I mean, I might be wrong, but this only changes the mapping right? In the case that user broke containment, I would assume that they would have the user id of the user that’s running the process?

Granted this is all in theory so I’m not sure exactly – that might be a perfectly reasonable way to do it.