diff --git a/rbac/rbac.go b/rbac/rbac.go
index 9a64b18f..e763246f 100644
--- a/rbac/rbac.go
+++ b/rbac/rbac.go
@@ -264,18 +264,25 @@ func (e *Enforcer) GetSpindleUsersByRole(role, domain string) ([]string, error)
 }
 
 func (e *Enforcer) GetUserByRoleInRepo(role, domain, repo string) ([]string, error) {
-	var users []string
-
 	policies, err := e.E.GetImplicitUsersForResourceByDomain(repo, domain)
+	if err != nil {
+		return nil, err
+	}
+
+	var users []string
 	for _, p := range policies {
 		user := p[0]
-		if strings.HasPrefix(user, "did:") {
+		if !strings.HasPrefix(user, "did:") {
+			continue
+		}
+		ok, err := e.E.Enforce(user, domain, repo, role)
+		if err != nil {
+			return nil, err
+		}
+		if ok {
 			users = append(users, user)
 		}
 	}
-	if err != nil {
-		return nil, err
-	}
 
 	slices.Sort(users)
 	return slices.Compact(users), nil
diff --git a/rbac/rbac_test.go b/rbac/rbac_test.go
index 7bc2c0fb..ea0bd82d 100644
--- a/rbac/rbac_test.go
+++ b/rbac/rbac_test.go
@@ -172,10 +172,10 @@ func TestGetByRole(t *testing.T) {
 	collaborators, err := e.GetUserByRoleInRepo("repo:collaborator", knot, repo)
 	assert.NoError(t, err)
 	assert.ElementsMatch(t, []string{
-		"did:plc:foo", // owner
 		"did:plc:bar", // collaborator1
 		"did:plc:baz", // collaborator2
 	}, collaborators)
+	assert.NotContains(t, collaborators, owner, "owner does not hold repo:collaborator and must not be listed")
 }
 
 func TestGetPermissionsInRepo(t *testing.T) {
@@ -475,3 +475,25 @@ func TestRemoveSpindle(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Empty(t, spindles)
 }
+
+func TestWipeRepoPoliciesRemovesCollaborators(t *testing.T) {
+	e := setup(t)
+
+	knot := "example.com"
+	repo := "did:plc:akshay/my-repo"
+	owner := "did:plc:akshay"
+	collaborator := "did:plc:boltless"
+
+	_ = e.AddKnot(knot)
+	_ = e.AddRepo(owner, knot, repo)
+	err := e.AddCollaborator(collaborator, knot, repo)
+	assert.NoError(t, err)
+
+	err = e.WipeRepoPolicies(knot, repo)
+	assert.NoError(t, err)
+
+	assert.ElementsMatch(t, []string{}, e.GetPermissionsInRepo(collaborator, knot, repo),
+		"collaborator policies must be wiped on repo teardown")
+	assert.ElementsMatch(t, []string{}, e.GetPermissionsInRepo(owner, knot, repo),
+		"owner policies must be wiped on repo teardown")
+}