diff --git a/recipients-resolver/src/main/java/com/redhat/cloud/notifications/recipients/resolver/kessel/KesselService.java b/recipients-resolver/src/main/java/com/redhat/cloud/notifications/recipients/resolver/kessel/KesselService.java
index db451f40c6..5ccf7caf06 100644
--- a/recipients-resolver/src/main/java/com/redhat/cloud/notifications/recipients/resolver/kessel/KesselService.java
+++ b/recipients-resolver/src/main/java/com/redhat/cloud/notifications/recipients/resolver/kessel/KesselService.java
@@ -2,6 +2,7 @@
 
 import com.redhat.cloud.notifications.ingress.RecipientsAuthorizationCriterion;
 import com.redhat.cloud.notifications.recipients.config.RecipientsResolverConfig;
+import io.quarkus.logging.Log;
 import jakarta.annotation.PostConstruct;
 import jakarta.enterprise.context.ApplicationScoped;
 import jakarta.inject.Inject;
@@ -21,7 +22,7 @@
 @ApplicationScoped
 public class KesselService {
 
-    static final String SUBJECT_TYPE_USER = "user";
+    static final String SUBJECT_TYPE_USER = "principal";
 
     static final String RBAC_NAMESPACE = "rbac";
 
@@ -104,6 +105,7 @@ public Set<String> lookupSubjects(RecipientsAuthorizationCriterion recipientsAut
 
         for (Iterator<LookupSubjectsResponse> it = lookupClient.lookupSubjects(request); it.hasNext();) {
             LookupSubjectsResponse response = it.next();
+            Log.infof("Kessel response: %s", response);
             userNames.add(response.getSubject().getSubject().getId());
         }
         return userNames;