Based on the slack thread: [link](https://camunda.slack.com/archives/C06UYJMMETZ/p1759839552959599) Orchestration Cluster authorization mentions that USER authorization accepts `*, felix.mueller--> All users / Username` for **Resource key type** https://docs.camunda.io/docs/next/components/concepts/access-control/authorizations/#available-resources <img width="1041" height="247" alt="Image" src="https://github.com/user-attachments/assets/9dcf8883-eb4b-4a52-8dff-368627541045" /> While in SaaS only emails can grant user access to a process, and this is expected because the deployments on SaaS are configured to use [the email address of the user as the username claim](https://github.com/camunda/camunda-operator/blob/4b41dbc7e4250683bd178094d704367a3e56772c/pkg/apps/camunda/oidc/oidc.go#L55). Based on the info above, the user docs should be updated to mention this.