diff --git a/db/migrations/0042_iam_tables.sql b/db/migrations/0042_iam_tables.sql
index 6c08a290..4dd8c4c9 100644
--- a/db/migrations/0042_iam_tables.sql
+++ b/db/migrations/0042_iam_tables.sql
@@ -108,10 +108,7 @@ CREATE TABLE IF NOT EXISTS public.role_assignment (
 
   -- Idempotency & correlation
   correlation_id UUID UNIQUE NOT NULL DEFAULT gen_random_uuid(),
-  checksum VARCHAR(64),
-
-  -- Constraints: One role per identity (except temporary/special cases)
-  UNIQUE(identity_id, role_id) WHERE assignment_state NOT IN ('REVOKED', 'REJECTED')
+  checksum VARCHAR(64)
 );
 
 CREATE INDEX idx_role_assignment_identity ON public.role_assignment(identity_id);
@@ -119,6 +116,11 @@ CREATE INDEX idx_role_assignment_role ON public.role_assignment(role_id);
 CREATE INDEX idx_role_assignment_state ON public.role_assignment(assignment_state);
 CREATE INDEX idx_role_assignment_correlation ON public.role_assignment(correlation_id);
 
+-- Partial unique constraint: One active role per identity
+CREATE UNIQUE INDEX idx_role_assignment_unique_active
+  ON public.role_assignment(identity_id, role_id)
+  WHERE assignment_state NOT IN ('REVOKED', 'REJECTED');
+
 -- 4. PERMISSION TABLE (Granular Permissions)
 CREATE TABLE IF NOT EXISTS public.permission (
   permission_id UUID PRIMARY KEY DEFAULT gen_random_uuid(),