diff --git a/internal/infrastructure/audit/writer.go b/internal/infrastructure/audit/writer.go
index 5489e10..ad8b71c 100644
--- a/internal/infrastructure/audit/writer.go
+++ b/internal/infrastructure/audit/writer.go
@@ -1025,7 +1025,10 @@ func (w *Writer) buildResources(inputs []ResourceInput, action ActionDefinition)
 		}
 		visibility := input.SubjectVisibility
 		if visibility == "" {
-			visibility = action.DefaultVisibility
+			visibility = constants.AuditSubjectInternalOnly
+			if input.Relation == constants.AuditResourceRelationPrimary {
+				visibility = action.DefaultVisibility
+			}
 		}
 		subjectDataInput, err := validateSubjectProjection(input, action, visibility)
 		if err != nil {