diff --git a/gui/admin-gui/src/main/resources/initial-objects/040-role-enduser.xml b/gui/admin-gui/src/main/resources/initial-objects/040-role-enduser.xml
index 39bea19a57b..d8b69d15f80 100644
--- a/gui/admin-gui/src/main/resources/initial-objects/040-role-enduser.xml
+++ b/gui/admin-gui/src/main/resources/initial-objects/040-role-enduser.xml
@@ -131,9 +131,6 @@
     	</object>
     	<item>credentials</item>
     	<item>assignment</item>
-    	<item>parentOrgRef</item>
-    	<item>roleMembershipRef</item>
-    	<item>metadata</item>
     </authorization>
     <authorization>
     	<name>self-shadow-execution-add-modify-delete</name>
diff --git a/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/security/AbstractSecurityTest.java b/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/security/AbstractSecurityTest.java
index a2821e59f90..8deafa43f1f 100644
--- a/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/security/AbstractSecurityTest.java
+++ b/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/security/AbstractSecurityTest.java
@@ -85,11 +85,13 @@
 import com.evolveum.midpoint.util.exception.SecurityViolationException;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.AccessCertificationCampaignType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.AccessCertificationCaseType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.AssignmentPolicyEnforcementType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.AssignmentType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.AuthorizationDecisionType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.AuthorizationType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.CredentialsType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.FocusType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.MetadataType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.ObjectType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.OwnedObjectSelectorType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.PartialProcessingOptionsType;
@@ -101,6 +103,7 @@
 import com.evolveum.midpoint.xml.ns._public.common.common_3.SubjectedObjectSelectorType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.TaskType;
 import com.evolveum.midpoint.xml.ns._public.common.common_3.UserType;
+import com.evolveum.prism.xml.ns._public.types_3.ProtectedStringType;
 
 /**
  * @author semancik
@@ -567,8 +570,11 @@ protected void assertAttributeFlags(RefinedObjectClassDefinition rOcDef, QName a
 		assertEquals("Wrong modification flag for "+attrName, expectedModify, rAttrDef.canModify());
 	}
 
-
 	protected void cleanupAutzTest(String userOid) throws ObjectNotFoundException, SchemaException, ExpressionEvaluationException, CommunicationException, ConfigurationException, ObjectAlreadyExistsException, PolicyViolationException, SecurityViolationException, IOException {
+		cleanupAutzTest(userOid, 0);
+	}
+
+	protected void cleanupAutzTest(String userOid, int expectedAssignments) throws ObjectNotFoundException, SchemaException, ExpressionEvaluationException, CommunicationException, ConfigurationException, ObjectAlreadyExistsException, PolicyViolationException, SecurityViolationException, IOException {
 		login(userAdministrator);
 		if (userOid != null) {
 			unassignAllRoles(userOid);
@@ -576,6 +582,8 @@ protected void cleanupAutzTest(String userOid) throws ObjectNotFoundException, S
 
         Task task = taskManager.createTaskInstance(AbstractSecurityTest.class.getName() + ".cleanupAutzTest");
         OperationResult result = task.getResult();
+        
+        assumeAssignmentPolicy(AssignmentPolicyEnforcementType.FULL);
 
         cleanupDelete(UserType.class, USER_HERMAN_OID, task, result);
         cleanupDelete(UserType.class, USER_DRAKE_OID, task, result);
@@ -592,6 +600,7 @@ protected void cleanupAutzTest(String userOid) throws ObjectNotFoundException, S
         modifyUserReplace(USER_JACK_OID, SchemaConstants.PATH_ACTIVATION_VALID_FROM, task, result);
         modifyUserReplace(USER_JACK_OID, UserType.F_GIVEN_NAME, task, result, createPolyString(USER_JACK_GIVEN_NAME));
 
+        unassignAccount(USER_JACK_OID, RESOURCE_DUMMY_OID, null);
         unassignOrg(USER_JACK_OID, ORG_MINISTRY_OF_RUM_OID, SchemaConstants.ORG_MANAGER, task, result);
         unassignOrg(USER_JACK_OID, ORG_MINISTRY_OF_RUM_OID, null, task, result);
         unassignOrg(USER_JACK_OID, ORG_MINISTRY_OF_DEFENSE_OID, SchemaConstants.ORG_MANAGER, task, result);
@@ -603,6 +612,14 @@ protected void cleanupAutzTest(String userOid) throws ObjectNotFoundException, S
         cleanupDelete(TaskType.class, TASK_T4_OID, task, result);
         cleanupDelete(TaskType.class, TASK_T5_OID, task, result);
         cleanupDelete(TaskType.class, TASK_T6_OID, task, result);
+        
+        assumeAssignmentPolicy(AssignmentPolicyEnforcementType.RELATIVE);
+        
+        PrismObject<UserType> user = getUser(userOid);
+        assertAssignments(user, expectedAssignments);
+        if (expectedAssignments == 0) {
+        	assertLinks(user, 0);
+        }
 	}
 
 	protected void cleanupAdd(File userLargoFile, Task task, OperationResult result) throws ObjectNotFoundException, SchemaException, ExpressionEvaluationException, CommunicationException, ConfigurationException, PolicyViolationException, SecurityViolationException, IOException {
@@ -982,6 +999,24 @@ protected <O extends ObjectType> void assertAddAllow(File file, ModelExecuteOpti
 		logAllow("add", object.getCompileTimeClass(), object.getOid(), null);
 	}
 
+	protected <O extends ObjectType> void assertModifyMetadataDeny(Class<O> type, String oid) throws ObjectAlreadyExistsException, ObjectNotFoundException, SchemaException, ExpressionEvaluationException, CommunicationException, ConfigurationException, PolicyViolationException, SecurityViolationException {
+		XMLGregorianCalendar oneHourAgo = XmlTypeConverter.addDuration(clock.currentTimeXMLGregorianCalendar(), "-PT1H");
+		assertModifyDenyOptions(type, oid, getMetadataPath(MetadataType.F_MODIFY_TIMESTAMP), null, oneHourAgo);
+		assertModifyDenyOptions(type, oid, getMetadataPath(MetadataType.F_CREATE_CHANNEL), null, "hackHackHack");
+	}
+	
+	protected <O extends ObjectType> void assertPasswordChangeDeny(Class<O> type, String oid, String newPassword) throws ObjectAlreadyExistsException, ObjectNotFoundException, SchemaException, ExpressionEvaluationException, CommunicationException, ConfigurationException, PolicyViolationException, SecurityViolationException {
+		ProtectedStringType passwordPs = new ProtectedStringType();
+        passwordPs.setClearValue(newPassword);
+        assertModifyDeny(type, oid, PASSWORD_PATH, passwordPs);
+	}
+
+	protected <O extends ObjectType> void assertPasswordChangeAllow(Class<O> type, String oid, String newPassword) throws ObjectAlreadyExistsException, ObjectNotFoundException, SchemaException, ExpressionEvaluationException, CommunicationException, ConfigurationException, PolicyViolationException, SecurityViolationException {
+		ProtectedStringType passwordPs = new ProtectedStringType();
+        passwordPs.setClearValue(newPassword);
+        assertModifyAllow(type, oid, PASSWORD_PATH, passwordPs);
+	}
+
 	protected <O extends ObjectType> void assertModifyDeny(Class<O> type, String oid, QName propertyName, Object... newRealValue) throws ObjectAlreadyExistsException, ObjectNotFoundException, SchemaException, ExpressionEvaluationException, CommunicationException, ConfigurationException, PolicyViolationException, SecurityViolationException {
 		assertModifyDenyOptions(type, oid, propertyName, null, newRealValue);
 	}
@@ -1375,5 +1410,5 @@ protected <T extends ObjectType, O extends ObjectType> void assertCanSearch(Stri
 	protected <O extends ObjectType> ObjectQuery createMembersQuery(Class<O> resultType, String roleOid) {
 		return QueryBuilder.queryFor(resultType, prismContext).item(UserType.F_ROLE_MEMBERSHIP_REF).ref(roleOid).build();
 	}
-
+	
 }
diff --git a/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/security/TestSecurityAdvanced.java b/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/security/TestSecurityAdvanced.java
index 2e2bc282afd..b01cda6ef5c 100644
--- a/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/security/TestSecurityAdvanced.java
+++ b/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/security/TestSecurityAdvanced.java
@@ -104,7 +104,7 @@ public void test102AutzLechuckPersonaManagement() throws Exception {
 		final String TEST_NAME = "test102AutzLechuckPersonaManagement";
         displayTestTitle(TEST_NAME);
         // GIVEN
-        cleanupAutzTest(USER_LECHUCK_OID);
+        cleanupAutzTest(USER_LECHUCK_OID, 1);
         assignRole(USER_LECHUCK_OID, ROLE_PERSONA_MANAGEMENT_OID);
         login(USER_LECHUCK_USERNAME);
 
@@ -1178,8 +1178,8 @@ public void test202AutzJackModifyOrgunitAndAssignRole() throws Exception {
 	}
 
     @Override
-    protected void cleanupAutzTest(String userOid) throws ObjectNotFoundException, SchemaException, ExpressionEvaluationException, CommunicationException, ConfigurationException, ObjectAlreadyExistsException, PolicyViolationException, SecurityViolationException, IOException {
-    	super.cleanupAutzTest(userOid);
+    protected void cleanupAutzTest(String userOid, int expectedAssignments) throws ObjectNotFoundException, SchemaException, ExpressionEvaluationException, CommunicationException, ConfigurationException, ObjectAlreadyExistsException, PolicyViolationException, SecurityViolationException, IOException {
+    	super.cleanupAutzTest(userOid, expectedAssignments);
 
         Task task = taskManager.createTaskInstance(TestSecurityAdvanced.class.getName() + ".cleanupAutzTest");
         OperationResult result = task.getResult();
diff --git a/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/security/TestSecurityBasic.java b/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/security/TestSecurityBasic.java
index 33fafb3cb90..8a9d520195b 100644
--- a/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/security/TestSecurityBasic.java
+++ b/model/model-intest/src/test/java/com/evolveum/midpoint/model/intest/security/TestSecurityBasic.java
@@ -15,7 +15,6 @@
  */
 package com.evolveum.midpoint.model.intest.security;
 
-import static com.evolveum.midpoint.test.IntegrationTestTools.display;
 import static org.testng.AssertJUnit.assertEquals;
 import static org.testng.AssertJUnit.assertNotNull;
 import static org.testng.AssertJUnit.assertNull;
@@ -41,6 +40,7 @@
 import com.evolveum.midpoint.prism.delta.ContainerDelta;
 import com.evolveum.midpoint.prism.delta.ItemDelta;
 import com.evolveum.midpoint.prism.delta.ObjectDelta;
+import com.evolveum.midpoint.prism.delta.ReferenceDelta;
 import com.evolveum.midpoint.prism.path.ItemPath;
 import com.evolveum.midpoint.prism.query.ObjectFilter;
 import com.evolveum.midpoint.prism.query.ObjectQuery;
@@ -1465,6 +1465,7 @@ public void test255AutzJackSelfAccountsReadWrite() throws Exception {
         // GIVEN
         cleanupAutzTest(USER_JACK_OID);
         assignRole(USER_JACK_OID, ROLE_SELF_ACCOUNTS_READ_WRITE_OID);
+        assignAccount(USER_JACK_OID, RESOURCE_DUMMY_OID, null);
 
         assumeAssignmentPolicy(AssignmentPolicyEnforcementType.NONE);
 
@@ -1528,6 +1529,7 @@ public void test256AutzJackSelfAccountsPartialControl() throws Exception {
         // GIVEN
         cleanupAutzTest(USER_JACK_OID);
         assignRole(USER_JACK_OID, ROLE_SELF_ACCOUNTS_PARTIAL_CONTROL_OID);
+        assignAccount(USER_JACK_OID, RESOURCE_DUMMY_OID, null);
 
         assumeAssignmentPolicy(AssignmentPolicyEnforcementType.NONE);
 
@@ -1568,10 +1570,8 @@ public void test256AutzJackSelfAccountsPartialControl() throws Exception {
         // Not even jack's account
         assertAddDeny(ACCOUNT_GUYBRUSH_DUMMY_FILE);
 
-        ProtectedStringType passwordPs = new ProtectedStringType();
-        passwordPs.setClearValue("nbusr123");
-        assertModifyDeny(UserType.class, USER_JACK_OID, PASSWORD_PATH, passwordPs);
-        assertModifyDeny(UserType.class, USER_GUYBRUSH_OID, PASSWORD_PATH, passwordPs);
+        assertPasswordChangeDeny(UserType.class, USER_JACK_OID, "nbusr123");
+        assertPasswordChangeDeny(UserType.class, USER_GUYBRUSH_OID, "nbusr123");
 
         Task task = taskManager.createTaskInstance(TEST_NAME);
         OperationResult result = task.getResult();
@@ -1611,6 +1611,7 @@ public void test258AutzJackSelfAccountsPartialControlPassword() throws Exception
         // GIVEN
         cleanupAutzTest(USER_JACK_OID);
         assignRole(USER_JACK_OID, ROLE_SELF_ACCOUNTS_PARTIAL_CONTROL_PASSWORD_OID);
+        assignAccount(USER_JACK_OID, RESOURCE_DUMMY_OID, null);
 
         assumeAssignmentPolicy(AssignmentPolicyEnforcementType.NONE);
 
@@ -1651,11 +1652,9 @@ public void test258AutzJackSelfAccountsPartialControlPassword() throws Exception
         // Not even jack's account
         assertAddDeny(ACCOUNT_GUYBRUSH_DUMMY_FILE);
 
-        ProtectedStringType passwordPs = new ProtectedStringType();
-        passwordPs.setClearValue("nbusr123");
-        assertModifyAllow(UserType.class, USER_JACK_OID, PASSWORD_PATH, passwordPs);
-        assertModifyDeny(UserType.class, USER_GUYBRUSH_OID, PASSWORD_PATH, passwordPs);
-
+        assertPasswordChangeAllow(UserType.class, USER_JACK_OID, "nbusr123");
+        assertPasswordChangeDeny(UserType.class, USER_GUYBRUSH_OID, "nbusr123");
+        
         Task task = taskManager.createTaskInstance(TEST_NAME);
         OperationResult result = task.getResult();
 		PrismObjectDefinition<UserType> rDef = modelInteractionService.getEditObjectDefinition(user, AuthorizationPhaseType.REQUEST, task, result);
@@ -1672,6 +1671,8 @@ public void test260AutzJackObjectFilterLocationShadowRole() throws Exception {
         cleanupAutzTest(USER_JACK_OID);
         assignRole(USER_JACK_OID, ROLE_FILTER_OBJECT_USER_LOCATION_SHADOWS_OID);
         login(USER_JACK_USERNAME);
+        
+        assumeAssignmentPolicy(AssignmentPolicyEnforcementType.NONE);
 
         // WHEN
         displayWhen(TEST_NAME);
@@ -1711,6 +1712,20 @@ public void test260AutzJackObjectFilterLocationShadowRole() throws Exception {
         assertGetAllow(ShadowType.class, accountRedOid);
 
         assertGlobalStateUntouched();
+        
+        displayCleanup(TEST_NAME);
+        login(USER_ADMINISTRATOR_USERNAME);
+        
+        Task task = createTask(TEST_NAME);
+        PrismObject<ShadowType> account = PrismTestUtil.parseObject(ACCOUNT_JACK_DUMMY_RED_FILE);
+        account.setOid(accountRedOid);
+        ObjectDelta<UserType> userDelta = ObjectDelta.createEmptyModifyDelta(UserType.class, USER_JACK_OID, prismContext);
+		ReferenceDelta accountDelta = ReferenceDelta.createModificationDelete(UserType.F_LINK_REF, getUserDefinition(), account);
+		userDelta.addModification(accountDelta);
+		executeChanges(userDelta, null, task, task.getResult());
+		
+		user = getUser(USER_JACK_OID);
+		assertLinks(user, 0);
 	}
 
 
@@ -1771,7 +1786,7 @@ public void test270AutzJackAssignApplicationRoles() throws Exception {
         assertDeleteDeny();
 
         PrismObject<UserType> user = getUser(USER_JACK_OID);
-        assertAssignments(user, 2);
+        assertAssignments(user, 1);
         assertAssignedRole(user, ROLE_ASSIGN_APPLICATION_ROLES_OID);
 
         assertAllow("assign application role to jack",
@@ -1779,7 +1794,7 @@ public void test270AutzJackAssignApplicationRoles() throws Exception {
 			);
 
         user = getUser(USER_JACK_OID);
-        assertAssignments(user, 3);
+        assertAssignments(user, 2);
         assertAssignedRole(user, ROLE_APPLICATION_1_OID);
 
         assertDeny("assign business role to jack",
@@ -1790,7 +1805,7 @@ public void test270AutzJackAssignApplicationRoles() throws Exception {
 			);
 
         user = getUser(USER_JACK_OID);
-        assertAssignments(user, 2);
+        assertAssignments(user, 1);
 
         RoleSelectionSpecification spec = getAssignableRoleSpecification(getUser(USER_JACK_OID));
         assertRoleTypes(spec, "application", "nonexistent");
@@ -1823,7 +1838,7 @@ public void test272AutzJackAssignAnyRoles() throws Exception {
         assertDeleteDeny();
 
         PrismObject<UserType> user = getUser(USER_JACK_OID);
-        assertAssignments(user, 2);
+        assertAssignments(user, 1);
         assertAssignedRole(user, ROLE_ASSIGN_ANY_ROLES_OID);
 
         assertAllow("assign application role to jack",
@@ -1831,7 +1846,7 @@ public void test272AutzJackAssignAnyRoles() throws Exception {
 			);
 
         user = getUser(USER_JACK_OID);
-        assertAssignments(user, 3);
+        assertAssignments(user, 2);
         assertAssignedRole(user, ROLE_APPLICATION_1_OID);
 
         assertAllow("assign business role to jack",
@@ -1842,7 +1857,7 @@ public void test272AutzJackAssignAnyRoles() throws Exception {
 			);
 
         user = getUser(USER_JACK_OID);
-        assertAssignments(user, 3);
+        assertAssignments(user, 2);
 
         RoleSelectionSpecification spec = getAssignableRoleSpecification(getUser(USER_JACK_OID));
         assertRoleTypes(spec);
@@ -1878,7 +1893,7 @@ public void test273AutzJackRedyAssignmentExceptionRules() throws Exception {
         assertDeleteDeny();
 
         PrismObject<UserType> user = getUser(USER_JACK_OID);
-        assertAssignments(user, 2);
+        assertAssignments(user, 1);
         assertAssignedRole(user, ROLE_ASSIGN_ANY_ROLES_OID);
 
         assertDeny("assign application role to jack",
@@ -1892,7 +1907,7 @@ public void test273AutzJackRedyAssignmentExceptionRules() throws Exception {
 			);
 
         user = getUser(USER_JACK_OID);
-        assertAssignments(user, 2);
+        assertAssignments(user, 1);
 
         assertDeny("assign application role to jack",
         		(task, result) ->  assignRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, null,
@@ -1906,7 +1921,7 @@ public void test273AutzJackRedyAssignmentExceptionRules() throws Exception {
 
 
         user = getUser(USER_JACK_OID);
-        assertAssignments(user, 2);
+        assertAssignments(user, 1);
 
         assertGlobalStateUntouched();
 	}
@@ -1932,14 +1947,14 @@ public void test274AutzJackAssignNonApplicationRoles() throws Exception {
         assertDeleteDeny();
 
         PrismObject<UserType> user = getUser(USER_JACK_OID);
-        assertAssignments(user, 2);
+        assertAssignments(user, 1);
         assertAssignedRole(user, ROLE_ASSIGN_NON_APPLICATION_ROLES_OID);
 
         assertAllow("assign business role to jack",
         		(task, result) -> assignRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, task, result));
 
         user = getUser(USER_JACK_OID);
-        assertAssignments(user, 3);
+        assertAssignments(user, 2);
         assertAssignedRole(user, ROLE_BUSINESS_1_OID);
 
         assertDeny("assign application role to jack",
@@ -1949,7 +1964,7 @@ public void test274AutzJackAssignNonApplicationRoles() throws Exception {
         		(task, result) -> unassignRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, task, result));
 
         user = getUser(USER_JACK_OID);
-        assertAssignments(user, 2);
+        assertAssignments(user, 1);
 
         RoleSelectionSpecification spec = getAssignableRoleSpecification(getUser(USER_JACK_OID));
         assertRoleTypes(spec);
@@ -1979,14 +1994,14 @@ public void test275aAutzJackAssignRequestableRoles() throws Exception {
         assertDeleteDeny();
 
         PrismObject<UserType> user = getUser(USER_JACK_OID);
-        assertAssignments(user, 2);
+        assertAssignments(user, 1);
         assertAssignedRole(user, ROLE_ASSIGN_REQUESTABLE_ROLES_OID);
 
         assertAllow("assign business role to jack",
         		(task, result) -> assignRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, task, result));
 
         user = getUser(USER_JACK_OID);
-        assertAssignments(user, 3);
+        assertAssignments(user, 2);
         assertAssignedRole(user, ROLE_BUSINESS_1_OID);
 
         assertDeny("assign application role to jack",
@@ -1996,7 +2011,7 @@ public void test275aAutzJackAssignRequestableRoles() throws Exception {
         		(task, result) -> unassignRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, task, result));
 
         user = getUser(USER_JACK_OID);
-        assertAssignments(user, 2);
+        assertAssignments(user, 1);
 
         RoleSelectionSpecification spec = getAssignableRoleSpecification(getUser(USER_JACK_OID));
         assertRoleTypes(spec);
@@ -2023,7 +2038,7 @@ public void test275bAutzJackAssignRequestableOrgs() throws Exception {
 		// WHEN
 		displayWhen(TEST_NAME);
 		PrismObject<UserType> user = getUser(USER_JACK_OID);
-		assertAssignments(user, 2);
+		assertAssignments(user, 1);
 		assertAssignedRole(user, ROLE_END_USER_REQUESTABLE_ABSTACTROLES_OID);
 
 		assertAllow("assign requestable org to jack",
@@ -2073,14 +2088,14 @@ public void test276AutzJackAssignRequestableRolesWithOrgRef() throws Exception {
         assertDeleteDeny();
 
         PrismObject<UserType> user = getUser(USER_JACK_OID);
-        assertAssignments(user, 2);
+        assertAssignments(user, 1);
         assertAssignedRole(user, ROLE_ASSIGN_REQUESTABLE_ROLES_OID);
 
         assertAllow("assign business role to jack",
         		(task, result) -> assignParametricRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, ORG_MINISTRY_OF_RUM_OID, null, task, result));
 
         user = getUser(USER_JACK_OID);
-        assertAssignments(user, 3);
+        assertAssignments(user, 2);
         assertAssignedRole(user, ROLE_BUSINESS_1_OID);
 
         assertDeny("assign application role to jack",
@@ -2090,8 +2105,8 @@ public void test276AutzJackAssignRequestableRolesWithOrgRef() throws Exception {
         		(task, result) -> unassignParametricRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, ORG_MINISTRY_OF_RUM_OID, null, task, result));
 
         user = getUser(USER_JACK_OID);
-        display("user after (expected 2 assignments)", user);
-        assertAssignments(user, 2);
+        display("user after (expected 1 assignments)", user);
+        assertAssignments(user, 1);
 
         RoleSelectionSpecification spec = getAssignableRoleSpecification(getUser(USER_JACK_OID));
         assertRoleTypes(spec);
@@ -2126,38 +2141,38 @@ public void test277AutzJackAssignRequestableRolesWithOrgRefSecondTime() throws E
         assertDeleteDeny();
 
         PrismObject<UserType> user = getUser(USER_JACK_OID);
-        assertAssignments(user, 2);
+        assertAssignments(user, 1);
         assertAssignedRole(user, ROLE_ASSIGN_REQUESTABLE_ROLES_OID);
 
         assertAllow("assign business role to jack (no param)",
         		(task, result) -> assignParametricRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, null, null, task, result));
 
         user = getUser(USER_JACK_OID);
-        assertAssignments(user, 3);
+        assertAssignments(user, 2);
         assertAssignedRole(user, ROLE_BUSINESS_1_OID);
 
         assertAllow("assign business role to jack (org MoR)",
         		(task, result) -> assignParametricRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, ORG_MINISTRY_OF_RUM_OID, null, task, result));
 
         user = getUser(USER_JACK_OID);
-        assertAssignments(user, 4);
-        display("user after (expected 4 assignments)", user);
+        assertAssignments(user, 3);
+        display("user after (expected 3 assignments)", user);
         assertAssignedRole(user, ROLE_BUSINESS_1_OID);
 
         assertAllow("assign business role to jack (org Scumm)",
         		(task, result) -> assignParametricRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, ORG_SCUMM_BAR_OID, null, task, result));
 
         user = getUser(USER_JACK_OID);
-        assertAssignments(user, 5);
-        display("user after (expected 5 assignments)", user);
+        assertAssignments(user, 4);
+        display("user after (expected 4 assignments)", user);
         assertAssignedRole(user, ROLE_BUSINESS_1_OID);
 
         assertAllow("unassign business role from jack (org Scumm)",
         		(task, result) -> unassignParametricRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, ORG_SCUMM_BAR_OID, null, task, result));
 
         user = getUser(USER_JACK_OID);
-        assertAssignments(user, 4);
-        display("user after (expected 4 assignments)", user);
+        assertAssignments(user, 3);
+        display("user after (expected 3 assignments)", user);
         assertAssignedRole(user, ROLE_BUSINESS_1_OID);
 
         assertDeny("assign application role to jack",
@@ -2167,15 +2182,15 @@ public void test277AutzJackAssignRequestableRolesWithOrgRefSecondTime() throws E
         		(task, result) -> unassignParametricRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, null, null, task, result));
 
         user = getUser(USER_JACK_OID);
-        display("user after (expected 3 assignments)", user);
-        assertAssignments(user, 3);
+        display("user after (expected 2 assignments)", user);
+        assertAssignments(user, 2);
 
         assertAllow("unassign business role from jack (org MoR)",
         		(task, result) -> unassignParametricRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, ORG_MINISTRY_OF_RUM_OID, null, task, result));
 
         user = getUser(USER_JACK_OID);
-        display("user after (expected 2 assignments)", user);
-        assertAssignments(user, 2);
+        display("user after (expected 1 assignments)", user);
+        assertAssignments(user, 1);
 
         RoleSelectionSpecification spec = getAssignableRoleSpecification(getUser(USER_JACK_OID));
         assertRoleTypes(spec);
@@ -2208,14 +2223,14 @@ public void test278AutzJackAssignRequestableRolesWithOrgRefTweakedDelta() throws
         assertDeleteDeny();
 
         PrismObject<UserType> user = getUser(USER_JACK_OID);
-        assertAssignments(user, 2);
+        assertAssignments(user, 1);
         assertAssignedRole(user, ROLE_ASSIGN_REQUESTABLE_ROLES_OID);
 
         assertAllow("assign business role to jack",
         		(task, result) -> assignParametricRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, ORG_MINISTRY_OF_RUM_OID, null, task, result));
 
         user = getUser(USER_JACK_OID);
-        assertAssignments(user, 3);
+        assertAssignments(user, 2);
         assertAssignedRole(user, ROLE_BUSINESS_1_OID);
 
         assertDeny("assign application role to jack",
@@ -2242,7 +2257,7 @@ public void test278AutzJackAssignRequestableRolesWithOrgRefTweakedDelta() throws
 
         user = getUser(USER_JACK_OID);
         display("user after (expected 2 assignments)", user);
-        assertAssignments(user, 2);
+        assertAssignments(user, 1);
 
         RoleSelectionSpecification spec = getAssignableRoleSpecification(getUser(USER_JACK_OID));
         assertRoleTypes(spec);
@@ -2275,7 +2290,7 @@ public void test279AutzJackAssignRequestableRolesWithTenantRef() throws Exceptio
         assertDeleteDeny();
 
         PrismObject<UserType> user = getUser(USER_JACK_OID);
-        assertAssignments(user, 2);
+        assertAssignments(user, 1);
         assertAssignedRole(user, ROLE_ASSIGN_REQUESTABLE_ROLES_OID);
 
         assertAllow("assign business role to jack",
@@ -2283,7 +2298,7 @@ public void test279AutzJackAssignRequestableRolesWithTenantRef() throws Exceptio
 				assignParametricRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, null, ORG_GOVERNOR_OFFICE_OID, task, result));
 
         user = getUser(USER_JACK_OID);
-        assertAssignments(user, 3);
+        assertAssignments(user, 2);
         assertAssignedRole(user, ROLE_BUSINESS_1_OID);
 
         assertDeny("assign application role to jack", new Attempt() {
@@ -2298,8 +2313,8 @@ public void run(Task task, OperationResult result) throws Exception {
 				unassignParametricRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, null, ORG_GOVERNOR_OFFICE_OID, task, result));
 
         user = getUser(USER_JACK_OID);
-        display("user after (expected 2 assignments)", user);
-        assertAssignments(user, 2);
+        display("user after (expected 1 assignments)", user);
+        assertAssignments(user, 1);
 
         RoleSelectionSpecification spec = getAssignableRoleSpecification(getUser(USER_JACK_OID));
         assertRoleTypes(spec);
@@ -2317,6 +2332,10 @@ public void test280AutzJackEndUser() throws Exception {
         cleanupAutzTest(USER_JACK_OID);
 
         assignRole(USER_JACK_OID, ROLE_END_USER_OID);
+        
+        PrismObject<UserType> user = getUser(USER_JACK_OID);
+        assertAssignments(user, 1);
+        assertLinks(user, 0);
 
         assumeAssignmentPolicy(AssignmentPolicyEnforcementType.RELATIVE);
 
@@ -2324,42 +2343,66 @@ public void test280AutzJackEndUser() throws Exception {
 
         // WHEN
         displayWhen(TEST_NAME);
-
-        assertGetAllow(UserType.class, USER_JACK_OID);
+        
         assertGetDeny(UserType.class, USER_JACK_OID, SelectorOptions.createCollection(GetOperationOptions.createRaw()));
         assertGetDeny(UserType.class, USER_GUYBRUSH_OID);
         assertGetDeny(UserType.class, USER_GUYBRUSH_OID, SelectorOptions.createCollection(GetOperationOptions.createRaw()));
-
+        
         assertSearch(UserType.class, null, 1);
         assertSearch(UserType.class, createNameQuery(USER_JACK_USERNAME), 1);
         assertSearchDeny(UserType.class, createNameQuery(USER_JACK_USERNAME), SelectorOptions.createCollection(GetOperationOptions.createRaw()));
         assertSearch(UserType.class, createNameQuery(USER_GUYBRUSH_USERNAME), 0);
         assertSearchDeny(UserType.class, createNameQuery(USER_GUYBRUSH_USERNAME), SelectorOptions.createCollection(GetOperationOptions.createRaw()));
-
+        
         assertAddDeny();
         assertModifyDeny();
         assertDeleteDeny();
+        
+        assertModifyMetadataDeny(UserType.class, USER_JACK_OID);
+        assertModifyMetadataDeny(UserType.class, USER_GUYBRUSH_OID);
 
-        PrismObject<UserType> user = getUser(USER_JACK_OID);
-        assertAssignments(user, 2);
-
-        user = getUser(USER_JACK_OID);
-
+        assertPasswordChangeAllow(UserType.class, USER_JACK_OID, "nbusr123");
+        assertPasswordChangeDeny(UserType.class, USER_GUYBRUSH_OID, "nbusr123");
+        
         // MID-3136
         assertAllow("assign business role to jack",
         		(task, result) -> assignParametricRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, null, ORG_GOVERNOR_OFFICE_OID, task, result));
 
         user = getUser(USER_JACK_OID);
-        assertAssignments(user, 3);
+        assertAssignments(user, 2);
         assertAssignedRole(user, ROLE_BUSINESS_1_OID);
 
         assertDeny("assign application role to jack",
         		(task, result) -> assignRole(USER_JACK_OID, ROLE_BUSINESS_2_OID, task, result));
-
+        
         // End-user role has authorization to assign, but not to unassign
         assertDeny("unassign business role from jack",
         		(task, result) -> unassignParametricRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, null, ORG_GOVERNOR_OFFICE_OID, task, result));
 
+        user = getUser(USER_JACK_OID);
+        display("user after (expected 3 assignments)", user);
+        assertAssignments(user, 2);
+        
+        assertAllow("assign basic role to jack",
+        		(task, result) -> assignRole(USER_JACK_OID, ROLE_BASIC_OID, task, result));
+        
+        user = getUser(USER_JACK_OID);
+        display("user after (expected 3 assignments)", user);
+        assertAssignments(user, 3);
+        
+        String accountOid = getSingleLinkOid(user);
+        
+        PrismObject<ShadowType> accountShadow = assertGetAllow(ShadowType.class, accountOid);
+        display("account shadow", accountShadow);
+        
+        assertPasswordChangeAllow(UserType.class, USER_JACK_OID, "nbusr321");
+        assertPasswordChangeDeny(UserType.class, USER_GUYBRUSH_OID, "nbusr321");
+        
+        assertPasswordChangeAllow(ShadowType.class, accountOid, "nbusr231");
+        
+        assertDeny("unassign basic role from jack",
+        		(task, result) -> unassignRole(USER_JACK_OID, ROLE_BASIC_OID, task, result));
+        
         user = getUser(USER_JACK_OID);
         display("user after (expected 3 assignments)", user);
         assertAssignments(user, 3);
@@ -2386,7 +2429,7 @@ public void test281AutzJackEndUserSecondTime() throws Exception {
         displayWhen(TEST_NAME);
 
         PrismObject<UserType> user = getUser(USER_JACK_OID);
-        assertAssignments(user, 2);
+        assertAssignments(user, 1);
 
         user = getUser(USER_JACK_OID);
 
@@ -2395,7 +2438,7 @@ public void test281AutzJackEndUserSecondTime() throws Exception {
         		(task, result) -> assignParametricRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, null, null, task, result));
 
         user = getUser(USER_JACK_OID);
-        assertAssignments(user, 3);
+        assertAssignments(user, 2);
         assertAssignedRole(user, ROLE_BUSINESS_1_OID);
 
         // MID-3136
@@ -2403,7 +2446,7 @@ public void test281AutzJackEndUserSecondTime() throws Exception {
         		(task, result) -> assignParametricRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, null, ORG_GOVERNOR_OFFICE_OID, task, result));
 
         user = getUser(USER_JACK_OID);
-        assertAssignments(user, 4);
+        assertAssignments(user, 3);
         assertAssignedRole(user, ROLE_BUSINESS_1_OID);
 
         assertDeny("assign application role to jack", new Attempt() {
@@ -2418,8 +2461,8 @@ public void run(Task task, OperationResult result) throws Exception {
         		(task, result) -> unassignParametricRole(USER_JACK_OID, ROLE_BUSINESS_1_OID, null, ORG_GOVERNOR_OFFICE_OID, task, result));
 
         user = getUser(USER_JACK_OID);
-        display("user after (expected 4 assignments)", user);
-        assertAssignments(user, 4);
+        display("user after (expected 3 assignments)", user);
+        assertAssignments(user, 3);
 
         assertGlobalStateUntouched();
 
@@ -2459,7 +2502,7 @@ public void test282AutzJackEndUserAndModify() throws Exception {
         assertDeleteDeny();
 
         PrismObject<UserType> user = getUser(USER_JACK_OID);
-        assertAssignments(user, 3);
+        assertAssignments(user, 2);
 
         assertAllow("modify jack's familyName",
         		(task, result) -> modifyObjectReplaceProperty(UserType.class, USER_JACK_OID, new ItemPath(UserType.F_FAMILY_NAME), task, result, PrismTestUtil.createPolyString("changed")));
@@ -2495,7 +2538,7 @@ public void test283AutzJackModifyAndEndUser() throws Exception {
         assertDeleteDeny();
 
         PrismObject<UserType> user = getUser(USER_JACK_OID);
-        assertAssignments(user, 3);
+        assertAssignments(user, 2);
 
         assertAllow("modify jack's familyName",
 			(task, result) -> modifyObjectReplaceProperty(UserType.class, USER_JACK_OID, new ItemPath(UserType.F_FAMILY_NAME), task, result, PrismTestUtil.createPolyString("changed")));
@@ -2527,14 +2570,14 @@ public void test290AutzJackRoleOwnerAssign() throws Exception {
         assertDeleteDeny();
 
         PrismObject<UserType> user = getUser(USER_JACK_OID);
-        assertAssignments(user, 2);
+        assertAssignments(user, 1);
         assertAssignedRole(user, ROLE_ROLE_OWNER_ASSIGN_OID);
 
         assertAllow("assign application role 1 to jack",
         		(task,result) -> assignRole(USER_JACK_OID, ROLE_APPLICATION_1_OID, task, result));
 
         user = getUser(USER_JACK_OID);
-        assertAssignments(user, 3);
+        assertAssignments(user, 2);
         assertAssignedRole(user, ROLE_APPLICATION_1_OID);
 
         assertDeny("assign application role 2 to jack", new Attempt() {
@@ -2548,7 +2591,7 @@ public void run(Task task, OperationResult result) throws Exception {
         		(task,result) -> unassignRole(USER_JACK_OID, ROLE_APPLICATION_1_OID, task, result));
 
         user = getUser(USER_JACK_OID);
-        assertAssignments(user, 2);
+        assertAssignments(user, 1);
 
         RoleSelectionSpecification spec = getAssignableRoleSpecification(getUser(USER_JACK_OID));
         assertRoleTypes(spec);
diff --git a/model/model-intest/src/test/resources/security/role-basic.xml b/model/model-intest/src/test/resources/security/role-basic.xml
index 3bb0ae3562f..8c713dc3ef9 100644
--- a/model/model-intest/src/test/resources/security/role-basic.xml
+++ b/model/model-intest/src/test/resources/security/role-basic.xml
@@ -1,5 +1,5 @@
 <!--
-  ~ Copyright (c) 2014 Evolveum
+  ~ Copyright (c) 2014-2017 Evolveum
   ~
   ~ Licensed under the Apache License, Version 2.0 (the "License");
   ~ you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@
   <role xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
       oid="00000000-0000-0000-0000-00000000aad1"
       version="0">
-   <name>Basic Role - CSV</name>
+   <name>Basic Role</name>
    <inducement id="1">
       <construction>
          <resourceRef xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
@@ -24,4 +24,5 @@
                       type="c:ResourceType"/>
       </construction>
    </inducement>
+   <requestable>true</requestable>
 </role>
\ No newline at end of file
diff --git a/model/model-intest/src/test/resources/security/role-end-user.xml b/model/model-intest/src/test/resources/security/role-end-user.xml
index 28cd1641d29..84f0d0da710 100644
--- a/model/model-intest/src/test/resources/security/role-end-user.xml
+++ b/model/model-intest/src/test/resources/security/role-end-user.xml
@@ -125,17 +125,17 @@
     	</object>
     	<item>credentials</item>
     	<item>assignment</item>
-    	<item>parentOrgRef</item>
-    	<item>roleMembershipRef</item>
     </authorization>
     
     <authorization>
-    	<name>self-shadow-execution-modify</name>
+    	<name>self-shadow-execution-add-modify-delete</name>
     	<description>
-    		Authorization that allows to self-modification of some properties on user's accounts, but only in execution phase. 
-    		The limitation real limitation of these operations is done in the request phase.
+    		Authorization that allows to self-modification of user's accounts, but only in execution phase.
+    		The real limitation of these operations is done in the request phase.
     	</description>
+		<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#add</action>
     	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
+    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#delete</action>
     	<phase>execution</phase>
     	<object>
     		<type>ShadowType</type>
@@ -143,7 +143,6 @@
     			<special>self</special>
     		</owner>
     	</object>
-    	<item>credentials</item>
     </authorization>
     
     <authorization>
diff --git a/model/model-test/src/main/java/com/evolveum/midpoint/model/test/AbstractModelIntegrationTest.java b/model/model-test/src/main/java/com/evolveum/midpoint/model/test/AbstractModelIntegrationTest.java
index ca3dc2f56ae..175025d3bf9 100644
--- a/model/model-test/src/main/java/com/evolveum/midpoint/model/test/AbstractModelIntegrationTest.java
+++ b/model/model-test/src/main/java/com/evolveum/midpoint/model/test/AbstractModelIntegrationTest.java
@@ -1453,8 +1453,7 @@ protected <O extends ObjectType> Collection<ObjectDeltaOperation<? extends Objec
 
 	protected <O extends ObjectType> Collection<ObjectDeltaOperation<? extends ObjectType>> executeChangesAssertSuccess(ObjectDelta<O> objectDelta, ModelExecuteOptions options, Task task, OperationResult result) throws ObjectAlreadyExistsException, ObjectNotFoundException, SchemaException, ExpressionEvaluationException, CommunicationException, ConfigurationException, PolicyViolationException, SecurityViolationException {
 		Collection<ObjectDeltaOperation<? extends ObjectType>> rv = executeChanges(objectDelta, options, task, result);
-		result.computeStatus();
-		TestUtil.assertSuccess(result);
+		assertSuccess(result);
 		return rv;
 	}
 
@@ -1462,8 +1461,7 @@ protected void assignAccount(String userOid, String resourceOid, String intent)
 		Task task = taskManager.createTaskInstance(AbstractModelIntegrationTest.class+".assignAccount");
 		OperationResult result = task.getResult();
 		assignAccount(userOid, resourceOid, intent, task, result);
-		result.computeStatus();
-		TestUtil.assertSuccess(result);
+		assertSuccess(result);
 	}
 
 	protected void assignAccount(String userOid, String resourceOid, String intent, Task task, OperationResult result) throws SchemaException, ObjectAlreadyExistsException, ObjectNotFoundException, ExpressionEvaluationException, CommunicationException, ConfigurationException, PolicyViolationException, SecurityViolationException {
@@ -1472,6 +1470,13 @@ protected void assignAccount(String userOid, String resourceOid, String intent,
 		modelService.executeChanges(deltas, null, task, result);
 	}
 
+	protected void unassignAccount(String userOid, String resourceOid, String intent) throws SchemaException, ObjectAlreadyExistsException, ObjectNotFoundException, ExpressionEvaluationException, CommunicationException, ConfigurationException, PolicyViolationException, SecurityViolationException {
+		Task task = taskManager.createTaskInstance(AbstractModelIntegrationTest.class+".assignAccount");
+		OperationResult result = task.getResult();
+		unassignAccount(userOid, resourceOid, intent, task, result);
+		assertSuccess(result);
+	}
+	
 	protected void unassignAccount(String userOid, String resourceOid, String intent, Task task, OperationResult result) throws SchemaException, ObjectAlreadyExistsException, ObjectNotFoundException, ExpressionEvaluationException, CommunicationException, ConfigurationException, PolicyViolationException, SecurityViolationException {
 		ObjectDelta<UserType> userDelta = createAccountAssignmentUserDelta(userOid, resourceOid, intent, false);
 		Collection<ObjectDelta<? extends ObjectType>> deltas = MiscSchemaUtil.createCollection(userDelta);
diff --git a/repo/repo-test-util/src/main/java/com/evolveum/midpoint/test/AbstractIntegrationTest.java b/repo/repo-test-util/src/main/java/com/evolveum/midpoint/test/AbstractIntegrationTest.java
index a905b2fa6b7..b524ac8eebd 100644
--- a/repo/repo-test-util/src/main/java/com/evolveum/midpoint/test/AbstractIntegrationTest.java
+++ b/repo/repo-test-util/src/main/java/com/evolveum/midpoint/test/AbstractIntegrationTest.java
@@ -2143,4 +2143,8 @@ protected void waitForThreads(ParallelTestThread[] threads, long timeout) throws
 			}
 		}
 	}
+	
+	protected ItemPath getMetadataPath(QName propName) {
+		return new ItemPath(ObjectType.F_METADATA, propName);
+	}
 }
diff --git a/repo/security-api/src/main/java/com/evolveum/midpoint/security/api/AuthorizationConstants.java b/repo/security-api/src/main/java/com/evolveum/midpoint/security/api/AuthorizationConstants.java
index 331effa5676..f58194f091a 100644
--- a/repo/security-api/src/main/java/com/evolveum/midpoint/security/api/AuthorizationConstants.java
+++ b/repo/security-api/src/main/java/com/evolveum/midpoint/security/api/AuthorizationConstants.java
@@ -15,10 +15,18 @@
  */
 package com.evolveum.midpoint.security.api;
 
+import java.util.Arrays;
+import java.util.Collection;
+
 import javax.xml.namespace.QName;
 
+import com.evolveum.midpoint.prism.path.ItemPath;
 import com.evolveum.midpoint.schema.constants.SchemaConstants;
 import com.evolveum.midpoint.util.QNameUtil;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.ActivationType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.AssignmentType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.FocusType;
+import com.evolveum.midpoint.xml.ns._public.common.common_3.ObjectType;
 
 /**
  * @author semancik
@@ -408,5 +416,49 @@ public class AuthorizationConstants {
 	//ui authorization for CSV export button (will be applied everywhere over mp)
 	public static final QName AUTZ_UI_ADMIN_CSV_EXPORT_ACTION_QNAME = new QName(NS_AUTHORIZATION_UI, "adminCSVexport");
 	public static final String AUTZ_UI_ADMIN_CSV_EXPORT_ACTION_URI = QNameUtil.qNameToUri(AUTZ_UI_ADMIN_CSV_EXPORT_ACTION_QNAME);
+	
+	/**
+	 * Those are the items that midPoint logic controls directly. They have exception from execution-phase
+	 * authorization enforcement. Their modification in execution phase is always allowed. If it was not
+	 * allowed then midPoint won't be able to function properly and it may even lead to security issues.
+	 * 
+	 * Note: this applies only to execution phase. Those items are still controlled by regular authorizations
+	 * for request phase. Therefore these exceptions do NOT allow user to modify those items. Attempt to do so
+	 * must pass through request-phase authorization first. This exception only allows midPoint logic to modify
+	 * those properties without explicit authorizations.
+	 * 
+	 * Motivation: Strictly speaking, there would be no need for these exceptions. The modification can be
+	 * allowed by regular authorizations. However, that would mean, that every practical authorization must
+	 * contain those items. That is error-prone, it is a maintenance burden and it is even an obstacle for
+	 * evolvability. E.g. if similar properties are added in future midPoint versions (which is likely) then
+	 * all existing authorizations much be updated. The cost of slightly increased perceived security is not
+	 * justified by those operational issues.
+	 */
+	public static final Collection<ItemPath> EXECUTION_ITEMS_ALLOWED_BY_DEFAULT = Arrays.asList(
+			new ItemPath(ObjectType.F_METADATA),
+			new ItemPath(ObjectType.F_PARENT_ORG_REF),
+			new ItemPath(ObjectType.F_TENANT_REF),
+			new ItemPath(ObjectType.F_TRIGGER),
+			new ItemPath(FocusType.F_ACTIVATION, ActivationType.F_ARCHIVE_TIMESTAMP),
+			new ItemPath(FocusType.F_ACTIVATION, ActivationType.F_DISABLE_REASON),
+			new ItemPath(FocusType.F_ACTIVATION, ActivationType.F_DISABLE_TIMESTAMP),
+			new ItemPath(FocusType.F_ACTIVATION, ActivationType.F_EFFECTIVE_STATUS),
+			new ItemPath(FocusType.F_ACTIVATION, ActivationType.F_ENABLE_TIMESTAMP),
+			new ItemPath(FocusType.F_ACTIVATION, ActivationType.F_LOCKOUT_EXPIRATION_TIMESTAMP),
+			new ItemPath(FocusType.F_ACTIVATION, ActivationType.F_LOCKOUT_STATUS),
+			new ItemPath(FocusType.F_ACTIVATION, ActivationType.F_VALIDITY_CHANGE_TIMESTAMP),
+			new ItemPath(FocusType.F_ACTIVATION, ActivationType.F_VALIDITY_STATUS),
+			new ItemPath(FocusType.F_ASSIGNMENT, AssignmentType.F_METADATA),
+			new ItemPath(FocusType.F_ASSIGNMENT, AssignmentType.F_POLICY_SITUATION),
+			new ItemPath(FocusType.F_ASSIGNMENT, AssignmentType.F_TRIGGERED_POLICY_RULE),
+			new ItemPath(FocusType.F_DELEGATED_REF),
+			new ItemPath(FocusType.F_ITERATION),
+			new ItemPath(FocusType.F_ITERATION_TOKEN),
+//			new ItemPath(FocusType.F_LINK_REF), // in fact, linkRef may be omitted here. link/unlink is done after execution authorizations are applied
+			new ItemPath(FocusType.F_PERSONA_REF),
+			new ItemPath(FocusType.F_ROLE_INFLUENCE_REF),
+			new ItemPath(FocusType.F_ROLE_MEMBERSHIP_REF),
+			new ItemPath(FocusType.F_TRIGGERED_POLICY_RULE)
+		);
 
 }
diff --git a/repo/security-impl/src/main/java/com/evolveum/midpoint/security/impl/SecurityEnforcerImpl.java b/repo/security-impl/src/main/java/com/evolveum/midpoint/security/impl/SecurityEnforcerImpl.java
index ce039b46193..00b79f3c967 100644
--- a/repo/security-impl/src/main/java/com/evolveum/midpoint/security/impl/SecurityEnforcerImpl.java
+++ b/repo/security-impl/src/main/java/com/evolveum/midpoint/security/impl/SecurityEnforcerImpl.java
@@ -16,7 +16,6 @@
 package com.evolveum.midpoint.security.impl;
 
 import com.evolveum.midpoint.prism.*;
-import com.evolveum.midpoint.prism.Visitor;
 import com.evolveum.midpoint.prism.delta.ContainerDelta;
 import com.evolveum.midpoint.prism.delta.ItemDelta;
 import com.evolveum.midpoint.prism.delta.ObjectDelta;
@@ -210,7 +209,7 @@ private <O extends ObjectType, T extends ObjectType> boolean isAuthorizedInterna
 					if (decision == null || decision == AuthorizationDecisionType.ALLOW) {
 						// if there is more than one role which specify
 						// different authz (e.g one role specify allow for whole
-						// objet, the other role specify allow only for some
+						// object, the other role specify allow only for some
 						// attributes. this ended with allow for whole object (MID-2018)
 						Collection<ItemPath> allowed = getItems(autz);
 						if (allow && allowedItems.isEmpty()){
@@ -252,9 +251,9 @@ private <O extends ObjectType, T extends ObjectType> boolean isAuthorizedInterna
 				// all items in the object and delta must be allowed
 
 				if (delta != null) {
-					allow = processAuthorizationDelta(delta, allowedItems);
+					allow = processAuthorizationDelta(delta, allowedItems, phase);
 				} else if (object != null) {
-					allow = processAuthorizationObject(object, allowedItems);
+					allow = processAuthorizationObject(object, allowedItems, phase);
 				}
 			}
 		}
@@ -265,21 +264,21 @@ private <O extends ObjectType, T extends ObjectType> boolean isAuthorizedInterna
 		return allow;
 	}
 
-	private <O extends ObjectType> boolean processAuthorizationObject(PrismContainer<O> object, final Collection<ItemPath> allowedItems) {
-		return isContainerAllowed(object.getValue(), allowedItems);
+	private <O extends ObjectType> boolean processAuthorizationObject(PrismContainer<O> object, final Collection<ItemPath> allowedItems, AuthorizationPhaseType phase) {
+		return isContainerAllowed(object.getValue(), allowedItems, phase);
 	}
 
-	private <C extends Containerable> boolean processAuthorizationContainerDelta(ContainerDelta<C> cdelta, final Collection<ItemPath> allowedItems) {
+	private <C extends Containerable> boolean processAuthorizationContainerDelta(ContainerDelta<C> cdelta, final Collection<ItemPath> allowedItems, AuthorizationPhaseType phase) {
 		final MutableBoolean itemDecision = new MutableBoolean(true);
 		cdelta.foreach(cval -> {
-			if (!isContainerAllowed(cval, allowedItems)) {
+			if (!isContainerAllowed(cval, allowedItems, phase)) {
 				itemDecision.setValue(false);
 			}
 		});
 		return itemDecision.booleanValue();
 	}
 
-	private boolean isContainerAllowed(PrismContainerValue<?> cval, Collection<ItemPath> allowedItems) {
+	private boolean isContainerAllowed(PrismContainerValue<?> cval, Collection<ItemPath> allowedItems, AuthorizationPhaseType phase) {
 		if (cval.isEmpty()) {
 			// TODO: problem with empty containers such as
 			// orderConstraint in assignment. Skip all
@@ -290,18 +289,18 @@ private boolean isContainerAllowed(PrismContainerValue<?> cval, Collection<ItemP
 		for (Item<?, ?> item: cval.getItems()) {
 			ItemPath itemPath = item.getPath();
 			if (item instanceof PrismContainer<?>) {
-				if (isInList(itemPath, allowedItems)) {
+				if (isAllowedItem(itemPath, allowedItems, phase)) {
 					// entire container is allowed. We do not need to go deeper
 				} else {
 					List<PrismContainerValue<?>> subValues = (List)((PrismContainer<?>)item).getValues();
 					for (PrismContainerValue<?> subValue: subValues) {
-						if (!isContainerAllowed(subValue, allowedItems)) {
+						if (!isContainerAllowed(subValue, allowedItems, phase)) {
 							decision = false;
 						}
 					}
 				}
 			} else {
-				if (!isInList(itemPath, allowedItems)) {
+				if (!isAllowedItem(itemPath, allowedItems, phase)) {
 					LOGGER.trace("  DENY operation because item {} in the object is not allowed", itemPath);
 					decision = false;
 				}
@@ -310,20 +309,20 @@ private boolean isContainerAllowed(PrismContainerValue<?> cval, Collection<ItemP
 		return decision;
 	}
 
-	private <O extends ObjectType> boolean processAuthorizationDelta(ObjectDelta<O> delta, final Collection<ItemPath> allowedItems) {
+	private <O extends ObjectType> boolean processAuthorizationDelta(ObjectDelta<O> delta, final Collection<ItemPath> allowedItems, AuthorizationPhaseType phase) {
 		if (delta.isAdd()) {
-			return processAuthorizationObject(delta.getObjectToAdd(), allowedItems);
+			return processAuthorizationObject(delta.getObjectToAdd(), allowedItems, phase);
 		} else {
 			for (ItemDelta<?,?> itemDelta: delta.getModifications()) {
 				ItemPath itemPath = itemDelta.getPath();
 				if (itemDelta instanceof ContainerDelta<?>) {
-					if (!isInList(itemPath, allowedItems)) {
-						if (!processAuthorizationContainerDelta((ContainerDelta<?>)itemDelta, allowedItems)) {
+					if (!isAllowedItem(itemPath, allowedItems, phase)) {
+						if (!processAuthorizationContainerDelta((ContainerDelta<?>)itemDelta, allowedItems, phase)) {
 							return false;
 						}
 					}
 				} else {
-					if (!isInList(itemPath, allowedItems)) {
+					if (!isAllowedItem(itemPath, allowedItems, phase)) {
 						LOGGER.trace("  DENY operation because item {} in the delta is not allowed", itemPath);
 						return false;
 					}
@@ -332,6 +331,17 @@ private <O extends ObjectType> boolean processAuthorizationDelta(ObjectDelta<O>
 			return true;
 		}
 	}
+	
+	private boolean isAllowedItem(ItemPath itemPath, Collection<ItemPath> allowedItems, AuthorizationPhaseType phase) {
+		return isInList(itemPath, allowedItems) || allowedForExecutionByDefault(itemPath, phase);
+	}
+	
+	private boolean allowedForExecutionByDefault(ItemPath itemPath, AuthorizationPhaseType phase) {
+		if (!AuthorizationPhaseType.EXECUTION.equals(phase)) {
+			return false;
+		}
+		return isInList(itemPath, AuthorizationConstants.EXECUTION_ITEMS_ALLOWED_BY_DEFAULT);
+	}
 
 	private boolean isInList(ItemPath itemPath, Collection<ItemPath> allowedItems) {
 		boolean itemAllowed = false;