they are 1-1. The only one question why do you make relation from org to a user/user_group and not vice versa? I thought it should be kinda from child to parent?