diff --git a/repo/repo-sqale/src/main/java/com/evolveum/midpoint/repo/sqale/qmodel/QOwnedBy.java b/repo/repo-sqale/src/main/java/com/evolveum/midpoint/repo/sqale/qmodel/QOwnedBy.java
index b965943371d..b61c11ae078 100644
--- a/repo/repo-sqale/src/main/java/com/evolveum/midpoint/repo/sqale/qmodel/QOwnedBy.java
+++ b/repo/repo-sqale/src/main/java/com/evolveum/midpoint/repo/sqale/qmodel/QOwnedBy.java
@@ -16,6 +16,10 @@
  */
 public interface QOwnedBy<OR> {
 
-    /** Returns predicate for where clause that matches only rows owned by the provided owner. */
+    /**
+     * Returns predicate for where clause that matches only rows owned by the provided owner.
+     * Owner row is immediate owner, so if the containers are nested, it is the owning container,
+     * not the top-level owning object.
+     */
     BooleanExpression isOwnedBy(OR ownerRow);
 }
diff --git a/repo/repo-sqale/src/main/java/com/evolveum/midpoint/repo/sqale/qmodel/accesscert/QAccessCertificationCaseMapping.java b/repo/repo-sqale/src/main/java/com/evolveum/midpoint/repo/sqale/qmodel/accesscert/QAccessCertificationCaseMapping.java
index 570db0d244a..556d2081d49 100644
--- a/repo/repo-sqale/src/main/java/com/evolveum/midpoint/repo/sqale/qmodel/accesscert/QAccessCertificationCaseMapping.java
+++ b/repo/repo-sqale/src/main/java/com/evolveum/midpoint/repo/sqale/qmodel/accesscert/QAccessCertificationCaseMapping.java
@@ -9,12 +9,7 @@
 import static com.evolveum.midpoint.xml.ns._public.common.common_3.AccessCertificationCaseType.*;
 import static com.evolveum.midpoint.xml.ns._public.common.common_3.FocusType.F_ACTIVATION;
 
-import java.util.Collection;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.UUID;
+import java.util.*;
 
 import com.querydsl.core.Tuple;
 import com.querydsl.core.types.Path;
@@ -129,6 +124,10 @@ private QAccessCertificationCaseMapping(@NotNull SqaleRepoContext repositoryCont
                 q -> q.tenantRefTargetType,
                 q -> q.tenantRefRelationId,
                 QOrgMapping::getOrgMapping);
+
+        addContainerTableMapping(F_WORK_ITEM,
+                QAccessCertificationWorkItemMapping.init(repositoryContext),
+                joinOn((c, wi) -> c.ownerOid.eq(wi.ownerOid)));
     }
 
     @Override
@@ -214,7 +213,7 @@ public MAccessCertificationCase insert(AccessCertificationCaseType acase,
 
         insert(row, jdbcSession);
 
-        storeWorkItems(ownerRow, row, acase, jdbcSession);
+        storeWorkItems(row, acase, jdbcSession);
 
         return row;
     }
@@ -224,7 +223,6 @@ public void afterModify(
             SqaleUpdateContext<AccessCertificationCaseType, QAccessCertificationCase, MAccessCertificationCase> updateContext)
             throws SchemaException {
 
-        @SuppressWarnings({ "unchecked", "rawtypes" })
         PrismContainer<AccessCertificationCaseType> caseContainer =
                 updateContext.findValueOrItem(AccessCertificationCampaignType.F_CASE);
         // row in context already knows its CID
@@ -235,7 +233,6 @@ public void afterModify(
     }
 
     public void storeWorkItems(
-            @NotNull MAccessCertificationCampaign campaignRow,
             @NotNull MAccessCertificationCase caseRow,
             @NotNull AccessCertificationCaseType schemaObject,
             @NotNull JdbcSession jdbcSession) throws SchemaException {
@@ -243,7 +240,7 @@ public void storeWorkItems(
         List<AccessCertificationWorkItemType> wis = schemaObject.getWorkItem();
         if (!wis.isEmpty()) {
             for (AccessCertificationWorkItemType wi : wis) {
-                QAccessCertificationWorkItemMapping.get().insert(wi, campaignRow, caseRow, jdbcSession);
+                QAccessCertificationWorkItemMapping.get().insert(wi, caseRow, jdbcSession);
             }
         }
     }
@@ -262,12 +259,13 @@ public ResultListRowTransformer<AccessCertificationCaseType, QAccessCertificatio
                 cache.put(ownerOid, owner);
             }
             try {
-                // Container could be null (since it is skipItem in campain)
+                // Container could be null (since it is skipItem in campaign)
                 PrismContainer<AccessCertificationCaseType> container = owner.findOrCreateContainer(AccessCertificationCampaignType.F_CASE);
                 PrismContainerValue<AccessCertificationCaseType> value = container.findValue(cid);
                 if (value == null) {
                     // value is not present, load it from full object
                     AccessCertificationCaseType valueObj = toSchemaObject(tuple, entityPath, options);
+                    //noinspection unchecked
                     value = valueObj.asPrismContainerValue();
                     container.add(value);
                 }
diff --git a/repo/repo-sqale/src/main/java/com/evolveum/midpoint/repo/sqale/qmodel/accesscert/QAccessCertificationWorkItem.java b/repo/repo-sqale/src/main/java/com/evolveum/midpoint/repo/sqale/qmodel/accesscert/QAccessCertificationWorkItem.java
index 925f78ef03e..7c6ac6deec8 100644
--- a/repo/repo-sqale/src/main/java/com/evolveum/midpoint/repo/sqale/qmodel/accesscert/QAccessCertificationWorkItem.java
+++ b/repo/repo-sqale/src/main/java/com/evolveum/midpoint/repo/sqale/qmodel/accesscert/QAccessCertificationWorkItem.java
@@ -20,7 +20,7 @@
  * Querydsl query type for {@value #TABLE_NAME} table.
  */
 @SuppressWarnings("unused")
-public class QAccessCertificationWorkItem extends QContainer<MAccessCertificationWorkItem, MAccessCertificationCampaign> {
+public class QAccessCertificationWorkItem extends QContainer<MAccessCertificationWorkItem, MAccessCertificationCase> {
 
     private static final long serialVersionUID = -672265595179912120L;
 
@@ -76,7 +76,8 @@ public QAccessCertificationWorkItem(String variable, String schema, String table
     }
 
     @Override
-    public BooleanExpression isOwnedBy(MAccessCertificationCampaign ownerRow) {
-        return ownerOid.eq(ownerRow.oid);
+    public BooleanExpression isOwnedBy(MAccessCertificationCase caseRow) {
+        return ownerOid.eq(caseRow.ownerOid)
+                .and(accessCertCaseCid.eq(caseRow.cid));
     }
 }
diff --git a/repo/repo-sqale/src/main/java/com/evolveum/midpoint/repo/sqale/qmodel/accesscert/QAccessCertificationWorkItemMapping.java b/repo/repo-sqale/src/main/java/com/evolveum/midpoint/repo/sqale/qmodel/accesscert/QAccessCertificationWorkItemMapping.java
index c5d837ec4fc..1c0d43b659a 100644
--- a/repo/repo-sqale/src/main/java/com/evolveum/midpoint/repo/sqale/qmodel/accesscert/QAccessCertificationWorkItemMapping.java
+++ b/repo/repo-sqale/src/main/java/com/evolveum/midpoint/repo/sqale/qmodel/accesscert/QAccessCertificationWorkItemMapping.java
@@ -40,7 +40,7 @@
  * Mapping between {@link QAccessCertificationWorkItem} and {@link AccessCertificationWorkItemType}.
  */
 public class QAccessCertificationWorkItemMapping
-        extends QContainerMapping<AccessCertificationWorkItemType, QAccessCertificationWorkItem, MAccessCertificationWorkItem, MAccessCertificationCampaign> {
+        extends QContainerMapping<AccessCertificationWorkItemType, QAccessCertificationWorkItem, MAccessCertificationWorkItem, MAccessCertificationCase> {
 
     public static final String DEFAULT_ALIAS_NAME = "acwi";
 
@@ -121,9 +121,10 @@ public MAccessCertificationWorkItem newRowObject() {
     }
 
     @Override
-    public MAccessCertificationWorkItem newRowObject(MAccessCertificationCampaign ownerRow) {
+    public MAccessCertificationWorkItem newRowObject(MAccessCertificationCase ownerRow) {
         MAccessCertificationWorkItem row = newRowObject();
-        row.ownerOid = ownerRow.oid;
+        row.ownerOid = ownerRow.ownerOid;
+        row.accessCertCaseCid = ownerRow.cid;
         return row;
     }
 
@@ -131,11 +132,9 @@ public MAccessCertificationWorkItem newRowObject(MAccessCertificationCampaign ow
     @SuppressWarnings("DuplicatedCode")
     public MAccessCertificationWorkItem insert(
             AccessCertificationWorkItemType workItem,
-            MAccessCertificationCampaign campaignRow,
             MAccessCertificationCase caseRow,
             JdbcSession jdbcSession) {
-        MAccessCertificationWorkItem row = initRowObject(workItem, campaignRow);
-        row.accessCertCaseCid = caseRow.cid;
+        MAccessCertificationWorkItem row = initRowObject(workItem, caseRow);
 
         row.closeTimestamp = MiscUtil.asInstant(workItem.getCloseTimestamp());
         // TODO: iteration -> campaignIteration
@@ -182,19 +181,19 @@ public ResultListRowTransformer<AccessCertificationWorkItemType, QAccessCertific
             }
             PrismContainer<AccessCertificationCaseType> caseContainer = owner.findContainer(AccessCertificationCampaignType.F_CASE);
             if (caseContainer == null) {
-                throw new SystemException("Campaing" + owner + " has no cases even if it should have " + tuple);
+                throw new SystemException("Campaign" + owner + " has no cases even if it should have " + tuple);
             }
-            PrismContainerValue<AccessCertificationCaseType> aCase = caseContainer .findValue(row.accessCertCaseCid);
+            PrismContainerValue<AccessCertificationCaseType> aCase = caseContainer.findValue(row.accessCertCaseCid);
             if (aCase == null) {
-                throw new SystemException("Campaing " + owner + " has no cases with ID " + row.accessCertCaseCid);
+                throw new SystemException("Campaign " + owner + " has no cases with ID " + row.accessCertCaseCid);
             }
             PrismContainer<AccessCertificationWorkItemType> container = aCase.findContainer(AccessCertificationCaseType.F_WORK_ITEM);
             if (container == null) {
-                throw new SystemException("Campaing " + owner + "has no work item for case with ID " + row.accessCertCaseCid);
+                throw new SystemException("Campaign " + owner + "has no work item for case with ID " + row.accessCertCaseCid);
             }
             PrismContainerValue<AccessCertificationWorkItemType> value = container.findValue(row.cid);
             if (value == null) {
-                throw new SystemException("Campaing " + owner + "has no work item with ID " + row.cid);
+                throw new SystemException("Campaign " + owner + "has no work item with ID " + row.cid);
             }
             return value.asContainerable();
         };
diff --git a/repo/repo-sqale/src/main/java/com/evolveum/midpoint/repo/sqale/qmodel/common/QContainer.java b/repo/repo-sqale/src/main/java/com/evolveum/midpoint/repo/sqale/qmodel/common/QContainer.java
index a9a6374f79f..704458b8ac8 100644
--- a/repo/repo-sqale/src/main/java/com/evolveum/midpoint/repo/sqale/qmodel/common/QContainer.java
+++ b/repo/repo-sqale/src/main/java/com/evolveum/midpoint/repo/sqale/qmodel/common/QContainer.java
@@ -22,6 +22,9 @@
 
 /**
  * Querydsl query type for {@value #TABLE_NAME} table.
+ *
+ * @param <R> type of this container row
+ * @param <OR> type of the owner row
  */
 @SuppressWarnings("unused")
 public class QContainer<R extends MContainer, OR> extends FlexibleRelationalPathBase<R>