid.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-relations-with-uuid.yaml
@@ -4,7 +4,7 @@ get:
     description: 'Fetch a single person relation by its uuid, if visible for the current subject.'
     operationId: getRelationByUuid
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: relationUUID
           in: path
@@ -32,7 +32,7 @@ patch:
     description: 'Updates a single person relation by its uuid, if permitted for the current subject.'
     operationId: patchRelation
     parameters:
-        -   $ref: 'auth.yaml#/components/parameters/currentUser'
+        -   $ref: 'auth.yaml#/components/parameters/currentSubject'
         -   $ref: 'auth.yaml#/components/parameters/assumedRoles'
         -   name: relationUUID
             in: path
@@ -63,7 +63,7 @@ delete:
     description: 'Delete a single person relation by its uuid, if permitted for the current subject.'
     operationId: deleteRelationByUuid
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: relationUUID
           in: path
diff --git a/src/main/resources/api-definition/hs-office/hs-office-relations.yaml b/src/main/resources/api-definition/hs-office/hs-office-relations.yaml
index 94131df5..0bcb9145 100644
--- a/src/main/resources/api-definition/hs-office/hs-office-relations.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-relations.yaml
@@ -5,7 +5,7 @@ get:
         - hs-office-relations
     operationId: listRelations
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: personUuid
           in: query
@@ -40,7 +40,7 @@ post:
         - hs-office-relations
     operationId: addRelation
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
     requestBody:
         content:
diff --git a/src/main/resources/api-definition/hs-office/hs-office-sepamandates-with-uuid.yaml b/src/main/resources/api-definition/hs-office/hs-office-sepamandates-with-uuid.yaml
index 52d050ee..1e14a235 100644
--- a/src/main/resources/api-definition/hs-office/hs-office-sepamandates-with-uuid.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-sepamandates-with-uuid.yaml
@@ -4,7 +4,7 @@ get:
     description: 'Fetch a single SEPA Mandate by its uuid, if visible for the current subject.'
     operationId: getSepaMandateByUuid
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: sepaMandateUUID
           in: path
@@ -32,7 +32,7 @@ patch:
     description: 'Updates a single SEPA Mandate by its uuid, if permitted for the current subject.'
     operationId: patchSepaMandate
     parameters:
-        -   $ref: 'auth.yaml#/components/parameters/currentUser'
+        -   $ref: 'auth.yaml#/components/parameters/currentSubject'
         -   $ref: 'auth.yaml#/components/parameters/assumedRoles'
         -   name: sepaMandateUUID
             in: path
@@ -63,7 +63,7 @@ delete:
     description: 'Delete a single SEPA Mandate by its uuid, if permitted for the current subject.'
     operationId: deleteSepaMandateByUuid
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: sepaMandateUUID
           in: path
diff --git a/src/main/resources/api-definition/hs-office/hs-office-sepamandates.yaml b/src/main/resources/api-definition/hs-office/hs-office-sepamandates.yaml
index 82f8f154..76f28092 100644
--- a/src/main/resources/api-definition/hs-office/hs-office-sepamandates.yaml
+++ b/src/main/resources/api-definition/hs-office/hs-office-sepamandates.yaml
@@ -5,7 +5,7 @@ get:
         - hs-office-sepaMandates
     operationId: listSepaMandatesByIBAN
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: name
           in: query
@@ -33,7 +33,7 @@ post:
         - hs-office-sepaMandates
     operationId: addSepaMandate
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
     requestBody:
         description: A JSON object describing the new SEPA-Mandate.
diff --git a/src/main/resources/api-definition/rbac/rbac-grants-with-id.yaml b/src/main/resources/api-definition/rbac/rbac-grants-with-id.yaml
index b45ebb4e..5bdcd29e 100644
--- a/src/main/resources/api-definition/rbac/rbac-grants-with-id.yaml
+++ b/src/main/resources/api-definition/rbac/rbac-grants-with-id.yaml
@@ -3,7 +3,7 @@ get:
     - rbac-grants
   operationId: getGrantById
   parameters:
-    - $ref: 'auth.yaml#/components/parameters/currentUser'
+    - $ref: 'auth.yaml#/components/parameters/currentSubject'
     - $ref: 'auth.yaml#/components/parameters/assumedRoles'
     - name: grantedRoleUuid
       in: path
@@ -38,7 +38,7 @@ delete:
         - rbac-grants
     operationId: revokeRoleFromUser
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: grantedRoleUuid
           in: path
diff --git a/src/main/resources/api-definition/rbac/rbac-grants.yaml b/src/main/resources/api-definition/rbac/rbac-grants.yaml
index 16011bcd..1452b8c6 100644
--- a/src/main/resources/api-definition/rbac/rbac-grants.yaml
+++ b/src/main/resources/api-definition/rbac/rbac-grants.yaml
@@ -3,7 +3,7 @@ get:
         - rbac-grants
     operationId: listUserGrants
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
     responses:
         "200":
@@ -20,7 +20,7 @@ post:
         - rbac-grants
     operationId: grantRoleToUser
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
     requestBody:
         required: true
diff --git a/src/main/resources/api-definition/rbac/rbac-roles.yaml b/src/main/resources/api-definition/rbac/rbac-roles.yaml
index b97aa387..e35ee44e 100644
--- a/src/main/resources/api-definition/rbac/rbac-roles.yaml
+++ b/src/main/resources/api-definition/rbac/rbac-roles.yaml
@@ -3,7 +3,7 @@ get:
         - rbac-roles
     operationId: listRoles
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
     responses:
         "200":
diff --git a/src/main/resources/api-definition/rbac/rbac-users-with-id-permissions.yaml b/src/main/resources/api-definition/rbac/rbac-users-with-id-permissions.yaml
index ba6eb3fe..34ea9fcc 100644
--- a/src/main/resources/api-definition/rbac/rbac-users-with-id-permissions.yaml
+++ b/src/main/resources/api-definition/rbac/rbac-users-with-id-permissions.yaml
@@ -4,7 +4,7 @@ get:
     description: 'List all visible permissions granted to the given user; reduced '
     operationId: listUserPermissions
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: userUuid
           in: path
diff --git a/src/main/resources/api-definition/rbac/rbac-users-with-uuid.yaml b/src/main/resources/api-definition/rbac/rbac-users-with-uuid.yaml
index 058fc5cd..974faa3c 100644
--- a/src/main/resources/api-definition/rbac/rbac-users-with-uuid.yaml
+++ b/src/main/resources/api-definition/rbac/rbac-users-with-uuid.yaml
@@ -4,7 +4,7 @@ get:
     description: 'Fetch a single user by its id, if visible for the current subject.'
     operationId: getUserById
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: userUuid
           in: path
@@ -31,7 +31,7 @@ delete:
         - rbac-users
     operationId: deleteUserByUuid
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: userUuid
           in: path
diff --git a/src/main/resources/api-definition/rbac/rbac-users.yaml b/src/main/resources/api-definition/rbac/rbac-users.yaml
index 4acb729e..e447f25d 100644
--- a/src/main/resources/api-definition/rbac/rbac-users.yaml
+++ b/src/main/resources/api-definition/rbac/rbac-users.yaml
@@ -4,7 +4,7 @@ get:
     description: List accessible RBAC users with optional filter by name.
     operationId: listUsers
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: name
           in: query
diff --git a/src/main/resources/api-definition/test/test-customers.yaml b/src/main/resources/api-definition/test/test-customers.yaml
index 89a8fb6b..25800099 100644
--- a/src/main/resources/api-definition/test/test-customers.yaml
+++ b/src/main/resources/api-definition/test/test-customers.yaml
@@ -5,7 +5,7 @@ get:
         - testCustomers
     operationId: listCustomers
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: prefix
           in: query
@@ -33,7 +33,7 @@ post:
         - testCustomers
     operationId: addCustomer
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
     requestBody:
         content:
diff --git a/src/main/resources/api-definition/test/test-packages-uuid.yaml b/src/main/resources/api-definition/test/test-packages-uuid.yaml
index 4fc8ef80..994810df 100644
--- a/src/main/resources/api-definition/test/test-packages-uuid.yaml
+++ b/src/main/resources/api-definition/test/test-packages-uuid.yaml
@@ -3,7 +3,7 @@ patch:
         - testPackages
     operationId: updatePackage
     parameters:
-        -   $ref: 'auth.yaml#/components/parameters/currentUser'
+        -   $ref: 'auth.yaml#/components/parameters/currentSubject'
         -   $ref: 'auth.yaml#/components/parameters/assumedRoles'
         -   name: packageUUID
             in: path
diff --git a/src/main/resources/api-definition/test/test-packages.yaml b/src/main/resources/api-definition/test/test-packages.yaml
index 6a3e0e7f..98190e30 100644
--- a/src/main/resources/api-definition/test/test-packages.yaml
+++ b/src/main/resources/api-definition/test/test-packages.yaml
@@ -3,7 +3,7 @@ get:
         - testPackages
     operationId: listPackages
     parameters:
-        - $ref: 'auth.yaml#/components/parameters/currentUser'
+        - $ref: 'auth.yaml#/components/parameters/currentSubject'
         - $ref: 'auth.yaml#/components/parameters/assumedRoles'
         - name: name
           in: query
diff --git a/src/main/resources/db/changelog/0-basis/000-basis-schema.sql b/src/main/resources/db/changelog/0-basis/000-basis-schema.sql
index 689a94ba..a20d690f 100644
--- a/src/main/resources/db/changelog/0-basis/000-basis-schema.sql
+++ b/src/main/resources/db/changelog/0-basis/000-basis-schema.sql
@@ -2,7 +2,7 @@
 
 
 -- ============================================================================
---changeset basis-schema:1 endDelimiter:--//
+--changeset basis-SCHEMA:1 endDelimiter:--//
 -- ----------------------------------------------------------------------------
 CREATE SCHEMA basis;
 --//
diff --git a/src/main/resources/db/changelog/0-basis/010-context.sql b/src/main/resources/db/changelog/0-basis/010-context.sql
index e0ff1818..d6e14ee6 100644
--- a/src/main/resources/db/changelog/0-basis/010-context.sql
+++ b/src/main/resources/db/changelog/0-basis/010-context.sql
@@ -12,7 +12,7 @@
 create procedure basis.contextDefined(
     currentTask varchar(127),
     currentRequest text,
-    currentUser varchar(63),
+    currentSubject varchar(63),
     assumedRoles varchar(1023)
 )
     language plpgsql as $$
@@ -25,7 +25,7 @@ end; $$;
 create or replace procedure basis.defineContext(
     currentTask varchar(127),
     currentRequest text = null,
-    currentUser varchar(63) = null,
+    currentSubject varchar(63) = null,
     assumedRoles varchar(1023) = null
 )
     language plpgsql as $$
@@ -38,15 +38,15 @@ begin
     currentRequest := coalesce(currentRequest, '');
     execute format('set local hsadminng.currentRequest to %L', currentRequest);
 
-    currentUser := coalesce(currentUser, '');
-    assert length(currentUser) <= 63, FORMAT('currentUser must not be longer than 63 characters: "%s"', currentUser);
-    execute format('set local hsadminng.currentUser to %L', currentUser);
+    currentSubject := coalesce(currentSubject, '');
+    assert length(currentSubject) <= 63, FORMAT('currentSubject must not be longer than 63 characters: "%s"', currentSubject);
+    execute format('set local hsadminng.currentSubject to %L', currentSubject);
 
     assumedRoles := coalesce(assumedRoles, '');
     assert length(assumedRoles) <= 1023, FORMAT('assumedRoles must not be longer than 1023 characters: "%s"', assumedRoles);
     execute format('set local hsadminng.assumedRoles to %L', assumedRoles);
 
-    call basis.contextDefined(currentTask, currentRequest, currentUser, assumedRoles);
+    call basis.contextDefined(currentTask, currentRequest, currentSubject, assumedRoles);
 end; $$;
 --//
 
@@ -105,25 +105,25 @@ end; $$;
 
 
 -- ============================================================================
---changeset context-CURRENT-USER:1 endDelimiter:--//
+--changeset context-current-subject:1 endDelimiter:--//
 -- ----------------------------------------------------------------------------
 /*
     Returns the current user as defined by `basis.defineContext(...)`.
  */
-create or replace function basis.currentUser()
+create or replace function basis.currentSubject() -- FIXME: move to schema rbac?
     returns varchar(63)
     stable -- leakproof
     language plpgsql as $$
 declare
-    currentUser varchar(63);
+    currentSubject varchar(63);
 begin
     begin
-        currentUser := current_setting('hsadminng.currentUser');
+        currentSubject := current_setting('hsadminng.currentSubject');
     exception
         when others then
-            currentUser := null;
+            currentSubject := null;
     end;
-    return currentUser;
+    return currentSubject;
 end; $$;
 --//
 
@@ -217,7 +217,7 @@ begin
     if array_length(assumedRoles, 1) > 0 then
         return assumedRoles;
     else
-        return array [basis.currentUser()]::varchar(1023)[];
+        return array [basis.currentSubject()]::varchar(1023)[];
     end if;
 end; $$;
 
diff --git a/src/main/resources/db/changelog/0-basis/020-audit-log.sql b/src/main/resources/db/changelog/0-basis/020-audit-log.sql
index 51efc301..b1835fff 100644
--- a/src/main/resources/db/changelog/0-basis/020-audit-log.sql
+++ b/src/main/resources/db/changelog/0-basis/020-audit-log.sql
@@ -25,7 +25,7 @@ create table basis.tx_context
 (
     txId            xid8            primary key     not null,
     txTimestamp     timestamp                       not null,
-    currentUser     varchar(63)                     not null, -- not the uuid, because users can be deleted
+    currentSubject     varchar(63)                     not null, -- not the uuid, because users can be deleted
     assumedRoles    varchar(1023)                   not null, -- not the uuids, because roles can be deleted
     currentTask     varchar(127)                    not null,
     currentRequest  text                            not null
@@ -82,9 +82,9 @@ begin
     curTxId := pg_current_xact_id();
 
     insert
-        into basis.tx_context (txId, txTimestamp, currentUser, assumedRoles, currentTask, currentRequest)
+        into basis.tx_context (txId, txTimestamp, currentSubject, assumedRoles, currentTask, currentRequest)
             values ( curTxId, now(),
-                     basis.currentUser(), basis.assumedRoles(), curTask, basis.currentRequest())
+                     basis.currentSubject(), basis.assumedRoles(), curTask, basis.currentRequest())
         on conflict do nothing;
 
     case tg_op
@@ -123,7 +123,7 @@ declare
 begin
     targetTable := lower(targetTable);
 
-    createTriggerSQL = 'CREATE TRIGGER ' || targetTable || '_journal' ||
+    createTriggerSQL = 'CREATE TRIGGER tx_journal_tg' ||
                        ' AFTER INSERT OR UPDATE OR DELETE ON ' || targetTable ||
                        '   FOR EACH ROW EXECUTE PROCEDURE basis.tx_journal_trigger()';
     execute createTriggerSQL;
diff --git a/src/main/resources/db/changelog/0-basis/030-historization.sql b/src/main/resources/db/changelog/0-basis/030-historization.sql
index 6368df06..dd523006 100644
--- a/src/main/resources/db/changelog/0-basis/030-historization.sql
+++ b/src/main/resources/db/changelog/0-basis/030-historization.sql
@@ -47,7 +47,7 @@ create or replace function tx_historicize_tf()
     language plpgsql
     strict as $$
 declare
-    currentUser varchar(63);
+    currentSubject varchar(63);
     currentTask varchar(127);
     "row"       record;
     "alive"     boolean;
@@ -55,15 +55,15 @@ declare
 begin
     -- determine user_id
     begin
-        currentUser := current_setting('hsadminng.currentUser');
+        currentSubject := current_setting('hsadminng.currentSubject');
     exception
         when others then
-            currentUser := null;
+            currentSubject := null;
     end;
-    if (currentUser is null or currentUser = '') then
-        raise exception 'hsadminng.currentUser must be defined, please use "SET LOCAL ...;"';
+    if (currentSubject is null or currentSubject = '') then
+        raise exception 'hsadminng.currentSubject must be defined, please use "SET LOCAL ...;"';
     end if;
-    raise notice 'currentUser: %', currentUser;
+    raise notice 'currentSubject: %', currentSubject;
 
     -- determine task
     currentTask = current_setting('hsadminng.currentTask');
diff --git a/src/main/resources/db/changelog/1-rbac/1000-rbac-schema.sql b/src/main/resources/db/changelog/1-rbac/1000-rbac-schema.sql
new file mode 100644
index 00000000..14f3ba93
--- /dev/null
+++ b/src/main/resources/db/changelog/1-rbac/1000-rbac-schema.sql
@@ -0,0 +1,8 @@
+--liquibase formatted sql
+
+
+-- ============================================================================
+--changeset rbac-SCHEMA:1 endDelimiter:--//
+-- ----------------------------------------------------------------------------
+CREATE SCHEMA rbac;
+--//
diff --git a/src/main/resources/db/changelog/1-rbac/1050-rbac-base.sql b/src/main/resources/db/changelog/1-rbac/1050-rbac-base.sql
index 695719be..99665c18 100644
--- a/src/main/resources/db/changelog/1-rbac/1050-rbac-base.sql
+++ b/src/main/resources/db/changelog/1-rbac/1050-rbac-base.sql
@@ -6,25 +6,25 @@
 /*
 
  */
-create type ReferenceType as enum ('RbacUser', 'RbacRole', 'RbacPermission');
+create type rbac.referenceType as enum ('rbac.subject', 'RbacRole', 'RbacPermission');
 
-create table RbacReference
+create table rbac.reference
 (
     uuid uuid unique default uuid_generate_v4(),
-    type ReferenceType not null
+    type rbac.referenceType not null
 );
 
-create or replace function assertReferenceType(argument varchar, referenceId uuid, expectedType ReferenceType)
-    returns ReferenceType
+create or replace function rbac.assertReferenceType(argument varchar, referenceId uuid, expectedType rbac.referenceType)
+    returns rbac.referenceType
     language plpgsql as $$
 declare
-    actualType ReferenceType;
+    actualType rbac.referenceType;
 begin
     if referenceId is null then
         raise exception '% must be a % and not null', argument, expectedType;
     end if;
 
-    actualType = (select type from RbacReference where uuid = referenceId);
+    actualType = (select type from  rbac.reference where uuid = referenceId);
     if (actualType <> expectedType) then
         raise exception '% must reference a %, but got a %', argument, expectedType, actualType;
     end if;
@@ -33,20 +33,20 @@ end; $$;
 --//
 
 -- ============================================================================
---changeset rbac-base-USER:1 endDelimiter:--//
+--changeset rbac-base-SUBJECT:1 endDelimiter:--//
 -- ----------------------------------------------------------------------------
 /*
 
  */
-create table RbacUser
+create table rbac.subject
 (
-    uuid uuid primary key references RbacReference (uuid) on delete cascade,
+    uuid uuid primary key references  rbac.reference (uuid) on delete cascade,
     name varchar(63) not null unique
 );
 
-call basis.create_journal('RbacUser');
+call basis.create_journal('rbac.subject');
 
-create or replace function createRbacUser(userName varchar)
+create or replace function rbac.create_subject(subjectName varchar)
     returns uuid
     returns null on null input
     language plpgsql as $$
@@ -54,37 +54,37 @@ declare
     objectId uuid;
 begin
     insert
-        into RbacReference (type)
-        values ('RbacUser')
+        into  rbac.reference (type)
+        values ('rbac.subject')
         returning uuid into objectId;
     insert
-        into RbacUser (uuid, name)
-        values (objectid, userName);
+        into rbac.subject (uuid, name)
+        values (objectid, subjectName);
     return objectId;
 end;
 $$;
 
-create or replace function createRbacUser(refUuid uuid, userName varchar)
+create or replace function rbac.create_subject(refUuid uuid, subjectName varchar)
     returns uuid
     called on null input
     language plpgsql as $$
 begin
     insert
-        into RbacReference as r (uuid, type)
-        values (coalesce(refUuid, uuid_generate_v4()), 'RbacUser')
+        into  rbac.reference as r (uuid, type)
+        values (coalesce(refUuid, uuid_generate_v4()), 'rbac.subject')
         returning r.uuid into refUuid;
     insert
-        into RbacUser (uuid, name)
-        values (refUuid, userName);
+        into rbac.subject (uuid, name)
+        values (refUuid, subjectName);
     return refUuid;
 end;
 $$;
 
-create or replace function findRbacUserId(userName varchar)
+create or replace function rbac.find_subject_id(subjectName varchar)
     returns uuid
     returns null on null input
     language sql as $$
-select uuid from RbacUser where name = userName
+select uuid from rbac.subject where name = subjectName
 $$;
 --//
 
@@ -94,7 +94,7 @@ $$;
 /*
 
  */
-create table RbacObject
+create table rbac.object
 (
     uuid        uuid primary key default uuid_generate_v4(),
     serialId    serial, -- TODO.perf: only needed for reverse deletion of temp test data
@@ -102,7 +102,7 @@ create table RbacObject
     unique (objectTable, uuid)
 );
 
-call basis.create_journal('RbacObject');
+call basis.create_journal('rbac.object');
 
 --//
 
@@ -112,9 +112,9 @@ call basis.create_journal('RbacObject');
 -- ----------------------------------------------------------------------------
 
 /*
-    Inserts related RbacObject for use in the BEFORE ONSERT TRIGGERs on the business objects.
+    Inserts related rbac.object for use in the BEFORE INSERT TRIGGERs on the business objects.
  */
-create or replace function insertRelatedRbacObject()
+create or replace function rbac.insert_related_object()
     returns trigger
     language plpgsql
     strict as $$
@@ -124,13 +124,13 @@ begin
     if TG_OP = 'INSERT' then
         if NEW.uuid is null then
             insert
-                into RbacObject (objectTable)
+                into rbac.object (objectTable)
                 values (TG_TABLE_NAME)
                 returning uuid into objectUuid;
             NEW.uuid = objectUuid;
         else
             insert
-                into RbacObject (uuid, objectTable)
+                into rbac.object (uuid, objectTable)
                 values (NEW.uuid, TG_TABLE_NAME)
                 returning uuid into objectUuid;
         end if;
@@ -141,7 +141,7 @@ begin
 end; $$;
 
 /*
-    Deletes related RbacObject for use in the BEFORE DELETE TRIGGERs on the business objects.
+    Deletes related rbac.object for use in the BEFORE DELETE TRIGGERs on the business objects.
  */
 create or replace function deleteRelatedRbacObject()
     returns trigger
@@ -149,7 +149,7 @@ create or replace function deleteRelatedRbacObject()
     strict as $$
 begin
     if TG_OP = 'DELETE' then
-        delete from RbacObject where rbacobject.uuid = old.uuid;
+        delete from rbac.object where rbac.object.uuid = old.uuid;
     else
         raise exception 'invalid usage of TRIGGER BEFORE DELETE';
     end if;
@@ -168,8 +168,8 @@ create type RbacRoleType as enum ('OWNER', 'ADMIN', 'AGENT', 'TENANT', 'GUEST',
 
 create table RbacRole
 (
-    uuid       uuid primary key references RbacReference (uuid) on delete cascade initially deferred, -- initially deferred
-    objectUuid uuid not null references RbacObject (uuid) initially deferred,
+    uuid       uuid primary key references  rbac.reference (uuid) on delete cascade initially deferred, -- initially deferred
+    objectUuid uuid not null references rbac.object (uuid) initially deferred,
     roleType   RbacRoleType not null,
     unique (objectUuid, roleType)
 );
@@ -217,7 +217,7 @@ declare
     referenceId uuid;
 begin
     insert
-        into RbacReference (type)
+        into  rbac.reference (type)
         values ('RbacRole')
         returning uuid into referenceId;
     insert
@@ -231,7 +231,7 @@ $$;
 create or replace procedure deleteRole(roleUUid uuid)
     language plpgsql as $$
 begin
-    --raise exception '% deleting role uuid %', currentsubjectsuuids(), roleUUid;
+    --raise exception '% deleting role uuid %', rbac.currentSubjectOrAssumedRolesUuids(), roleUUid;
     delete from RbacRole where uuid = roleUUid;
 end;
 $$;
@@ -323,7 +323,7 @@ execute procedure deleteRbacGrantsOfRbacRole();
 -- ----------------------------------------------------------------------------
 
 /*
-    RbacObject BEFORE DELETE TRIGGER function which deletes all related roles.
+    rbac.object BEFORE DELETE TRIGGER function which deletes all related roles.
  */
 create or replace function deleteRbacRolesOfRbacObject()
     returns trigger
@@ -344,7 +344,7 @@ end; $$;
  */
 create trigger deleteRbacRolesOfRbacObject_Trigger
     before delete
-    on RbacObject
+    on rbac.object
     for each row
         execute procedure deleteRbacRolesOfRbacObject();
 --//
@@ -367,8 +367,8 @@ create domain RbacOp as varchar(6)
 
 create table RbacPermission
 (
-    uuid        uuid primary key references RbacReference (uuid) on delete cascade,
-    objectUuid  uuid not null references RbacObject,
+    uuid        uuid primary key references  rbac.reference (uuid) on delete cascade,
+    objectUuid  uuid not null references rbac.object,
     op          RbacOp not null,
     opTableName varchar(60)
 );
@@ -402,7 +402,7 @@ begin
          where objectUuid = forObjectUuid
            and op = forOp and opTableName is not distinct from forOpTableName);
     if (permissionUuid is null) then
-        insert into RbacReference ("type")
+        insert into  rbac.reference ("type")
             values ('RbacPermission')
             returning uuid into permissionUuid;
         begin
@@ -482,15 +482,15 @@ $$;
 --changeset rbac-base-GRANTS:1 endDelimiter:--//
 -- ----------------------------------------------------------------------------
 /*
-    Table to store grants / role- or permission assignments to users or roles.
+    Table to store grants / role- or permission assignments to subjects or roles.
  */
 create table RbacGrants
 (
     uuid                uuid primary key default uuid_generate_v4(),
-    grantedByTriggerOf  uuid references RbacObject (uuid) on delete cascade initially deferred ,
+    grantedByTriggerOf  uuid references rbac.object (uuid) on delete cascade initially deferred ,
     grantedByRoleUuid   uuid references RbacRole (uuid),
-    ascendantUuid       uuid references RbacReference (uuid),
-    descendantUuid      uuid references RbacReference (uuid),
+    ascendantUuid       uuid references  rbac.reference (uuid),
+    descendantUuid      uuid references  rbac.reference (uuid),
     assumed             boolean not null default true,  -- auto assumed (true) vs. needs assumeRoles (false)
     unique (ascendantUuid, descendantUuid),
     constraint rbacGrant_createdBy check ( grantedByRoleUuid is null or grantedByTriggerOf is null) );
@@ -499,7 +499,7 @@ create index on RbacGrants (descendantUuid);
 
 call basis.create_journal('RbacGrants');
 create or replace function findGrantees(grantedId uuid)
-    returns setof RbacReference
+    returns setof  rbac.reference
     returns null on null input
     language sql as $$
 with recursive grants as (
@@ -513,7 +513,7 @@ with recursive grants as (
 )
 select ref.*
     from grants
-             join RbacReference ref on ref.uuid = grants.ascendantUuid;
+             join  rbac.reference ref on ref.uuid = grants.ascendantUuid;
 $$;
 
 create or replace function isGranted(granteeIds uuid[], grantedId uuid)
@@ -574,7 +574,7 @@ begin
 end;
 $$;
 
-create or replace function hasGlobalRoleGranted(userUuid uuid)
+create or replace function hasGlobalRoleGranted(forAscendantUuid uuid)
     returns bool
     stable -- leakproof
     language sql as $$
@@ -582,8 +582,8 @@ select exists(
            select r.uuid
                from RbacGrants as g
                         join RbacRole as r on r.uuid = g.descendantuuid
-                        join RbacObject as o on o.uuid = r.objectuuid
-               where g.ascendantuuid = userUuid
+                        join rbac.object as o on o.uuid = r.objectuuid
+               where g.ascendantuuid = forAscendantUuid
                  and o.objecttable = 'global'
            );
 $$;
@@ -591,8 +591,8 @@ $$;
 create or replace procedure grantPermissionToRole(permissionUuid uuid, roleUuid uuid)
     language plpgsql as $$
 begin
-    perform assertReferenceType('roleId (ascendant)', roleUuid, 'RbacRole');
-    perform assertReferenceType('permissionId (descendant)', permissionUuid, 'RbacPermission');
+    perform rbac.assertReferenceType('roleId (ascendant)', roleUuid, 'RbacRole');
+    perform rbac.assertReferenceType('permissionId (descendant)', permissionUuid, 'RbacPermission');
 
     insert
         into RbacGrants (grantedByTriggerOf, ascendantUuid, descendantUuid, assumed)
@@ -611,8 +611,8 @@ $$;
 create or replace procedure grantRoleToRole(subRoleId uuid, superRoleId uuid, doAssume bool = true)
     language plpgsql as $$
 begin
-    perform assertReferenceType('superRoleId (ascendant)', superRoleId, 'RbacRole');
-    perform assertReferenceType('subRoleId (descendant)', subRoleId, 'RbacRole');
+    perform rbac.assertReferenceType('superRoleId (ascendant)', superRoleId, 'RbacRole');
+    perform rbac.assertReferenceType('subRoleId (descendant)', subRoleId, 'RbacRole');
 
     if isGranted(subRoleId, superRoleId) then
         call raiseDuplicateRoleGrantException(subRoleId, superRoleId);
@@ -639,8 +639,8 @@ begin
     superRoleId := findRoleId(superRole);
     subRoleId := findRoleId(subRole);
 
-    perform assertReferenceType('superRoleId (ascendant)', superRoleId, 'RbacRole');
-    perform assertReferenceType('subRoleId (descendant)', subRoleId, 'RbacRole');
+    perform rbac.assertReferenceType('superRoleId (ascendant)', superRoleId, 'RbacRole');
+    perform rbac.assertReferenceType('subRoleId (descendant)', subRoleId, 'RbacRole');
 
     if isGranted(subRoleId, superRoleId) then
         call raiseDuplicateRoleGrantException(subRoleId, superRoleId);
@@ -661,8 +661,8 @@ begin
     superRoleId := findRoleId(superRole);
     subRoleId := findRoleId(subRole);
 
-    perform assertReferenceType('superRoleId (ascendant)', superRoleId, 'RbacRole');
-    perform assertReferenceType('subRoleId (descendant)', subRoleId, 'RbacRole');
+    perform rbac.assertReferenceType('superRoleId (ascendant)', superRoleId, 'RbacRole');
+    perform rbac.assertReferenceType('subRoleId (descendant)', subRoleId, 'RbacRole');
 
     if (isGranted(superRoleId, subRoleId)) then
         delete from RbacGrants where ascendantUuid = superRoleId and descendantUuid = subRoleId;
@@ -682,8 +682,8 @@ declare
 begin
     superRoleId := findRoleId(superRole);
 
-    perform assertReferenceType('superRoleId (ascendant)', superRoleId, 'RbacRole');
-    perform assertReferenceType('permission (descendant)', permissionId, 'RbacPermission');
+    perform rbac.assertReferenceType('superRoleId (ascendant)', superRoleId, 'RbacRole');
+    perform rbac.assertReferenceType('permission (descendant)', permissionId, 'RbacPermission');
 
     if (isGranted(superRoleId, permissionId)) then
         delete from RbacGrants where ascendantUuid = superRoleId and descendantUuid = permissionId;
@@ -691,7 +691,7 @@ begin
         select p.op, o.objectTable, o.uuid
             from rbacGrants g
                      join rbacPermission p on p.uuid=g.descendantUuid
-                     join rbacobject o on o.uuid=p.objectUuid
+                     join rbac.object o on o.uuid=p.objectUuid
             where g.uuid=permissionId
             into permissionOp, objectTable, objectUuid;
 
@@ -736,7 +736,7 @@ begin
         SELECT DISTINCT perm.objectUuid
             FROM granted
                      JOIN RbacPermission perm ON granted.descendantUuid = perm.uuid
-                     JOIN RbacObject obj ON obj.uuid = perm.objectUuid
+                     JOIN rbac.object obj ON obj.uuid = perm.objectUuid
             WHERE (requiredOp = 'SELECT' OR perm.op = requiredOp)
               AND obj.objectTable = forObjectTable
             LIMIT maxObjects+1;
@@ -756,7 +756,7 @@ $$;
 --changeset rbac-base-QUERY-GRANTED-PERMISSIONS:1 endDelimiter:--//
 -- ----------------------------------------------------------------------------
 /*
-    Returns all permissions accessible to the given subject UUID (user or role).
+    Returns all permissions accessible to the given subject UUID (subject or role).
  */
 create or replace function queryPermissionsGrantedToSubjectId(subjectId uuid)
     returns setof RbacPermission
@@ -782,18 +782,18 @@ $$;
 --//
 
 -- ============================================================================
---changeset rbac-base-QUERY-USERS-WITH-PERMISSION-FOR-OBJECT:1 endDelimiter:--//
+--changeset rbac-base-QUERY-SUBJECTS-WITH-PERMISSION-FOR-OBJECT:1 endDelimiter:--//
 -- ----------------------------------------------------------------------------
 /*
-    Returns all user UUIDs which have any permission for the given object UUID.
+    Returns all subject UUIDs which have any permission for the given object UUID.
  */
 
-create or replace function queryAllRbacUsersWithPermissionsFor(objectId uuid)
-    returns setof RbacUser
+create or replace function queryAllRbacSubjectsWithPermissionsFor(objectId uuid)
+    returns setof rbac.subject
     returns null on null input
     language sql as $$
 select *
-    from RbacUser
+    from rbac.subject
     where uuid in (
         -- @formatter:off
         with recursive grants as (
diff --git a/src/main/resources/db/changelog/1-rbac/1051-rbac-user-grant.sql b/src/main/resources/db/changelog/1-rbac/1051-rbac-user-grant.sql
index 99a0b349..087a2e2f 100644
--- a/src/main/resources/db/changelog/1-rbac/1051-rbac-user-grant.sql
+++ b/src/main/resources/db/changelog/1-rbac/1051-rbac-user-grant.sql
@@ -9,23 +9,23 @@ create or replace function assumedRoleUuid()
     stable -- leakproof
     language plpgsql as $$
 declare
-    currentSubjectsUuids uuid[];
+    currentSubjectOrAssumedRolesUuids uuid[];
 begin
     -- exactly one role must be assumed, not none not more than one
     if cardinality(basis.assumedRoles()) <> 1 then
         raise exception '[400] Granting roles to user is only possible if exactly one role is assumed, given: %', basis.assumedRoles();
     end if;
 
-    currentSubjectsUuids := currentSubjectsUuids();
-    return currentSubjectsUuids[1];
+    currentSubjectOrAssumedRolesUuids := rbac.currentSubjectOrAssumedRolesUuids();
+    return currentSubjectOrAssumedRolesUuids[1];
 end; $$;
 
 create or replace procedure grantRoleToUserUnchecked(grantedByRoleUuid uuid, grantedRoleUuid uuid, userUuid uuid, doAssume boolean = true)
     language plpgsql as $$
 begin
-    perform assertReferenceType('grantingRoleUuid', grantedByRoleUuid, 'RbacRole');
-    perform assertReferenceType('roleId (descendant)', grantedRoleUuid, 'RbacRole');
-    perform assertReferenceType('userId (ascendant)', userUuid, 'RbacUser');
+    perform rbac.assertReferenceType('grantingRoleUuid', grantedByRoleUuid, 'RbacRole');
+    perform rbac.assertReferenceType('roleId (descendant)', grantedRoleUuid, 'RbacRole');
+    perform rbac.assertReferenceType('userId (ascendant)', userUuid, 'rbac.subject');
 
     insert
         into RbacGrants (grantedByRoleUuid, ascendantUuid, descendantUuid, assumed)
@@ -40,18 +40,18 @@ declare
     grantedByRoleIdName text;
     grantedRoleIdName text;
 begin
-    perform assertReferenceType('grantingRoleUuid', grantedByRoleUuid, 'RbacRole');
-    perform assertReferenceType('grantedRoleUuid (descendant)', grantedRoleUuid, 'RbacRole');
-    perform assertReferenceType('userUuid (ascendant)', userUuid, 'RbacUser');
+    perform rbac.assertReferenceType('grantingRoleUuid', grantedByRoleUuid, 'RbacRole');
+    perform rbac.assertReferenceType('grantedRoleUuid (descendant)', grantedRoleUuid, 'RbacRole');
+    perform rbac.assertReferenceType('userUuid (ascendant)', userUuid, 'rbac.subject');
 
     assert grantedByRoleUuid is not null, 'grantedByRoleUuid must not be null';
     assert grantedRoleUuid is not null, 'grantedRoleUuid must not be null';
     assert userUuid is not null, 'userUuid must not be null';
 
-    if NOT isGranted(currentSubjectsUuids(), grantedByRoleUuid) then
+    if NOT isGranted(rbac.currentSubjectOrAssumedRolesUuids(), grantedByRoleUuid) then
         select roleIdName from rbacRole_ev where uuid=grantedByRoleUuid into grantedByRoleIdName;
         raise exception '[403] Access to granted-by-role % (%) forbidden for % (%)',
-                grantedByRoleIdName, grantedByRoleUuid, currentSubjects(), currentSubjectsUuids();
+                grantedByRoleIdName, grantedByRoleUuid, currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
     end if;
     if NOT isGranted(grantedByRoleUuid, grantedRoleUuid) then
         select roleIdName from rbacRole_ev where uuid=grantedByRoleUuid into grantedByRoleIdName;
@@ -77,11 +77,11 @@ end; $$;
 create or replace procedure checkRevokeRoleFromUserPreconditions(grantedByRoleUuid uuid, grantedRoleUuid uuid, userUuid uuid)
     language plpgsql as $$
 begin
-    perform assertReferenceType('grantedByRoleUuid', grantedByRoleUuid, 'RbacRole');
-    perform assertReferenceType('grantedRoleUuid (descendant)', grantedRoleUuid, 'RbacRole');
-    perform assertReferenceType('userUuid (ascendant)', userUuid, 'RbacUser');
+    perform rbac.assertReferenceType('grantedByRoleUuid', grantedByRoleUuid, 'RbacRole');
+    perform rbac.assertReferenceType('grantedRoleUuid (descendant)', grantedRoleUuid, 'RbacRole');
+    perform rbac.assertReferenceType('userUuid (ascendant)', userUuid, 'rbac.subject');
 
-    if NOT isGranted(currentSubjectsUuids(), grantedByRoleUuid) then
+    if NOT isGranted(rbac.currentSubjectOrAssumedRolesUuids(), grantedByRoleUuid) then
         raise exception '[403] Revoking role created by % is forbidden for %.', grantedByRoleUuid, currentSubjects();
     end if;
 
@@ -89,8 +89,8 @@ begin
         raise exception '[403] Revoking role % is forbidden for %.', grantedRoleUuid, currentSubjects();
     end if;
 
-    --raise exception 'isGranted(%, %)', currentSubjectsUuids(), grantedByRoleUuid;
-    if NOT isGranted(currentSubjectsUuids(), grantedByRoleUuid) then
+    --raise exception 'isGranted(%, %)', rbac.currentSubjectOrAssumedRolesUuids(), grantedByRoleUuid;
+    if NOT isGranted(rbac.currentSubjectOrAssumedRolesUuids(), grantedByRoleUuid) then
         raise exception '[403] Revoking role granted by % is forbidden for %.', grantedByRoleUuid, currentSubjects();
     end if;
 
diff --git a/src/main/resources/db/changelog/1-rbac/1054-rbac-context.sql b/src/main/resources/db/changelog/1-rbac/1054-rbac-context.sql
index 552bcd22..2380c84d 100644
--- a/src/main/resources/db/changelog/1-rbac/1054-rbac-context.sql
+++ b/src/main/resources/db/changelog/1-rbac/1054-rbac-context.sql
@@ -5,25 +5,25 @@
 --changeset rbac-context-DETERMINE:1 endDelimiter:--//
 -- ----------------------------------------------------------------------------
 
-create or replace function determineCurrentUserUuid(currentUser varchar)
+create or replace function determineCurrentSubjectUuid(currentSubject varchar)
     returns uuid
     stable -- leakproof
     language plpgsql as $$
 declare
-    currentUserUuid uuid;
+    currentSubjectUuid uuid;
 begin
-    if currentUser = '' then
+    if currentSubject = '' then
         return null;
     end if;
 
-    select uuid from RbacUser where name = currentUser into currentUserUuid;
-    if currentUserUuid is null then
-        raise exception '[401] user % given in `basis.defineContext(...)` does not exist', currentUser;
+    select uuid from rbac.subject where name = currentSubject into currentSubjectUuid;
+    if currentSubjectUuid is null then
+        raise exception '[401] subject % given in `basis.defineContext(...)` does not exist', currentSubject;
     end if;
-    return currentUserUuid;
+    return currentSubjectUuid;
 end; $$;
 
-create or replace function determineCurrentSubjectsUuids(currentUserUuid uuid, assumedRoles varchar)
+create or replace function determineCurrentSubjectOrAssumedRolesUuids(currentSubjectOrAssumedRolesUuids uuid, assumedRoles varchar)
     returns uuid[]
     stable -- leakproof
     language plpgsql as $$
@@ -37,7 +37,7 @@ declare
     roleIdsToAssume     uuid[];
     roleUuidToAssume    uuid;
 begin
-    if currentUserUuid is null then
+    if currentSubjectOrAssumedRolesUuids is null then
         if length(coalesce(assumedRoles, '')) > 0 then
             raise exception '[403] undefined has no permission to assume role %', assumedRoles;
         else
@@ -45,7 +45,7 @@ begin
         end if;
     end if;
     if  length(coalesce(assumedRoles, '')) = 0 then
-        return array [currentUserUuid];
+        return array [currentSubjectOrAssumedRolesUuids];
     end if;
 
     foreach roleName in array string_to_array(assumedRoles, ';')
@@ -66,10 +66,10 @@ begin
                   and r.roleType = roleTypeToAssume
                 into roleUuidToAssume;
             if roleUuidToAssume is null then
-                raise exception '[403] role % does not exist or is not accessible for user %', roleName, basis.currentUser();
+                raise exception '[403] role % does not exist or is not accessible for subject %', roleName, basis.currentSubject();
             end if;
-            if not isGranted(currentUserUuid, roleUuidToAssume) then
-                raise exception '[403] user % has no permission to assume role %', basis.currentUser(), roleName;
+            if not isGranted(currentSubjectOrAssumedRolesUuids, roleUuidToAssume) then
+                raise exception '[403] subject % has no permission to assume role %', basis.currentSubject(), roleName;
             end if;
             roleIdsToAssume := roleIdsToAssume || roleUuidToAssume;
         end loop;
@@ -87,59 +87,59 @@ end; $$;
 create or replace procedure basis.contextDefined(
     currentTask varchar(127),
     currentRequest text,
-    currentUser varchar(63),
+    currentSubject varchar(63),
     assumedRoles varchar(1023)
 )
     language plpgsql as $$
 declare
-    currentUserUuid uuid;
+    currentSubjectUuid uuid;
 begin
     execute format('set local hsadminng.currentTask to %L', currentTask);
 
     execute format('set local hsadminng.currentRequest to %L', currentRequest);
 
-    execute format('set local hsadminng.currentUser to %L', currentUser);
-    select determineCurrentUserUuid(currentUser) into currentUserUuid;
-    execute format('set local hsadminng.currentUserUuid to %L', coalesce(currentUserUuid::text, ''));
+    execute format('set local hsadminng.currentSubject to %L', currentSubject);
+    select determineCurrentSubjectUuid(currentSubject) into currentSubjectUuid;
+    execute format('set local hsadminng.currentSubjectUuid to %L', coalesce(currentSubjectUuid::text, ''));
 
     execute format('set local hsadminng.assumedRoles to %L', assumedRoles);
-    execute format('set local hsadminng.currentSubjectsUuids to %L',
-       (select array_to_string(determinecurrentSubjectsUuids(currentUserUuid, assumedRoles), ';')));
+    execute format('set local hsadminng.currentSubjectOrAssumedRolesUuids to %L',
+       (select array_to_string(determineCurrentSubjectOrAssumedRolesUuids(currentSubjectUuid, assumedRoles), ';')));
 
-    raise notice 'Context defined as: %, %, %, [%]', currentTask, currentRequest, currentUser, assumedRoles;
+    raise notice 'Context defined as: %, %, %, [%]', currentTask, currentRequest, currentSubject, assumedRoles;
 end; $$;
 
 
 -- ============================================================================
---changeset rbac-context-CURRENT-USER-ID:1 endDelimiter:--//
+--changeset rbac-context-current-subject-ID:1 endDelimiter:--//
 -- ----------------------------------------------------------------------------
 /*
-    Returns the uuid of the current user as set via `basis.defineContext(...)`.
+    Returns the uuid of the current subject as set via `basis.defineContext(...)`.
  */
 
-create or replace function currentUserUuid()
+create or replace function rbac.currentSubjectUuid()
     returns uuid
     stable -- leakproof
     language plpgsql as $$
 declare
-    currentUserUuid text;
-    currentUserName text;
+    currentSubjectUuid text;
+    currentSubjectName text;
 begin
     begin
-        currentUserUuid := current_setting('hsadminng.currentUserUuid');
+        currentSubjectUuid := current_setting('hsadminng.currentSubjectUuid');
     exception
         when others then
-            currentUserUuid := null;
+            currentSubjectUuid := null;
     end;
-    if (currentUserUuid is null or currentUserUuid = '') then
-        currentUserName := basis.currentUser();
-        if (length(currentUserName) > 0) then
-            raise exception '[401] currentUserUuid cannot be determined, unknown user name "%"', currentUserName;
+    if (currentSubjectUuid is null or currentSubjectUuid = '') then
+        currentSubjectName := basis.currentSubject();
+        if (length(currentSubjectName) > 0) then
+            raise exception '[401] currentSubjectUuid cannot be determined, unknown subject name "%"', currentSubjectName;
         else
-            raise exception '[401] currentUserUuid cannot be determined, please call `basis.defineContext(...)` first;"';
+            raise exception '[401] currentSubjectUuid cannot be determined, please call `basis.defineContext(...)` first;"';
         end if;
     end if;
-    return currentUserUuid::uuid;
+    return currentSubjectUuid::uuid;
 end; $$;
 --//
 
@@ -147,33 +147,33 @@ end; $$;
 --changeset rbac-context-CURRENT-SUBJECT-UUIDS:1 endDelimiter:--//
 -- ----------------------------------------------------------------------------
 /*
-    Returns the uuid of the current user as set via `basis.defineContext(...)`,
+    Returns the uuid of the current subject as set via `basis.defineContext(...)`,
     or, if any, the uuids of all assumed roles as set via `basis.defineContext(...)`
     or empty array, if context is not defined.
  */
-create or replace function currentSubjectsUuids()
+create or replace function rbac.currentSubjectOrAssumedRolesUuids()
     returns uuid[]
     stable -- leakproof
     language plpgsql as $$
 declare
-    currentSubjectsUuids text;
-    currentUserName text;
+    currentSubjectOrAssumedRolesUuids text;
+    currentSubjectName text;
 begin
     begin
-        currentSubjectsUuids := current_setting('hsadminng.currentSubjectsUuids');
+        currentSubjectOrAssumedRolesUuids := current_setting('hsadminng.currentSubjectOrAssumedRolesUuids');
     exception
         when others then
-            currentSubjectsUuids := null;
+            currentSubjectOrAssumedRolesUuids := null;
     end;
-    if (currentSubjectsUuids is null or length(currentSubjectsUuids) = 0 ) then
-        currentUserName := basis.currentUser();
-        if (length(currentUserName) > 0) then
-            raise exception '[401] currentSubjectsUuids (%) cannot be determined, unknown user name "%"', currentSubjectsUuids, currentUserName;
+    if (currentSubjectOrAssumedRolesUuids is null or length(currentSubjectOrAssumedRolesUuids) = 0 ) then
+        currentSubjectName := basis.currentSubject();
+        if (length(currentSubjectName) > 0) then
+            raise exception '[401] currentSubjectOrAssumedRolesUuids (%) cannot be determined, unknown subject name "%"', currentSubjectOrAssumedRolesUuids, currentSubjectName;
         else
-            raise exception '[401] currentSubjectsUuids cannot be determined, please call `basis.defineContext(...)` with a valid user;"';
+            raise exception '[401] currentSubjectOrAssumedRolesUuids cannot be determined, please call `basis.defineContext(...)` with a valid subject;"';
         end if;
     end if;
-    return string_to_array(currentSubjectsUuids, ';');
+    return string_to_array(currentSubjectOrAssumedRolesUuids, ';');
 end; $$;
 --//
 
diff --git a/src/main/resources/db/changelog/1-rbac/1055-rbac-views.sql b/src/main/resources/db/changelog/1-rbac/1055-rbac-views.sql
index 38530ba7..e753798e 100644
--- a/src/main/resources/db/changelog/1-rbac/1055-rbac-views.sql
+++ b/src/main/resources/db/changelog/1-rbac/1055-rbac-views.sql
@@ -15,7 +15,7 @@ select (objectTable || '#' || objectIdName || ':' || roleType) as roleIdName, *
              select r.*,
                     o.objectTable, findIdNameByObjectUuid(o.objectTable, o.uuid) as objectIdName
                  from rbacrole as r
-                          join rbacobject as o on o.uuid = r.objectuuid
+                          join rbac.object as o on o.uuid = r.objectuuid
          ) as unordered
          -- @formatter:on
     order by roleIdName;
@@ -36,8 +36,8 @@ select *
             select r.*, o.objectTable,
                    findIdNameByObjectUuid(o.objectTable, o.uuid) as objectIdName
                 from rbacrole as r
-                join rbacobject as o on o.uuid = r.objectuuid
-                where isGranted(currentSubjectsUuids(), r.uuid)
+                join rbac.object as o on o.uuid = r.objectuuid
+                where isGranted(rbac.currentSubjectOrAssumedRolesUuids(), r.uuid)
         ) as unordered
         -- @formatter:on
         order by objectTable || '#' || objectIdName || ':' || roleType;
@@ -88,17 +88,17 @@ create or replace view rbacgrants_ev as
                  from rbacgrants as g
 
                 left outer join rbacrole as ar on ar.uuid = g.ascendantUuid
-                    left outer join rbacobject as aro on aro.uuid = ar.objectuuid
-                left outer join rbacuser as au on au.uuid = g.ascendantUuid
+                    left outer join rbac.object as aro on aro.uuid = ar.objectuuid
+                left outer join rbac.subject as au on au.uuid = g.ascendantUuid
 
                 left outer join rbacrole as dr on dr.uuid = g.descendantUuid
-                    left outer join rbacobject as dro on dro.uuid = dr.objectuuid
+                    left outer join rbac.object as dro on dro.uuid = dr.objectuuid
                 left outer join rbacpermission dp on dp.uuid = g.descendantUuid
-                    left outer join rbacobject as dpo on dpo.uuid = dp.objectUuid
+                    left outer join rbac.object as dpo on dpo.uuid = dp.objectUuid
          ) as x
          left outer join rbacrole as r on r.uuid = grantedByRoleUuid
-         left outer join rbacuser u on u.uuid = x.ascendantuuid
-         left outer join rbacobject go on go.uuid = r.objectuuid
+         left outer join rbac.subject u on u.uuid = x.ascendantuuid
+         left outer join rbac.object go on go.uuid = r.objectuuid
 
         order by x.ascendingIdName, x.descendingIdName;
     -- @formatter:on
@@ -125,12 +125,12 @@ select o.objectTable || '#' || findIdNameByObjectUuid(o.objectTable, o.uuid) ||
                     findIdNameByObjectUuid(o.objectTable, o.uuid) as objectIdName
                  from rbacgrants as g
                           join rbacrole as r on r.uuid = g.descendantUuid
-                          join rbacobject o on o.uuid = r.objectuuid
-                          left outer join rbacuser u on u.uuid = g.ascendantuuid
-                 where isGranted(currentSubjectsUuids(), r.uuid)
+                          join rbac.object o on o.uuid = r.objectuuid
+                          left outer join rbac.subject u on u.uuid = g.ascendantuuid
+                 where isGranted(rbac.currentSubjectOrAssumedRolesUuids(), r.uuid)
          ) as g
              join RbacRole as r on r.uuid = grantedByRoleUuid
-             join RbacObject as o on o.uuid = r.objectUuid
+             join rbac.object as o on o.uuid = r.objectUuid
     order by grantedRoleIdName;
 -- @formatter:on
 grant all privileges on rbacrole_rv to ${HSADMINNG_POSTGRES_RESTRICTED_USERNAME};
@@ -209,13 +209,13 @@ create or replace view RbacUser_ev as
 select distinct *
                 -- @formatter:off
     from (
-             select usersInRolesOfCurrentUser.*
-                 from RbacUser as usersInRolesOfCurrentUser
-                          join RbacGrants as g on g.ascendantuuid = usersInRolesOfCurrentUser.uuid
+             select usersInRolesOfcurrentSubject.*
+                 from rbac.subject as usersInRolesOfcurrentSubject
+                          join RbacGrants as g on g.ascendantuuid = usersInRolesOfcurrentSubject.uuid
                           join rbacrole_ev as r on r.uuid = g.descendantuuid
              union
              select users.*
-                 from RbacUser as users
+                 from rbac.subject as users
          ) as unordered
          -- @formatter:on
     order by unordered.name;
@@ -234,15 +234,15 @@ create or replace view RbacUser_rv as
     select distinct *
         -- @formatter:off
         from (
-            select usersInRolesOfCurrentUser.*
-                from RbacUser as usersInRolesOfCurrentUser
-                 join RbacGrants as g on g.ascendantuuid = usersInRolesOfCurrentUser.uuid
+            select usersInRolesOfcurrentSubject.*
+                from rbac.subject as usersInRolesOfcurrentSubject
+                 join RbacGrants as g on g.ascendantuuid = usersInRolesOfcurrentSubject.uuid
                  join rbacrole_rv as r on r.uuid = g.descendantuuid
             union
             select users.*
-                from RbacUser as users
+                from rbac.subject as users
                 where cardinality(basis.assumedRoles()) = 0 and
-                        (currentUserUuid() = users.uuid or hasGlobalRoleGranted(currentUserUuid()))
+                        (rbac.currentSubjectUuid() = users.uuid or hasGlobalRoleGranted(rbac.currentSubjectUuid()))
 
         ) as unordered
         -- @formatter:on
@@ -262,14 +262,14 @@ create or replace function insertRbacUser()
     language plpgsql as $$
 declare
     refUuid uuid;
-    newUser RbacUser;
+    newUser rbac.subject;
 begin
     insert
-        into RbacReference as r (uuid, type)
-        values( new.uuid, 'RbacUser')
+        into  rbac.reference as r (uuid, type)
+        values( new.uuid, 'rbac.subject')
         returning r.uuid into refUuid;
     insert
-        into RbacUser (uuid, name)
+        into rbac.subject (uuid, name)
         values (refUuid, new.name)
         returning * into newUser;
     return newUser;
@@ -299,11 +299,11 @@ create or replace function deleteRbacUser()
     returns trigger
     language plpgsql as $$
 begin
-    if currentUserUuid() = old.uuid or hasGlobalRoleGranted(currentUserUuid()) then
-        delete from RbacUser where uuid = old.uuid;
+    if rbac.currentSubjectUuid() = old.uuid or hasGlobalRoleGranted(rbac.currentSubjectUuid()) then
+        delete from rbac.subject where uuid = old.uuid;
         return old;
     end if;
-    raise exception '[403] User % not allowed to delete user uuid %', basis.currentUser(), old.uuid;
+    raise exception '[403] User % not allowed to delete user uuid %', basis.currentSubject(), old.uuid;
 end; $$;
 
 /*
@@ -332,7 +332,7 @@ select r.uuid as roleuuid, p.uuid as permissionUuid,
     from rbacrole_rv r
     join rbacgrants g on g.ascendantuuid = r.uuid
     join rbacpermission p on p.uuid = g.descendantuuid
-    join rbacobject o on o.uuid = p.objectuuid;
+    join rbac.object o on o.uuid = p.objectuuid;
 grant all privileges on RbacOwnGrantedPermissions_rv to ${HSADMINNG_POSTGRES_RESTRICTED_USERNAME};
 -- @formatter:om
 
@@ -348,13 +348,13 @@ create or replace function grantedPermissionsRaw(targetUserUuid uuid)
     returns null on null input
     language plpgsql as $$
 declare
-    currentUserUuid uuid;
+    currentSubjectUuid uuid;
 begin
     -- @formatter:off
-    currentUserUuid := currentUserUuid();
+    currentSubjectUuid := rbac.currentSubjectUuid();
 
-    if hasGlobalRoleGranted(targetUserUuid) and not hasGlobalRoleGranted(currentUserUuid) then
-        raise exception '[403] permissions of user "%" are not accessible to user "%"', targetUserUuid, basis.currentUser();
+    if hasGlobalRoleGranted(targetUserUuid) and not hasGlobalRoleGranted(currentSubjectUuid) then
+        raise exception '[403] permissions of user "%" are not accessible to user "%"', targetUserUuid, basis.currentSubject();
     end if;
 
     return query select
@@ -371,9 +371,9 @@ begin
                   po.uuid as permissionObjectUuid
               from queryPermissionsGrantedToSubjectId( targetUserUuid) as p
               join rbacgrants as g on g.descendantUuid = p.uuid
-              join rbacobject as po on po.uuid = p.objectUuid
+              join rbac.object as po on po.uuid = p.objectUuid
               join rbacrole_rv as r on r.uuid = g.ascendantUuid
-              join rbacobject as ro on ro.uuid = r.objectUuid
+              join rbac.object as ro on ro.uuid = r.objectUuid
               where isGranted(targetUserUuid, r.uuid)
              ) xp;
     -- @formatter:on
diff --git a/src/main/resources/db/changelog/1-rbac/1058-rbac-generators.sql b/src/main/resources/db/changelog/1-rbac/1058-rbac-generators.sql
index 233cc316..a1fd2e52 100644
--- a/src/main/resources/db/changelog/1-rbac/1058-rbac-generators.sql
+++ b/src/main/resources/db/changelog/1-rbac/1058-rbac-generators.sql
@@ -15,7 +15,7 @@ begin
         create trigger createRbacObjectFor_%s_Trigger
             before insert on %s
             for each row
-                execute procedure insertRelatedRbacObject();
+                execute procedure rbac.insert_related_object();
         $sql$, targetTable, targetTable);
     execute createInsertTriggerSQL;
 
@@ -185,7 +185,7 @@ begin
                                                true
                                    from rbacgrants
                                    where rbacgrants.assumed
-                                     and (rbacgrants.ascendantuuid = any (currentsubjectsuuids()))
+                                     and (rbacgrants.ascendantuuid = any (rbac.currentSubjectOrAssumedRolesUuids()))
                                union all
                                select distinct g.descendantuuid,
                                                g.ascendantuuid,
@@ -203,7 +203,7 @@ begin
                       select distinct perm.objectuuid
                           from recursive_grants
                                    join rbacpermission perm on recursive_grants.descendantuuid = perm.uuid
-                                   join rbacobject obj on obj.uuid = perm.objectuuid
+                                   join rbac.object obj on obj.uuid = perm.objectuuid
                                    join count_check cc on cc.valid
                           where obj.objectTable = '%1$s' -- 'SELECT' permission is included in all other permissions
             )
@@ -256,11 +256,11 @@ begin
             returns trigger
             language plpgsql as $f$
         begin
-            if old.uuid in (select queryAccessibleObjectUuidsOfSubjectIds('DELETE', '%1$s', currentSubjectsUuids())) then
+            if old.uuid in (select queryAccessibleObjectUuidsOfSubjectIds('DELETE', '%1$s', rbac.currentSubjectOrAssumedRolesUuids())) then
                 delete from %1$s p where p.uuid = old.uuid;
                 return old;
             end if;
-            raise exception '[403] Subject %% is not allowed to delete %1$s uuid %%', currentSubjectsUuids(), old.uuid;
+            raise exception '[403] Subject %% is not allowed to delete %1$s uuid %%', rbac.currentSubjectOrAssumedRolesUuids(), old.uuid;
         end; $f$;
     $sql$, targetTable);
     execute sql;
@@ -287,13 +287,13 @@ begin
                 returns trigger
                 language plpgsql as $f$
             begin
-                if old.uuid in (select queryAccessibleObjectUuidsOfSubjectIds('UPDATE', '%1$s', currentSubjectsUuids())) then
+                if old.uuid in (select queryAccessibleObjectUuidsOfSubjectIds('UPDATE', '%1$s', rbac.currentSubjectOrAssumedRolesUuids())) then
                     update %1$s
                         set %2$s
                         where uuid = old.uuid;
                     return old;
                 end if;
-                raise exception '[403] Subject %% is not allowed to update %1$s uuid %%', currentSubjectsUuids(), old.uuid;
+                raise exception '[403] Subject %% is not allowed to update %1$s uuid %%', rbac.currentSubjectOrAssumedRolesUuids(), old.uuid;
             end; $f$;
         $sql$, targetTable, columnUpdates);
         execute sql;
diff --git a/src/main/resources/db/changelog/1-rbac/1059-rbac-statistics.sql b/src/main/resources/db/changelog/1-rbac/1059-rbac-statistics.sql
index 1ef6283a..4cb5ff19 100644
--- a/src/main/resources/db/changelog/1-rbac/1059-rbac-statistics.sql
+++ b/src/main/resources/db/changelog/1-rbac/1059-rbac-statistics.sql
@@ -8,7 +8,7 @@
 create view RbacStatisticsView as
 select no, to_char("count", '9 999 999 999') as "count", "table"
     from (select 1 as no, count(*) as "count", 'login users' as "table"
-              from RbacUser
+              from rbac.subject
           union
           select 2 as no, count(*) as "count", 'roles' as "table"
               from RbacRole
@@ -17,12 +17,12 @@ select no, to_char("count", '9 999 999 999') as "count", "table"
               from RbacPermission
           union
           select 4 as no, count(*) as "count", 'references' as "table"
-              from RbacReference
+              from  rbac.reference
           union
           select 5 as no, count(*) as "count", 'grants' as "table"
               from RbacGrants
           union
           select 6 as no, count(*) as "count", 'objects' as "table"
-              from RbacObject) as totals
+              from rbac.object) as totals
     order by totals.no;
 --//
diff --git a/src/main/resources/db/changelog/1-rbac/1080-rbac-global.sql b/src/main/resources/db/changelog/1-rbac/1080-rbac-global.sql
index c20238c7..8fb1f19e 100644
--- a/src/main/resources/db/changelog/1-rbac/1080-rbac-global.sql
+++ b/src/main/resources/db/changelog/1-rbac/1080-rbac-global.sql
@@ -13,7 +13,7 @@
  */
 create table Global
 (
-    uuid uuid primary key references RbacObject (uuid) on delete cascade,
+    uuid uuid primary key references rbac.object (uuid) on delete cascade,
     name varchar(63) unique
 );
 create unique index Global_Singleton on Global ((0));
@@ -30,7 +30,7 @@ create or replace function isGlobalAdmin()
     returns boolean
     language plpgsql as $$
 begin
-    return isGranted(currentSubjectsUuids(), findRoleId(globalAdmin()));
+    return isGranted(rbac.currentSubjectOrAssumedRolesUuids(), findRoleId(globalAdmin()));
 end; $$;
 --//
 
@@ -45,7 +45,7 @@ create or replace function hasGlobalPermission(op RbacOp)
 $$
     -- TODO.perf: this could to be optimized
 select (select uuid from global) in
-       (select queryAccessibleObjectUuidsOfSubjectIds(op, 'global', currentSubjectsUuids()));
+       (select queryAccessibleObjectUuidsOfSubjectIds(op, 'global', rbac.currentSubjectOrAssumedRolesUuids()));
 $$;
 --//
 
@@ -96,9 +96,9 @@ $$;
 begin transaction;
 call basis.defineContext('initializing table "global"', null, null, null);
 insert
-    into RbacObject (objecttable) values ('global');
+    into rbac.object (objecttable) values ('global');
 insert
-    into Global (uuid, name) values ((select uuid from RbacObject where objectTable = 'global'), 'global');
+    into Global (uuid, name) values ((select uuid from rbac.object where objectTable = 'global'), 'global');
 commit;
 --//
 
@@ -114,7 +114,7 @@ create or replace function globalAdmin(assumed boolean = true)
     returns null on null input
     stable -- leakproof
     language sql as $$
-select 'global', (select uuid from RbacObject where objectTable = 'global'), 'ADMIN'::RbacRoleType, assumed;
+select 'global', (select uuid from rbac.object where objectTable = 'global'), 'ADMIN'::RbacRoleType, assumed;
 $$;
 
 begin transaction;
@@ -135,7 +135,7 @@ create or replace function globalGuest(assumed boolean = true)
     returns null on null input
     stable -- leakproof
     language sql as $$
-select 'global', (select uuid from RbacObject where objectTable = 'global'), 'GUEST'::RbacRoleType, assumed;
+select 'global', (select uuid from rbac.object where objectTable = 'global'), 'GUEST'::RbacRoleType, assumed;
 $$;
 
 begin transaction;
@@ -158,10 +158,10 @@ do language plpgsql $$
         call basis.defineContext('creating fake test-realm admin users', null, null, null);
 
         admins = findRoleId(globalAdmin());
-        call grantRoleToUserUnchecked(admins, admins, createRbacUser('superuser-alex@hostsharing.net'));
-        call grantRoleToUserUnchecked(admins, admins, createRbacUser('superuser-fran@hostsharing.net'));
-        perform createRbacUser('selfregistered-user-drew@hostsharing.org');
-        perform createRbacUser('selfregistered-test-user@hostsharing.org');
+        call grantRoleToUserUnchecked(admins, admins, rbac.create_subject('superuser-alex@hostsharing.net'));
+        call grantRoleToUserUnchecked(admins, admins, rbac.create_subject('superuser-fran@hostsharing.net'));
+        perform rbac.create_subject('selfregistered-user-drew@hostsharing.org');
+        perform rbac.create_subject('selfregistered-test-user@hostsharing.org');
     end;
 $$;
 --//
@@ -172,23 +172,23 @@ $$;
 -- ----------------------------------------------------------------------------
 
 /*
-    Tests if currentUserUuid() can fetch the user from the session variable.
+    Tests if rbac.currentSubjectUuid() can fetch the user from the session variable.
  */
 
 do language plpgsql $$
     declare
         userName varchar;
     begin
-        call basis.defineContext('testing currentUserUuid', null, 'superuser-fran@hostsharing.net', null);
-        select userName from RbacUser where uuid = currentUserUuid() into userName;
+        call basis.defineContext('testing currentSubjectUuid', null, 'superuser-fran@hostsharing.net', null);
+        select userName from rbac.subject where uuid = rbac.currentSubjectUuid() into userName;
         if userName <> 'superuser-fran@hostsharing.net' then
-            raise exception 'setting or fetching initial currentUser failed, got: %', userName;
+            raise exception 'setting or fetching initial currentSubject failed, got: %', userName;
         end if;
 
-        call basis.defineContext('testing currentUserUuid', null, 'superuser-alex@hostsharing.net', null);
-        select userName from RbacUser where uuid = currentUserUuid() into userName;
+        call basis.defineContext('testing currentSubjectUuid', null, 'superuser-alex@hostsharing.net', null);
+        select userName from rbac.subject where uuid = rbac.currentSubjectUuid() into userName;
         if userName = 'superuser-alex@hostsharing.net' then
-            raise exception 'currentUser should not change in one transaction, but did change, got: %', userName;
+            raise exception 'currentSubject should not change in one transaction, but did change, got: %', userName;
         end if;
     end; $$;
 --//
diff --git a/src/main/resources/db/changelog/2-test/201-test-customer/2010-test-customer.sql b/src/main/resources/db/changelog/2-test/201-test-customer/2010-test-customer.sql
index 559ba51a..f956cb1d 100644
--- a/src/main/resources/db/changelog/2-test/201-test-customer/2010-test-customer.sql
+++ b/src/main/resources/db/changelog/2-test/201-test-customer/2010-test-customer.sql
@@ -6,7 +6,7 @@
 
 create table if not exists test_customer
 (
-    uuid          uuid unique references RbacObject (uuid),
+    uuid          uuid unique references rbac.object (uuid),
     version      int not null default 0,
     reference     int not null unique check (reference between 10000 and 99999),
     prefix        character(3) unique,
diff --git a/src/main/resources/db/changelog/2-test/201-test-customer/2013-test-customer-rbac.sql b/src/main/resources/db/changelog/2-test/201-test-customer/2013-test-customer-rbac.sql
index 6e084160..f1ebb9dd 100644
--- a/src/main/resources/db/changelog/2-test/201-test-customer/2013-test-customer-rbac.sql
+++ b/src/main/resources/db/changelog/2-test/201-test-customer/2013-test-customer-rbac.sql
@@ -38,7 +38,7 @@ begin
         testCustomerOWNER(NEW),
             permissions => array['DELETE'],
             incomingSuperRoles => array[globalADMIN(unassumed())],
-            userUuids => array[currentUserUuid()]
+            userUuids => array[rbac.currentSubjectUuid()]
     );
 
     perform createRoleWithGrants(
@@ -143,7 +143,7 @@ begin
     end if;
 
     raise exception '[403] insert into test_customer values(%) not allowed for current subjects % (%)',
-            NEW, currentSubjects(), currentSubjectsUuids();
+            NEW, currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
 end; $$;
 
 create trigger test_customer_insert_permission_check_tg
diff --git a/src/main/resources/db/changelog/2-test/201-test-customer/2018-test-customer-test-data.sql b/src/main/resources/db/changelog/2-test/201-test-customer/2018-test-customer-test-data.sql
index a05835f8..e9a63044 100644
--- a/src/main/resources/db/changelog/2-test/201-test-customer/2018-test-customer-test-data.sql
+++ b/src/main/resources/db/changelog/2-test/201-test-customer/2018-test-customer-test-data.sql
@@ -32,7 +32,7 @@ declare
 begin
     custRowId = uuid_generate_v4();
     custAdminName = 'customer-admin@' || custPrefix || '.example.com';
-    custAdminUuid = createRbacUser(custAdminName);
+    custAdminUuid = rbac.create_subject(custAdminName);
 
     insert
         into test_customer (reference, prefix, adminUserName)
diff --git a/src/main/resources/db/changelog/2-test/202-test-package/2020-test-package.sql b/src/main/resources/db/changelog/2-test/202-test-package/2020-test-package.sql
index 30739cd3..794f558f 100644
--- a/src/main/resources/db/changelog/2-test/202-test-package/2020-test-package.sql
+++ b/src/main/resources/db/changelog/2-test/202-test-package/2020-test-package.sql
@@ -6,7 +6,7 @@
 
 create table if not exists test_package
 (
-    uuid         uuid unique references RbacObject (uuid),
+    uuid         uuid unique references rbac.object (uuid),
     version      int not null default 0,
     customerUuid uuid references test_customer (uuid),
     name         varchar(5),
diff --git a/src/main/resources/db/changelog/2-test/202-test-package/2023-test-package-rbac.sql b/src/main/resources/db/changelog/2-test/202-test-package/2023-test-package-rbac.sql
index 4cc51b27..af51c791 100644
--- a/src/main/resources/db/changelog/2-test/202-test-package/2023-test-package-rbac.sql
+++ b/src/main/resources/db/changelog/2-test/202-test-package/2023-test-package-rbac.sql
@@ -208,7 +208,7 @@ begin
     end if;
 
     raise exception '[403] insert into test_package values(%) not allowed for current subjects % (%)',
-            NEW, currentSubjects(), currentSubjectsUuids();
+            NEW, currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
 end; $$;
 
 create trigger test_package_insert_permission_check_tg
diff --git a/src/main/resources/db/changelog/2-test/202-test-package/2028-test-package-test-data.sql b/src/main/resources/db/changelog/2-test/202-test-package/2028-test-package-test-data.sql
index d471a421..d8c64916 100644
--- a/src/main/resources/db/changelog/2-test/202-test-package/2028-test-package-test-data.sql
+++ b/src/main/resources/db/changelog/2-test/202-test-package/2028-test-package-test-data.sql
@@ -32,7 +32,7 @@ begin
             call grantRoleToUser(
                     getRoleId(testCustomerAdmin(cust)),
                     findRoleId(testPackageAdmin(pac)),
-                    createRbacUser('pac-admin-' || pacName || '@' || cust.prefix || '.example.com'),
+                    rbac.create_subject('pac-admin-' || pacName || '@' || cust.prefix || '.example.com'),
                     true);
 
         end loop;
diff --git a/src/main/resources/db/changelog/2-test/203-test-domain/2030-test-domain.sql b/src/main/resources/db/changelog/2-test/203-test-domain/2030-test-domain.sql
index 6b50dcae..c4318617 100644
--- a/src/main/resources/db/changelog/2-test/203-test-domain/2030-test-domain.sql
+++ b/src/main/resources/db/changelog/2-test/203-test-domain/2030-test-domain.sql
@@ -6,7 +6,7 @@
 
 create table if not exists test_domain
 (
-    uuid        uuid unique references RbacObject (uuid),
+    uuid        uuid unique references rbac.object (uuid),
     packageUuid uuid references test_package (uuid),
     name        character varying(253),
     description character varying(96)
diff --git a/src/main/resources/db/changelog/2-test/203-test-domain/2033-test-domain-rbac.sql b/src/main/resources/db/changelog/2-test/203-test-domain/2033-test-domain-rbac.sql
index ab12d7fd..1b4a0421 100644
--- a/src/main/resources/db/changelog/2-test/203-test-domain/2033-test-domain-rbac.sql
+++ b/src/main/resources/db/changelog/2-test/203-test-domain/2033-test-domain-rbac.sql
@@ -207,7 +207,7 @@ begin
     end if;
 
     raise exception '[403] insert into test_domain values(%) not allowed for current subjects % (%)',
-            NEW, currentSubjects(), currentSubjectsUuids();
+            NEW, currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
 end; $$;
 
 create trigger test_domain_insert_permission_check_tg
diff --git a/src/main/resources/db/changelog/5-hs-office/501-contact/5010-hs-office-contact.sql b/src/main/resources/db/changelog/5-hs-office/501-contact/5010-hs-office-contact.sql
index 9c187d11..d1694eb6 100644
--- a/src/main/resources/db/changelog/5-hs-office/501-contact/5010-hs-office-contact.sql
+++ b/src/main/resources/db/changelog/5-hs-office/501-contact/5010-hs-office-contact.sql
@@ -6,7 +6,7 @@
 
 create table if not exists hs_office_contact
 (
-    uuid           uuid unique references RbacObject (uuid) initially deferred,
+    uuid           uuid unique references rbac.object (uuid) initially deferred,
     version        int not null default 0,
     caption        varchar(128) not null,
     postalAddress  text,
diff --git a/src/main/resources/db/changelog/5-hs-office/501-contact/5013-hs-office-contact-rbac.sql b/src/main/resources/db/changelog/5-hs-office/501-contact/5013-hs-office-contact-rbac.sql
index d1fabf3e..bfd66de5 100644
--- a/src/main/resources/db/changelog/5-hs-office/501-contact/5013-hs-office-contact-rbac.sql
+++ b/src/main/resources/db/changelog/5-hs-office/501-contact/5013-hs-office-contact-rbac.sql
@@ -38,7 +38,7 @@ begin
         hsOfficeContactOWNER(NEW),
             permissions => array['DELETE'],
             incomingSuperRoles => array[globalADMIN()],
-            userUuids => array[currentUserUuid()]
+            userUuids => array[rbac.currentSubjectUuid()]
     );
 
     perform createRoleWithGrants(
diff --git a/src/main/resources/db/changelog/5-hs-office/501-contact/5018-hs-office-contact-test-data.sql b/src/main/resources/db/changelog/5-hs-office/501-contact/5018-hs-office-contact-test-data.sql
index d8bbcd74..cb431d26 100644
--- a/src/main/resources/db/changelog/5-hs-office/501-contact/5018-hs-office-contact-test-data.sql
+++ b/src/main/resources/db/changelog/5-hs-office/501-contact/5018-hs-office-contact-test-data.sql
@@ -16,7 +16,7 @@ declare
 begin
     emailAddr = 'contact-admin@' || cleanIdentifier(contCaption) || '.example.com';
     call basis.defineContext('creating contact test-data');
-    perform createRbacUser(emailAddr);
+    perform rbac.create_subject(emailAddr);
     call basis.defineContext('creating contact test-data', null, emailAddr);
 
     postalAddr := E'Vorname Nachname\nStraße Hnr\nPLZ Stadt';
diff --git a/src/main/resources/db/changelog/5-hs-office/502-person/5020-hs-office-person.sql b/src/main/resources/db/changelog/5-hs-office/502-person/5020-hs-office-person.sql
index 97435390..f73696c0 100644
--- a/src/main/resources/db/changelog/5-hs-office/502-person/5020-hs-office-person.sql
+++ b/src/main/resources/db/changelog/5-hs-office/502-person/5020-hs-office-person.sql
@@ -16,7 +16,7 @@ CREATE CAST (character varying as HsOfficePersonType) WITH INOUT AS IMPLICIT;
 
 create table if not exists hs_office_person
 (
-    uuid           uuid unique references RbacObject (uuid) initially deferred,
+    uuid           uuid unique references rbac.object (uuid) initially deferred,
     version        int not null default 0,
     personType     HsOfficePersonType not null,
     tradeName      varchar(96),
diff --git a/src/main/resources/db/changelog/5-hs-office/502-person/5023-hs-office-person-rbac.sql b/src/main/resources/db/changelog/5-hs-office/502-person/5023-hs-office-person-rbac.sql
index bdaca63c..4fb80622 100644
--- a/src/main/resources/db/changelog/5-hs-office/502-person/5023-hs-office-person-rbac.sql
+++ b/src/main/resources/db/changelog/5-hs-office/502-person/5023-hs-office-person-rbac.sql
@@ -38,7 +38,7 @@ begin
         hsOfficePersonOWNER(NEW),
             permissions => array['DELETE'],
             incomingSuperRoles => array[globalADMIN()],
-            userUuids => array[currentUserUuid()]
+            userUuids => array[rbac.currentSubjectUuid()]
     );
 
     perform createRoleWithGrants(
diff --git a/src/main/resources/db/changelog/5-hs-office/502-person/5028-hs-office-person-test-data.sql b/src/main/resources/db/changelog/5-hs-office/502-person/5028-hs-office-person-test-data.sql
index 4040ceb4..f04b2d5c 100644
--- a/src/main/resources/db/changelog/5-hs-office/502-person/5028-hs-office-person-test-data.sql
+++ b/src/main/resources/db/changelog/5-hs-office/502-person/5028-hs-office-person-test-data.sql
@@ -22,7 +22,7 @@ begin
     fullName := concat_ws(', ', newTradeName, newFamilyName, newGivenName);
     emailAddr = 'person-' || left(cleanIdentifier(fullName), 32) || '@example.com';
     call basis.defineContext('creating person test-data');
-    perform createRbacUser(emailAddr);
+    perform rbac.create_subject(emailAddr);
     call basis.defineContext('creating person test-data', null, emailAddr);
 
     raise notice 'creating test person: % by %', fullName, emailAddr;
diff --git a/src/main/resources/db/changelog/5-hs-office/503-relation/5030-hs-office-relation.sql b/src/main/resources/db/changelog/5-hs-office/503-relation/5030-hs-office-relation.sql
index e4d6d166..ee02668d 100644
--- a/src/main/resources/db/changelog/5-hs-office/503-relation/5030-hs-office-relation.sql
+++ b/src/main/resources/db/changelog/5-hs-office/503-relation/5030-hs-office-relation.sql
@@ -18,7 +18,7 @@ CREATE CAST (character varying as HsOfficeRelationType) WITH INOUT AS IMPLICIT;
 
 create table if not exists hs_office_relation
 (
-    uuid             uuid unique references RbacObject (uuid) initially deferred, -- on delete cascade
+    uuid             uuid unique references rbac.object (uuid) initially deferred, -- on delete cascade
     version          int not null default 0,
     anchorUuid       uuid not null references hs_office_person(uuid),
     holderUuid       uuid not null references hs_office_person(uuid),
diff --git a/src/main/resources/db/changelog/5-hs-office/503-relation/5033-hs-office-relation-rbac.sql b/src/main/resources/db/changelog/5-hs-office/503-relation/5033-hs-office-relation-rbac.sql
index 84ae494c..3941456a 100644
--- a/src/main/resources/db/changelog/5-hs-office/503-relation/5033-hs-office-relation-rbac.sql
+++ b/src/main/resources/db/changelog/5-hs-office/503-relation/5033-hs-office-relation-rbac.sql
@@ -51,7 +51,7 @@ begin
         hsOfficeRelationOWNER(NEW),
             permissions => array['DELETE'],
             incomingSuperRoles => array[globalADMIN()],
-            userUuids => array[currentUserUuid()]
+            userUuids => array[rbac.currentSubjectUuid()]
     );
 
     perform createRoleWithGrants(
@@ -217,7 +217,7 @@ begin
     end if;
 
     raise exception '[403] insert into hs_office_relation not allowed for current subjects % (%)',
-            currentSubjects(), currentSubjectsUuids();
+            currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
 end; $$;
 
 create trigger hs_office_relation_insert_permission_check_tg
diff --git a/src/main/resources/db/changelog/5-hs-office/504-partner/5040-hs-office-partner.sql b/src/main/resources/db/changelog/5-hs-office/504-partner/5040-hs-office-partner.sql
index aac22c5b..8dc99bf3 100644
--- a/src/main/resources/db/changelog/5-hs-office/504-partner/5040-hs-office-partner.sql
+++ b/src/main/resources/db/changelog/5-hs-office/504-partner/5040-hs-office-partner.sql
@@ -7,7 +7,7 @@
 
 create table hs_office_partner_details
 (
-    uuid                uuid unique references RbacObject (uuid) initially deferred,
+    uuid                uuid unique references rbac.object (uuid) initially deferred,
     version             int not null default 0,
     registrationOffice  varchar(96),
     registrationNumber  varchar(96),
@@ -32,7 +32,7 @@ call basis.create_journal('hs_office_partner_details');
 
 create table hs_office_partner
 (
-    uuid                uuid unique references RbacObject (uuid) initially deferred,
+    uuid                uuid unique references rbac.object (uuid) initially deferred,
     version             int not null default 0,
     partnerNumber       numeric(5) unique not null,
     partnerRelUuid      uuid not null references hs_office_relation(uuid), -- deleted in after delete trigger
diff --git a/src/main/resources/db/changelog/5-hs-office/504-partner/5043-hs-office-partner-rbac.sql b/src/main/resources/db/changelog/5-hs-office/504-partner/5043-hs-office-partner-rbac.sql
index 9bc7f773..36040336 100644
--- a/src/main/resources/db/changelog/5-hs-office/504-partner/5043-hs-office-partner-rbac.sql
+++ b/src/main/resources/db/changelog/5-hs-office/504-partner/5043-hs-office-partner-rbac.sql
@@ -220,7 +220,7 @@ begin
     end if;
 
     raise exception '[403] insert into hs_office_partner values(%) not allowed for current subjects % (%)',
-            NEW, currentSubjects(), currentSubjectsUuids();
+            NEW, currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
 end; $$;
 
 create trigger hs_office_partner_insert_permission_check_tg
diff --git a/src/main/resources/db/changelog/5-hs-office/504-partner/5044-hs-office-partner-details-rbac.sql b/src/main/resources/db/changelog/5-hs-office/504-partner/5044-hs-office-partner-details-rbac.sql
index 09ed6dc5..7810f838 100644
--- a/src/main/resources/db/changelog/5-hs-office/504-partner/5044-hs-office-partner-details-rbac.sql
+++ b/src/main/resources/db/changelog/5-hs-office/504-partner/5044-hs-office-partner-details-rbac.sql
@@ -124,7 +124,7 @@ begin
     end if;
 
     raise exception '[403] insert into hs_office_partner_details values(%) not allowed for current subjects % (%)',
-            NEW, currentSubjects(), currentSubjectsUuids();
+            NEW, currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
 end; $$;
 
 create trigger hs_office_partner_details_insert_permission_check_tg
diff --git a/src/main/resources/db/changelog/5-hs-office/505-bankaccount/5050-hs-office-bankaccount.sql b/src/main/resources/db/changelog/5-hs-office/505-bankaccount/5050-hs-office-bankaccount.sql
index 1dec8bc3..a1c577c6 100644
--- a/src/main/resources/db/changelog/5-hs-office/505-bankaccount/5050-hs-office-bankaccount.sql
+++ b/src/main/resources/db/changelog/5-hs-office/505-bankaccount/5050-hs-office-bankaccount.sql
@@ -5,7 +5,7 @@
 
 create table hs_office_bankaccount
 (
-    uuid                uuid unique references RbacObject (uuid) initially deferred,
+    uuid                uuid unique references rbac.object (uuid) initially deferred,
     version             int not null default 0,
     holder              varchar(64) not null,
     iban                varchar(34) not null,
diff --git a/src/main/resources/db/changelog/5-hs-office/505-bankaccount/5053-hs-office-bankaccount-rbac.sql b/src/main/resources/db/changelog/5-hs-office/505-bankaccount/5053-hs-office-bankaccount-rbac.sql
index 724dd658..4d05ae0c 100644
--- a/src/main/resources/db/changelog/5-hs-office/505-bankaccount/5053-hs-office-bankaccount-rbac.sql
+++ b/src/main/resources/db/changelog/5-hs-office/505-bankaccount/5053-hs-office-bankaccount-rbac.sql
@@ -38,7 +38,7 @@ begin
         hsOfficeBankAccountOWNER(NEW),
             permissions => array['DELETE'],
             incomingSuperRoles => array[globalADMIN()],
-            userUuids => array[currentUserUuid()]
+            userUuids => array[rbac.currentSubjectUuid()]
     );
 
     perform createRoleWithGrants(
diff --git a/src/main/resources/db/changelog/5-hs-office/505-bankaccount/5058-hs-office-bankaccount-test-data.sql b/src/main/resources/db/changelog/5-hs-office/505-bankaccount/5058-hs-office-bankaccount-test-data.sql
index ed00ca3a..20891c37 100644
--- a/src/main/resources/db/changelog/5-hs-office/505-bankaccount/5058-hs-office-bankaccount-test-data.sql
+++ b/src/main/resources/db/changelog/5-hs-office/505-bankaccount/5058-hs-office-bankaccount-test-data.sql
@@ -14,7 +14,7 @@ declare
     emailAddr varchar;
 begin
     emailAddr = 'bankaccount-admin@' || cleanIdentifier(givenHolder) || '.example.com';
-    perform createRbacUser(emailAddr);
+    perform rbac.create_subject(emailAddr);
     call basis.defineContext('creating bankaccount test-data', null, emailAddr);
 
     raise notice 'creating test bankaccount: %', givenHolder;
diff --git a/src/main/resources/db/changelog/5-hs-office/506-debitor/5060-hs-office-debitor.sql b/src/main/resources/db/changelog/5-hs-office/506-debitor/5060-hs-office-debitor.sql
index 462a9dbd..6d680d49 100644
--- a/src/main/resources/db/changelog/5-hs-office/506-debitor/5060-hs-office-debitor.sql
+++ b/src/main/resources/db/changelog/5-hs-office/506-debitor/5060-hs-office-debitor.sql
@@ -6,7 +6,7 @@
 
 create table hs_office_debitor
 (
-    uuid                    uuid unique references RbacObject (uuid) initially deferred,
+    uuid                    uuid unique references rbac.object (uuid) initially deferred,
     version                 int not null default 0,
     debitorNumberSuffix     char(2) not null check (debitorNumberSuffix::text ~ '^[0-9][0-9]$'),
     debitorRelUuid          uuid not null references hs_office_relation(uuid),
diff --git a/src/main/resources/db/changelog/5-hs-office/506-debitor/5063-hs-office-debitor-rbac.sql b/src/main/resources/db/changelog/5-hs-office/506-debitor/5063-hs-office-debitor-rbac.sql
index b0c77c67..130f4d95 100644
--- a/src/main/resources/db/changelog/5-hs-office/506-debitor/5063-hs-office-debitor-rbac.sql
+++ b/src/main/resources/db/changelog/5-hs-office/506-debitor/5063-hs-office-debitor-rbac.sql
@@ -193,7 +193,7 @@ begin
     end if;
 
     raise exception '[403] insert into hs_office_debitor values(%) not allowed for current subjects % (%)',
-            NEW, currentSubjects(), currentSubjectsUuids();
+            NEW, currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
 end; $$;
 
 create trigger hs_office_debitor_insert_permission_check_tg
diff --git a/src/main/resources/db/changelog/5-hs-office/507-sepamandate/5070-hs-office-sepamandate.sql b/src/main/resources/db/changelog/5-hs-office/507-sepamandate/5070-hs-office-sepamandate.sql
index ff020fb3..35aad65a 100644
--- a/src/main/resources/db/changelog/5-hs-office/507-sepamandate/5070-hs-office-sepamandate.sql
+++ b/src/main/resources/db/changelog/5-hs-office/507-sepamandate/5070-hs-office-sepamandate.sql
@@ -6,7 +6,7 @@
 
 create table if not exists hs_office_sepamandate
 (
-    uuid                uuid unique references RbacObject (uuid) initially deferred,
+    uuid                uuid unique references rbac.object (uuid) initially deferred,
     version             int not null default 0,
     debitorUuid         uuid not null references hs_office_debitor(uuid),
     bankAccountUuid     uuid not null references hs_office_bankaccount(uuid),
diff --git a/src/main/resources/db/changelog/5-hs-office/507-sepamandate/5073-hs-office-sepamandate-rbac.sql b/src/main/resources/db/changelog/5-hs-office/507-sepamandate/5073-hs-office-sepamandate-rbac.sql
index e794d97a..ea2fe7c0 100644
--- a/src/main/resources/db/changelog/5-hs-office/507-sepamandate/5073-hs-office-sepamandate-rbac.sql
+++ b/src/main/resources/db/changelog/5-hs-office/507-sepamandate/5073-hs-office-sepamandate-rbac.sql
@@ -51,7 +51,7 @@ begin
         hsOfficeSepaMandateOWNER(NEW),
             permissions => array['DELETE'],
             incomingSuperRoles => array[globalADMIN()],
-            userUuids => array[currentUserUuid()]
+            userUuids => array[rbac.currentSubjectUuid()]
     );
 
     perform createRoleWithGrants(
@@ -174,7 +174,7 @@ begin
     end if;
 
     raise exception '[403] insert into hs_office_sepamandate values(%) not allowed for current subjects % (%)',
-            NEW, currentSubjects(), currentSubjectsUuids();
+            NEW, currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
 end; $$;
 
 create trigger hs_office_sepamandate_insert_permission_check_tg
diff --git a/src/main/resources/db/changelog/5-hs-office/510-membership/5100-hs-office-membership.sql b/src/main/resources/db/changelog/5-hs-office/510-membership/5100-hs-office-membership.sql
index ab9d3e43..26d1a0d2 100644
--- a/src/main/resources/db/changelog/5-hs-office/510-membership/5100-hs-office-membership.sql
+++ b/src/main/resources/db/changelog/5-hs-office/510-membership/5100-hs-office-membership.sql
@@ -19,7 +19,7 @@ CREATE CAST (character varying as HsOfficeMembershipStatus) WITH INOUT AS IMPLIC
 
 create table if not exists hs_office_membership
 (
-    uuid                    uuid unique references RbacObject (uuid) initially deferred,
+    uuid                    uuid unique references rbac.object (uuid) initially deferred,
     version                 int not null default 0,
     partnerUuid             uuid not null references hs_office_partner(uuid),
     memberNumberSuffix      char(2) not null check (memberNumberSuffix::text ~ '^[0-9][0-9]$'),
diff --git a/src/main/resources/db/changelog/5-hs-office/510-membership/5103-hs-office-membership-rbac.sql b/src/main/resources/db/changelog/5-hs-office/510-membership/5103-hs-office-membership-rbac.sql
index ec39c6d3..ad90b0c2 100644
--- a/src/main/resources/db/changelog/5-hs-office/510-membership/5103-hs-office-membership-rbac.sql
+++ b/src/main/resources/db/changelog/5-hs-office/510-membership/5103-hs-office-membership-rbac.sql
@@ -45,7 +45,7 @@ begin
 
     perform createRoleWithGrants(
         hsOfficeMembershipOWNER(NEW),
-            userUuids => array[currentUserUuid()]
+            userUuids => array[rbac.currentSubjectUuid()]
     );
 
     perform createRoleWithGrants(
@@ -155,7 +155,7 @@ begin
     end if;
 
     raise exception '[403] insert into hs_office_membership values(%) not allowed for current subjects % (%)',
-            NEW, currentSubjects(), currentSubjectsUuids();
+            NEW, currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
 end; $$;
 
 create trigger hs_office_membership_insert_permission_check_tg
diff --git a/src/main/resources/db/changelog/5-hs-office/511-coopshares/5110-hs-office-coopshares.sql b/src/main/resources/db/changelog/5-hs-office/511-coopshares/5110-hs-office-coopshares.sql
index 1adf48d6..1cb9dd72 100644
--- a/src/main/resources/db/changelog/5-hs-office/511-coopshares/5110-hs-office-coopshares.sql
+++ b/src/main/resources/db/changelog/5-hs-office/511-coopshares/5110-hs-office-coopshares.sql
@@ -10,7 +10,7 @@ CREATE CAST (character varying as HsOfficeCoopSharesTransactionType) WITH INOUT
 
 create table if not exists hs_office_coopsharestransaction
 (
-    uuid            uuid unique references RbacObject (uuid) initially deferred,
+    uuid            uuid unique references rbac.object (uuid) initially deferred,
     version         int not null default 0,
     membershipUuid  uuid not null references hs_office_membership(uuid),
     transactionType HsOfficeCoopSharesTransactionType not null,
diff --git a/src/main/resources/db/changelog/5-hs-office/511-coopshares/5113-hs-office-coopshares-rbac.sql b/src/main/resources/db/changelog/5-hs-office/511-coopshares/5113-hs-office-coopshares-rbac.sql
index e632b648..f440dd83 100644
--- a/src/main/resources/db/changelog/5-hs-office/511-coopshares/5113-hs-office-coopshares-rbac.sql
+++ b/src/main/resources/db/changelog/5-hs-office/511-coopshares/5113-hs-office-coopshares-rbac.sql
@@ -131,7 +131,7 @@ begin
     end if;
 
     raise exception '[403] insert into hs_office_coopsharestransaction values(%) not allowed for current subjects % (%)',
-            NEW, currentSubjects(), currentSubjectsUuids();
+            NEW, currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
 end; $$;
 
 create trigger hs_office_coopsharestransaction_insert_permission_check_tg
diff --git a/src/main/resources/db/changelog/5-hs-office/512-coopassets/5120-hs-office-coopassets.sql b/src/main/resources/db/changelog/5-hs-office/512-coopassets/5120-hs-office-coopassets.sql
index 3b93e61e..65adf724 100644
--- a/src/main/resources/db/changelog/5-hs-office/512-coopassets/5120-hs-office-coopassets.sql
+++ b/src/main/resources/db/changelog/5-hs-office/512-coopassets/5120-hs-office-coopassets.sql
@@ -17,7 +17,7 @@ CREATE CAST (character varying as HsOfficeCoopAssetsTransactionType) WITH INOUT
 
 create table if not exists hs_office_coopassetstransaction
 (
-    uuid                uuid unique references RbacObject (uuid) initially deferred,
+    uuid                uuid unique references rbac.object (uuid) initially deferred,
     version             int not null default 0,
     membershipUuid      uuid not null references hs_office_membership(uuid),
     transactionType     HsOfficeCoopAssetsTransactionType not null,
diff --git a/src/main/resources/db/changelog/5-hs-office/512-coopassets/5123-hs-office-coopassets-rbac.sql b/src/main/resources/db/changelog/5-hs-office/512-coopassets/5123-hs-office-coopassets-rbac.sql
index 4ef072a1..edaf816e 100644
--- a/src/main/resources/db/changelog/5-hs-office/512-coopassets/5123-hs-office-coopassets-rbac.sql
+++ b/src/main/resources/db/changelog/5-hs-office/512-coopassets/5123-hs-office-coopassets-rbac.sql
@@ -131,7 +131,7 @@ begin
     end if;
 
     raise exception '[403] insert into hs_office_coopassetstransaction values(%) not allowed for current subjects % (%)',
-            NEW, currentSubjects(), currentSubjectsUuids();
+            NEW, currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
 end; $$;
 
 create trigger hs_office_coopassetstransaction_insert_permission_check_tg
diff --git a/src/main/resources/db/changelog/6-hs-booking/620-booking-project/6200-hs-booking-project.sql b/src/main/resources/db/changelog/6-hs-booking/620-booking-project/6200-hs-booking-project.sql
index 8ea0cc68..d8471d71 100644
--- a/src/main/resources/db/changelog/6-hs-booking/620-booking-project/6200-hs-booking-project.sql
+++ b/src/main/resources/db/changelog/6-hs-booking/620-booking-project/6200-hs-booking-project.sql
@@ -6,7 +6,7 @@
 
 create table if not exists hs_booking_project
 (
-    uuid                uuid unique references RbacObject (uuid),
+    uuid                uuid unique references rbac.object (uuid),
     version             int not null default 0,
     debitorUuid         uuid not null references hs_office_debitor(uuid),
     caption             varchar(80) not null
diff --git a/src/main/resources/db/changelog/6-hs-booking/620-booking-project/6203-hs-booking-project-rbac.sql b/src/main/resources/db/changelog/6-hs-booking/620-booking-project/6203-hs-booking-project-rbac.sql
index 7137f162..7079ea11 100644
--- a/src/main/resources/db/changelog/6-hs-booking/620-booking-project/6203-hs-booking-project-rbac.sql
+++ b/src/main/resources/db/changelog/6-hs-booking/620-booking-project/6203-hs-booking-project-rbac.sql
@@ -168,7 +168,7 @@ begin
     end if;
 
     raise exception '[403] insert into hs_booking_project values(%) not allowed for current subjects % (%)',
-            NEW, currentSubjects(), currentSubjectsUuids();
+            NEW, currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
 end; $$;
 
 create trigger hs_booking_project_insert_permission_check_tg
diff --git a/src/main/resources/db/changelog/6-hs-booking/630-booking-item/6200-hs-booking-item.sql b/src/main/resources/db/changelog/6-hs-booking/630-booking-item/6200-hs-booking-item.sql
index 6cb8808a..215a5eb1 100644
--- a/src/main/resources/db/changelog/6-hs-booking/630-booking-item/6200-hs-booking-item.sql
+++ b/src/main/resources/db/changelog/6-hs-booking/630-booking-item/6200-hs-booking-item.sql
@@ -16,7 +16,7 @@ CREATE CAST (character varying as HsBookingItemType) WITH INOUT AS IMPLICIT;
 
 create table if not exists hs_booking_item
 (
-    uuid                uuid unique references RbacObject (uuid),
+    uuid                uuid unique references rbac.object (uuid),
     version             int not null default 0,
     projectUuid         uuid null references hs_booking_project(uuid),
     type                HsBookingItemType not null,
diff --git a/src/main/resources/db/changelog/6-hs-booking/630-booking-item/6203-hs-booking-item-rbac.sql b/src/main/resources/db/changelog/6-hs-booking/630-booking-item/6203-hs-booking-item-rbac.sql
index e9ce4c33..9e7c8a8d 100644
--- a/src/main/resources/db/changelog/6-hs-booking/630-booking-item/6203-hs-booking-item-rbac.sql
+++ b/src/main/resources/db/changelog/6-hs-booking/630-booking-item/6203-hs-booking-item-rbac.sql
@@ -239,7 +239,7 @@ begin
     end if;
 
     raise exception '[403] insert into hs_booking_item values(%) not allowed for current subjects % (%)',
-            NEW, currentSubjects(), currentSubjectsUuids();
+            NEW, currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
 end; $$;
 
 create trigger hs_booking_item_insert_permission_check_tg
diff --git a/src/main/resources/db/changelog/6-hs-booking/630-booking-item/6303-hs-booking-item-rbac.sql b/src/main/resources/db/changelog/6-hs-booking/630-booking-item/6303-hs-booking-item-rbac.sql
index e9ce4c33..9e7c8a8d 100644
--- a/src/main/resources/db/changelog/6-hs-booking/630-booking-item/6303-hs-booking-item-rbac.sql
+++ b/src/main/resources/db/changelog/6-hs-booking/630-booking-item/6303-hs-booking-item-rbac.sql
@@ -239,7 +239,7 @@ begin
     end if;
 
     raise exception '[403] insert into hs_booking_item values(%) not allowed for current subjects % (%)',
-            NEW, currentSubjects(), currentSubjectsUuids();
+            NEW, currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
 end; $$;
 
 create trigger hs_booking_item_insert_permission_check_tg
diff --git a/src/main/resources/db/changelog/7-hs-hosting/701-hosting-asset/7010-hs-hosting-asset.sql b/src/main/resources/db/changelog/7-hs-hosting/701-hosting-asset/7010-hs-hosting-asset.sql
index 34a79af5..5c1bd781 100644
--- a/src/main/resources/db/changelog/7-hs-hosting/701-hosting-asset/7010-hs-hosting-asset.sql
+++ b/src/main/resources/db/changelog/7-hs-hosting/701-hosting-asset/7010-hs-hosting-asset.sql
@@ -30,7 +30,7 @@ CREATE CAST (character varying as HsHostingAssetType) WITH INOUT AS IMPLICIT;
 
 create table if not exists hs_hosting_asset
 (
-    uuid                uuid unique references RbacObject (uuid),
+    uuid                uuid unique references rbac.object (uuid),
     version             int not null default 0,
     bookingItemUuid     uuid null references hs_booking_item(uuid),
     type                HsHostingAssetType not null,
diff --git a/src/main/resources/db/changelog/7-hs-hosting/701-hosting-asset/7013-hs-hosting-asset-rbac.sql b/src/main/resources/db/changelog/7-hs-hosting/701-hosting-asset/7013-hs-hosting-asset-rbac.sql
index 5ec3e044..b237a18a 100644
--- a/src/main/resources/db/changelog/7-hs-hosting/701-hosting-asset/7013-hs-hosting-asset-rbac.sql
+++ b/src/main/resources/db/changelog/7-hs-hosting/701-hosting-asset/7013-hs-hosting-asset-rbac.sql
@@ -53,7 +53,7 @@ begin
             	globalADMIN(unassumed()),
             	hsBookingItemADMIN(newBookingItem),
             	hsHostingAssetADMIN(newParentAsset)],
-            userUuids => array[currentUserUuid()]
+            userUuids => array[rbac.currentSubjectUuid()]
     );
 
     perform createRoleWithGrants(
diff --git a/src/main/resources/db/changelog/9-hs-global/9000-statistics.sql b/src/main/resources/db/changelog/9-hs-global/9000-statistics.sql
index 7c4304b3..7265d2cc 100644
--- a/src/main/resources/db/changelog/9-hs-global/9000-statistics.sql
+++ b/src/main/resources/db/changelog/9-hs-global/9000-statistics.sql
@@ -9,7 +9,7 @@ select *
               from rbacstatisticsview
           union all
           select to_char(count(*)::int, '9 999 999 999') as "count", 'objects' as "rbac-table", objecttable as "hs-table", '' as "type"
-              from rbacobject
+              from rbac.object
               group by objecttable
           union all
           select to_char(count(*)::int, '9 999 999 999'), 'objects', 'hs_hosting_asset', type::text
diff --git a/src/main/resources/db/changelog/db.changelog-master.yaml b/src/main/resources/db/changelog/db.changelog-master.yaml
index f30020ae..82ab190e 100644
--- a/src/main/resources/db/changelog/db.changelog-master.yaml
+++ b/src/main/resources/db/changelog/db.changelog-master.yaml
@@ -27,6 +27,8 @@ databaseChangeLog:
         file: db/changelog/0-basis/030-historization.sql
     - include:
         file: db/changelog/0-basis/090-log-slow-queries-extensions.sql
+    - include:
+        file: db/changelog/1-rbac/1000-rbac-schema.sql
     - include:
         file: db/changelog/1-rbac/1050-rbac-base.sql
     - include:
diff --git a/src/test/java/net/hostsharing/hsadminng/arch/ArchitectureTest.java b/src/test/java/net/hostsharing/hsadminng/arch/ArchitectureTest.java
index 8a51a3f2..cb214959 100644
--- a/src/test/java/net/hostsharing/hsadminng/arch/ArchitectureTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/arch/ArchitectureTest.java
@@ -71,7 +71,7 @@ public class ArchitectureTest {
                     "..rbac.rbacuser",
                     "..rbac.rbacgrant",
                     "..rbac.rbacrole",
-                    "..rbac.rbacobject",
+                    "..rbac.object",
                     "..rbac.rbacdef",
                     "..stringify"
                     // ATTENTION: Don't simply add packages here, also add arch rules for the new package!
@@ -160,7 +160,7 @@ public class ArchitectureTest {
                     "..hs.booking.(*)..",
                     "..hs.hosting.(*)..",
                     "..hs.migration",
-                    "..rbac.rbacgrant" // TODO.test: just because of RbacGrantsDiagramServiceIntegrationTest
+                    "..rbacgrant" // TODO.test: just because of RbacGrantsDiagramServiceIntegrationTest
             );
 
     @ArchTest
diff --git a/src/test/java/net/hostsharing/hsadminng/hs/booking/item/HsBookingItemControllerAcceptanceTest.java b/src/test/java/net/hostsharing/hsadminng/hs/booking/item/HsBookingItemControllerAcceptanceTest.java
index 539df3e5..25222f6c 100644
--- a/src/test/java/net/hostsharing/hsadminng/hs/booking/item/HsBookingItemControllerAcceptanceTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/hs/booking/item/HsBookingItemControllerAcceptanceTest.java
@@ -72,7 +72,7 @@ class HsBookingItemControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/booking/items?projectUuid=" + givenProject.getUuid())
@@ -140,7 +140,7 @@ class HsBookingItemControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             final var location = RestAssured // @formatter:off
                     .given()
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         .contentType(ContentType.JSON)
                         .body("""
                             {
@@ -198,7 +198,7 @@ class HsBookingItemControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/booking/items/" + givenBookingItemUuid)
@@ -232,7 +232,7 @@ class HsBookingItemControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "selfregistered-user-drew@hostsharing.org")
+                    .header("current-subject", "selfregistered-user-drew@hostsharing.org")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/booking/items/" + givenBookingItemUuid)
@@ -250,7 +250,7 @@ class HsBookingItemControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .header("assumed-roles", "hs_booking_project#D-1000313-D-1000313defaultproject:ADMIN")
                     .port(port)
                 .when()
@@ -294,7 +294,7 @@ class HsBookingItemControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .header("assumed-roles", "hs_booking_project#D-1000111-D-1000111defaultproject:AGENT")
                     .contentType(ContentType.JSON)
                     .body("""
@@ -350,7 +350,7 @@ class HsBookingItemControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/booking/items/" + givenBookingItem.getUuid())
@@ -369,7 +369,7 @@ class HsBookingItemControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "selfregistered-user-drew@hostsharing.org")
+                    .header("current-subject", "selfregistered-user-drew@hostsharing.org")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/booking/items/" + givenBookingItem.getUuid())
diff --git a/src/test/java/net/hostsharing/hsadminng/hs/booking/item/HsBookingItemControllerRestTest.java b/src/test/java/net/hostsharing/hsadminng/hs/booking/item/HsBookingItemControllerRestTest.java
index 55893753..e28f4d38 100644
--- a/src/test/java/net/hostsharing/hsadminng/hs/booking/item/HsBookingItemControllerRestTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/hs/booking/item/HsBookingItemControllerRestTest.java
@@ -83,7 +83,7 @@ class HsBookingItemControllerRestTest {
             // when
             mockMvc.perform(MockMvcRequestBuilders
                             .post("/api/hs/booking/items")
-                            .header("current-user", "superuser-alex@hostsharing.net")
+                            .header("current-subject", "superuser-alex@hostsharing.net")
                             .contentType(MediaType.APPLICATION_JSON)
                             .content("""
                             {
@@ -133,7 +133,7 @@ class HsBookingItemControllerRestTest {
             // when
             mockMvc.perform(MockMvcRequestBuilders
                             .post("/api/hs/booking/items")
-                            .header("current-user", "superuser-alex@hostsharing.net")
+                            .header("current-subject", "superuser-alex@hostsharing.net")
                             .contentType(MediaType.APPLICATION_JSON)
                             .content("""
                             {
diff --git a/src/test/java/net/hostsharing/hsadminng/hs/booking/project/HsBookingProjectControllerAcceptanceTest.java b/src/test/java/net/hostsharing/hsadminng/hs/booking/project/HsBookingProjectControllerAcceptanceTest.java
index c4bc8e2e..ba182483 100644
--- a/src/test/java/net/hostsharing/hsadminng/hs/booking/project/HsBookingProjectControllerAcceptanceTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/hs/booking/project/HsBookingProjectControllerAcceptanceTest.java
@@ -57,7 +57,7 @@ class HsBookingProjectControllerAcceptanceTest extends ContextBasedTestWithClean
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/booking/projects?debitorUuid=" + givenDebitor.getUuid())
@@ -88,7 +88,7 @@ class HsBookingProjectControllerAcceptanceTest extends ContextBasedTestWithClean
 
             final var location = RestAssured // @formatter:off
                     .given()
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         .contentType(ContentType.JSON)
                         .body("""
                             {
@@ -128,7 +128,7 @@ class HsBookingProjectControllerAcceptanceTest extends ContextBasedTestWithClean
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/booking/projects/" + givenBookingProjectUuid)
@@ -151,7 +151,7 @@ class HsBookingProjectControllerAcceptanceTest extends ContextBasedTestWithClean
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "selfregistered-user-drew@hostsharing.org")
+                    .header("current-subject", "selfregistered-user-drew@hostsharing.org")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/booking/projects/" + givenBookingProjectUuid)
@@ -167,7 +167,7 @@ class HsBookingProjectControllerAcceptanceTest extends ContextBasedTestWithClean
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "person-TuckerJack@example.com")
+                    .header("current-subject", "person-TuckerJack@example.com")
                     .header("assumed-roles", "hs_booking_project#D-1000313-D-1000313defaultproject:AGENT")
                     .port(port)
                 .when()
@@ -193,7 +193,7 @@ class HsBookingProjectControllerAcceptanceTest extends ContextBasedTestWithClean
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                         {
@@ -232,7 +232,7 @@ class HsBookingProjectControllerAcceptanceTest extends ContextBasedTestWithClean
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/booking/projects/" + givenBookingProject.getUuid())
@@ -250,7 +250,7 @@ class HsBookingProjectControllerAcceptanceTest extends ContextBasedTestWithClean
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "selfregistered-user-drew@hostsharing.org")
+                    .header("current-subject", "selfregistered-user-drew@hostsharing.org")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/booking/projects/" + givenBookingProject.getUuid())
diff --git a/src/test/java/net/hostsharing/hsadminng/hs/hosting/asset/HsHostingAssetControllerAcceptanceTest.java b/src/test/java/net/hostsharing/hsadminng/hs/hosting/asset/HsHostingAssetControllerAcceptanceTest.java
index 81f3192e..23eecaf2 100644
--- a/src/test/java/net/hostsharing/hsadminng/hs/hosting/asset/HsHostingAssetControllerAcceptanceTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/hs/hosting/asset/HsHostingAssetControllerAcceptanceTest.java
@@ -85,7 +85,7 @@ class HsHostingAssetControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/hosting/assets?projectUuid=" + givenProject.getUuid() + "&type=MANAGED_WEBSPACE")
@@ -113,7 +113,7 @@ class HsHostingAssetControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             RestAssured // @formatter:off
                     .given()
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         .header("assumed-roles", "hs_hosting_asset#fir01:AGENT")
                         .port(port)
                     .when()
@@ -160,7 +160,7 @@ class HsHostingAssetControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             final var location = RestAssured // @formatter:off
                     .given()
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         .contentType(ContentType.JSON)
                         .body("""
                             {
@@ -217,7 +217,7 @@ class HsHostingAssetControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             final var location = RestAssured // @formatter:off
                     .given()
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         .header("assumed-roles", "hs_hosting_asset#vm1011:ADMIN")
                         .contentType(ContentType.JSON)
                         .body("""
@@ -271,7 +271,7 @@ class HsHostingAssetControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             final var location = RestAssured // @formatter:off
                     .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                             {
@@ -317,7 +317,7 @@ class HsHostingAssetControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             RestAssured // @formatter:off
                     .given()
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         .contentType(ContentType.JSON)
                         .body("""
                                 {
@@ -372,7 +372,7 @@ class HsHostingAssetControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             RestAssured // @formatter:off
                     .given()
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         .contentType(ContentType.JSON)
                         .body("""
                                     {
@@ -411,7 +411,7 @@ class HsHostingAssetControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/hosting/assets/" + givenAssetUuid)
@@ -436,7 +436,7 @@ class HsHostingAssetControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "selfregistered-user-drew@hostsharing.org")
+                    .header("current-subject", "selfregistered-user-drew@hostsharing.org")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/hosting/assets/" + givenAssetUuid)
@@ -453,7 +453,7 @@ class HsHostingAssetControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "person-TuckerJack@example.com")
+                    .header("current-subject", "person-TuckerJack@example.com")
                     .header("assumed-roles", "hs_booking_project#D-1000313-D-1000313defaultproject:AGENT")
                     .port(port)
                 .when()
@@ -499,7 +499,7 @@ class HsHostingAssetControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                         {
@@ -573,7 +573,7 @@ class HsHostingAssetControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             RestAssured // @formatter:off
                     .given()
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         //.header("assumed-roles", "hs_hosting_asset#vm2001:ADMIN")
                         .contentType(ContentType.JSON)
                         .body("""
@@ -657,7 +657,7 @@ class HsHostingAssetControllerAcceptanceTest extends ContextBasedTestWithCleanup
                             .build());
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/hosting/assets/" + givenAsset.getUuid())
@@ -690,7 +690,7 @@ class HsHostingAssetControllerAcceptanceTest extends ContextBasedTestWithCleanup
                             .build());
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "selfregistered-user-drew@hostsharing.org")
+                    .header("current-subject", "selfregistered-user-drew@hostsharing.org")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/hosting/assets/" + givenAsset.getUuid())
diff --git a/src/test/java/net/hostsharing/hsadminng/hs/hosting/asset/HsHostingAssetControllerRestTest.java b/src/test/java/net/hostsharing/hsadminng/hs/hosting/asset/HsHostingAssetControllerRestTest.java
index ff2da459..0d9dd87b 100644
--- a/src/test/java/net/hostsharing/hsadminng/hs/hosting/asset/HsHostingAssetControllerRestTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/hs/hosting/asset/HsHostingAssetControllerRestTest.java
@@ -590,7 +590,7 @@ public class HsHostingAssetControllerRestTest {
         // when
         final var result = mockMvc.perform(MockMvcRequestBuilders
                         .get("/api/hs/hosting/assets?type="+testCase.name())
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         .accept(MediaType.APPLICATION_JSON))
 
                 // then
@@ -660,7 +660,7 @@ public class HsHostingAssetControllerRestTest {
         // when
         final var result = mockMvc.perform(MockMvcRequestBuilders
                         .patch("/api/hs/hosting/assets/" + givenDomainHttpSetupUuid)
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("""
                         {
diff --git a/src/test/java/net/hostsharing/hsadminng/hs/office/bankaccount/HsOfficeBankAccountControllerAcceptanceTest.java b/src/test/java/net/hostsharing/hsadminng/hs/office/bankaccount/HsOfficeBankAccountControllerAcceptanceTest.java
index 540fd2c7..3e43ea3a 100644
--- a/src/test/java/net/hostsharing/hsadminng/hs/office/bankaccount/HsOfficeBankAccountControllerAcceptanceTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/hs/office/bankaccount/HsOfficeBankAccountControllerAcceptanceTest.java
@@ -54,7 +54,7 @@ class HsOfficeBankAccountControllerAcceptanceTest extends ContextBasedTestWithCl
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/bankaccounts")
@@ -120,7 +120,7 @@ class HsOfficeBankAccountControllerAcceptanceTest extends ContextBasedTestWithCl
 
             final var location = RestAssured // @formatter:off
                     .given()
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         .contentType(ContentType.JSON)
                         .body("""
                             {
@@ -159,7 +159,7 @@ class HsOfficeBankAccountControllerAcceptanceTest extends ContextBasedTestWithCl
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/bankaccounts/" + givenBankAccountUuid)
@@ -180,7 +180,7 @@ class HsOfficeBankAccountControllerAcceptanceTest extends ContextBasedTestWithCl
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "selfregistered-user-drew@hostsharing.org")
+                    .header("current-subject", "selfregistered-user-drew@hostsharing.org")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/bankaccounts/" + givenBankAccountUuid)
@@ -196,7 +196,7 @@ class HsOfficeBankAccountControllerAcceptanceTest extends ContextBasedTestWithCl
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "bankaccount-admin@firstbankaccount.example.com")
+                    .header("current-subject", "bankaccount-admin@firstbankaccount.example.com")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/bankaccounts/" + givenBankAccountUuid)
@@ -224,7 +224,7 @@ class HsOfficeBankAccountControllerAcceptanceTest extends ContextBasedTestWithCl
 
             final var location = RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                        {
@@ -262,7 +262,7 @@ class HsOfficeBankAccountControllerAcceptanceTest extends ContextBasedTestWithCl
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/office/bankaccounts/" + givenBankAccount.getUuid())
@@ -279,7 +279,7 @@ class HsOfficeBankAccountControllerAcceptanceTest extends ContextBasedTestWithCl
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "selfregistered-test-user@hostsharing.org")
+                    .header("current-subject", "selfregistered-test-user@hostsharing.org")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/office/bankaccounts/" + givenBankAccount.getUuid())
@@ -300,7 +300,7 @@ class HsOfficeBankAccountControllerAcceptanceTest extends ContextBasedTestWithCl
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "selfregistered-user-drew@hostsharing.org")
+                    .header("current-subject", "selfregistered-user-drew@hostsharing.org")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/office/bankaccounts/" + givenBankAccount.getUuid())
diff --git a/src/test/java/net/hostsharing/hsadminng/hs/office/bankaccount/HsOfficeBankAccountControllerRestTest.java b/src/test/java/net/hostsharing/hsadminng/hs/office/bankaccount/HsOfficeBankAccountControllerRestTest.java
index 37f85f83..6dcd1cb5 100644
--- a/src/test/java/net/hostsharing/hsadminng/hs/office/bankaccount/HsOfficeBankAccountControllerRestTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/hs/office/bankaccount/HsOfficeBankAccountControllerRestTest.java
@@ -62,7 +62,7 @@ class HsOfficeBankAccountControllerRestTest {
         // when
         mockMvc.perform(MockMvcRequestBuilders
                         .post("/api/hs/office/bankaccounts")
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("""
                                 {
@@ -109,7 +109,7 @@ class HsOfficeBankAccountControllerRestTest {
         // when
         mockMvc.perform(MockMvcRequestBuilders
                         .post("/api/hs/office/bankaccounts")
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content("""
                                 {
diff --git a/src/test/java/net/hostsharing/hsadminng/hs/office/contact/HsOfficeContactControllerAcceptanceTest.java b/src/test/java/net/hostsharing/hsadminng/hs/office/contact/HsOfficeContactControllerAcceptanceTest.java
index 4bd2a4be..ba959ad5 100644
--- a/src/test/java/net/hostsharing/hsadminng/hs/office/contact/HsOfficeContactControllerAcceptanceTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/hs/office/contact/HsOfficeContactControllerAcceptanceTest.java
@@ -61,7 +61,7 @@ class HsOfficeContactControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/contacts")
@@ -99,7 +99,7 @@ class HsOfficeContactControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             final var location = RestAssured // @formatter:off
                     .given()
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         .contentType(ContentType.JSON)
                         .body("""
                                {
@@ -138,7 +138,7 @@ class HsOfficeContactControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/contacts/" + givenContactUuid)
@@ -159,7 +159,7 @@ class HsOfficeContactControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "selfregistered-user-drew@hostsharing.org")
+                    .header("current-subject", "selfregistered-user-drew@hostsharing.org")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/contacts/" + givenContactUuid)
@@ -174,7 +174,7 @@ class HsOfficeContactControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "contact-admin@firstcontact.example.com")
+                    .header("current-subject", "contact-admin@firstcontact.example.com")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/contacts/" + givenContactUuid)
@@ -206,7 +206,7 @@ class HsOfficeContactControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             final var location = RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                        {
@@ -253,7 +253,7 @@ class HsOfficeContactControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             final var location = RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                        {
@@ -301,7 +301,7 @@ class HsOfficeContactControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/office/contacts/" + givenContact.getUuid())
@@ -321,7 +321,7 @@ class HsOfficeContactControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "selfregistered-test-user@hostsharing.org")
+                    .header("current-subject", "selfregistered-test-user@hostsharing.org")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/office/contacts/" + givenContact.getUuid())
@@ -342,7 +342,7 @@ class HsOfficeContactControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "selfregistered-user-drew@hostsharing.org")
+                    .header("current-subject", "selfregistered-user-drew@hostsharing.org")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/office/contacts/" + givenContact.getUuid())
diff --git a/src/test/java/net/hostsharing/hsadminng/hs/office/coopassets/HsOfficeCoopAssetsTransactionControllerAcceptanceTest.java b/src/test/java/net/hostsharing/hsadminng/hs/office/coopassets/HsOfficeCoopAssetsTransactionControllerAcceptanceTest.java
index cb2b937b..9358e9ba 100644
--- a/src/test/java/net/hostsharing/hsadminng/hs/office/coopassets/HsOfficeCoopAssetsTransactionControllerAcceptanceTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/hs/office/coopassets/HsOfficeCoopAssetsTransactionControllerAcceptanceTest.java
@@ -62,7 +62,7 @@ class HsOfficeCoopAssetsTransactionControllerAcceptanceTest extends ContextBased
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/coopassetstransactions")
@@ -80,7 +80,7 @@ class HsOfficeCoopAssetsTransactionControllerAcceptanceTest extends ContextBased
 
             RestAssured // @formatter:off
                     .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/coopassetstransactions?membershipUuid="+givenMembership.getUuid())
@@ -143,7 +143,7 @@ class HsOfficeCoopAssetsTransactionControllerAcceptanceTest extends ContextBased
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/coopassetstransactions?membershipUuid="
@@ -176,7 +176,7 @@ class HsOfficeCoopAssetsTransactionControllerAcceptanceTest extends ContextBased
 
             final var location = RestAssured // @formatter:off
                     .given()
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         .contentType(ContentType.JSON)
                         .body("""
                                {
@@ -233,7 +233,7 @@ class HsOfficeCoopAssetsTransactionControllerAcceptanceTest extends ContextBased
 
             final var location = RestAssured // @formatter:off
                     .given()
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         .contentType(ContentType.JSON)
                         .body("""
                                    {
@@ -289,7 +289,7 @@ class HsOfficeCoopAssetsTransactionControllerAcceptanceTest extends ContextBased
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                            {
@@ -329,7 +329,7 @@ class HsOfficeCoopAssetsTransactionControllerAcceptanceTest extends ContextBased
                     LocalDate.of(2010, 3, 15)).get(0).getUuid();
 
             RestAssured // @formatter:off
-                .given().header("current-user", "superuser-alex@hostsharing.net")
+                .given().header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/coopassetstransactions/" + givenCoopAssetTransactionUuid)
@@ -352,7 +352,7 @@ class HsOfficeCoopAssetsTransactionControllerAcceptanceTest extends ContextBased
                     LocalDate.of(2010, 3, 15)).get(0).getUuid();
 
             RestAssured // @formatter:off
-                .given().header("current-user", "selfregistered-user-drew@hostsharing.org")
+                .given().header("current-subject", "selfregistered-user-drew@hostsharing.org")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/coopassetstransactions/" + givenCoopAssetTransactionUuid)
@@ -370,7 +370,7 @@ class HsOfficeCoopAssetsTransactionControllerAcceptanceTest extends ContextBased
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "person-FirstGmbH@example.com")
+                    .header("current-subject", "person-FirstGmbH@example.com")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/coopassetstransactions/" + givenCoopAssetTransactionUuid)
diff --git a/src/test/java/net/hostsharing/hsadminng/hs/office/coopassets/HsOfficeCoopAssetsTransactionControllerRestTest.java b/src/test/java/net/hostsharing/hsadminng/hs/office/coopassets/HsOfficeCoopAssetsTransactionControllerRestTest.java
index 8176df09..0e4716d4 100644
--- a/src/test/java/net/hostsharing/hsadminng/hs/office/coopassets/HsOfficeCoopAssetsTransactionControllerRestTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/hs/office/coopassets/HsOfficeCoopAssetsTransactionControllerRestTest.java
@@ -115,7 +115,7 @@ class HsOfficeCoopAssetsTransactionControllerRestTest {
         // when
         mockMvc.perform(MockMvcRequestBuilders
                         .post("/api/hs/office/coopassetstransactions")
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(testCase.givenRequestBody())
                         .accept(MediaType.APPLICATION_JSON))
diff --git a/src/test/java/net/hostsharing/hsadminng/hs/office/coopshares/HsOfficeCoopSharesTransactionControllerAcceptanceTest.java b/src/test/java/net/hostsharing/hsadminng/hs/office/coopshares/HsOfficeCoopSharesTransactionControllerAcceptanceTest.java
index bdd9a34a..83fd3917 100644
--- a/src/test/java/net/hostsharing/hsadminng/hs/office/coopshares/HsOfficeCoopSharesTransactionControllerAcceptanceTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/hs/office/coopshares/HsOfficeCoopSharesTransactionControllerAcceptanceTest.java
@@ -69,7 +69,7 @@ class HsOfficeCoopSharesTransactionControllerAcceptanceTest extends ContextBased
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/coopsharestransactions")
@@ -86,7 +86,7 @@ class HsOfficeCoopSharesTransactionControllerAcceptanceTest extends ContextBased
             final var givenMembership = membershipRepo.findMembershipByMemberNumber(1000202);
 
             RestAssured // @formatter:off
-                .given().header("current-user", "superuser-alex@hostsharing.net").port(port).when().get("http://localhost/api/hs/office/coopsharestransactions?membershipUuid=" + givenMembership.getUuid()).then().log().all().assertThat().statusCode(200).contentType("application/json").body("", lenientlyEquals("""
+                .given().header("current-subject", "superuser-alex@hostsharing.net").port(port).when().get("http://localhost/api/hs/office/coopsharestransactions?membershipUuid=" + givenMembership.getUuid()).then().log().all().assertThat().statusCode(200).contentType("application/json").body("", lenientlyEquals("""
                     [
                         {
                             "transactionType": "SUBSCRIPTION",
@@ -141,7 +141,7 @@ class HsOfficeCoopSharesTransactionControllerAcceptanceTest extends ContextBased
             final var givenMembership = membershipRepo.findMembershipByMemberNumber(1000202);
 
             RestAssured // @formatter:off
-                .given().header("current-user", "superuser-alex@hostsharing.net").port(port).when()
+                .given().header("current-subject", "superuser-alex@hostsharing.net").port(port).when()
                     .get("http://localhost/api/hs/office/coopsharestransactions?membershipUuid=" + givenMembership.getUuid() + "&fromValueDate=2020-01-01&toValueDate=2021-12-31").then().log().all().assertThat().statusCode(200).contentType("application/json").body("", lenientlyEquals("""
                     [
                         {
@@ -166,7 +166,7 @@ class HsOfficeCoopSharesTransactionControllerAcceptanceTest extends ContextBased
             final var givenMembership = membershipRepo.findMembershipByMemberNumber(1000101);
 
             final var location = RestAssured // @formatter:off
-                .given().header("current-user", "superuser-alex@hostsharing.net").contentType(ContentType.JSON).body("""
+                .given().header("current-subject", "superuser-alex@hostsharing.net").contentType(ContentType.JSON).body("""
                        {
                            "membershipUuid": "%s",
                            "transactionType": "SUBSCRIPTION",
@@ -210,7 +210,7 @@ class HsOfficeCoopSharesTransactionControllerAcceptanceTest extends ContextBased
 
             final var location = RestAssured // @formatter:off
                 .given()
-                .header("current-user", "superuser-alex@hostsharing.net")
+                .header("current-subject", "superuser-alex@hostsharing.net")
                 .contentType(ContentType.JSON)
                 .body("""
                                    {
@@ -265,7 +265,7 @@ class HsOfficeCoopSharesTransactionControllerAcceptanceTest extends ContextBased
             final var givenMembership = membershipRepo.findMembershipByMemberNumber(1000101);
 
             RestAssured // @formatter:off
-                .given().header("current-user", "superuser-alex@hostsharing.net").contentType(ContentType.JSON).body("""
+                .given().header("current-subject", "superuser-alex@hostsharing.net").contentType(ContentType.JSON).body("""
                     {
                         "membershipUuid": "%s",
                         "transactionType": "CANCELLATION",
@@ -293,7 +293,7 @@ class HsOfficeCoopSharesTransactionControllerAcceptanceTest extends ContextBased
             final var givenCoopShareTransactionUuid = coopSharesTransactionRepo.findCoopSharesTransactionByOptionalMembershipUuidAndDateRange(null, LocalDate.of(2010, 3, 15), LocalDate.of(2010, 3, 15)).get(0).getUuid();
 
             RestAssured // @formatter:off
-                .given().header("current-user", "superuser-alex@hostsharing.net").port(port).when().get("http://localhost/api/hs/office/coopsharestransactions/" + givenCoopShareTransactionUuid).then().log().body().assertThat().statusCode(200).contentType("application/json").body("", lenientlyEquals("""
+                .given().header("current-subject", "superuser-alex@hostsharing.net").port(port).when().get("http://localhost/api/hs/office/coopsharestransactions/" + givenCoopShareTransactionUuid).then().log().body().assertThat().statusCode(200).contentType("application/json").body("", lenientlyEquals("""
                     {
                         "transactionType": "SUBSCRIPTION"
                     }
@@ -306,7 +306,7 @@ class HsOfficeCoopSharesTransactionControllerAcceptanceTest extends ContextBased
             final var givenCoopShareTransactionUuid = coopSharesTransactionRepo.findCoopSharesTransactionByOptionalMembershipUuidAndDateRange(null, LocalDate.of(2010, 3, 15), LocalDate.of(2010, 3, 15)).get(0).getUuid();
 
             RestAssured // @formatter:off
-                .given().header("current-user", "selfregistered-user-drew@hostsharing.org").port(port).when().get("http://localhost/api/hs/office/coopsharestransactions/" + givenCoopShareTransactionUuid).then().log().body().assertThat().statusCode(404); // @formatter:on
+                .given().header("current-subject", "selfregistered-user-drew@hostsharing.org").port(port).when().get("http://localhost/api/hs/office/coopsharestransactions/" + givenCoopShareTransactionUuid).then().log().body().assertThat().statusCode(404); // @formatter:on
         }
 
         @Test
@@ -316,7 +316,7 @@ class HsOfficeCoopSharesTransactionControllerAcceptanceTest extends ContextBased
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "person-FirstGmbH@example.com")
+                    .header("current-subject", "person-FirstGmbH@example.com")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/coopsharestransactions/" + givenCoopShareTransactionUuid)
diff --git a/src/test/java/net/hostsharing/hsadminng/hs/office/coopshares/HsOfficeCoopSharesTransactionControllerRestTest.java b/src/test/java/net/hostsharing/hsadminng/hs/office/coopshares/HsOfficeCoopSharesTransactionControllerRestTest.java
index 6c126978..4d44c0fb 100644
--- a/src/test/java/net/hostsharing/hsadminng/hs/office/coopshares/HsOfficeCoopSharesTransactionControllerRestTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/hs/office/coopshares/HsOfficeCoopSharesTransactionControllerRestTest.java
@@ -111,7 +111,7 @@ class HsOfficeCoopSharesTransactionControllerRestTest {
         // when
         mockMvc.perform(MockMvcRequestBuilders
                         .post("/api/hs/office/coopsharestransactions")
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(testCase.givenRequestBody())
                         .accept(MediaType.APPLICATION_JSON))
diff --git a/src/test/java/net/hostsharing/hsadminng/hs/office/debitor/HsOfficeDebitorControllerAcceptanceTest.java b/src/test/java/net/hostsharing/hsadminng/hs/office/debitor/HsOfficeDebitorControllerAcceptanceTest.java
index 68545a78..7c531fa2 100644
--- a/src/test/java/net/hostsharing/hsadminng/hs/office/debitor/HsOfficeDebitorControllerAcceptanceTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/hs/office/debitor/HsOfficeDebitorControllerAcceptanceTest.java
@@ -80,7 +80,7 @@ class HsOfficeDebitorControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/debitors")
@@ -235,7 +235,7 @@ class HsOfficeDebitorControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             RestAssured // @formatter:off
                     .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                     .when()
                     .get("http://localhost/api/hs/office/debitors?debitorNumber=1000212")
@@ -284,7 +284,7 @@ class HsOfficeDebitorControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             final var location = RestAssured // @formatter:off
                     .given()
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         .contentType(ContentType.JSON)
                         .body("""
                                {
@@ -329,7 +329,7 @@ class HsOfficeDebitorControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             final var location = RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                             {
@@ -381,7 +381,7 @@ class HsOfficeDebitorControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             final var location = RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                             {
@@ -417,7 +417,7 @@ class HsOfficeDebitorControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                             {
@@ -448,7 +448,7 @@ class HsOfficeDebitorControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/debitors/" + givenDebitorUuid)
@@ -509,7 +509,7 @@ class HsOfficeDebitorControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "selfregistered-user-drew@hostsharing.org")
+                    .header("current-subject", "selfregistered-user-drew@hostsharing.org")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/debitors/" + givenDebitorUuid)
@@ -524,7 +524,7 @@ class HsOfficeDebitorControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "contact-admin@firstcontact.example.com")
+                    .header("current-subject", "contact-admin@firstcontact.example.com")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/debitors/" + givenDebitorUuid)
@@ -554,7 +554,7 @@ class HsOfficeDebitorControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             final var location = RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                                {
@@ -637,7 +637,7 @@ class HsOfficeDebitorControllerAcceptanceTest extends ContextBasedTestWithCleanu
             // @formatter:on
             RestAssured // @formatter:off
                     .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .header("assumed-roles", "hs_office_contact#fourthcontact:ADMIN")
                     .contentType(ContentType.JSON)
                     .body("""
@@ -666,7 +666,7 @@ class HsOfficeDebitorControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/office/debitors/" + givenDebitor.getUuid())
@@ -685,7 +685,7 @@ class HsOfficeDebitorControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "contact-admin@fourthcontact.example.com")
+                    .header("current-subject", "contact-admin@fourthcontact.example.com")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/office/debitors/" + givenDebitor.getUuid())
@@ -704,7 +704,7 @@ class HsOfficeDebitorControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "selfregistered-user-drew@hostsharing.org")
+                    .header("current-subject", "selfregistered-user-drew@hostsharing.org")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/office/debitors/" + givenDebitor.getUuid())
diff --git a/src/test/java/net/hostsharing/hsadminng/hs/office/membership/HsOfficeMembershipControllerAcceptanceTest.java b/src/test/java/net/hostsharing/hsadminng/hs/office/membership/HsOfficeMembershipControllerAcceptanceTest.java
index f0e108dc..88e35268 100644
--- a/src/test/java/net/hostsharing/hsadminng/hs/office/membership/HsOfficeMembershipControllerAcceptanceTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/hs/office/membership/HsOfficeMembershipControllerAcceptanceTest.java
@@ -67,7 +67,7 @@ class HsOfficeMembershipControllerAcceptanceTest extends ContextBasedTestWithCle
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/memberships")
@@ -113,7 +113,7 @@ class HsOfficeMembershipControllerAcceptanceTest extends ContextBasedTestWithCle
 
             RestAssured // @formatter:off
                     .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                     .when()
                     .queryParam("partnerUuid", partner.getUuid() )
@@ -141,7 +141,7 @@ class HsOfficeMembershipControllerAcceptanceTest extends ContextBasedTestWithCle
 
             RestAssured // @formatter:off
                     .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                     .when()
                     .queryParam("memberNumber", 1000202 )
@@ -178,7 +178,7 @@ class HsOfficeMembershipControllerAcceptanceTest extends ContextBasedTestWithCle
 
             final var location = RestAssured // @formatter:off
                     .given()
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         .contentType(ContentType.JSON)
                         .body("""
                                {
@@ -221,7 +221,7 @@ class HsOfficeMembershipControllerAcceptanceTest extends ContextBasedTestWithCle
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/memberships/" + givenMembershipUuid)
@@ -247,7 +247,7 @@ class HsOfficeMembershipControllerAcceptanceTest extends ContextBasedTestWithCle
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "selfregistered-user-drew@hostsharing.org")
+                    .header("current-subject", "selfregistered-user-drew@hostsharing.org")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/memberships/" + givenMembershipUuid)
@@ -262,7 +262,7 @@ class HsOfficeMembershipControllerAcceptanceTest extends ContextBasedTestWithCle
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .header("assumed-roles", "hs_office_relation#HostsharingeG-with-PARTNER-ThirdOHG:AGENT")
                     .port(port)
                 .when()
@@ -294,7 +294,7 @@ class HsOfficeMembershipControllerAcceptanceTest extends ContextBasedTestWithCle
 
             final var location = RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                            {
@@ -338,7 +338,7 @@ class HsOfficeMembershipControllerAcceptanceTest extends ContextBasedTestWithCle
             // when
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .header("assumed-roles", givenPartnerAdmin)
                     .contentType(ContentType.JSON)
                     .body("""
@@ -373,7 +373,7 @@ class HsOfficeMembershipControllerAcceptanceTest extends ContextBasedTestWithCle
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/office/memberships/" + givenMembership.getUuid())
@@ -391,7 +391,7 @@ class HsOfficeMembershipControllerAcceptanceTest extends ContextBasedTestWithCle
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .header("assumed-roles", "hs_office_relation#HostsharingeG-with-PARTNER-FirstGmbH:AGENT")
                     .port(port)
                 .when()
@@ -410,7 +410,7 @@ class HsOfficeMembershipControllerAcceptanceTest extends ContextBasedTestWithCle
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "selfregistered-user-drew@hostsharing.org")
+                    .header("current-subject", "selfregistered-user-drew@hostsharing.org")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/office/memberships/" + givenMembership.getUuid())
diff --git a/src/test/java/net/hostsharing/hsadminng/hs/office/membership/HsOfficeMembershipControllerRestTest.java b/src/test/java/net/hostsharing/hsadminng/hs/office/membership/HsOfficeMembershipControllerRestTest.java
index 7c62859b..2a5005e6 100644
--- a/src/test/java/net/hostsharing/hsadminng/hs/office/membership/HsOfficeMembershipControllerRestTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/hs/office/membership/HsOfficeMembershipControllerRestTest.java
@@ -69,7 +69,7 @@ public class HsOfficeMembershipControllerRestTest {
             // when
             mockMvc.perform(MockMvcRequestBuilders
                             .post("/api/hs/office/memberships")
-                            .header("current-user", "superuser-alex@hostsharing.net")
+                            .header("current-subject", "superuser-alex@hostsharing.net")
                             .contentType(MediaType.APPLICATION_JSON)
                             .content("""
                                        {
@@ -99,7 +99,7 @@ public class HsOfficeMembershipControllerRestTest {
             // when
             mockMvc.perform(MockMvcRequestBuilders
                             .post("/api/hs/office/memberships")
-                            .header("current-user", "superuser-alex@hostsharing.net")
+                            .header("current-subject", "superuser-alex@hostsharing.net")
                             .contentType(MediaType.APPLICATION_JSON)
                             .content("""
                                        {
@@ -125,7 +125,7 @@ public class HsOfficeMembershipControllerRestTest {
             // when
             mockMvc.perform(MockMvcRequestBuilders
                             .post("/api/hs/office/memberships")
-                            .header("current-user", "superuser-alex@hostsharing.net")
+                            .header("current-subject", "superuser-alex@hostsharing.net")
                             .contentType(MediaType.APPLICATION_JSON)
                             .content("""
                                        {
diff --git a/src/test/java/net/hostsharing/hsadminng/hs/office/partner/HsOfficePartnerControllerAcceptanceTest.java b/src/test/java/net/hostsharing/hsadminng/hs/office/partner/HsOfficePartnerControllerAcceptanceTest.java
index fc7287e4..c293e59a 100644
--- a/src/test/java/net/hostsharing/hsadminng/hs/office/partner/HsOfficePartnerControllerAcceptanceTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/hs/office/partner/HsOfficePartnerControllerAcceptanceTest.java
@@ -62,7 +62,7 @@ class HsOfficePartnerControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/partners")
@@ -96,7 +96,7 @@ class HsOfficePartnerControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             final var location = RestAssured // @formatter:off
                     .given()
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         .contentType(ContentType.JSON)
                         .body("""
                             {
@@ -155,7 +155,7 @@ class HsOfficePartnerControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             final var location = RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                             {
@@ -193,7 +193,7 @@ class HsOfficePartnerControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             final var location = RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                             {
@@ -238,7 +238,7 @@ class HsOfficePartnerControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/partners/" + givenPartnerUuid)
@@ -270,7 +270,7 @@ class HsOfficePartnerControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "selfregistered-user-drew@hostsharing.org")
+                    .header("current-subject", "selfregistered-user-drew@hostsharing.org")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/partners/" + givenPartnerUuid)
@@ -285,7 +285,7 @@ class HsOfficePartnerControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "contact-admin@firstcontact.example.com")
+                    .header("current-subject", "contact-admin@firstcontact.example.com")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/partners/" + givenPartnerUuid)
@@ -316,7 +316,7 @@ class HsOfficePartnerControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                            {
@@ -383,7 +383,7 @@ class HsOfficePartnerControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             RestAssured // @formatter:off
                     .given()
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         .contentType(ContentType.JSON)
                         .body("""
                                 {
@@ -421,7 +421,7 @@ class HsOfficePartnerControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             final var location = RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                                {
@@ -469,7 +469,7 @@ class HsOfficePartnerControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/office/partners/" + givenPartner.getUuid())
@@ -489,7 +489,7 @@ class HsOfficePartnerControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "contact-admin@fourthcontact.example.com")
+                    .header("current-subject", "contact-admin@fourthcontact.example.com")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/office/partners/" + givenPartner.getUuid())
@@ -508,7 +508,7 @@ class HsOfficePartnerControllerAcceptanceTest extends ContextBasedTestWithCleanu
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "selfregistered-user-drew@hostsharing.org")
+                    .header("current-subject", "selfregistered-user-drew@hostsharing.org")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/office/partners/" + givenPartner.getUuid())
diff --git a/src/test/java/net/hostsharing/hsadminng/hs/office/partner/HsOfficePartnerControllerRestTest.java b/src/test/java/net/hostsharing/hsadminng/hs/office/partner/HsOfficePartnerControllerRestTest.java
index 97b56052..a42a4780 100644
--- a/src/test/java/net/hostsharing/hsadminng/hs/office/partner/HsOfficePartnerControllerRestTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/hs/office/partner/HsOfficePartnerControllerRestTest.java
@@ -95,7 +95,7 @@ class HsOfficePartnerControllerRestTest {
             // when
             mockMvc.perform(MockMvcRequestBuilders
                             .post("/api/hs/office/partners")
-                            .header("current-user", "superuser-alex@hostsharing.net")
+                            .header("current-subject", "superuser-alex@hostsharing.net")
                             .contentType(MediaType.APPLICATION_JSON)
                             .content("""
                                      {
@@ -132,7 +132,7 @@ class HsOfficePartnerControllerRestTest {
             // when
             mockMvc.perform(MockMvcRequestBuilders
                             .post("/api/hs/office/partners")
-                            .header("current-user", "superuser-alex@hostsharing.net")
+                            .header("current-subject", "superuser-alex@hostsharing.net")
                             .contentType(MediaType.APPLICATION_JSON)
                             .content("""
                                      {
@@ -184,7 +184,7 @@ class HsOfficePartnerControllerRestTest {
             // when
             mockMvc.perform(MockMvcRequestBuilders
                             .delete("/api/hs/office/partners/" + givenPartnerUuid)
-                            .header("current-user", "superuser-alex@hostsharing.net")
+                            .header("current-subject", "superuser-alex@hostsharing.net")
                             .contentType(MediaType.APPLICATION_JSON)
                             .accept(MediaType.APPLICATION_JSON))
 
diff --git a/src/test/java/net/hostsharing/hsadminng/hs/office/person/HsOfficePersonControllerAcceptanceTest.java b/src/test/java/net/hostsharing/hsadminng/hs/office/person/HsOfficePersonControllerAcceptanceTest.java
index 4a136331..1bce926c 100644
--- a/src/test/java/net/hostsharing/hsadminng/hs/office/person/HsOfficePersonControllerAcceptanceTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/hs/office/person/HsOfficePersonControllerAcceptanceTest.java
@@ -56,7 +56,7 @@ class HsOfficePersonControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/persons")
@@ -76,7 +76,7 @@ class HsOfficePersonControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             final var location = RestAssured // @formatter:off
                     .given()
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         .contentType(ContentType.JSON)
                         .body("""
                                {
@@ -116,7 +116,7 @@ class HsOfficePersonControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/persons/" + givenPersonUuid)
@@ -139,7 +139,7 @@ class HsOfficePersonControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "selfregistered-user-drew@hostsharing.org")
+                    .header("current-subject", "selfregistered-user-drew@hostsharing.org")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/persons/" + givenPersonUuid)
@@ -156,7 +156,7 @@ class HsOfficePersonControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "person-ErbenBesslerMelBessler@example.com")
+                    .header("current-subject", "person-ErbenBesslerMelBessler@example.com")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/persons/" + givenPersonUuid)
@@ -185,7 +185,7 @@ class HsOfficePersonControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             final var location = RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                        {
@@ -227,7 +227,7 @@ class HsOfficePersonControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             final var location = RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                         {
@@ -271,7 +271,7 @@ class HsOfficePersonControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/office/persons/" + givenPerson.getUuid())
@@ -290,7 +290,7 @@ class HsOfficePersonControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "selfregistered-test-user@hostsharing.org")
+                    .header("current-subject", "selfregistered-test-user@hostsharing.org")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/office/persons/" + givenPerson.getUuid())
@@ -310,7 +310,7 @@ class HsOfficePersonControllerAcceptanceTest extends ContextBasedTestWithCleanup
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "selfregistered-user-drew@hostsharing.org")
+                    .header("current-subject", "selfregistered-user-drew@hostsharing.org")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/office/persons/" + givenPerson.getUuid())
diff --git a/src/test/java/net/hostsharing/hsadminng/hs/office/relation/HsOfficeRelationControllerAcceptanceTest.java b/src/test/java/net/hostsharing/hsadminng/hs/office/relation/HsOfficeRelationControllerAcceptanceTest.java
index 265a65e3..bf80c3ff 100644
--- a/src/test/java/net/hostsharing/hsadminng/hs/office/relation/HsOfficeRelationControllerAcceptanceTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/hs/office/relation/HsOfficeRelationControllerAcceptanceTest.java
@@ -66,7 +66,7 @@ class HsOfficeRelationControllerAcceptanceTest extends ContextBasedTestWithClean
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/relations?personUuid=%s&relationType=%s"
@@ -129,7 +129,7 @@ class HsOfficeRelationControllerAcceptanceTest extends ContextBasedTestWithClean
 
             final var location = RestAssured // @formatter:off
                     .given()
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         .contentType(ContentType.JSON)
                         .body("""
                                {
@@ -176,7 +176,7 @@ class HsOfficeRelationControllerAcceptanceTest extends ContextBasedTestWithClean
 
             final var location = RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                                {
@@ -208,7 +208,7 @@ class HsOfficeRelationControllerAcceptanceTest extends ContextBasedTestWithClean
 
             final var location = RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                                {
@@ -241,7 +241,7 @@ class HsOfficeRelationControllerAcceptanceTest extends ContextBasedTestWithClean
 
             final var location = RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                            {
@@ -275,7 +275,7 @@ class HsOfficeRelationControllerAcceptanceTest extends ContextBasedTestWithClean
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/relations/" + givenRelationUuid)
@@ -298,7 +298,7 @@ class HsOfficeRelationControllerAcceptanceTest extends ContextBasedTestWithClean
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "selfregistered-user-drew@hostsharing.org")
+                    .header("current-subject", "selfregistered-user-drew@hostsharing.org")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/relations/" + givenRelationUuid)
@@ -314,7 +314,7 @@ class HsOfficeRelationControllerAcceptanceTest extends ContextBasedTestWithClean
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "contact-admin@firstcontact.example.com")
+                    .header("current-subject", "contact-admin@firstcontact.example.com")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/relations/" + givenRelation.getUuid())
@@ -357,7 +357,7 @@ class HsOfficeRelationControllerAcceptanceTest extends ContextBasedTestWithClean
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                            {
@@ -400,7 +400,7 @@ class HsOfficeRelationControllerAcceptanceTest extends ContextBasedTestWithClean
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/office/relations/" + givenRelation.getUuid())
@@ -419,7 +419,7 @@ class HsOfficeRelationControllerAcceptanceTest extends ContextBasedTestWithClean
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "contact-admin@seventhcontact.example.com")
+                    .header("current-subject", "contact-admin@seventhcontact.example.com")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/office/relations/" + givenRelation.getUuid())
@@ -438,7 +438,7 @@ class HsOfficeRelationControllerAcceptanceTest extends ContextBasedTestWithClean
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "selfregistered-user-drew@hostsharing.org")
+                    .header("current-subject", "selfregistered-user-drew@hostsharing.org")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/office/relations/" + givenRelation.getUuid())
diff --git a/src/test/java/net/hostsharing/hsadminng/hs/office/sepamandate/HsOfficeSepaMandateControllerAcceptanceTest.java b/src/test/java/net/hostsharing/hsadminng/hs/office/sepamandate/HsOfficeSepaMandateControllerAcceptanceTest.java
index 7d7e2c3a..ebcb817a 100644
--- a/src/test/java/net/hostsharing/hsadminng/hs/office/sepamandate/HsOfficeSepaMandateControllerAcceptanceTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/hs/office/sepamandate/HsOfficeSepaMandateControllerAcceptanceTest.java
@@ -62,7 +62,7 @@ class HsOfficeSepaMandateControllerAcceptanceTest extends ContextBasedTestWithCl
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/sepamandates")
@@ -111,7 +111,7 @@ class HsOfficeSepaMandateControllerAcceptanceTest extends ContextBasedTestWithCl
 
             final var location = RestAssured // @formatter:off
                     .given()
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         .contentType(ContentType.JSON)
                         .body("""
                                {
@@ -153,7 +153,7 @@ class HsOfficeSepaMandateControllerAcceptanceTest extends ContextBasedTestWithCl
 
             final var location = RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                                {
@@ -178,7 +178,7 @@ class HsOfficeSepaMandateControllerAcceptanceTest extends ContextBasedTestWithCl
 
             final var location = RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                                {
@@ -208,7 +208,7 @@ class HsOfficeSepaMandateControllerAcceptanceTest extends ContextBasedTestWithCl
 
             final var location = RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                                {
@@ -242,7 +242,7 @@ class HsOfficeSepaMandateControllerAcceptanceTest extends ContextBasedTestWithCl
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/sepamandates/" + givenSepaMandateUuid)
@@ -272,7 +272,7 @@ class HsOfficeSepaMandateControllerAcceptanceTest extends ContextBasedTestWithCl
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "selfregistered-user-drew@hostsharing.org")
+                    .header("current-subject", "selfregistered-user-drew@hostsharing.org")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/sepamandates/" + givenSepaMandateUuid)
@@ -289,7 +289,7 @@ class HsOfficeSepaMandateControllerAcceptanceTest extends ContextBasedTestWithCl
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "bankaccount-admin@FirstGmbH.example.com")
+                    .header("current-subject", "bankaccount-admin@FirstGmbH.example.com")
                     .port(port)
                 .when()
                     .get("http://localhost/api/hs/office/sepamandates/" + givenSepaMandateUuid)
@@ -321,7 +321,7 @@ class HsOfficeSepaMandateControllerAcceptanceTest extends ContextBasedTestWithCl
 
             final var location = RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                            {
@@ -367,7 +367,7 @@ class HsOfficeSepaMandateControllerAcceptanceTest extends ContextBasedTestWithCl
 
             final var location = RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                            {
@@ -407,7 +407,7 @@ class HsOfficeSepaMandateControllerAcceptanceTest extends ContextBasedTestWithCl
 
             final var location = RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("""
                            {
@@ -441,7 +441,7 @@ class HsOfficeSepaMandateControllerAcceptanceTest extends ContextBasedTestWithCl
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/office/sepamandates/" + givenSepaMandate.getUuid())
@@ -459,7 +459,7 @@ class HsOfficeSepaMandateControllerAcceptanceTest extends ContextBasedTestWithCl
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "bankaccount-admin@FirstGmbH.example.com")
+                    .header("current-subject", "bankaccount-admin@FirstGmbH.example.com")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/office/sepamandates/" + givenSepaMandate.getUuid())
@@ -477,7 +477,7 @@ class HsOfficeSepaMandateControllerAcceptanceTest extends ContextBasedTestWithCl
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "selfregistered-user-drew@hostsharing.org")
+                    .header("current-subject", "selfregistered-user-drew@hostsharing.org")
                     .port(port)
                 .when()
                     .delete("http://localhost/api/hs/office/sepamandates/" + givenSepaMandate.getUuid())
diff --git a/src/test/java/net/hostsharing/hsadminng/rbac/context/ContextBasedTest.java b/src/test/java/net/hostsharing/hsadminng/rbac/context/ContextBasedTest.java
index 1ba06236..dbe873c3 100644
--- a/src/test/java/net/hostsharing/hsadminng/rbac/context/ContextBasedTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/rbac/context/ContextBasedTest.java
@@ -26,7 +26,7 @@ public abstract class ContextBasedTest {
      <pre>
      RbacGrantsDiagramService.writeToFile(
          "title",
-         diagramService.allGrantsToCurrentUser(of(RbacGrantsDiagramService.Include.USERS, RbacGrantsDiagramService.Include.TEST_ENTITIES, RbacGrantsDiagramService.Include.NOT_ASSUMED, RbacGrantsDiagramService.Include.DETAILS, RbacGrantsDiagramService.Include.PERMISSIONS)),
+         diagramService.allGrantsTocurrentSubject(of(RbacGrantsDiagramService.Include.USERS, RbacGrantsDiagramService.Include.TEST_ENTITIES, RbacGrantsDiagramService.Include.NOT_ASSUMED, RbacGrantsDiagramService.Include.DETAILS, RbacGrantsDiagramService.Include.PERMISSIONS)),
          "filename.md
      );
     </pre>
@@ -41,12 +41,12 @@ public abstract class ContextBasedTest {
         this.test = testInfo;
     }
 
-    protected void context(final String currentUser, final String assumedRoles) {
-        context.define(test.getDisplayName(), null, currentUser, assumedRoles);
+    protected void context(final String currentSubject, final String assumedRoles) {
+        context.define(test.getDisplayName(), null, currentSubject, assumedRoles);
     }
 
-    protected void context(final String currentUser) {
-        context(currentUser, null);
+    protected void context(final String currentSubject) {
+        context(currentSubject, null);
     }
 
     protected void historicalContext(final Long txId) {
diff --git a/src/test/java/net/hostsharing/hsadminng/rbac/context/ContextIntegrationTests.java b/src/test/java/net/hostsharing/hsadminng/rbac/context/ContextIntegrationTests.java
index 1838958e..1bace68c 100644
--- a/src/test/java/net/hostsharing/hsadminng/rbac/context/ContextIntegrationTests.java
+++ b/src/test/java/net/hostsharing/hsadminng/rbac/context/ContextIntegrationTests.java
@@ -36,30 +36,30 @@ class ContextIntegrationTests {
 
         context.define("superuser-alex@hostsharing.net", null);
 
-        assertThat(context.getCurrentTask())
+        assertThat(context.fetchCurrentTask())
                 .isEqualTo("ContextIntegrationTests.defineWithoutHttpServletRequestUsesCallStack");
     }
 
     @Test
     @Transactional
-    void defineWithCurrentUserButWithoutAssumedRoles() {
+    void defineWithcurrentSubjectButWithoutAssumedRoles() {
         // when
         context.define("superuser-alex@hostsharing.net");
 
         // then
-        assertThat(context.getCurrentUser()).
+        assertThat(context.fetchCurrentSubject()).
                 isEqualTo("superuser-alex@hostsharing.net");
 
-        assertThat(context.getCurrentUserUUid()).isNotNull();
+        assertThat(context.fetchCurrentSubjectUuid()).isNotNull();
 
-        assertThat(context.getAssumedRoles()).isEmpty();
+        assertThat(context.fetchAssumedRoles()).isEmpty();
 
-        assertThat(context.currentSubjectsUuids())
-                .containsExactly(context.getCurrentUserUUid());
+        assertThat(context.fetchCurrentSubjectOrAssumedRolesUuids())
+                .containsExactly(context.fetchCurrentSubjectUuid());
     }
 
     @Test
-    void defineWithoutCurrentUserButWithAssumedRoles() {
+    void defineWithoutcurrentSubjectButWithAssumedRoles() {
         // when
         final var result = jpaAttempt.transacted(() ->
                 context.define(null, "test_package#yyy00:ADMIN")
@@ -72,7 +72,7 @@ class ContextIntegrationTests {
     }
 
     @Test
-    void defineWithUnknownCurrentUser() {
+    void defineWithUnknowncurrentSubject() {
         // when
         final var result = jpaAttempt.transacted(() ->
                 context.define("unknown@example.org")
@@ -81,27 +81,27 @@ class ContextIntegrationTests {
         // then
         result.assertExceptionWithRootCauseMessage(
                 jakarta.persistence.PersistenceException.class,
-                "[401] user unknown@example.org given in `basis.defineContext(...)` does not exist");
+                "[401] subject unknown@example.org given in `basis.defineContext(...)` does not exist");
     }
 
     @Test
     @Transactional
-    void defineWithCurrentUserAndAssumedRoles() {
+    void defineWithcurrentSubjectAndAssumedRoles() {
         // given
         context.define("superuser-alex@hostsharing.net", "test_customer#xxx:OWNER;test_customer#yyy:OWNER");
 
         // when
-        final var currentUser = context.getCurrentUser();
-        assertThat(currentUser).isEqualTo("superuser-alex@hostsharing.net");
+        final var currentSubject = context.fetchCurrentSubject();
+        assertThat(currentSubject).isEqualTo("superuser-alex@hostsharing.net");
 
         // then
-        assertThat(context.getAssumedRoles())
+        assertThat(context.fetchAssumedRoles())
                 .isEqualTo(Array.of("test_customer#xxx:OWNER", "test_customer#yyy:OWNER"));
-        assertThat(context.currentSubjectsUuids()).hasSize(2);
+        assertThat(context.fetchCurrentSubjectOrAssumedRolesUuids()).hasSize(2);
     }
 
     @Test
-    public void defineContextWithCurrentUserAndAssumeInaccessibleRole() {
+    public void defineContextWithcurrentSubjectAndAssumeInaccessibleRole() {
         // when
         final var result = jpaAttempt.transacted(() ->
                 context.define("customer-admin@xxx.example.com", "test_package#yyy00:ADMIN")
@@ -110,6 +110,6 @@ class ContextIntegrationTests {
         // then
         result.assertExceptionWithRootCauseMessage(
                 jakarta.persistence.PersistenceException.class,
-                "ERROR: [403] user customer-admin@xxx.example.com has no permission to assume role test_package#yyy00:ADMIN");
+                "ERROR: [403] subject customer-admin@xxx.example.com has no permission to assume role test_package#yyy00:ADMIN");
     }
 }
diff --git a/src/test/java/net/hostsharing/hsadminng/rbac/context/ContextUnitTest.java b/src/test/java/net/hostsharing/hsadminng/rbac/context/ContextUnitTest.java
index 3b1f6cf5..1a9f9140 100644
--- a/src/test/java/net/hostsharing/hsadminng/rbac/context/ContextUnitTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/rbac/context/ContextUnitTest.java
@@ -31,7 +31,7 @@ class ContextUnitTest {
            call basis.defineContext(
                cast(:currentTask as varchar(127)),
                cast(:currentRequest as text),
-               cast(:currentUser as varchar(63)),
+               cast(:currentSubject as varchar(63)),
                cast(:assumedRoles as varchar(1023)));
            """;
 
@@ -57,7 +57,7 @@ class ContextUnitTest {
         void registerWithoutHttpServletRequestUsesCallStackForTask() {
             given(em.createNativeQuery(any())).willReturn(nativeQuery);
 
-            context.define("current-user");
+            context.define("current-subject");
 
             verify(em).createNativeQuery(DEFINE_CONTEXT_QUERY_STRING);
             verify(nativeQuery).setParameter(
@@ -69,7 +69,7 @@ class ContextUnitTest {
         void registerWithoutHttpServletRequestUsesEmptyStringForRequest() {
             given(em.createNativeQuery(any())).willReturn(nativeQuery);
 
-            context.define("current-user");
+            context.define("current-subject");
 
             verify(em).createNativeQuery(DEFINE_CONTEXT_QUERY_STRING);
             verify(nativeQuery).setParameter("currentRequest", null);
@@ -109,12 +109,12 @@ class ContextUnitTest {
         @Test
         void registerWithHttpServletRequestUsesRequest() throws IOException {
             givenRequest("POST", "http://localhost:9999/api/endpoint", Map.ofEntries(
-                            Map.entry("current-user", "given-user"),
+                            Map.entry("current-subject", "given-user"),
                             Map.entry("content-type", "application/json"),
                             Map.entry("user-agent", "given-user-agent")),
                     "{}");
 
-            context.define("current-user");
+            context.define("current-subject");
 
             verify(em).createNativeQuery(DEFINE_CONTEXT_QUERY_STRING);
             verify(nativeQuery).setParameter("currentTask", "POST http://localhost:9999/api/endpoint");
@@ -123,20 +123,20 @@ class ContextUnitTest {
         @Test
         void registerWithHttpServletRequestForwardsRequestAsCurl() throws IOException {
             givenRequest("POST", "http://localhost:9999/api/endpoint", Map.ofEntries(
-                            Map.entry("current-user", "given-user"),
+                            Map.entry("current-subject", "given-user"),
                             Map.entry("content-type", "application/json"),
                             Map.entry("user-agent", "given-user-agent")),
                     "{}");
 
-            context.define("current-user");
+            context.define("current-subject");
 
             verify(em).createNativeQuery(DEFINE_CONTEXT_QUERY_STRING);
             verify(nativeQuery).setParameter("currentRequest", """
                     curl -0 -v -X POST http://localhost:9999/api/endpoint \\
-                    -H 'current-user:given-user' \\
                     -H 'content-type:application/json' \\
+                    -H 'current-subject:given-user' \\
                     --data-binary @- << EOF
-                                            
+
                     {}
                     EOF
                     """.trim());
@@ -146,12 +146,12 @@ class ContextUnitTest {
         void shortensCurrentTaskToMaxLength() throws IOException {
             givenRequest("GET", "http://localhost:9999/api/endpoint/" + "0123456789".repeat(13),
                     Map.ofEntries(
-                            Map.entry("current-user", "given-user"),
+                            Map.entry("current-subject", "given-user"),
                             Map.entry("content-type", "application/json"),
                             Map.entry("user-agent", "given-user-agent")),
                     "{}");
 
-            context.define("current-user");
+            context.define("current-subject");
 
             verify(em).createNativeQuery(DEFINE_CONTEXT_QUERY_STRING);
             verify(nativeQuery).setParameter(eq("currentTask"), argThat((String t) -> t.length() == 127));
diff --git a/src/test/java/net/hostsharing/hsadminng/rbac/rbacgrant/RbacGrantControllerAcceptanceTest.java b/src/test/java/net/hostsharing/hsadminng/rbac/rbacgrant/RbacGrantControllerAcceptanceTest.java
index aa2f0afb..4dbbde15 100644
--- a/src/test/java/net/hostsharing/hsadminng/rbac/rbacgrant/RbacGrantControllerAcceptanceTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/rbac/rbacgrant/RbacGrantControllerAcceptanceTest.java
@@ -61,7 +61,7 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
         void globalAdmin_withoutAssumedRole_canViewAllGrants() {
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/rbac/grants")
@@ -113,7 +113,7 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
         void globalAdmin_withAssumedPackageAdminRole_canViewPacketRelatedGrants() {
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .header("assumed-roles", "test_package#yyy00:ADMIN")
                     .port(port)
                 .when()
@@ -136,7 +136,7 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
         void packageAdmin_withoutAssumedRole_canViewPacketRelatedGrants() {
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "pac-admin-yyy00@yyy.example.com")
+                    .header("current-subject", "pac-admin-yyy00@yyy.example.com")
                     .port(port)
                 .when()
                     .get("http://localhost/api/rbac/grants")
@@ -163,12 +163,12 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
         @Test
         void customerAdmin_withAssumedPacketAdminRole_canReadPacketAdminsGrantById() {
             // given
-            final var givenCurrentUserAsPackageAdmin = new Subject("customer-admin@xxx.example.com");
+            final var givencurrentSubjectAsPackageAdmin = new Subject("customer-admin@xxx.example.com");
             final var givenGranteeUser = findRbacUserByName("pac-admin-xxx00@xxx.example.com");
             final var givenGrantedRole = getRbacRoleByName("test_package#xxx00:ADMIN");
 
             // when
-            final var grant = givenCurrentUserAsPackageAdmin.getGrantById()
+            final var grant = givencurrentSubjectAsPackageAdmin.getGrantById()
                     .forGrantedRole(givenGrantedRole).toGranteeUser(givenGranteeUser);
 
             // then
@@ -182,12 +182,12 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
         @Test
         void packageAdmin_withoutAssumedRole_canReadItsOwnGrantById() {
             // given
-            final var givenCurrentUserAsPackageAdmin = new Subject("pac-admin-xxx00@xxx.example.com");
+            final var givencurrentSubjectAsPackageAdmin = new Subject("pac-admin-xxx00@xxx.example.com");
             final var givenGranteeUser = findRbacUserByName("pac-admin-xxx00@xxx.example.com");
             final var givenGrantedRole = getRbacRoleByName("test_package#xxx00:ADMIN");
 
             // when
-            final var grant = givenCurrentUserAsPackageAdmin.getGrantById()
+            final var grant = givencurrentSubjectAsPackageAdmin.getGrantById()
                     .forGrantedRole(givenGrantedRole).toGranteeUser(givenGranteeUser);
 
             // then
@@ -201,14 +201,14 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
         @Test
         void packageAdmin_withAssumedPackageAdmin_canStillReadItsOwnGrantById() {
             // given
-            final var givenCurrentUserAsPackageAdmin = new Subject(
+            final var givencurrentSubjectAsPackageAdmin = new Subject(
                     "pac-admin-xxx00@xxx.example.com",
                     "test_package#xxx00:ADMIN");
             final var givenGranteeUser = findRbacUserByName("pac-admin-xxx00@xxx.example.com");
             final var givenGrantedRole = getRbacRoleByName("test_package#xxx00:ADMIN");
 
             // when
-            final var grant = givenCurrentUserAsPackageAdmin.getGrantById()
+            final var grant = givencurrentSubjectAsPackageAdmin.getGrantById()
                     .forGrantedRole(givenGrantedRole).toGranteeUser(givenGranteeUser);
 
             // then
@@ -223,12 +223,12 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
         void packageAdmin_withAssumedPackageTenantRole_canNotReadItsOwnGrantByIdAnymore() {
 
             // given
-            final var givenCurrentUserAsPackageAdmin = new Subject(
+            final var givencurrentSubjectAsPackageAdmin = new Subject(
                     "pac-admin-xxx00@xxx.example.com",
                     "test_package#xxx00:TENANT");
             final var givenGranteeUser = findRbacUserByName("pac-admin-xxx00@xxx.example.com");
             final var givenGrantedRole = getRbacRoleByName("test_package#xxx00:ADMIN");
-            final var grant = givenCurrentUserAsPackageAdmin.getGrantById()
+            final var grant = givencurrentSubjectAsPackageAdmin.getGrantById()
                     .forGrantedRole(givenGrantedRole).toGranteeUser(givenGranteeUser);
 
             // then
@@ -246,12 +246,12 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
             // given
             final var givenNewUser = createRBacUser();
             final var givenRoleToGrant = "test_package#xxx00:ADMIN";
-            final var givenCurrentUserAsPackageAdmin = new Subject("pac-admin-xxx00@xxx.example.com", givenRoleToGrant);
+            final var givencurrentSubjectAsPackageAdmin = new Subject("pac-admin-xxx00@xxx.example.com", givenRoleToGrant);
             final var givenOwnPackageAdminRole =
-                    getRbacRoleByName(givenCurrentUserAsPackageAdmin.assumedRole);
+                    getRbacRoleByName(givencurrentSubjectAsPackageAdmin.assumedRole);
 
             // when
-            final var response = givenCurrentUserAsPackageAdmin
+            final var response = givencurrentSubjectAsPackageAdmin
                     .grantsRole(givenOwnPackageAdminRole).assumed()
                     .toUser(givenNewUser);
 
@@ -262,7 +262,7 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
                     .body("assumed", is(true))
                     .body("grantedRoleIdName", is("test_package#xxx00:ADMIN"))
                     .body("granteeUserName", is(givenNewUser.getName()));
-            assertThat(findAllGrantsOf(givenCurrentUserAsPackageAdmin))
+            assertThat(findAllGrantsOf(givencurrentSubjectAsPackageAdmin))
                     .extracting(RbacGrantEntity::toDisplay)
                     .contains("{ grant role:" + givenOwnPackageAdminRole.getRoleName() +
                             " to user:" + givenNewUser.getName() +
@@ -275,11 +275,11 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
             // given
             final var givenNewUser = createRBacUser();
             final var givenRoleToGrant = "test_package#xxx00:ADMIN";
-            final var givenCurrentUserAsPackageAdmin = new Subject("pac-admin-xxx00@xxx.example.com", givenRoleToGrant);
+            final var givencurrentSubjectAsPackageAdmin = new Subject("pac-admin-xxx00@xxx.example.com", givenRoleToGrant);
             final var givenAlienPackageAdminRole = getRbacRoleByName("test_package#yyy00:ADMIN");
 
             // when
-            final var result = givenCurrentUserAsPackageAdmin
+            final var result = givencurrentSubjectAsPackageAdmin
                     .grantsRole(givenAlienPackageAdminRole).assumed()
                     .toUser(givenNewUser);
 
@@ -288,7 +288,7 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
                     .statusCode(403)
                     .body("message", containsString("Access to granted role"))
                     .body("message", containsString("forbidden for test_package#xxx00:ADMIN"));
-            assertThat(findAllGrantsOf(givenCurrentUserAsPackageAdmin))
+            assertThat(findAllGrantsOf(givencurrentSubjectAsPackageAdmin))
                     .extracting(RbacGrantEntity::getGranteeUserName)
                     .doesNotContain(givenNewUser.getName());
         }
@@ -304,28 +304,28 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
             // given
             final var givenArbitraryUser = createRBacUser();
             final var givenRoleToGrant = "test_package#xxx00:ADMIN";
-            final var givenCurrentUserAsPackageAdmin = new Subject("pac-admin-xxx00@xxx.example.com", givenRoleToGrant);
+            final var givencurrentSubjectAsPackageAdmin = new Subject("pac-admin-xxx00@xxx.example.com", givenRoleToGrant);
             final var givenOwnPackageAdminRole = getRbacRoleByName("test_package#xxx00:ADMIN");
 
             // and given an existing grant
-            assumeCreated(givenCurrentUserAsPackageAdmin
+            assumeCreated(givencurrentSubjectAsPackageAdmin
                     .grantsRole(givenOwnPackageAdminRole).assumed()
                     .toUser(givenArbitraryUser));
             assumeGrantExists(
-                    givenCurrentUserAsPackageAdmin,
+                    givencurrentSubjectAsPackageAdmin,
                     "{ grant role:%s to user:%s by role:%s and assume }".formatted(
                             givenOwnPackageAdminRole.getRoleName(),
                             givenArbitraryUser.getName(),
-                            givenCurrentUserAsPackageAdmin.assumedRole));
+                            givencurrentSubjectAsPackageAdmin.assumedRole));
 
             // when
-            final var revokeResponse = givenCurrentUserAsPackageAdmin
+            final var revokeResponse = givencurrentSubjectAsPackageAdmin
                     .revokesRole(givenOwnPackageAdminRole)
                     .fromUser(givenArbitraryUser);
 
             // then
             revokeResponse.assertThat().statusCode(204);
-            assertThat(findAllGrantsOf(givenCurrentUserAsPackageAdmin))
+            assertThat(findAllGrantsOf(givencurrentSubjectAsPackageAdmin))
                     .extracting(RbacGrantEntity::getGranteeUserName)
                     .doesNotContain(givenArbitraryUser.getName());
         }
@@ -337,16 +337,16 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
 
     class Subject {
 
-        final String currentUser;
+        final String currentSubject;
         final String assumedRole;
 
-        public Subject(final String currentUser, final String assumedRole) {
-            this.currentUser = currentUser;
+        public Subject(final String currentSubject, final String assumedRole) {
+            this.currentSubject = currentSubject;
             this.assumedRole = assumedRole;
         }
 
-        public Subject(final String currentUser) {
-            this(currentUser, "");
+        public Subject(final String currentSubject) {
+            this(currentSubject, "");
         }
 
         GrantFixture grantsRole(final RbacRoleEntity givenOwnPackageAdminRole) {
@@ -382,7 +382,7 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
 
                 return RestAssured // @formatter:ff
                         .given()
-                        .header("current-user", grantingSubject.currentUser)
+                        .header("current-subject", grantingSubject.currentSubject)
                         .header("assumed-roles", grantingSubject.assumedRole)
                         .contentType(ContentType.JSON)
                         .body("""
@@ -418,7 +418,7 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
 
                 return RestAssured // @formatter:ff
                         .given()
-                        .header("current-user", currentSubject.currentUser)
+                        .header("current-subject", currentSubject.currentSubject)
                         .header("assumed-roles", currentSubject.assumedRole)
                         .contentType(ContentType.JSON)
                         .body("""
@@ -454,7 +454,7 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
 
                 return RestAssured // @formatter:ff
                         .given()
-                        .header("current-user", currentSubject.currentUser)
+                        .header("current-subject", currentSubject.currentSubject)
                         .header("assumed-roles", currentSubject.assumedRole)
                         .port(port)
                         .when()
@@ -475,7 +475,7 @@ class RbacGrantControllerAcceptanceTest extends ContextBasedTest {
 
     List<RbacGrantEntity> findAllGrantsOf(final Subject grantingSubject) {
         return jpaAttempt.transacted(() -> {
-            context(grantingSubject.currentUser, null);
+            context(grantingSubject.currentSubject, null);
             return rbacGrantRepository.findAll();
         }).returnedValue();
     }
diff --git a/src/test/java/net/hostsharing/hsadminng/rbac/rbacgrant/RbacGrantsDiagramServiceIntegrationTest.java b/src/test/java/net/hostsharing/hsadminng/rbac/rbacgrant/RbacGrantsDiagramServiceIntegrationTest.java
index 7f183ba3..7c7dccee 100644
--- a/src/test/java/net/hostsharing/hsadminng/rbac/rbacgrant/RbacGrantsDiagramServiceIntegrationTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/rbac/rbacgrant/RbacGrantsDiagramServiceIntegrationTest.java
@@ -44,18 +44,18 @@ class RbacGrantsDiagramServiceIntegrationTest extends ContextBasedTestWithCleanu
         this.test = testInfo;
     }
 
-    protected void context(final String currentUser, final String assumedRoles) {
-        context.define(test.getDisplayName(), null, currentUser, assumedRoles);
+    protected void context(final String currentSubject, final String assumedRoles) {
+        context.define(test.getDisplayName(), null, currentSubject, assumedRoles);
     }
 
-    protected void context(final String currentUser) {
-        context(currentUser, null);
+    protected void context(final String currentSubject) {
+        context(currentSubject, null);
     }
 
     @Test
-    void allGrantsToCurrentUser() {
+    void allGrantsTocurrentSubject() {
         context("superuser-alex@hostsharing.net", "test_domain#xxx00-aaaa:OWNER");
-        final var graph = grantsMermaidService.allGrantsToCurrentUser(EnumSet.of(Include.TEST_ENTITIES));
+        final var graph = grantsMermaidService.allGrantsTocurrentSubject(EnumSet.of(Include.TEST_ENTITIES));
 
         assertThat(graph).isEqualTo("""
                 flowchart TB
@@ -68,9 +68,9 @@ class RbacGrantsDiagramServiceIntegrationTest extends ContextBasedTestWithCleanu
     }
 
     @Test
-    void allGrantsToCurrentUserIncludingPermissions() {
+    void allGrantsTocurrentSubjectIncludingPermissions() {
         context("superuser-alex@hostsharing.net", "test_domain#xxx00-aaaa:OWNER");
-        final var graph = grantsMermaidService.allGrantsToCurrentUser(EnumSet.of(Include.TEST_ENTITIES, Include.PERMISSIONS));
+        final var graph = grantsMermaidService.allGrantsTocurrentSubject(EnumSet.of(Include.TEST_ENTITIES, Include.PERMISSIONS));
 
         assertThat(graph).isEqualTo("""
                 flowchart TB
@@ -93,11 +93,11 @@ class RbacGrantsDiagramServiceIntegrationTest extends ContextBasedTestWithCleanu
         //context("superuser-alex@hostsharing.net", "hs_office_person#FirbySusan:ADMIN");
         context("superuser-alex@hostsharing.net");
 
-        //final var graph = grantsMermaidService.allGrantsToCurrentUser(EnumSet.of(Include.NON_TEST_ENTITIES, Include.PERMISSIONS));
+        //final var graph = grantsMermaidService.allGrantsTocurrentSubject(EnumSet.of(Include.NON_TEST_ENTITIES, Include.PERMISSIONS));
 
         final var targetObject = (UUID) em.createNativeQuery("SELECT uuid FROM hs_office_coopassetstransaction WHERE reference='ref 1000101-1'").getSingleResult();
         final var graph = grantsMermaidService.allGrantsFrom(targetObject, "view", EnumSet.of(Include.USERS));
 
-        RbacGrantsDiagramService.writeToFile(join(";", context.getAssumedRoles()), graph, "doc/all-grants.md");
+        RbacGrantsDiagramService.writeToFile(join(";", context.fetchAssumedRoles()), graph, "doc/all-grants.md");
     }
 }
diff --git a/src/test/java/net/hostsharing/hsadminng/rbac/rbacrole/RawRbacObjectEntity.java b/src/test/java/net/hostsharing/hsadminng/rbac/rbacrole/RawRbacObjectEntity.java
index d4256e56..dedda7c2 100644
--- a/src/test/java/net/hostsharing/hsadminng/rbac/rbacrole/RawRbacObjectEntity.java
+++ b/src/test/java/net/hostsharing/hsadminng/rbac/rbacrole/RawRbacObjectEntity.java
@@ -9,7 +9,7 @@ import java.util.List;
 import java.util.UUID;
 
 @Entity
-@Table(name = "rbacobject") // TODO: create view rbacobject_ev
+@Table(schema = "rbac", name = "object") // TODO.impl: create view rbacobject_ev
 @Getter
 @Setter
 @ToString
diff --git a/src/test/java/net/hostsharing/hsadminng/rbac/rbacrole/RbacRoleControllerAcceptanceTest.java b/src/test/java/net/hostsharing/hsadminng/rbac/rbacrole/RbacRoleControllerAcceptanceTest.java
index 5f20b0ab..2b710bfb 100644
--- a/src/test/java/net/hostsharing/hsadminng/rbac/rbacrole/RbacRoleControllerAcceptanceTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/rbac/rbacrole/RbacRoleControllerAcceptanceTest.java
@@ -35,7 +35,7 @@ class RbacRoleControllerAcceptanceTest {
         // @formatter:off
         RestAssured
             .given()
-                .header("current-user", "superuser-alex@hostsharing.net")
+                .header("current-subject", "superuser-alex@hostsharing.net")
                 .port(port)
             .when()
                 .get("http://localhost/api/rbac/roles")
@@ -60,7 +60,7 @@ class RbacRoleControllerAcceptanceTest {
         // @formatter:off
         RestAssured
             .given()
-                .header("current-user", "superuser-alex@hostsharing.net")
+                .header("current-subject", "superuser-alex@hostsharing.net")
                 .header("assumed-roles", "test_package#yyy00:ADMIN")
                 .port(port)
             .when()
@@ -93,7 +93,7 @@ class RbacRoleControllerAcceptanceTest {
         // @formatter:off
         RestAssured
             .given()
-                .header("current-user", "pac-admin-zzz00@zzz.example.com")
+                .header("current-subject", "pac-admin-zzz00@zzz.example.com")
                 .port(port)
             .when()
                 .get("http://localhost/api/rbac/roles")
diff --git a/src/test/java/net/hostsharing/hsadminng/rbac/rbacrole/RbacRoleControllerRestTest.java b/src/test/java/net/hostsharing/hsadminng/rbac/rbacrole/RbacRoleControllerRestTest.java
index 44b3885e..2686ade7 100644
--- a/src/test/java/net/hostsharing/hsadminng/rbac/rbacrole/RbacRoleControllerRestTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/rbac/rbacrole/RbacRoleControllerRestTest.java
@@ -67,7 +67,7 @@ class RbacRoleControllerRestTest {
         // when
         mockMvc.perform(MockMvcRequestBuilders
                         .get("/api/rbac/roles")
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         .accept(MediaType.APPLICATION_JSON))
 
                 // then
diff --git a/src/test/java/net/hostsharing/hsadminng/rbac/rbacrole/RbacRoleRepositoryIntegrationTest.java b/src/test/java/net/hostsharing/hsadminng/rbac/rbacrole/RbacRoleRepositoryIntegrationTest.java
index 092ac91a..71182cd1 100644
--- a/src/test/java/net/hostsharing/hsadminng/rbac/rbacrole/RbacRoleRepositoryIntegrationTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/rbac/rbacrole/RbacRoleRepositoryIntegrationTest.java
@@ -38,7 +38,7 @@ class RbacRoleRepositoryIntegrationTest {
     class FindAllRbacRoles {
 
         private static final String[] ALL_TEST_DATA_ROLES = Array.of(
-                // @formatter:off
+            // @formatter:off
             "global#global:ADMIN",
                 "test_customer#xxx:ADMIN", "test_customer#xxx:OWNER", "test_customer#xxx:TENANT",
                     "test_package#xxx00:ADMIN", "test_package#xxx00:OWNER", "test_package#xxx00:TENANT",
@@ -146,7 +146,7 @@ class RbacRoleRepositoryIntegrationTest {
 
             result.assertExceptionWithRootCauseMessage(
                     JpaSystemException.class,
-                    "[401] currentSubjectsUuids cannot be determined, please call `basis.defineContext(...)` with a valid user");
+                    "[401] currentSubjectOrAssumedRolesUuids cannot be determined, please call `basis.defineContext(...)` with a valid subject");
         }
     }
 
diff --git a/src/test/java/net/hostsharing/hsadminng/rbac/rbacuser/RbacUserControllerAcceptanceTest.java b/src/test/java/net/hostsharing/hsadminng/rbac/rbacuser/RbacUserControllerAcceptanceTest.java
index 601fadad..f5abca18 100644
--- a/src/test/java/net/hostsharing/hsadminng/rbac/rbacuser/RbacUserControllerAcceptanceTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/rbac/rbacuser/RbacUserControllerAcceptanceTest.java
@@ -81,7 +81,7 @@ class RbacUserControllerAcceptanceTest {
             // @formatter:off
             RestAssured
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/rbac/users/" + givenUser.getUuid())
@@ -99,7 +99,7 @@ class RbacUserControllerAcceptanceTest {
             // @formatter:off
             RestAssured
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .header("assumed-roles", "test_customer#yyy:ADMIN")
                     .port(port)
                 .when()
@@ -118,7 +118,7 @@ class RbacUserControllerAcceptanceTest {
             // @formatter:off
             RestAssured
                 .given()
-                    .header("current-user", "customer-admin@yyy.example.com")
+                    .header("current-subject", "customer-admin@yyy.example.com")
                     .port(port)
                 .when()
                     .get("http://localhost/api/rbac/users/" + givenUser.getUuid())
@@ -136,7 +136,7 @@ class RbacUserControllerAcceptanceTest {
             // @formatter:off
             RestAssured
                 .given()
-                    .header("current-user", "customer-admin@xxx.example.com")
+                    .header("current-subject", "customer-admin@xxx.example.com")
                     .port(port)
                 .when()
                     .get("http://localhost/api/rbac/users/" + givenUser.getUuid())
@@ -155,7 +155,7 @@ class RbacUserControllerAcceptanceTest {
             // @formatter:off
             RestAssured
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/rbac/users")
@@ -180,7 +180,7 @@ class RbacUserControllerAcceptanceTest {
             // @formatter:off
             RestAssured
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/rbac/users?name=pac-admin-zzz0")
@@ -200,7 +200,7 @@ class RbacUserControllerAcceptanceTest {
             // @formatter:off
             RestAssured
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .header("assumed-roles", "test_customer#yyy:ADMIN")
                     .port(port)
                 .when()
@@ -222,7 +222,7 @@ class RbacUserControllerAcceptanceTest {
             // @formatter:off
             RestAssured
                 .given()
-                    .header("current-user", "customer-admin@yyy.example.com")
+                    .header("current-subject", "customer-admin@yyy.example.com")
                     .port(port)
                 .when()
                     .get("http://localhost/api/rbac/users")
@@ -243,7 +243,7 @@ class RbacUserControllerAcceptanceTest {
             // @formatter:off
             RestAssured
                 .given()
-                    .header("current-user", "pac-admin-xxx01@xxx.example.com")
+                    .header("current-subject", "pac-admin-xxx01@xxx.example.com")
                     .port(port)
                 .when()
                     .get("http://localhost/api/rbac/users")
@@ -266,7 +266,7 @@ class RbacUserControllerAcceptanceTest {
             // @formatter:off
             RestAssured
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/rbac/users/" + givenUser.getUuid() + "/permissions")
@@ -295,7 +295,7 @@ class RbacUserControllerAcceptanceTest {
             // @formatter:off
             RestAssured
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .header("assumed-roles", "test_customer#yyy:ADMIN")
                     .port(port)
                 .when()
@@ -325,7 +325,7 @@ class RbacUserControllerAcceptanceTest {
             // @formatter:off
             RestAssured
                 .given()
-                    .header("current-user", "pac-admin-yyy00@yyy.example.com")
+                    .header("current-subject", "pac-admin-yyy00@yyy.example.com")
                     .port(port)
                 .when()
                     .get("http://localhost/api/rbac/users/" + givenUser.getUuid() + "/permissions")
@@ -354,7 +354,7 @@ class RbacUserControllerAcceptanceTest {
             // @formatter:off
             RestAssured
                 .given()
-                    .header("current-user", "pac-admin-yyy00@yyy.example.com")
+                    .header("current-subject", "pac-admin-yyy00@yyy.example.com")
                     .port(port)
                 .when()
                     .get("http://localhost/api/rbac/users/" + givenUser.getUuid() + "/permissions")
@@ -378,7 +378,7 @@ class RbacUserControllerAcceptanceTest {
             // @formatter:off
             final var location = RestAssured
                     .given()
-                        .header("current-user", givenUser.getName())
+                        .header("current-subject", givenUser.getName())
                         .port(port)
                     .when()
                         .delete("http://localhost/api/rbac/users/" + givenUser.getUuid())
@@ -399,7 +399,7 @@ class RbacUserControllerAcceptanceTest {
             // @formatter:off
             final var location = RestAssured
                     .given()
-                        .header("current-user", "customer-admin@xxx.example.com")
+                        .header("current-subject", "customer-admin@xxx.example.com")
                         .port(port)
                     .when()
                         .delete("http://localhost/api/rbac/users/" + givenUser.getUuid())
@@ -421,7 +421,7 @@ class RbacUserControllerAcceptanceTest {
             // @formatter:off
             final var location = RestAssured
                     .given()
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         .port(port)
                     .when()
                         .delete("http://localhost/api/rbac/users/" + givenUser.getUuid())
diff --git a/src/test/java/net/hostsharing/hsadminng/rbac/test/ContextBasedTestWithCleanup.java b/src/test/java/net/hostsharing/hsadminng/rbac/test/ContextBasedTestWithCleanup.java
index 366e79d7..ac285a45 100644
--- a/src/test/java/net/hostsharing/hsadminng/rbac/test/ContextBasedTestWithCleanup.java
+++ b/src/test/java/net/hostsharing/hsadminng/rbac/test/ContextBasedTestWithCleanup.java
@@ -18,6 +18,7 @@ import org.springframework.data.repository.Repository;
 import org.springframework.transaction.PlatformTransactionManager;
 
 import jakarta.persistence.*;
+import jakarta.transaction.Transactional;
 import java.util.*;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.function.Supplier;
@@ -200,7 +201,7 @@ public abstract class ContextBasedTestWithCleanup extends ContextBasedTest {
             });
         }).caughtException();
 
-        // ... and in case of foreign key violations, we rely on the RbacObject cleanup.
+        // ... and in case of foreign key violations, we rely on the rbac.object cleanup.
         if (exception != null) {
             System.err.println(exception);
         }
@@ -322,7 +323,7 @@ public abstract class ContextBasedTestWithCleanup extends ContextBasedTest {
     protected void generateRbacDiagramForCurrentSubjects(final EnumSet<RbacGrantsDiagramService.Include> include, final String name) {
         RbacGrantsDiagramService.writeToFile(
                 name,
-                diagramService.allGrantsToCurrentUser(include),
+                diagramService.allGrantsTocurrentSubject(include),
                 "doc/temp/" + name + ".md"
         );
     }
@@ -362,7 +363,7 @@ interface RbacObjectRepository extends Repository<RbacObjectEntity, UUID> {
 }
 
 @Entity
-@Table(name = "rbacobject")
+@Table(schema ="rbac", name = "object")
 class RbacObjectEntity {
 
     @Id
diff --git a/src/test/java/net/hostsharing/hsadminng/rbac/test/cust/TestCustomerControllerAcceptanceTest.java b/src/test/java/net/hostsharing/hsadminng/rbac/test/cust/TestCustomerControllerAcceptanceTest.java
index 2d6d5a70..60b7148d 100644
--- a/src/test/java/net/hostsharing/hsadminng/rbac/test/cust/TestCustomerControllerAcceptanceTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/rbac/test/cust/TestCustomerControllerAcceptanceTest.java
@@ -54,7 +54,7 @@ class TestCustomerControllerAcceptanceTest {
         void globalAdmin_withoutAssumedRoles_canViewAllCustomers_ifNoCriteriaGiven() {
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/test/customers")
@@ -72,7 +72,7 @@ class TestCustomerControllerAcceptanceTest {
         void globalAdmin_withoutAssumedRoles_canViewMatchingCustomers_ifCriteriaGiven() {
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .port(port)
                 .when()
                     .get("http://localhost/api/test/customers?prefix=y")
@@ -88,7 +88,7 @@ class TestCustomerControllerAcceptanceTest {
         void globalAdmin_withoutAssumedCustomerAdminRole_canOnlyViewOwnCustomer() {
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .header("assumed-roles", "test_customer#yyy:ADMIN")
                     .port(port)
                 .when()
@@ -105,7 +105,7 @@ class TestCustomerControllerAcceptanceTest {
         void customerAdmin_withoutAssumedRole_canOnlyViewOwnCustomer() {
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "customer-admin@yyy.example.com")
+                    .header("current-subject", "customer-admin@yyy.example.com")
                     .port(port)
                 .when()
                     .get("http://localhost/api/test/customers")
@@ -126,7 +126,7 @@ class TestCustomerControllerAcceptanceTest {
 
             final var location = RestAssured // @formatter:off
                     .given()
-                        .header("current-user", "superuser-alex@hostsharing.net")
+                        .header("current-subject", "superuser-alex@hostsharing.net")
                         .contentType(ContentType.JSON)
                         .body("""
                               {
@@ -158,7 +158,7 @@ class TestCustomerControllerAcceptanceTest {
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .header("assumed-roles", "test_customer#xxx:ADMIN")
                     .contentType(ContentType.JSON)
                     .body("""
@@ -189,7 +189,7 @@ class TestCustomerControllerAcceptanceTest {
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "customer-admin@yyy.example.com")
+                    .header("current-subject", "customer-admin@yyy.example.com")
                     .contentType(ContentType.JSON)
                     .body("""
                               {
@@ -219,7 +219,7 @@ class TestCustomerControllerAcceptanceTest {
 
             RestAssured // @formatter:off
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .contentType(ContentType.JSON)
                     .body("{]") // deliberately invalid JSON
                     .port(port)
diff --git a/src/test/java/net/hostsharing/hsadminng/rbac/test/pac/TestPackageControllerAcceptanceTest.java b/src/test/java/net/hostsharing/hsadminng/rbac/test/pac/TestPackageControllerAcceptanceTest.java
index a5e89330..fd9ec9a0 100644
--- a/src/test/java/net/hostsharing/hsadminng/rbac/test/pac/TestPackageControllerAcceptanceTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/rbac/test/pac/TestPackageControllerAcceptanceTest.java
@@ -43,7 +43,7 @@ class TestPackageControllerAcceptanceTest {
             // @formatter:off
             RestAssured
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .header("assumed-roles", "test_customer#xxx:ADMIN")
                     .port(port)
                 .when()
@@ -65,7 +65,7 @@ class TestPackageControllerAcceptanceTest {
             // @formatter:off
             RestAssured
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .header("assumed-roles", "test_customer#xxx:ADMIN")
                     .port(port)
                 .when()
@@ -94,7 +94,7 @@ class TestPackageControllerAcceptanceTest {
             // @formatter:off
             RestAssured
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .header("assumed-roles", "test_customer#xxx:ADMIN")
                     .contentType(ContentType.JSON)
                     .body(format("""
@@ -125,7 +125,7 @@ class TestPackageControllerAcceptanceTest {
             // @formatter:off
             RestAssured
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .header("assumed-roles", "test_customer#xxx:ADMIN")
                     .contentType(ContentType.JSON)
                     .body("""
@@ -155,7 +155,7 @@ class TestPackageControllerAcceptanceTest {
             // @formatter:off
             RestAssured
                 .given()
-                    .header("current-user", "superuser-alex@hostsharing.net")
+                    .header("current-subject", "superuser-alex@hostsharing.net")
                     .header("assumed-roles", "test_customer#xxx:ADMIN")
                     .contentType(ContentType.JSON)
                     .body("{}")
@@ -175,7 +175,7 @@ class TestPackageControllerAcceptanceTest {
         // @formatter:off
         return UUID.fromString(RestAssured
             .given()
-                .header("current-user", "superuser-alex@hostsharing.net")
+                .header("current-subject", "superuser-alex@hostsharing.net")
                 .header("assumed-roles", "test_customer#xxx:ADMIN")
                 .port(port)
             .when()