diff --git a/app/models/anomaly_notification.rb b/app/models/anomaly_notification.rb
index 5bafbac9..1acf556e 100644
--- a/app/models/anomaly_notification.rb
+++ b/app/models/anomaly_notification.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 class AnomalyNotification < ApplicationRecord
-  belongs_to :user, polymorphic: true
+  include Creation
   belongs_to :exercise
   belongs_to :exercise_collection
 end
diff --git a/app/models/code_ocean/file.rb b/app/models/code_ocean/file.rb
index d9f35510..e97f7785 100644
--- a/app/models/code_ocean/file.rb
+++ b/app/models/code_ocean/file.rb
@@ -12,6 +12,7 @@ module CodeOcean
     TEACHER_DEFINED_ROLES = ROLES - %w[user_defined_file]
     OWNER_READ_PERMISSION = 0o400
     OTHER_READ_PERMISSION = 0o004
+    ALLOWED_CONTEXT_TYPES = %w[Exercise Submission CommunitySolution CommunitySolutionContribution].freeze
 
     after_initialize :set_default_values
     before_validation :clear_weight, unless: :teacher_defined_assessment?
@@ -56,6 +57,7 @@ module CodeOcean
     validates :weight, if: :teacher_defined_assessment?, numericality: true, presence: true
     validates :weight, absence: true, unless: :teacher_defined_assessment?
     validates :file, presence: true if :context.is_a?(Submission)
+    validates :context_type, inclusion: {in: ALLOWED_CONTEXT_TYPES}
 
     validates_with FileNameValidator, fields: %i[name path file_type_id]
 
diff --git a/app/models/comment.rb b/app/models/comment.rb
index 7c4e7014..9d67fbfa 100644
--- a/app/models/comment.rb
+++ b/app/models/comment.rb
@@ -8,7 +8,6 @@ class Comment < ApplicationRecord
   attr_accessor :username, :date, :updated, :editable
 
   belongs_to :file, class_name: 'CodeOcean::File'
-  belongs_to :user, polymorphic: true
   # after_save :trigger_rfc_action_cable_from_comment
 
   def request_for_comment
diff --git a/app/models/community_solution.rb b/app/models/community_solution.rb
index 67b0e7f3..6b3c3d15 100644
--- a/app/models/community_solution.rb
+++ b/app/models/community_solution.rb
@@ -1,12 +1,15 @@
 # frozen_string_literal: true
 
 class CommunitySolution < ApplicationRecord
+  ALLOWED_USER_TYPES = [InternalUser, ExternalUser].map(&:to_s).freeze
   belongs_to :exercise
   has_many :community_solution_locks
   has_many :community_solution_contributions
   has_and_belongs_to_many :users, polymorphic: true, through: :community_solution_contributions
   has_many :files, class_name: 'CodeOcean::File', through: :community_solution_contributions
 
+  validates :user_type, inclusion: {in: ALLOWED_USER_TYPES}
+
   def to_s
     "Gemeinschaftslösung für #{exercise}"
   end
diff --git a/app/models/concerns/contributor_creation.rb b/app/models/concerns/contributor_creation.rb
index 376f8e71..015d2fa6 100644
--- a/app/models/concerns/contributor_creation.rb
+++ b/app/models/concerns/contributor_creation.rb
@@ -4,11 +4,15 @@ module ContributorCreation
   extend ActiveSupport::Concern
   include Contributor
 
+  ALLOWED_CONTRIBUTOR_TYPES = [InternalUser, ExternalUser, ProgrammingGroup].map(&:to_s).freeze
+
   included do
     belongs_to :contributor, polymorphic: true
     alias_method :user, :contributor
     alias_method :user=, :contributor=
     alias_method :author, :user
     alias_method :creator, :user
+
+    validates :contributor_type, inclusion: {in: ALLOWED_CONTRIBUTOR_TYPES}
   end
 end
diff --git a/app/models/concerns/creation.rb b/app/models/concerns/creation.rb
index 926245bc..19f7fec9 100644
--- a/app/models/concerns/creation.rb
+++ b/app/models/concerns/creation.rb
@@ -3,9 +3,13 @@
 module Creation
   extend ActiveSupport::Concern
 
+  ALLOWED_USER_TYPES = [InternalUser, ExternalUser].map(&:to_s).freeze
+
   included do
     belongs_to :user, polymorphic: true
     alias_method :author, :user
     alias_method :creator, :user
+
+    validates :user_type, inclusion: {in: ALLOWED_USER_TYPES}
   end
 end
diff --git a/app/models/event.rb b/app/models/event.rb
index 52f3744a..e4798059 100644
--- a/app/models/event.rb
+++ b/app/models/event.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 class Event < ApplicationRecord
-  belongs_to :user, polymorphic: true
+  include Creation
   belongs_to :exercise
   belongs_to :file, class_name: 'CodeOcean::File'
 
diff --git a/app/models/exercise_collection.rb b/app/models/exercise_collection.rb
index 895abdc3..c28b3790 100644
--- a/app/models/exercise_collection.rb
+++ b/app/models/exercise_collection.rb
@@ -1,12 +1,12 @@
 # frozen_string_literal: true
 
 class ExerciseCollection < ApplicationRecord
+  include Creation
   include TimeHelper
 
   has_many :exercise_collection_items, dependent: :delete_all
   alias items exercise_collection_items
   has_many :exercises, through: :exercise_collection_items, inverse_of: :exercise_collections
-  belongs_to :user, polymorphic: true
 
   def collection_statistics
     statistics = {}
diff --git a/app/models/programming_group_membership.rb b/app/models/programming_group_membership.rb
index d7182673..975c2550 100644
--- a/app/models/programming_group_membership.rb
+++ b/app/models/programming_group_membership.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 class ProgrammingGroupMembership < ApplicationRecord
-  belongs_to :user, polymorphic: true
+  include Creation
   belongs_to :programming_group
 
   validate :unique_membership_for_exercise
diff --git a/app/models/remote_evaluation_mapping.rb b/app/models/remote_evaluation_mapping.rb
index 9575b8fb..4cd24a0c 100644
--- a/app/models/remote_evaluation_mapping.rb
+++ b/app/models/remote_evaluation_mapping.rb
@@ -2,9 +2,9 @@
 
 # TODO: reference to lti_param_model
 class RemoteEvaluationMapping < ApplicationRecord
+  include Creation
   before_create :generate_token, unless: :validation_token?
   belongs_to :exercise
-  belongs_to :user, polymorphic: true
   belongs_to :study_group, optional: true
 
   def generate_token
diff --git a/app/models/runner.rb b/app/models/runner.rb
index 2304c422..ddb4ab46 100644
--- a/app/models/runner.rb
+++ b/app/models/runner.rb
@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
 class Runner < ApplicationRecord
+  include Creation
   belongs_to :execution_environment
-  belongs_to :user, polymorphic: true
 
   before_validation :request_id
 
diff --git a/app/models/study_group_membership.rb b/app/models/study_group_membership.rb
index e732e4ed..04ca0a76 100644
--- a/app/models/study_group_membership.rb
+++ b/app/models/study_group_membership.rb
@@ -1,13 +1,13 @@
 # frozen_string_literal: true
 
 class StudyGroupMembership < ApplicationRecord
-  ROLES = %w[learner teacher].freeze
-
-  belongs_to :user, polymorphic: true
+  include Creation
   belongs_to :study_group
 
   before_save :destroy_if_empty_study_group_or_user
 
+  ROLES = %w[learner teacher].freeze
+
   def destroy_if_empty_study_group_or_user
     destroy if study_group.blank? || user.blank?
   end
diff --git a/app/models/subscription.rb b/app/models/subscription.rb
index 027e4992..5a35bd9d 100644
--- a/app/models/subscription.rb
+++ b/app/models/subscription.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 class Subscription < ApplicationRecord
-  belongs_to :user, polymorphic: true
+  include Creation
   belongs_to :request_for_comment
   belongs_to :study_group, optional: true
 end
diff --git a/app/models/testrun.rb b/app/models/testrun.rb
index be3df12d..757d3e64 100644
--- a/app/models/testrun.rb
+++ b/app/models/testrun.rb
@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 class Testrun < ApplicationRecord
+  include Creation
   belongs_to :file, class_name: 'CodeOcean::File', optional: true
   belongs_to :submission
   belongs_to :testrun_execution_environment, optional: true, dependent: :destroy
diff --git a/app/models/user_exercise_intervention.rb b/app/models/user_exercise_intervention.rb
index ff5e7749..2048ccf7 100644
--- a/app/models/user_exercise_intervention.rb
+++ b/app/models/user_exercise_intervention.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 class UserExerciseIntervention < ApplicationRecord
-  belongs_to :user, polymorphic: true
+  include Creation
   belongs_to :intervention
   belongs_to :exercise
 end
diff --git a/app/models/user_proxy_exercise_exercise.rb b/app/models/user_proxy_exercise_exercise.rb
index 05a57c24..a8550956 100644
--- a/app/models/user_proxy_exercise_exercise.rb
+++ b/app/models/user_proxy_exercise_exercise.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 class UserProxyExerciseExercise < ApplicationRecord
-  belongs_to :user, polymorphic: true
+  include Creation
   belongs_to :exercise
   belongs_to :proxy_exercise