diff --git a/docs/grpc/index.html b/docs/grpc/index.html
index c3c252a786..e22a412c00 100644
--- a/docs/grpc/index.html
+++ b/docs/grpc/index.html
@@ -241,6 +241,14 @@ <h2>Table of Contents</h2>
                   <a href="#policy.ConditionGroup"><span class="badge">M</span>ConditionGroup</a>
                 </li>
               
+                <li>
+                  <a href="#policy.DynamicValueMapping"><span class="badge">M</span>DynamicValueMapping</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.DynamicValueResolver"><span class="badge">M</span>DynamicValueResolver</a>
+                </li>
+              
                 <li>
                   <a href="#policy.KasKey"><span class="badge">M</span>KasKey</a>
                 </li>
@@ -370,6 +378,14 @@ <h2>Table of Contents</h2>
                   <a href="#policy.ConditionBooleanTypeEnum"><span class="badge">E</span>ConditionBooleanTypeEnum</a>
                 </li>
               
+                <li>
+                  <a href="#policy.ConditionComparisonOperatorEnum"><span class="badge">E</span>ConditionComparisonOperatorEnum</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.ConditionQuantifierEnum"><span class="badge">E</span>ConditionQuantifierEnum</a>
+                </li>
+              
                 <li>
                   <a href="#policy.KasPublicKeyAlgEnum"><span class="badge">E</span>KasPublicKeyAlgEnum</a>
                 </li>
@@ -1071,6 +1087,200 @@ <h2>Table of Contents</h2>
           </li>
         
           
+          <li>
+            <a href="#policy%2fsubjectmapping%2fsubject_mapping.proto">policy/subjectmapping/subject_mapping.proto</a>
+            <ul>
+              
+                <li>
+                  <a href="#policy.subjectmapping.CreateSubjectConditionSetRequest"><span class="badge">M</span>CreateSubjectConditionSetRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.subjectmapping.CreateSubjectConditionSetResponse"><span class="badge">M</span>CreateSubjectConditionSetResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.subjectmapping.CreateSubjectMappingRequest"><span class="badge">M</span>CreateSubjectMappingRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.subjectmapping.CreateSubjectMappingResponse"><span class="badge">M</span>CreateSubjectMappingResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.subjectmapping.DeleteAllUnmappedSubjectConditionSetsRequest"><span class="badge">M</span>DeleteAllUnmappedSubjectConditionSetsRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.subjectmapping.DeleteAllUnmappedSubjectConditionSetsResponse"><span class="badge">M</span>DeleteAllUnmappedSubjectConditionSetsResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.subjectmapping.DeleteSubjectConditionSetRequest"><span class="badge">M</span>DeleteSubjectConditionSetRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.subjectmapping.DeleteSubjectConditionSetResponse"><span class="badge">M</span>DeleteSubjectConditionSetResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.subjectmapping.DeleteSubjectMappingRequest"><span class="badge">M</span>DeleteSubjectMappingRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.subjectmapping.DeleteSubjectMappingResponse"><span class="badge">M</span>DeleteSubjectMappingResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.subjectmapping.GetSubjectConditionSetRequest"><span class="badge">M</span>GetSubjectConditionSetRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.subjectmapping.GetSubjectConditionSetResponse"><span class="badge">M</span>GetSubjectConditionSetResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.subjectmapping.GetSubjectMappingRequest"><span class="badge">M</span>GetSubjectMappingRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.subjectmapping.GetSubjectMappingResponse"><span class="badge">M</span>GetSubjectMappingResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.subjectmapping.ListSubjectConditionSetsRequest"><span class="badge">M</span>ListSubjectConditionSetsRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.subjectmapping.ListSubjectConditionSetsResponse"><span class="badge">M</span>ListSubjectConditionSetsResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.subjectmapping.ListSubjectMappingsRequest"><span class="badge">M</span>ListSubjectMappingsRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.subjectmapping.ListSubjectMappingsResponse"><span class="badge">M</span>ListSubjectMappingsResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.subjectmapping.MatchSubjectMappingsRequest"><span class="badge">M</span>MatchSubjectMappingsRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.subjectmapping.MatchSubjectMappingsResponse"><span class="badge">M</span>MatchSubjectMappingsResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.subjectmapping.SubjectConditionSetCreate"><span class="badge">M</span>SubjectConditionSetCreate</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.subjectmapping.SubjectConditionSetsSort"><span class="badge">M</span>SubjectConditionSetsSort</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.subjectmapping.SubjectMappingsSort"><span class="badge">M</span>SubjectMappingsSort</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.subjectmapping.UpdateSubjectConditionSetRequest"><span class="badge">M</span>UpdateSubjectConditionSetRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.subjectmapping.UpdateSubjectConditionSetResponse"><span class="badge">M</span>UpdateSubjectConditionSetResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.subjectmapping.UpdateSubjectMappingRequest"><span class="badge">M</span>UpdateSubjectMappingRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.subjectmapping.UpdateSubjectMappingResponse"><span class="badge">M</span>UpdateSubjectMappingResponse</a>
+                </li>
+              
+              
+                <li>
+                  <a href="#policy.subjectmapping.SortSubjectConditionSetsType"><span class="badge">E</span>SortSubjectConditionSetsType</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.subjectmapping.SortSubjectMappingsType"><span class="badge">E</span>SortSubjectMappingsType</a>
+                </li>
+              
+              
+              
+                <li>
+                  <a href="#policy.subjectmapping.SubjectMappingService"><span class="badge">S</span>SubjectMappingService</a>
+                </li>
+              
+            </ul>
+          </li>
+        
+          
+          <li>
+            <a href="#policy%2fdynamicvaluemapping%2fdynamic_value_mapping.proto">policy/dynamicvaluemapping/dynamic_value_mapping.proto</a>
+            <ul>
+              
+                <li>
+                  <a href="#policy.dynamicvaluemapping.CreateDynamicValueMappingRequest"><span class="badge">M</span>CreateDynamicValueMappingRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.dynamicvaluemapping.CreateDynamicValueMappingResponse"><span class="badge">M</span>CreateDynamicValueMappingResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.dynamicvaluemapping.DeleteDynamicValueMappingRequest"><span class="badge">M</span>DeleteDynamicValueMappingRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.dynamicvaluemapping.DeleteDynamicValueMappingResponse"><span class="badge">M</span>DeleteDynamicValueMappingResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.dynamicvaluemapping.DynamicValueMappingsSort"><span class="badge">M</span>DynamicValueMappingsSort</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.dynamicvaluemapping.GetDynamicValueMappingRequest"><span class="badge">M</span>GetDynamicValueMappingRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.dynamicvaluemapping.GetDynamicValueMappingResponse"><span class="badge">M</span>GetDynamicValueMappingResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.dynamicvaluemapping.ListDynamicValueMappingsRequest"><span class="badge">M</span>ListDynamicValueMappingsRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.dynamicvaluemapping.ListDynamicValueMappingsResponse"><span class="badge">M</span>ListDynamicValueMappingsResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.dynamicvaluemapping.UpdateDynamicValueMappingRequest"><span class="badge">M</span>UpdateDynamicValueMappingRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.dynamicvaluemapping.UpdateDynamicValueMappingResponse"><span class="badge">M</span>UpdateDynamicValueMappingResponse</a>
+                </li>
+              
+              
+                <li>
+                  <a href="#policy.dynamicvaluemapping.SortDynamicValueMappingsType"><span class="badge">E</span>SortDynamicValueMappingsType</a>
+                </li>
+              
+              
+              
+                <li>
+                  <a href="#policy.dynamicvaluemapping.DynamicValueMappingService"><span class="badge">S</span>DynamicValueMappingService</a>
+                </li>
+              
+            </ul>
+          </li>
+        
+          
           <li>
             <a href="#policy%2fkasregistry%2fkey_access_server_registry.proto">policy/kasregistry/key_access_server_registry.proto</a>
             <ul>
@@ -1858,249 +2068,118 @@ <h2>Table of Contents</h2>
         
           
           <li>
-            <a href="#policy%2fsubjectmapping%2fsubject_mapping.proto">policy/subjectmapping/subject_mapping.proto</a>
+            <a href="#policy%2funsafe%2funsafe.proto">policy/unsafe/unsafe.proto</a>
             <ul>
               
                 <li>
-                  <a href="#policy.subjectmapping.CreateSubjectConditionSetRequest"><span class="badge">M</span>CreateSubjectConditionSetRequest</a>
+                  <a href="#policy.unsafe.UnsafeDeleteAttributeRequest"><span class="badge">M</span>UnsafeDeleteAttributeRequest</a>
                 </li>
               
                 <li>
-                  <a href="#policy.subjectmapping.CreateSubjectConditionSetResponse"><span class="badge">M</span>CreateSubjectConditionSetResponse</a>
+                  <a href="#policy.unsafe.UnsafeDeleteAttributeResponse"><span class="badge">M</span>UnsafeDeleteAttributeResponse</a>
                 </li>
               
                 <li>
-                  <a href="#policy.subjectmapping.CreateSubjectMappingRequest"><span class="badge">M</span>CreateSubjectMappingRequest</a>
+                  <a href="#policy.unsafe.UnsafeDeleteAttributeValueRequest"><span class="badge">M</span>UnsafeDeleteAttributeValueRequest</a>
                 </li>
               
                 <li>
-                  <a href="#policy.subjectmapping.CreateSubjectMappingResponse"><span class="badge">M</span>CreateSubjectMappingResponse</a>
+                  <a href="#policy.unsafe.UnsafeDeleteAttributeValueResponse"><span class="badge">M</span>UnsafeDeleteAttributeValueResponse</a>
                 </li>
               
                 <li>
-                  <a href="#policy.subjectmapping.DeleteAllUnmappedSubjectConditionSetsRequest"><span class="badge">M</span>DeleteAllUnmappedSubjectConditionSetsRequest</a>
+                  <a href="#policy.unsafe.UnsafeDeleteKasKeyRequest"><span class="badge">M</span>UnsafeDeleteKasKeyRequest</a>
                 </li>
               
                 <li>
-                  <a href="#policy.subjectmapping.DeleteAllUnmappedSubjectConditionSetsResponse"><span class="badge">M</span>DeleteAllUnmappedSubjectConditionSetsResponse</a>
+                  <a href="#policy.unsafe.UnsafeDeleteKasKeyResponse"><span class="badge">M</span>UnsafeDeleteKasKeyResponse</a>
                 </li>
               
                 <li>
-                  <a href="#policy.subjectmapping.DeleteSubjectConditionSetRequest"><span class="badge">M</span>DeleteSubjectConditionSetRequest</a>
+                  <a href="#policy.unsafe.UnsafeDeleteNamespaceRequest"><span class="badge">M</span>UnsafeDeleteNamespaceRequest</a>
                 </li>
               
                 <li>
-                  <a href="#policy.subjectmapping.DeleteSubjectConditionSetResponse"><span class="badge">M</span>DeleteSubjectConditionSetResponse</a>
+                  <a href="#policy.unsafe.UnsafeDeleteNamespaceResponse"><span class="badge">M</span>UnsafeDeleteNamespaceResponse</a>
                 </li>
               
                 <li>
-                  <a href="#policy.subjectmapping.DeleteSubjectMappingRequest"><span class="badge">M</span>DeleteSubjectMappingRequest</a>
+                  <a href="#policy.unsafe.UnsafeReactivateAttributeRequest"><span class="badge">M</span>UnsafeReactivateAttributeRequest</a>
                 </li>
               
                 <li>
-                  <a href="#policy.subjectmapping.DeleteSubjectMappingResponse"><span class="badge">M</span>DeleteSubjectMappingResponse</a>
+                  <a href="#policy.unsafe.UnsafeReactivateAttributeResponse"><span class="badge">M</span>UnsafeReactivateAttributeResponse</a>
                 </li>
               
                 <li>
-                  <a href="#policy.subjectmapping.GetSubjectConditionSetRequest"><span class="badge">M</span>GetSubjectConditionSetRequest</a>
+                  <a href="#policy.unsafe.UnsafeReactivateAttributeValueRequest"><span class="badge">M</span>UnsafeReactivateAttributeValueRequest</a>
                 </li>
               
                 <li>
-                  <a href="#policy.subjectmapping.GetSubjectConditionSetResponse"><span class="badge">M</span>GetSubjectConditionSetResponse</a>
+                  <a href="#policy.unsafe.UnsafeReactivateAttributeValueResponse"><span class="badge">M</span>UnsafeReactivateAttributeValueResponse</a>
                 </li>
               
                 <li>
-                  <a href="#policy.subjectmapping.GetSubjectMappingRequest"><span class="badge">M</span>GetSubjectMappingRequest</a>
+                  <a href="#policy.unsafe.UnsafeReactivateNamespaceRequest"><span class="badge">M</span>UnsafeReactivateNamespaceRequest</a>
                 </li>
               
                 <li>
-                  <a href="#policy.subjectmapping.GetSubjectMappingResponse"><span class="badge">M</span>GetSubjectMappingResponse</a>
+                  <a href="#policy.unsafe.UnsafeReactivateNamespaceResponse"><span class="badge">M</span>UnsafeReactivateNamespaceResponse</a>
                 </li>
               
                 <li>
-                  <a href="#policy.subjectmapping.ListSubjectConditionSetsRequest"><span class="badge">M</span>ListSubjectConditionSetsRequest</a>
+                  <a href="#policy.unsafe.UnsafeUpdateAttributeRequest"><span class="badge">M</span>UnsafeUpdateAttributeRequest</a>
                 </li>
               
                 <li>
-                  <a href="#policy.subjectmapping.ListSubjectConditionSetsResponse"><span class="badge">M</span>ListSubjectConditionSetsResponse</a>
+                  <a href="#policy.unsafe.UnsafeUpdateAttributeResponse"><span class="badge">M</span>UnsafeUpdateAttributeResponse</a>
                 </li>
               
                 <li>
-                  <a href="#policy.subjectmapping.ListSubjectMappingsRequest"><span class="badge">M</span>ListSubjectMappingsRequest</a>
+                  <a href="#policy.unsafe.UnsafeUpdateAttributeValueRequest"><span class="badge">M</span>UnsafeUpdateAttributeValueRequest</a>
                 </li>
               
                 <li>
-                  <a href="#policy.subjectmapping.ListSubjectMappingsResponse"><span class="badge">M</span>ListSubjectMappingsResponse</a>
+                  <a href="#policy.unsafe.UnsafeUpdateAttributeValueResponse"><span class="badge">M</span>UnsafeUpdateAttributeValueResponse</a>
                 </li>
               
                 <li>
-                  <a href="#policy.subjectmapping.MatchSubjectMappingsRequest"><span class="badge">M</span>MatchSubjectMappingsRequest</a>
+                  <a href="#policy.unsafe.UnsafeUpdateNamespaceRequest"><span class="badge">M</span>UnsafeUpdateNamespaceRequest</a>
                 </li>
               
                 <li>
-                  <a href="#policy.subjectmapping.MatchSubjectMappingsResponse"><span class="badge">M</span>MatchSubjectMappingsResponse</a>
+                  <a href="#policy.unsafe.UnsafeUpdateNamespaceResponse"><span class="badge">M</span>UnsafeUpdateNamespaceResponse</a>
                 </li>
               
+              
+              
+              
                 <li>
-                  <a href="#policy.subjectmapping.SubjectConditionSetCreate"><span class="badge">M</span>SubjectConditionSetCreate</a>
+                  <a href="#policy.unsafe.UnsafeService"><span class="badge">S</span>UnsafeService</a>
                 </li>
               
+            </ul>
+          </li>
+        
+          
+          <li>
+            <a href="#wellknownconfiguration%2fwellknown_configuration.proto">wellknownconfiguration/wellknown_configuration.proto</a>
+            <ul>
+              
                 <li>
-                  <a href="#policy.subjectmapping.SubjectConditionSetsSort"><span class="badge">M</span>SubjectConditionSetsSort</a>
+                  <a href="#wellknownconfiguration.GetWellKnownConfigurationRequest"><span class="badge">M</span>GetWellKnownConfigurationRequest</a>
                 </li>
               
                 <li>
-                  <a href="#policy.subjectmapping.SubjectMappingsSort"><span class="badge">M</span>SubjectMappingsSort</a>
+                  <a href="#wellknownconfiguration.GetWellKnownConfigurationResponse"><span class="badge">M</span>GetWellKnownConfigurationResponse</a>
                 </li>
               
                 <li>
-                  <a href="#policy.subjectmapping.UpdateSubjectConditionSetRequest"><span class="badge">M</span>UpdateSubjectConditionSetRequest</a>
+                  <a href="#wellknownconfiguration.WellKnownConfig"><span class="badge">M</span>WellKnownConfig</a>
                 </li>
               
                 <li>
-                  <a href="#policy.subjectmapping.UpdateSubjectConditionSetResponse"><span class="badge">M</span>UpdateSubjectConditionSetResponse</a>
-                </li>
-              
-                <li>
-                  <a href="#policy.subjectmapping.UpdateSubjectMappingRequest"><span class="badge">M</span>UpdateSubjectMappingRequest</a>
-                </li>
-              
-                <li>
-                  <a href="#policy.subjectmapping.UpdateSubjectMappingResponse"><span class="badge">M</span>UpdateSubjectMappingResponse</a>
-                </li>
-              
-              
-                <li>
-                  <a href="#policy.subjectmapping.SortSubjectConditionSetsType"><span class="badge">E</span>SortSubjectConditionSetsType</a>
-                </li>
-              
-                <li>
-                  <a href="#policy.subjectmapping.SortSubjectMappingsType"><span class="badge">E</span>SortSubjectMappingsType</a>
-                </li>
-              
-              
-              
-                <li>
-                  <a href="#policy.subjectmapping.SubjectMappingService"><span class="badge">S</span>SubjectMappingService</a>
-                </li>
-              
-            </ul>
-          </li>
-        
-          
-          <li>
-            <a href="#policy%2funsafe%2funsafe.proto">policy/unsafe/unsafe.proto</a>
-            <ul>
-              
-                <li>
-                  <a href="#policy.unsafe.UnsafeDeleteAttributeRequest"><span class="badge">M</span>UnsafeDeleteAttributeRequest</a>
-                </li>
-              
-                <li>
-                  <a href="#policy.unsafe.UnsafeDeleteAttributeResponse"><span class="badge">M</span>UnsafeDeleteAttributeResponse</a>
-                </li>
-              
-                <li>
-                  <a href="#policy.unsafe.UnsafeDeleteAttributeValueRequest"><span class="badge">M</span>UnsafeDeleteAttributeValueRequest</a>
-                </li>
-              
-                <li>
-                  <a href="#policy.unsafe.UnsafeDeleteAttributeValueResponse"><span class="badge">M</span>UnsafeDeleteAttributeValueResponse</a>
-                </li>
-              
-                <li>
-                  <a href="#policy.unsafe.UnsafeDeleteKasKeyRequest"><span class="badge">M</span>UnsafeDeleteKasKeyRequest</a>
-                </li>
-              
-                <li>
-                  <a href="#policy.unsafe.UnsafeDeleteKasKeyResponse"><span class="badge">M</span>UnsafeDeleteKasKeyResponse</a>
-                </li>
-              
-                <li>
-                  <a href="#policy.unsafe.UnsafeDeleteNamespaceRequest"><span class="badge">M</span>UnsafeDeleteNamespaceRequest</a>
-                </li>
-              
-                <li>
-                  <a href="#policy.unsafe.UnsafeDeleteNamespaceResponse"><span class="badge">M</span>UnsafeDeleteNamespaceResponse</a>
-                </li>
-              
-                <li>
-                  <a href="#policy.unsafe.UnsafeReactivateAttributeRequest"><span class="badge">M</span>UnsafeReactivateAttributeRequest</a>
-                </li>
-              
-                <li>
-                  <a href="#policy.unsafe.UnsafeReactivateAttributeResponse"><span class="badge">M</span>UnsafeReactivateAttributeResponse</a>
-                </li>
-              
-                <li>
-                  <a href="#policy.unsafe.UnsafeReactivateAttributeValueRequest"><span class="badge">M</span>UnsafeReactivateAttributeValueRequest</a>
-                </li>
-              
-                <li>
-                  <a href="#policy.unsafe.UnsafeReactivateAttributeValueResponse"><span class="badge">M</span>UnsafeReactivateAttributeValueResponse</a>
-                </li>
-              
-                <li>
-                  <a href="#policy.unsafe.UnsafeReactivateNamespaceRequest"><span class="badge">M</span>UnsafeReactivateNamespaceRequest</a>
-                </li>
-              
-                <li>
-                  <a href="#policy.unsafe.UnsafeReactivateNamespaceResponse"><span class="badge">M</span>UnsafeReactivateNamespaceResponse</a>
-                </li>
-              
-                <li>
-                  <a href="#policy.unsafe.UnsafeUpdateAttributeRequest"><span class="badge">M</span>UnsafeUpdateAttributeRequest</a>
-                </li>
-              
-                <li>
-                  <a href="#policy.unsafe.UnsafeUpdateAttributeResponse"><span class="badge">M</span>UnsafeUpdateAttributeResponse</a>
-                </li>
-              
-                <li>
-                  <a href="#policy.unsafe.UnsafeUpdateAttributeValueRequest"><span class="badge">M</span>UnsafeUpdateAttributeValueRequest</a>
-                </li>
-              
-                <li>
-                  <a href="#policy.unsafe.UnsafeUpdateAttributeValueResponse"><span class="badge">M</span>UnsafeUpdateAttributeValueResponse</a>
-                </li>
-              
-                <li>
-                  <a href="#policy.unsafe.UnsafeUpdateNamespaceRequest"><span class="badge">M</span>UnsafeUpdateNamespaceRequest</a>
-                </li>
-              
-                <li>
-                  <a href="#policy.unsafe.UnsafeUpdateNamespaceResponse"><span class="badge">M</span>UnsafeUpdateNamespaceResponse</a>
-                </li>
-              
-              
-              
-              
-                <li>
-                  <a href="#policy.unsafe.UnsafeService"><span class="badge">S</span>UnsafeService</a>
-                </li>
-              
-            </ul>
-          </li>
-        
-          
-          <li>
-            <a href="#wellknownconfiguration%2fwellknown_configuration.proto">wellknownconfiguration/wellknown_configuration.proto</a>
-            <ul>
-              
-                <li>
-                  <a href="#wellknownconfiguration.GetWellKnownConfigurationRequest"><span class="badge">M</span>GetWellKnownConfigurationRequest</a>
-                </li>
-              
-                <li>
-                  <a href="#wellknownconfiguration.GetWellKnownConfigurationResponse"><span class="badge">M</span>GetWellKnownConfigurationResponse</a>
-                </li>
-              
-                <li>
-                  <a href="#wellknownconfiguration.WellKnownConfig"><span class="badge">M</span>WellKnownConfig</a>
-                </li>
-              
-                <li>
-                  <a href="#wellknownconfiguration.WellKnownConfig.ConfigurationEntry"><span class="badge">M</span>WellKnownConfig.ConfigurationEntry</a>
+                  <a href="#wellknownconfiguration.WellKnownConfig.ConfigurationEntry"><span class="badge">M</span>WellKnownConfig.ConfigurationEntry</a>
                 </li>
               
               
@@ -2662,7 +2741,8 @@ <h3 id="policy.Condition">Condition</h3>
                   <td>operator</td>
                   <td><a href="#policy.SubjectMappingOperatorEnum">SubjectMappingOperatorEnum</a></td>
                   <td></td>
-                  <td><p>the evaluation operator of relation </p></td>
+                  <td><p><strong>Deprecated.</strong> Deprecated: use comparison &#43; quantifier (&#43; case_insensitive) instead. Normalized to the
+decomposed fields in the service layer for backward compatibility. </p></td>
                 </tr>
               
                 <tr>
@@ -2674,10 +2754,53 @@ <h3 id="policy.Condition">Condition</h3>
 (Subject), evaluated by the operator </p></td>
                 </tr>
               
+                <tr>
+                  <td>comparison</td>
+                  <td><a href="#policy.ConditionComparisonOperatorEnum">ConditionComparisonOperatorEnum</a></td>
+                  <td></td>
+                  <td><p>how each selector result is compared to subject_external_values entries </p></td>
+                </tr>
+              
+                <tr>
+                  <td>quantifier</td>
+                  <td><a href="#policy.ConditionQuantifierEnum">ConditionQuantifierEnum</a></td>
+                  <td></td>
+                  <td><p>how matches are aggregated across subject_external_values </p></td>
+                </tr>
+              
+                <tr>
+                  <td>case_insensitive</td>
+                  <td><a href="#google.protobuf.BoolValue">google.protobuf.BoolValue</a></td>
+                  <td></td>
+                  <td><p>when set true, comparison is case-insensitive; unset is treated as case-sensitive. Modeled as
+BoolValue so an explicit false is distinguishable from unset, leaving room to change the default. </p></td>
+                </tr>
+              
             </tbody>
           </table>
 
           
+            
+            
+            <h4>Fields with deprecated option</h4>
+            <table>
+              <thead>
+                <tr>
+                  <td>Name</td>
+                  <td>Option</td>
+                </tr>
+              </thead>
+              <tbody>
+              
+                <tr>
+                  <td>operator</td>
+                  <td><p>true</p></td>
+                </tr>
+              
+              </tbody>
+            </table>
+            
+          
 
         
       
@@ -2712,8 +2835,8 @@ <h3 id="policy.ConditionGroup">ConditionGroup</h3>
 
         
       
-        <h3 id="policy.KasKey">KasKey</h3>
-        <p></p>
+        <h3 id="policy.DynamicValueMapping">DynamicValueMapping</h3>
+        <p>Dynamic Value Mapping: a Policy assigning permitted action(s) to</p><p>dynamically-requested values under an Attribute Definition. It raises entitlement</p><p>authority from a concrete Attribute Value to the Attribute Definition: at decision time</p><p>the value_resolver compares the requested resource value segment against the entity</p><p>representation, avoiding pre-provisioning a value + subject mapping per discrete value.</p>
 
         
           <table class="field-table">
@@ -2723,22 +2846,52 @@ <h3 id="policy.KasKey">KasKey</h3>
             <tbody>
               
                 <tr>
-                  <td>kas_id</td>
+                  <td>id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>key</td>
-                  <td><a href="#policy.AsymmetricKey">AsymmetricKey</a></td>
+                  <td>attribute_definition</td>
+                  <td><a href="#policy.Attribute">Attribute</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>the Attribute Definition whose values are entitled dynamically </p></td>
                 </tr>
               
                 <tr>
-                  <td>kas_uri</td>
-                  <td><a href="#string">string</a></td>
+                  <td>value_resolver</td>
+                  <td><a href="#policy.DynamicValueResolver">DynamicValueResolver</a></td>
+                  <td></td>
+                  <td><p>the dynamic resolver matched against the requested resource value segment </p></td>
+                </tr>
+              
+                <tr>
+                  <td>subject_condition_set</td>
+                  <td><a href="#policy.SubjectConditionSet">SubjectConditionSet</a></td>
+                  <td></td>
+                  <td><p>optional static pre-gate on the entity, evaluated with normal SubjectConditionSet
+semantics (no dynamic overload). When present, both the gate and the resolver must
+pass for entitlement. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>actions</td>
+                  <td><a href="#policy.Action">Action</a></td>
+                  <td>repeated</td>
+                  <td><p>the actions permitted by subjects in this mapping </p></td>
+                </tr>
+              
+                <tr>
+                  <td>namespace</td>
+                  <td><a href="#policy.Namespace">Namespace</a></td>
+                  <td></td>
+                  <td><p>the namespace containing this mapping </p></td>
+                </tr>
+              
+                <tr>
+                  <td>metadata</td>
+                  <td><a href="#common.Metadata">common.Metadata</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -2750,8 +2903,8 @@ <h3 id="policy.KasKey">KasKey</h3>
 
         
       
-        <h3 id="policy.KasPublicKey">KasPublicKey</h3>
-        <p>Deprecated</p><p>A KAS public key and some associated metadata for further identifcation</p>
+        <h3 id="policy.DynamicValueResolver">DynamicValueResolver</h3>
+        <p>Dynamic Value Resolver: the dynamic half of a DynamicValueMapping. It resolves a selector</p><p>against the entity representation, then tests whether any resolved entity value matches the</p><p>requested resource value segment under comparison. The match is inherently existential over</p><p>the resolved entity values, so no quantifier is carried here.</p>
 
         
           <table class="field-table">
@@ -2761,26 +2914,27 @@ <h3 id="policy.KasPublicKey">KasPublicKey</h3>
             <tbody>
               
                 <tr>
-                  <td>pem</td>
+                  <td>subject_external_selector_value</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>x509 ASN.1 content in PEM envelope, usually </p></td>
+                  <td><p>a selector for a field value on a flattened Entity Representation (such as from
+idP/LDAP), e.g. &#34;.patientAssignments[]&#34; </p></td>
                 </tr>
               
                 <tr>
-                  <td>kid</td>
-                  <td><a href="#string">string</a></td>
+                  <td>comparison</td>
+                  <td><a href="#policy.ConditionComparisonOperatorEnum">ConditionComparisonOperatorEnum</a></td>
                   <td></td>
-                  <td><p>A unique string identifier for this key </p></td>
+                  <td><p>how the requested resource value segment is compared against each value the selector
+resolves from the entity representation </p></td>
                 </tr>
               
                 <tr>
-                  <td>alg</td>
-                  <td><a href="#policy.KasPublicKeyAlgEnum">KasPublicKeyAlgEnum</a></td>
+                  <td>case_insensitive</td>
+                  <td><a href="#google.protobuf.BoolValue">google.protobuf.BoolValue</a></td>
                   <td></td>
-                  <td><p>A known algorithm type with any additional parameters encoded.
-To start, these may be `rsa:2048` for RSA-based wrapping and
-`ec:secp256r1` for EC-based wrapping, but more formats may be added as needed. </p></td>
+                  <td><p>when set true, comparison is case-insensitive; unset is treated as case-sensitive. Modeled as
+BoolValue so an explicit false is distinguishable from unset, leaving room to change the default. </p></td>
                 </tr>
               
             </tbody>
@@ -2790,8 +2944,8 @@ <h3 id="policy.KasPublicKey">KasPublicKey</h3>
 
         
       
-        <h3 id="policy.KasPublicKeySet">KasPublicKeySet</h3>
-        <p>Deprecated</p><p>A list of known KAS public keys</p>
+        <h3 id="policy.KasKey">KasKey</h3>
+        <p></p>
 
         
           <table class="field-table">
@@ -2801,9 +2955,23 @@ <h3 id="policy.KasPublicKeySet">KasPublicKeySet</h3>
             <tbody>
               
                 <tr>
-                  <td>keys</td>
-                  <td><a href="#policy.KasPublicKey">KasPublicKey</a></td>
-                  <td>repeated</td>
+                  <td>kas_id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>key</td>
+                  <td><a href="#policy.AsymmetricKey">AsymmetricKey</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>kas_uri</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
                   <td><p> </p></td>
                 </tr>
               
@@ -2814,8 +2982,8 @@ <h3 id="policy.KasPublicKeySet">KasPublicKeySet</h3>
 
         
       
-        <h3 id="policy.Key">Key</h3>
-        <p></p>
+        <h3 id="policy.KasPublicKey">KasPublicKey</h3>
+        <p>Deprecated</p><p>A KAS public key and some associated metadata for further identifcation</p>
 
         
           <table class="field-table">
@@ -2825,14 +2993,78 @@ <h3 id="policy.Key">Key</h3>
             <tbody>
               
                 <tr>
-                  <td>id</td>
+                  <td>pem</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>the database record ID, not the key ID (`kid`) </p></td>
+                  <td><p>x509 ASN.1 content in PEM envelope, usually </p></td>
                 </tr>
               
                 <tr>
-                  <td>is_active</td>
+                  <td>kid</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>A unique string identifier for this key </p></td>
+                </tr>
+              
+                <tr>
+                  <td>alg</td>
+                  <td><a href="#policy.KasPublicKeyAlgEnum">KasPublicKeyAlgEnum</a></td>
+                  <td></td>
+                  <td><p>A known algorithm type with any additional parameters encoded.
+To start, these may be `rsa:2048` for RSA-based wrapping and
+`ec:secp256r1` for EC-based wrapping, but more formats may be added as needed. </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.KasPublicKeySet">KasPublicKeySet</h3>
+        <p>Deprecated</p><p>A list of known KAS public keys</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>keys</td>
+                  <td><a href="#policy.KasPublicKey">KasPublicKey</a></td>
+                  <td>repeated</td>
+                  <td><p> </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.Key">Key</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>the database record ID, not the key ID (`kid`) </p></td>
+                </tr>
+              
+                <tr>
+                  <td>is_active</td>
                   <td><a href="#google.protobuf.BoolValue">google.protobuf.BoolValue</a></td>
                   <td></td>
                   <td><p> </p></td>
@@ -4214,6 +4446,82 @@ <h3 id="policy.ConditionBooleanTypeEnum">ConditionBooleanTypeEnum</h3>
           </tbody>
         </table>
       
+        <h3 id="policy.ConditionComparisonOperatorEnum">ConditionComparisonOperatorEnum</h3>
+        <p>How a selector result is compared against a comparison value. Replaces the all-in-one</p><p>SubjectMappingOperatorEnum by separating the comparison from the quantifier (see</p><p>ConditionQuantifierEnum) and case sensitivity.</p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>CONDITION_COMPARISON_OPERATOR_ENUM_UNSPECIFIED</td>
+                <td>0</td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>CONDITION_COMPARISON_OPERATOR_ENUM_EQUALS</td>
+                <td>1</td>
+                <td><p>exact string equality</p></td>
+              </tr>
+            
+              <tr>
+                <td>CONDITION_COMPARISON_OPERATOR_ENUM_CONTAINS</td>
+                <td>2</td>
+                <td><p>substring containment</p></td>
+              </tr>
+            
+              <tr>
+                <td>CONDITION_COMPARISON_OPERATOR_ENUM_STARTS_WITH</td>
+                <td>3</td>
+                <td><p>prefix match</p></td>
+              </tr>
+            
+              <tr>
+                <td>CONDITION_COMPARISON_OPERATOR_ENUM_ENDS_WITH</td>
+                <td>4</td>
+                <td><p>suffix match; the safe operator for domain matching (e.g. email domains)</p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+      
+        <h3 id="policy.ConditionQuantifierEnum">ConditionQuantifierEnum</h3>
+        <p>How matches are aggregated across the comparison set (subject_external_values).</p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>CONDITION_QUANTIFIER_ENUM_UNSPECIFIED</td>
+                <td>0</td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>CONDITION_QUANTIFIER_ENUM_ANY</td>
+                <td>1</td>
+                <td><p>at least one match (legacy IN behavior)</p></td>
+              </tr>
+            
+              <tr>
+                <td>CONDITION_QUANTIFIER_ENUM_ALL</td>
+                <td>2</td>
+                <td><p>every expected value matches</p></td>
+              </tr>
+            
+              <tr>
+                <td>CONDITION_QUANTIFIER_ENUM_NONE</td>
+                <td>3</td>
+                <td><p>no matches (legacy NOT_IN behavior)</p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+      
         <h3 id="policy.KasPublicKeyAlgEnum">KasPublicKeyAlgEnum</h3>
         <p></p>
         <table class="enum-table">
@@ -9589,12 +9897,12 @@ <h4>Methods with idempotency_level option</h4>
     
       
       <div class="file-heading">
-        <h2 id="policy/kasregistry/key_access_server_registry.proto">policy/kasregistry/key_access_server_registry.proto</h2><a href="#title">Top</a>
+        <h2 id="policy/subjectmapping/subject_mapping.proto">policy/subjectmapping/subject_mapping.proto</h2><a href="#title">Top</a>
       </div>
       <p></p>
 
       
-        <h3 id="policy.kasregistry.ActivatePublicKeyRequest">ActivatePublicKeyRequest</h3>
+        <h3 id="policy.subjectmapping.CreateSubjectConditionSetRequest">CreateSubjectConditionSetRequest</h3>
         <p></p>
 
         
@@ -9605,7 +9913,21 @@ <h3 id="policy.kasregistry.ActivatePublicKeyRequest">ActivatePublicKeyRequest</h
             <tbody>
               
                 <tr>
-                  <td>id</td>
+                  <td>subject_condition_set</td>
+                  <td><a href="#policy.subjectmapping.SubjectConditionSetCreate">SubjectConditionSetCreate</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>namespace_id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>namespace_fqn</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
                   <td><p> </p></td>
@@ -9618,7 +9940,7 @@ <h3 id="policy.kasregistry.ActivatePublicKeyRequest">ActivatePublicKeyRequest</h
 
         
       
-        <h3 id="policy.kasregistry.ActivatePublicKeyResponse">ActivatePublicKeyResponse</h3>
+        <h3 id="policy.subjectmapping.CreateSubjectConditionSetResponse">CreateSubjectConditionSetResponse</h3>
         <p></p>
 
         
@@ -9629,8 +9951,8 @@ <h3 id="policy.kasregistry.ActivatePublicKeyResponse">ActivatePublicKeyResponse<
             <tbody>
               
                 <tr>
-                  <td>key</td>
-                  <td><a href="#policy.Key">policy.Key</a></td>
+                  <td>subject_condition_set</td>
+                  <td><a href="#policy.SubjectConditionSet">policy.SubjectConditionSet</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -9642,8 +9964,8 @@ <h3 id="policy.kasregistry.ActivatePublicKeyResponse">ActivatePublicKeyResponse<
 
         
       
-        <h3 id="policy.kasregistry.ChangeMappings">ChangeMappings</h3>
-        <p>Simplified information about the resources that were rotated as part of the key rotation process.</p>
+        <h3 id="policy.subjectmapping.CreateSubjectMappingRequest">CreateSubjectMappingRequest</h3>
+        <p></p>
 
         
           <table class="field-table">
@@ -9653,69 +9975,56 @@ <h3 id="policy.kasregistry.ChangeMappings">ChangeMappings</h3>
             <tbody>
               
                 <tr>
-                  <td>id</td>
+                  <td>attribute_value_id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Required
+Attribute Value to be mapped to </p></td>
                 </tr>
               
                 <tr>
-                  <td>fqn</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p> </p></td>
+                  <td>actions</td>
+                  <td><a href="#policy.Action">policy.Action</a></td>
+                  <td>repeated</td>
+                  <td><p>Required
+The actions permitted by subjects in this mapping </p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="policy.kasregistry.CreateKeyAccessServerRequest">CreateKeyAccessServerRequest</h3>
-        <p></p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
                 <tr>
-                  <td>uri</td>
+                  <td>existing_subject_condition_set_id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Required </p></td>
+                  <td><p>Either of the following:
+Reuse existing SubjectConditionSet (NOTE: prioritized over new_subject_condition_set) </p></td>
                 </tr>
               
                 <tr>
-                  <td>public_key</td>
-                  <td><a href="#policy.PublicKey">policy.PublicKey</a></td>
+                  <td>new_subject_condition_set</td>
+                  <td><a href="#policy.subjectmapping.SubjectConditionSetCreate">SubjectConditionSetCreate</a></td>
                   <td></td>
-                  <td><p>Deprecated </p></td>
+                  <td><p>Create new SubjectConditionSet (NOTE: ignored if existing_subject_condition_set_id is provided) </p></td>
                 </tr>
               
                 <tr>
-                  <td>source_type</td>
-                  <td><a href="#policy.SourceType">policy.SourceType</a></td>
+                  <td>namespace_id</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Optional </p></td>
+                  <td><p>Optional
+Namespace ID or FQN for the subject mapping </p></td>
                 </tr>
               
                 <tr>
-                  <td>name</td>
+                  <td>namespace_fqn</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Optional </p></td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
                   <td>metadata</td>
                   <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
                   <td></td>
-                  <td><p>Common metadata </p></td>
+                  <td><p>Optional </p></td>
                 </tr>
               
             </tbody>
@@ -9725,7 +10034,7 @@ <h3 id="policy.kasregistry.CreateKeyAccessServerRequest">CreateKeyAccessServerRe
 
         
       
-        <h3 id="policy.kasregistry.CreateKeyAccessServerResponse">CreateKeyAccessServerResponse</h3>
+        <h3 id="policy.subjectmapping.CreateSubjectMappingResponse">CreateSubjectMappingResponse</h3>
         <p></p>
 
         
@@ -9736,8 +10045,8 @@ <h3 id="policy.kasregistry.CreateKeyAccessServerResponse">CreateKeyAccessServerR
             <tbody>
               
                 <tr>
-                  <td>key_access_server</td>
-                  <td><a href="#policy.KeyAccessServer">policy.KeyAccessServer</a></td>
+                  <td>subject_mapping</td>
+                  <td><a href="#policy.SubjectMapping">policy.SubjectMapping</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -9749,8 +10058,15 @@ <h3 id="policy.kasregistry.CreateKeyAccessServerResponse">CreateKeyAccessServerR
 
         
       
-        <h3 id="policy.kasregistry.CreateKeyRequest">CreateKeyRequest</h3>
-        <p>Create a new asymmetric key for the specified Key Access Server (KAS)</p>
+        <h3 id="policy.subjectmapping.DeleteAllUnmappedSubjectConditionSetsRequest">DeleteAllUnmappedSubjectConditionSetsRequest</h3>
+        <p>Prune any Subject Condition Sets not utilized within a Subject Mapping</p>
+
+        
+
+        
+      
+        <h3 id="policy.subjectmapping.DeleteAllUnmappedSubjectConditionSetsResponse">DeleteAllUnmappedSubjectConditionSetsResponse</h3>
+        <p></p>
 
         
           <table class="field-table">
@@ -9760,84 +10076,34 @@ <h3 id="policy.kasregistry.CreateKeyRequest">CreateKeyRequest</h3>
             <tbody>
               
                 <tr>
-                  <td>kas_id</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Required
-
-The unique identifier of the Key Access Server </p></td>
+                  <td>subject_condition_sets</td>
+                  <td><a href="#policy.SubjectConditionSet">policy.SubjectConditionSet</a></td>
+                  <td>repeated</td>
+                  <td><p>Only IDs of any deleted Subject Condition Set provided </p></td>
                 </tr>
               
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.subjectmapping.DeleteSubjectConditionSetRequest">DeleteSubjectConditionSetRequest</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
                 <tr>
-                  <td>key_id</td>
+                  <td>id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Required
-
-A user-defined identifier for the key </p></td>
-                </tr>
-              
-                <tr>
-                  <td>key_algorithm</td>
-                  <td><a href="#policy.Algorithm">policy.Algorithm</a></td>
-                  <td></td>
-                  <td><p>Required
-
-The algorithm to be used for the key </p></td>
-                </tr>
-              
-                <tr>
-                  <td>key_mode</td>
-                  <td><a href="#policy.KeyMode">policy.KeyMode</a></td>
-                  <td></td>
-                  <td><p>Required
-
-The mode of the key (e.g., local or external) </p></td>
-                </tr>
-              
-                <tr>
-                  <td>public_key_ctx</td>
-                  <td><a href="#policy.PublicKeyCtx">policy.PublicKeyCtx</a></td>
-                  <td></td>
-                  <td><p>Required
-
-Context or additional data specific to the public key, based on the key provider implementation </p></td>
-                </tr>
-              
-                <tr>
-                  <td>private_key_ctx</td>
-                  <td><a href="#policy.PrivateKeyCtx">policy.PrivateKeyCtx</a></td>
-                  <td></td>
-                  <td><p>Conditionally Required
-
-Context or additional data specific to the private key, based on the key provider implementation </p></td>
-                </tr>
-              
-                <tr>
-                  <td>provider_config_id</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Optional
-
-Configuration ID for the key provider, if applicable </p></td>
-                </tr>
-              
-                <tr>
-                  <td>legacy</td>
-                  <td><a href="#bool">bool</a></td>
-                  <td></td>
-                  <td><p>Optional
-
-Whether the key is a legacy key </p></td>
-                </tr>
-              
-                <tr>
-                  <td>metadata</td>
-                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
-                  <td></td>
-                  <td><p>Common metadata
-
-Mutable metadata for the key </p></td>
+                  <td><p>Required </p></td>
                 </tr>
               
             </tbody>
@@ -9847,8 +10113,8 @@ <h3 id="policy.kasregistry.CreateKeyRequest">CreateKeyRequest</h3>
 
         
       
-        <h3 id="policy.kasregistry.CreateKeyResponse">CreateKeyResponse</h3>
-        <p>Response to a CreateKeyRequest, containing the created asymmetric key</p>
+        <h3 id="policy.subjectmapping.DeleteSubjectConditionSetResponse">DeleteSubjectConditionSetResponse</h3>
+        <p></p>
 
         
           <table class="field-table">
@@ -9858,10 +10124,10 @@ <h3 id="policy.kasregistry.CreateKeyResponse">CreateKeyResponse</h3>
             <tbody>
               
                 <tr>
-                  <td>kas_key</td>
-                  <td><a href="#policy.KasKey">policy.KasKey</a></td>
+                  <td>subject_condition_set</td>
+                  <td><a href="#policy.SubjectConditionSet">policy.SubjectConditionSet</a></td>
                   <td></td>
-                  <td><p>The created asymmetric key for a KAS. </p></td>
+                  <td><p>Only ID of deleted Subject Condition Set provided </p></td>
                 </tr>
               
             </tbody>
@@ -9871,7 +10137,7 @@ <h3 id="policy.kasregistry.CreateKeyResponse">CreateKeyResponse</h3>
 
         
       
-        <h3 id="policy.kasregistry.CreatePublicKeyRequest">CreatePublicKeyRequest</h3>
+        <h3 id="policy.subjectmapping.DeleteSubjectMappingRequest">DeleteSubjectMappingRequest</h3>
         <p></p>
 
         
@@ -9882,26 +10148,12 @@ <h3 id="policy.kasregistry.CreatePublicKeyRequest">CreatePublicKeyRequest</h3>
             <tbody>
               
                 <tr>
-                  <td>kas_id</td>
+                  <td>id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
                   <td><p>Required </p></td>
                 </tr>
               
-                <tr>
-                  <td>key</td>
-                  <td><a href="#policy.KasPublicKey">policy.KasPublicKey</a></td>
-                  <td></td>
-                  <td><p>Required </p></td>
-                </tr>
-              
-                <tr>
-                  <td>metadata</td>
-                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
-                  <td></td>
-                  <td><p>Common metadata </p></td>
-                </tr>
-              
             </tbody>
           </table>
 
@@ -9909,7 +10161,7 @@ <h3 id="policy.kasregistry.CreatePublicKeyRequest">CreatePublicKeyRequest</h3>
 
         
       
-        <h3 id="policy.kasregistry.CreatePublicKeyResponse">CreatePublicKeyResponse</h3>
+        <h3 id="policy.subjectmapping.DeleteSubjectMappingResponse">DeleteSubjectMappingResponse</h3>
         <p></p>
 
         
@@ -9920,10 +10172,10 @@ <h3 id="policy.kasregistry.CreatePublicKeyResponse">CreatePublicKeyResponse</h3>
             <tbody>
               
                 <tr>
-                  <td>key</td>
-                  <td><a href="#policy.Key">policy.Key</a></td>
+                  <td>subject_mapping</td>
+                  <td><a href="#policy.SubjectMapping">policy.SubjectMapping</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Only ID of the updated Subject Mapping provided </p></td>
                 </tr>
               
             </tbody>
@@ -9933,7 +10185,7 @@ <h3 id="policy.kasregistry.CreatePublicKeyResponse">CreatePublicKeyResponse</h3>
 
         
       
-        <h3 id="policy.kasregistry.DeactivatePublicKeyRequest">DeactivatePublicKeyRequest</h3>
+        <h3 id="policy.subjectmapping.GetSubjectConditionSetRequest">GetSubjectConditionSetRequest</h3>
         <p></p>
 
         
@@ -9947,7 +10199,7 @@ <h3 id="policy.kasregistry.DeactivatePublicKeyRequest">DeactivatePublicKeyReques
                   <td>id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Required </p></td>
                 </tr>
               
             </tbody>
@@ -9957,7 +10209,7 @@ <h3 id="policy.kasregistry.DeactivatePublicKeyRequest">DeactivatePublicKeyReques
 
         
       
-        <h3 id="policy.kasregistry.DeactivatePublicKeyResponse">DeactivatePublicKeyResponse</h3>
+        <h3 id="policy.subjectmapping.GetSubjectConditionSetResponse">GetSubjectConditionSetResponse</h3>
         <p></p>
 
         
@@ -9968,12 +10220,19 @@ <h3 id="policy.kasregistry.DeactivatePublicKeyResponse">DeactivatePublicKeyRespo
             <tbody>
               
                 <tr>
-                  <td>key</td>
-                  <td><a href="#policy.Key">policy.Key</a></td>
+                  <td>subject_condition_set</td>
+                  <td><a href="#policy.SubjectConditionSet">policy.SubjectConditionSet</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
               
+                <tr>
+                  <td>associated_subject_mappings</td>
+                  <td><a href="#policy.SubjectMapping">policy.SubjectMapping</a></td>
+                  <td>repeated</td>
+                  <td><p>contextualized Subject Mappings associated with this SubjectConditionSet </p></td>
+                </tr>
+              
             </tbody>
           </table>
 
@@ -9981,7 +10240,7 @@ <h3 id="policy.kasregistry.DeactivatePublicKeyResponse">DeactivatePublicKeyRespo
 
         
       
-        <h3 id="policy.kasregistry.DeleteKeyAccessServerRequest">DeleteKeyAccessServerRequest</h3>
+        <h3 id="policy.subjectmapping.GetSubjectMappingRequest">GetSubjectMappingRequest</h3>
         <p></p>
 
         
@@ -10005,7 +10264,7 @@ <h3 id="policy.kasregistry.DeleteKeyAccessServerRequest">DeleteKeyAccessServerRe
 
         
       
-        <h3 id="policy.kasregistry.DeleteKeyAccessServerResponse">DeleteKeyAccessServerResponse</h3>
+        <h3 id="policy.subjectmapping.GetSubjectMappingResponse">GetSubjectMappingResponse</h3>
         <p></p>
 
         
@@ -10016,8 +10275,8 @@ <h3 id="policy.kasregistry.DeleteKeyAccessServerResponse">DeleteKeyAccessServerR
             <tbody>
               
                 <tr>
-                  <td>key_access_server</td>
-                  <td><a href="#policy.KeyAccessServer">policy.KeyAccessServer</a></td>
+                  <td>subject_mapping</td>
+                  <td><a href="#policy.SubjectMapping">policy.SubjectMapping</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -10029,14 +10288,7 @@ <h3 id="policy.kasregistry.DeleteKeyAccessServerResponse">DeleteKeyAccessServerR
 
         
       
-        <h3 id="policy.kasregistry.GetBaseKeyRequest">GetBaseKeyRequest</h3>
-        <p></p>
-
-        
-
-        
-      
-        <h3 id="policy.kasregistry.GetBaseKeyResponse">GetBaseKeyResponse</h3>
+        <h3 id="policy.subjectmapping.ListSubjectConditionSetsRequest">ListSubjectConditionSetsRequest</h3>
         <p></p>
 
         
@@ -10047,86 +10299,52 @@ <h3 id="policy.kasregistry.GetBaseKeyResponse">GetBaseKeyResponse</h3>
             <tbody>
               
                 <tr>
-                  <td>base_key</td>
-                  <td><a href="#policy.SimpleKasKey">policy.SimpleKasKey</a></td>
+                  <td>namespace_id</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>The current base key </p></td>
+                  <td><p> </p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="policy.kasregistry.GetKeyAccessServerRequest">GetKeyAccessServerRequest</h3>
-        <p></p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
                 <tr>
-                  <td>id</td>
+                  <td>namespace_fqn</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p><strong>Deprecated.</strong> Deprecated </p></td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>kas_id</td>
-                  <td><a href="#string">string</a></td>
+                  <td>pagination</td>
+                  <td><a href="#policy.PageRequest">policy.PageRequest</a></td>
                   <td></td>
-                  <td><p>option (buf.validate.oneof).required = true; // TODO: enable this when we remove the deprecated field </p></td>
+                  <td><p>Optional </p></td>
                 </tr>
               
                 <tr>
-                  <td>name</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p> </p></td>
+                  <td>sort</td>
+                  <td><a href="#policy.subjectmapping.SubjectConditionSetsSort">SubjectConditionSetsSort</a></td>
+                  <td>repeated</td>
+                  <td><p>Optional - CONSTRAINT: max 1 item
+Sort defaults:
+  - direction UNSPECIFIED defaults to DESC for the specified field
+  - field UNSPECIFIED defaults to created_at with the specified direction
+  - both UNSPECIFIED or sort omitted defaults to created_at DESC </p></td>
                 </tr>
               
                 <tr>
-                  <td>uri</td>
-                  <td><a href="#string">string</a></td>
+                  <td>search</td>
+                  <td><a href="#policy.Search">policy.Search</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Optional </p></td>
                 </tr>
               
             </tbody>
           </table>
 
           
-            
-            
-            <h4>Fields with deprecated option</h4>
-            <table>
-              <thead>
-                <tr>
-                  <td>Name</td>
-                  <td>Option</td>
-                </tr>
-              </thead>
-              <tbody>
-              
-                <tr>
-                  <td>id</td>
-                  <td><p>true</p></td>
-                </tr>
-              
-              </tbody>
-            </table>
-            
-          
 
         
       
-        <h3 id="policy.kasregistry.GetKeyAccessServerResponse">GetKeyAccessServerResponse</h3>
+        <h3 id="policy.subjectmapping.ListSubjectConditionSetsResponse">ListSubjectConditionSetsResponse</h3>
         <p></p>
 
         
@@ -10137,8 +10355,15 @@ <h3 id="policy.kasregistry.GetKeyAccessServerResponse">GetKeyAccessServerRespons
             <tbody>
               
                 <tr>
-                  <td>key_access_server</td>
-                  <td><a href="#policy.KeyAccessServer">policy.KeyAccessServer</a></td>
+                  <td>subject_condition_sets</td>
+                  <td><a href="#policy.SubjectConditionSet">policy.SubjectConditionSet</a></td>
+                  <td>repeated</td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>pagination</td>
+                  <td><a href="#policy.PageResponse">policy.PageResponse</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -10150,8 +10375,8 @@ <h3 id="policy.kasregistry.GetKeyAccessServerResponse">GetKeyAccessServerRespons
 
         
       
-        <h3 id="policy.kasregistry.GetKeyRequest">GetKeyRequest</h3>
-        <p>Retrieve an existing asymmetric key from the Key Management System</p>
+        <h3 id="policy.subjectmapping.ListSubjectMappingsRequest">ListSubjectMappingsRequest</h3>
+        <p></p>
 
         
           <table class="field-table">
@@ -10161,19 +10386,44 @@ <h3 id="policy.kasregistry.GetKeyRequest">GetKeyRequest</h3>
             <tbody>
               
                 <tr>
-                  <td>id</td>
+                  <td>namespace_id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>The unique identifier of the key to retrieve </p></td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>key</td>
-                  <td><a href="#policy.kasregistry.KasKeyIdentifier">KasKeyIdentifier</a></td>
+                  <td>namespace_fqn</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
               
+                <tr>
+                  <td>pagination</td>
+                  <td><a href="#policy.PageRequest">policy.PageRequest</a></td>
+                  <td></td>
+                  <td><p>Optional </p></td>
+                </tr>
+              
+                <tr>
+                  <td>sort</td>
+                  <td><a href="#policy.subjectmapping.SubjectMappingsSort">SubjectMappingsSort</a></td>
+                  <td>repeated</td>
+                  <td><p>Optional - CONSTRAINT: max 1 item
+Sort defaults:
+  - direction UNSPECIFIED defaults to DESC for the specified field
+  - field UNSPECIFIED defaults to created_at with the specified direction
+  - both UNSPECIFIED or sort omitted defaults to created_at DESC </p></td>
+                </tr>
+              
+                <tr>
+                  <td>search</td>
+                  <td><a href="#policy.Search">policy.Search</a></td>
+                  <td></td>
+                  <td><p>Optional </p></td>
+                </tr>
+              
             </tbody>
           </table>
 
@@ -10181,8 +10431,8 @@ <h3 id="policy.kasregistry.GetKeyRequest">GetKeyRequest</h3>
 
         
       
-        <h3 id="policy.kasregistry.GetKeyResponse">GetKeyResponse</h3>
-        <p>Response to a GetKeyRequest, containing the requested asymmetric key</p>
+        <h3 id="policy.subjectmapping.ListSubjectMappingsResponse">ListSubjectMappingsResponse</h3>
+        <p></p>
 
         
           <table class="field-table">
@@ -10192,10 +10442,17 @@ <h3 id="policy.kasregistry.GetKeyResponse">GetKeyResponse</h3>
             <tbody>
               
                 <tr>
-                  <td>kas_key</td>
-                  <td><a href="#policy.KasKey">policy.KasKey</a></td>
+                  <td>subject_mappings</td>
+                  <td><a href="#policy.SubjectMapping">policy.SubjectMapping</a></td>
+                  <td>repeated</td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>pagination</td>
+                  <td><a href="#policy.PageResponse">policy.PageResponse</a></td>
                   <td></td>
-                  <td><p>The requested asymmetric key for a KAS. </p></td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
@@ -10205,8 +10462,8 @@ <h3 id="policy.kasregistry.GetKeyResponse">GetKeyResponse</h3>
 
         
       
-        <h3 id="policy.kasregistry.GetPublicKeyRequest">GetPublicKeyRequest</h3>
-        <p></p>
+        <h3 id="policy.subjectmapping.MatchSubjectMappingsRequest">MatchSubjectMappingsRequest</h3>
+        <p>MatchSubjectMappingsRequest liberally returns a list of SubjectMappings based on the provided SubjectProperties.</p><p>The SubjectMappings are returned if an external selector field matches.</p>
 
         
           <table class="field-table">
@@ -10216,9 +10473,9 @@ <h3 id="policy.kasregistry.GetPublicKeyRequest">GetPublicKeyRequest</h3>
             <tbody>
               
                 <tr>
-                  <td>id</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
+                  <td>subject_properties</td>
+                  <td><a href="#policy.SubjectProperty">policy.SubjectProperty</a></td>
+                  <td>repeated</td>
                   <td><p> </p></td>
                 </tr>
               
@@ -10229,7 +10486,7 @@ <h3 id="policy.kasregistry.GetPublicKeyRequest">GetPublicKeyRequest</h3>
 
         
       
-        <h3 id="policy.kasregistry.GetPublicKeyResponse">GetPublicKeyResponse</h3>
+        <h3 id="policy.subjectmapping.MatchSubjectMappingsResponse">MatchSubjectMappingsResponse</h3>
         <p></p>
 
         
@@ -10240,9 +10497,9 @@ <h3 id="policy.kasregistry.GetPublicKeyResponse">GetPublicKeyResponse</h3>
             <tbody>
               
                 <tr>
-                  <td>key</td>
-                  <td><a href="#policy.Key">policy.Key</a></td>
-                  <td></td>
+                  <td>subject_mappings</td>
+                  <td><a href="#policy.SubjectMapping">policy.SubjectMapping</a></td>
+                  <td>repeated</td>
                   <td><p> </p></td>
                 </tr>
               
@@ -10253,8 +10510,8 @@ <h3 id="policy.kasregistry.GetPublicKeyResponse">GetPublicKeyResponse</h3>
 
         
       
-        <h3 id="policy.kasregistry.GrantedPolicyObject">GrantedPolicyObject</h3>
-        <p>Can be namespace, attribute definition, or value</p>
+        <h3 id="policy.subjectmapping.SubjectConditionSetCreate">SubjectConditionSetCreate</h3>
+        <p></p>
 
         
           <table class="field-table">
@@ -10264,17 +10521,18 @@ <h3 id="policy.kasregistry.GrantedPolicyObject">GrantedPolicyObject</h3>
             <tbody>
               
                 <tr>
-                  <td>id</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p> </p></td>
+                  <td>subject_sets</td>
+                  <td><a href="#policy.SubjectSet">policy.SubjectSet</a></td>
+                  <td>repeated</td>
+                  <td><p>Required </p></td>
                 </tr>
               
                 <tr>
-                  <td>fqn</td>
-                  <td><a href="#string">string</a></td>
+                  <td>metadata</td>
+                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Optional
+Common metadata </p></td>
                 </tr>
               
             </tbody>
@@ -10284,8 +10542,8 @@ <h3 id="policy.kasregistry.GrantedPolicyObject">GrantedPolicyObject</h3>
 
         
       
-        <h3 id="policy.kasregistry.KasKeyIdentifier">KasKeyIdentifier</h3>
-        <p>Nested message for specifying the active key using KAS ID and Key ID</p>
+        <h3 id="policy.subjectmapping.SubjectConditionSetsSort">SubjectConditionSetsSort</h3>
+        <p></p>
 
         
           <table class="field-table">
@@ -10295,33 +10553,19 @@ <h3 id="policy.kasregistry.KasKeyIdentifier">KasKeyIdentifier</h3>
             <tbody>
               
                 <tr>
-                  <td>kas_id</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p> </p></td>
-                </tr>
-              
-                <tr>
-                  <td>name</td>
-                  <td><a href="#string">string</a></td>
+                  <td>field</td>
+                  <td><a href="#policy.subjectmapping.SortSubjectConditionSetsType">SortSubjectConditionSetsType</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>uri</td>
-                  <td><a href="#string">string</a></td>
+                  <td>direction</td>
+                  <td><a href="#policy.SortDirection">policy.SortDirection</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
               
-                <tr>
-                  <td>kid</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Required Key ID of the key in question </p></td>
-                </tr>
-              
             </tbody>
           </table>
 
@@ -10329,7 +10573,7 @@ <h3 id="policy.kasregistry.KasKeyIdentifier">KasKeyIdentifier</h3>
 
         
       
-        <h3 id="policy.kasregistry.KasKeysSort">KasKeysSort</h3>
+        <h3 id="policy.subjectmapping.SubjectMappingsSort">SubjectMappingsSort</h3>
         <p></p>
 
         
@@ -10341,7 +10585,7 @@ <h3 id="policy.kasregistry.KasKeysSort">KasKeysSort</h3>
               
                 <tr>
                   <td>field</td>
-                  <td><a href="#policy.kasregistry.SortKasKeysType">SortKasKeysType</a></td>
+                  <td><a href="#policy.subjectmapping.SortSubjectMappingsType">SortSubjectMappingsType</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -10360,8 +10604,8 @@ <h3 id="policy.kasregistry.KasKeysSort">KasKeysSort</h3>
 
         
       
-        <h3 id="policy.kasregistry.KeyAccessServerGrants">KeyAccessServerGrants</h3>
-        <p>Deprecated</p>
+        <h3 id="policy.subjectmapping.UpdateSubjectConditionSetRequest">UpdateSubjectConditionSetRequest</h3>
+        <p></p>
 
         
           <table class="field-table">
@@ -10371,30 +10615,31 @@ <h3 id="policy.kasregistry.KeyAccessServerGrants">KeyAccessServerGrants</h3>
             <tbody>
               
                 <tr>
-                  <td>key_access_server</td>
-                  <td><a href="#policy.KeyAccessServer">policy.KeyAccessServer</a></td>
+                  <td>id</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Required </p></td>
                 </tr>
               
                 <tr>
-                  <td>namespace_grants</td>
-                  <td><a href="#policy.kasregistry.GrantedPolicyObject">GrantedPolicyObject</a></td>
+                  <td>subject_sets</td>
+                  <td><a href="#policy.SubjectSet">policy.SubjectSet</a></td>
                   <td>repeated</td>
-                  <td><p> </p></td>
+                  <td><p>Optional
+If provided, replaces entire existing structure of Subject Sets, Condition Groups, &amp; Conditions </p></td>
                 </tr>
               
                 <tr>
-                  <td>attribute_grants</td>
-                  <td><a href="#policy.kasregistry.GrantedPolicyObject">GrantedPolicyObject</a></td>
-                  <td>repeated</td>
-                  <td><p> </p></td>
+                  <td>metadata</td>
+                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
+                  <td></td>
+                  <td><p>Common metadata </p></td>
                 </tr>
               
                 <tr>
-                  <td>value_grants</td>
-                  <td><a href="#policy.kasregistry.GrantedPolicyObject">GrantedPolicyObject</a></td>
-                  <td>repeated</td>
+                  <td>metadata_update_behavior</td>
+                  <td><a href="#common.MetadataUpdateEnum">common.MetadataUpdateEnum</a></td>
+                  <td></td>
                   <td><p> </p></td>
                 </tr>
               
@@ -10405,7 +10650,7 @@ <h3 id="policy.kasregistry.KeyAccessServerGrants">KeyAccessServerGrants</h3>
 
         
       
-        <h3 id="policy.kasregistry.KeyAccessServersSort">KeyAccessServersSort</h3>
+        <h3 id="policy.subjectmapping.UpdateSubjectConditionSetResponse">UpdateSubjectConditionSetResponse</h3>
         <p></p>
 
         
@@ -10416,17 +10661,10 @@ <h3 id="policy.kasregistry.KeyAccessServersSort">KeyAccessServersSort</h3>
             <tbody>
               
                 <tr>
-                  <td>field</td>
-                  <td><a href="#policy.kasregistry.SortKeyAccessServersType">SortKeyAccessServersType</a></td>
-                  <td></td>
-                  <td><p> </p></td>
-                </tr>
-              
-                <tr>
-                  <td>direction</td>
-                  <td><a href="#policy.SortDirection">policy.SortDirection</a></td>
+                  <td>subject_condition_set</td>
+                  <td><a href="#policy.SubjectConditionSet">policy.SubjectConditionSet</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Only ID of updated Subject Condition Set provided </p></td>
                 </tr>
               
             </tbody>
@@ -10436,7 +10674,7 @@ <h3 id="policy.kasregistry.KeyAccessServersSort">KeyAccessServersSort</h3>
 
         
       
-        <h3 id="policy.kasregistry.KeyMapping">KeyMapping</h3>
+        <h3 id="policy.subjectmapping.UpdateSubjectMappingRequest">UpdateSubjectMappingRequest</h3>
         <p></p>
 
         
@@ -10447,92 +10685,40 @@ <h3 id="policy.kasregistry.KeyMapping">KeyMapping</h3>
             <tbody>
               
                 <tr>
-                  <td>kid</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p> </p></td>
-                </tr>
-              
-                <tr>
-                  <td>kas_uri</td>
+                  <td>id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p> </p></td>
-                </tr>
-              
-                <tr>
-                  <td>namespace_mappings</td>
-                  <td><a href="#policy.kasregistry.MappedPolicyObject">MappedPolicyObject</a></td>
-                  <td>repeated</td>
-                  <td><p>List of namespaces mapped to the key </p></td>
-                </tr>
-              
-                <tr>
-                  <td>attribute_mappings</td>
-                  <td><a href="#policy.kasregistry.MappedPolicyObject">MappedPolicyObject</a></td>
-                  <td>repeated</td>
-                  <td><p>List of attribute definitions mapped to the key </p></td>
-                </tr>
-              
-                <tr>
-                  <td>value_mappings</td>
-                  <td><a href="#policy.kasregistry.MappedPolicyObject">MappedPolicyObject</a></td>
-                  <td>repeated</td>
-                  <td><p>List of attribute values mapped to the key </p></td>
+                  <td><p>Required </p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="policy.kasregistry.ListKeyAccessServerGrantsRequest">ListKeyAccessServerGrantsRequest</h3>
-        <p>LIST of KAS Grants returns flat response of grants to all policy objects. It</p><p>does not employ selectors for grants to specific policy objects or build the</p><p>attribute tree relation. If grants to a known namespace, attribute, or value</p><p>are needed, use the respective GET request to the specific policy object.</p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
                 <tr>
-                  <td>kas_id</td>
+                  <td>subject_condition_set_id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
                   <td><p>Optional
-Filter LIST by ID of a registered Key Access Server.
-If neither is provided, grants from all registered KASs to policy attribute
-objects are returned. </p></td>
+Replaces the existing SubjectConditionSet id with a new one </p></td>
                 </tr>
               
                 <tr>
-                  <td>kas_uri</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
+                  <td>actions</td>
+                  <td><a href="#policy.Action">policy.Action</a></td>
+                  <td>repeated</td>
                   <td><p>Optional
-Filter LIST by URI of a registered Key Access Server.
-If none is provided, grants from all registered KASs to policy attribute
-objects are returned. </p></td>
+Replaces entire list of actions permitted by subjects </p></td>
                 </tr>
               
                 <tr>
-                  <td>kas_name</td>
-                  <td><a href="#string">string</a></td>
+                  <td>metadata</td>
+                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
                   <td></td>
-                  <td><p>Optional
-Filter LIST by name of a registered Key Access Server.
-If none are provided, grants from all registered KASs to policy attribute
-objects are returned. </p></td>
+                  <td><p>Common metadata </p></td>
                 </tr>
               
                 <tr>
-                  <td>pagination</td>
-                  <td><a href="#policy.PageRequest">policy.PageRequest</a></td>
+                  <td>metadata_update_behavior</td>
+                  <td><a href="#common.MetadataUpdateEnum">common.MetadataUpdateEnum</a></td>
                   <td></td>
-                  <td><p>Optional </p></td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
@@ -10542,8 +10728,8 @@ <h3 id="policy.kasregistry.ListKeyAccessServerGrantsRequest">ListKeyAccessServer
 
         
       
-        <h3 id="policy.kasregistry.ListKeyAccessServerGrantsResponse">ListKeyAccessServerGrantsResponse</h3>
-        <p>Deprecated</p>
+        <h3 id="policy.subjectmapping.UpdateSubjectMappingResponse">UpdateSubjectMappingResponse</h3>
+        <p></p>
 
         
           <table class="field-table">
@@ -10553,80 +10739,775 @@ <h3 id="policy.kasregistry.ListKeyAccessServerGrantsResponse">ListKeyAccessServe
             <tbody>
               
                 <tr>
-                  <td>grants</td>
-                  <td><a href="#policy.kasregistry.KeyAccessServerGrants">KeyAccessServerGrants</a></td>
-                  <td>repeated</td>
-                  <td><p><strong>Deprecated.</strong>  </p></td>
-                </tr>
-              
-                <tr>
-                  <td>pagination</td>
-                  <td><a href="#policy.PageResponse">policy.PageResponse</a></td>
+                  <td>subject_mapping</td>
+                  <td><a href="#policy.SubjectMapping">policy.SubjectMapping</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Only ID of the updated Subject Mapping provided </p></td>
                 </tr>
               
             </tbody>
           </table>
 
           
-            
-            
-            <h4>Fields with deprecated option</h4>
-            <table>
-              <thead>
-                <tr>
-                  <td>Name</td>
-                  <td>Option</td>
-                </tr>
-              </thead>
-              <tbody>
-              
-                <tr>
-                  <td>grants</td>
-                  <td><p>true</p></td>
-                </tr>
-              
-              </tbody>
-            </table>
-            
-          
 
         
       
-        <h3 id="policy.kasregistry.ListKeyAccessServersRequest">ListKeyAccessServersRequest</h3>
-        <p></p>
 
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
+      
+        <h3 id="policy.subjectmapping.SortSubjectConditionSetsType">SortSubjectConditionSetsType</h3>
+        <p></p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>SORT_SUBJECT_CONDITION_SETS_TYPE_UNSPECIFIED</td>
+                <td>0</td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>SORT_SUBJECT_CONDITION_SETS_TYPE_CREATED_AT</td>
+                <td>1</td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>SORT_SUBJECT_CONDITION_SETS_TYPE_UPDATED_AT</td>
+                <td>2</td>
+                <td><p></p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+      
+        <h3 id="policy.subjectmapping.SortSubjectMappingsType">SortSubjectMappingsType</h3>
+        <p></p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>SORT_SUBJECT_MAPPINGS_TYPE_UNSPECIFIED</td>
+                <td>0</td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>SORT_SUBJECT_MAPPINGS_TYPE_CREATED_AT</td>
+                <td>1</td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>SORT_SUBJECT_MAPPINGS_TYPE_UPDATED_AT</td>
+                <td>2</td>
+                <td><p></p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+      
+
+      
+
+      
+        <h3 id="policy.subjectmapping.SubjectMappingService">SubjectMappingService</h3>
+        <p></p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>MatchSubjectMappings</td>
+                <td><a href="#policy.subjectmapping.MatchSubjectMappingsRequest">MatchSubjectMappingsRequest</a></td>
+                <td><a href="#policy.subjectmapping.MatchSubjectMappingsResponse">MatchSubjectMappingsResponse</a></td>
+                <td><p>Find matching Subject Mappings for a given Subject</p></td>
+              </tr>
+            
+              <tr>
+                <td>ListSubjectMappings</td>
+                <td><a href="#policy.subjectmapping.ListSubjectMappingsRequest">ListSubjectMappingsRequest</a></td>
+                <td><a href="#policy.subjectmapping.ListSubjectMappingsResponse">ListSubjectMappingsResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>GetSubjectMapping</td>
+                <td><a href="#policy.subjectmapping.GetSubjectMappingRequest">GetSubjectMappingRequest</a></td>
+                <td><a href="#policy.subjectmapping.GetSubjectMappingResponse">GetSubjectMappingResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>CreateSubjectMapping</td>
+                <td><a href="#policy.subjectmapping.CreateSubjectMappingRequest">CreateSubjectMappingRequest</a></td>
+                <td><a href="#policy.subjectmapping.CreateSubjectMappingResponse">CreateSubjectMappingResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>UpdateSubjectMapping</td>
+                <td><a href="#policy.subjectmapping.UpdateSubjectMappingRequest">UpdateSubjectMappingRequest</a></td>
+                <td><a href="#policy.subjectmapping.UpdateSubjectMappingResponse">UpdateSubjectMappingResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>DeleteSubjectMapping</td>
+                <td><a href="#policy.subjectmapping.DeleteSubjectMappingRequest">DeleteSubjectMappingRequest</a></td>
+                <td><a href="#policy.subjectmapping.DeleteSubjectMappingResponse">DeleteSubjectMappingResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>ListSubjectConditionSets</td>
+                <td><a href="#policy.subjectmapping.ListSubjectConditionSetsRequest">ListSubjectConditionSetsRequest</a></td>
+                <td><a href="#policy.subjectmapping.ListSubjectConditionSetsResponse">ListSubjectConditionSetsResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>GetSubjectConditionSet</td>
+                <td><a href="#policy.subjectmapping.GetSubjectConditionSetRequest">GetSubjectConditionSetRequest</a></td>
+                <td><a href="#policy.subjectmapping.GetSubjectConditionSetResponse">GetSubjectConditionSetResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>CreateSubjectConditionSet</td>
+                <td><a href="#policy.subjectmapping.CreateSubjectConditionSetRequest">CreateSubjectConditionSetRequest</a></td>
+                <td><a href="#policy.subjectmapping.CreateSubjectConditionSetResponse">CreateSubjectConditionSetResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>UpdateSubjectConditionSet</td>
+                <td><a href="#policy.subjectmapping.UpdateSubjectConditionSetRequest">UpdateSubjectConditionSetRequest</a></td>
+                <td><a href="#policy.subjectmapping.UpdateSubjectConditionSetResponse">UpdateSubjectConditionSetResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>DeleteSubjectConditionSet</td>
+                <td><a href="#policy.subjectmapping.DeleteSubjectConditionSetRequest">DeleteSubjectConditionSetRequest</a></td>
+                <td><a href="#policy.subjectmapping.DeleteSubjectConditionSetResponse">DeleteSubjectConditionSetResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>DeleteAllUnmappedSubjectConditionSets</td>
+                <td><a href="#policy.subjectmapping.DeleteAllUnmappedSubjectConditionSetsRequest">DeleteAllUnmappedSubjectConditionSetsRequest</a></td>
+                <td><a href="#policy.subjectmapping.DeleteAllUnmappedSubjectConditionSetsResponse">DeleteAllUnmappedSubjectConditionSetsResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+
+        
+          
+          
+          <h4>Methods with idempotency_level option</h4>
+          <table>
+            <thead>
+              <tr>
+                <td>Method Name</td>
+                <td>Option</td>
+              </tr>
+            </thead>
+            <tbody>
+            
+              <tr>
+                <td>ListSubjectMappings</td>
+                <td><p>NO_SIDE_EFFECTS</p></td>
+              </tr>
+            
+              <tr>
+                <td>GetSubjectMapping</td>
+                <td><p>NO_SIDE_EFFECTS</p></td>
+              </tr>
+            
+              <tr>
+                <td>ListSubjectConditionSets</td>
+                <td><p>NO_SIDE_EFFECTS</p></td>
+              </tr>
+            
+              <tr>
+                <td>GetSubjectConditionSet</td>
+                <td><p>NO_SIDE_EFFECTS</p></td>
+              </tr>
+            
+            </tbody>
+          </table>
+          
+        
+    
+      
+      <div class="file-heading">
+        <h2 id="policy/dynamicvaluemapping/dynamic_value_mapping.proto">policy/dynamicvaluemapping/dynamic_value_mapping.proto</h2><a href="#title">Top</a>
+      </div>
+      <p></p>
+
+      
+        <h3 id="policy.dynamicvaluemapping.CreateDynamicValueMappingRequest">CreateDynamicValueMappingRequest</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>attribute_definition_id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>attribute_definition_fqn</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>value_resolver</td>
+                  <td><a href="#policy.DynamicValueResolver">policy.DynamicValueResolver</a></td>
+                  <td></td>
+                  <td><p>Required: the dynamic resolver comparing entity selector result to the resource value segment </p></td>
+                </tr>
+              
+                <tr>
+                  <td>actions</td>
+                  <td><a href="#policy.Action">policy.Action</a></td>
+                  <td>repeated</td>
+                  <td><p>Required: actions permitted on a matched value </p></td>
+                </tr>
+              
+                <tr>
+                  <td>existing_subject_condition_set_id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Optional static pre-gate. Reuse an existing SubjectConditionSet (prioritized) ... </p></td>
+                </tr>
+              
+                <tr>
+                  <td>new_subject_condition_set</td>
+                  <td><a href="#policy.subjectmapping.SubjectConditionSetCreate">policy.subjectmapping.SubjectConditionSetCreate</a></td>
+                  <td></td>
+                  <td><p>... or create a new one (ignored if existing_subject_condition_set_id is provided) </p></td>
+                </tr>
+              
+                <tr>
+                  <td>namespace_id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Optional: namespace ID or FQN for the mapping </p></td>
+                </tr>
+              
+                <tr>
+                  <td>namespace_fqn</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>metadata</td>
+                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
+                  <td></td>
+                  <td><p>Optional </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.dynamicvaluemapping.CreateDynamicValueMappingResponse">CreateDynamicValueMappingResponse</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>dynamic_value_mapping</td>
+                  <td><a href="#policy.DynamicValueMapping">policy.DynamicValueMapping</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.dynamicvaluemapping.DeleteDynamicValueMappingRequest">DeleteDynamicValueMappingRequest</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Required </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.dynamicvaluemapping.DeleteDynamicValueMappingResponse">DeleteDynamicValueMappingResponse</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>dynamic_value_mapping</td>
+                  <td><a href="#policy.DynamicValueMapping">policy.DynamicValueMapping</a></td>
+                  <td></td>
+                  <td><p>Only ID of the deleted mapping provided </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.dynamicvaluemapping.DynamicValueMappingsSort">DynamicValueMappingsSort</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>field</td>
+                  <td><a href="#policy.dynamicvaluemapping.SortDynamicValueMappingsType">SortDynamicValueMappingsType</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>direction</td>
+                  <td><a href="#policy.SortDirection">policy.SortDirection</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.dynamicvaluemapping.GetDynamicValueMappingRequest">GetDynamicValueMappingRequest</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Required </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.dynamicvaluemapping.GetDynamicValueMappingResponse">GetDynamicValueMappingResponse</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>dynamic_value_mapping</td>
+                  <td><a href="#policy.DynamicValueMapping">policy.DynamicValueMapping</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.dynamicvaluemapping.ListDynamicValueMappingsRequest">ListDynamicValueMappingsRequest</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>namespace_id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>namespace_fqn</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>attribute_definition_id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Optional: Attribute Definition ID to filter by </p></td>
+                </tr>
+              
+                <tr>
+                  <td>pagination</td>
+                  <td><a href="#policy.PageRequest">policy.PageRequest</a></td>
+                  <td></td>
+                  <td><p>Optional </p></td>
+                </tr>
+              
+                <tr>
+                  <td>sort</td>
+                  <td><a href="#policy.dynamicvaluemapping.DynamicValueMappingsSort">DynamicValueMappingsSort</a></td>
+                  <td>repeated</td>
+                  <td><p>Optional - CONSTRAINT: max 1 item </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.dynamicvaluemapping.ListDynamicValueMappingsResponse">ListDynamicValueMappingsResponse</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>dynamic_value_mappings</td>
+                  <td><a href="#policy.DynamicValueMapping">policy.DynamicValueMapping</a></td>
+                  <td>repeated</td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>pagination</td>
+                  <td><a href="#policy.PageResponse">policy.PageResponse</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.dynamicvaluemapping.UpdateDynamicValueMappingRequest">UpdateDynamicValueMappingRequest</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Required </p></td>
+                </tr>
+              
+                <tr>
+                  <td>value_resolver</td>
+                  <td><a href="#policy.DynamicValueResolver">policy.DynamicValueResolver</a></td>
+                  <td></td>
+                  <td><p>Optional: replace the dynamic resolver </p></td>
+                </tr>
+              
+                <tr>
+                  <td>subject_condition_set_id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Optional: replace the static pre-gate SubjectConditionSet by id </p></td>
+                </tr>
+              
+                <tr>
+                  <td>actions</td>
+                  <td><a href="#policy.Action">policy.Action</a></td>
+                  <td>repeated</td>
+                  <td><p>Optional: replace the entire list of actions </p></td>
+                </tr>
+              
+                <tr>
+                  <td>metadata</td>
+                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
+                  <td></td>
+                  <td><p>Common metadata </p></td>
+                </tr>
+              
+                <tr>
+                  <td>metadata_update_behavior</td>
+                  <td><a href="#common.MetadataUpdateEnum">common.MetadataUpdateEnum</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.dynamicvaluemapping.UpdateDynamicValueMappingResponse">UpdateDynamicValueMappingResponse</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>dynamic_value_mapping</td>
+                  <td><a href="#policy.DynamicValueMapping">policy.DynamicValueMapping</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+
+      
+        <h3 id="policy.dynamicvaluemapping.SortDynamicValueMappingsType">SortDynamicValueMappingsType</h3>
+        <p></p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>SORT_DYNAMIC_VALUE_MAPPINGS_TYPE_UNSPECIFIED</td>
+                <td>0</td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>SORT_DYNAMIC_VALUE_MAPPINGS_TYPE_CREATED_AT</td>
+                <td>1</td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>SORT_DYNAMIC_VALUE_MAPPINGS_TYPE_UPDATED_AT</td>
+                <td>2</td>
+                <td><p></p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+      
+
+      
+
+      
+        <h3 id="policy.dynamicvaluemapping.DynamicValueMappingService">DynamicValueMappingService</h3>
+        <p></p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>ListDynamicValueMappings</td>
+                <td><a href="#policy.dynamicvaluemapping.ListDynamicValueMappingsRequest">ListDynamicValueMappingsRequest</a></td>
+                <td><a href="#policy.dynamicvaluemapping.ListDynamicValueMappingsResponse">ListDynamicValueMappingsResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>GetDynamicValueMapping</td>
+                <td><a href="#policy.dynamicvaluemapping.GetDynamicValueMappingRequest">GetDynamicValueMappingRequest</a></td>
+                <td><a href="#policy.dynamicvaluemapping.GetDynamicValueMappingResponse">GetDynamicValueMappingResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>CreateDynamicValueMapping</td>
+                <td><a href="#policy.dynamicvaluemapping.CreateDynamicValueMappingRequest">CreateDynamicValueMappingRequest</a></td>
+                <td><a href="#policy.dynamicvaluemapping.CreateDynamicValueMappingResponse">CreateDynamicValueMappingResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>UpdateDynamicValueMapping</td>
+                <td><a href="#policy.dynamicvaluemapping.UpdateDynamicValueMappingRequest">UpdateDynamicValueMappingRequest</a></td>
+                <td><a href="#policy.dynamicvaluemapping.UpdateDynamicValueMappingResponse">UpdateDynamicValueMappingResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>DeleteDynamicValueMapping</td>
+                <td><a href="#policy.dynamicvaluemapping.DeleteDynamicValueMappingRequest">DeleteDynamicValueMappingRequest</a></td>
+                <td><a href="#policy.dynamicvaluemapping.DeleteDynamicValueMappingResponse">DeleteDynamicValueMappingResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+
+        
+          
+          
+          <h4>Methods with idempotency_level option</h4>
+          <table>
+            <thead>
+              <tr>
+                <td>Method Name</td>
+                <td>Option</td>
+              </tr>
+            </thead>
+            <tbody>
+            
+              <tr>
+                <td>ListDynamicValueMappings</td>
+                <td><p>NO_SIDE_EFFECTS</p></td>
+              </tr>
+            
+              <tr>
+                <td>GetDynamicValueMapping</td>
+                <td><p>NO_SIDE_EFFECTS</p></td>
+              </tr>
+            
+            </tbody>
+          </table>
+          
+        
+    
+      
+      <div class="file-heading">
+        <h2 id="policy/kasregistry/key_access_server_registry.proto">policy/kasregistry/key_access_server_registry.proto</h2><a href="#title">Top</a>
+      </div>
+      <p></p>
+
+      
+        <h3 id="policy.kasregistry.ActivatePublicKeyRequest">ActivatePublicKeyRequest</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
             <tbody>
               
                 <tr>
-                  <td>pagination</td>
-                  <td><a href="#policy.PageRequest">policy.PageRequest</a></td>
+                  <td>id</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Optional </p></td>
+                  <td><p> </p></td>
                 </tr>
               
-                <tr>
-                  <td>sort</td>
-                  <td><a href="#policy.kasregistry.KeyAccessServersSort">KeyAccessServersSort</a></td>
-                  <td>repeated</td>
-                  <td><p>Optional - CONSTRAINT: max 1 item
-Sort defaults:
-  - direction UNSPECIFIED defaults to DESC for the specified field
-  - field UNSPECIFIED defaults to created_at with the specified direction
-  - both UNSPECIFIED or sort omitted defaults to created_at DESC </p></td>
-                </tr>
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.kasregistry.ActivatePublicKeyResponse">ActivatePublicKeyResponse</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
               
                 <tr>
-                  <td>search</td>
-                  <td><a href="#policy.Search">policy.Search</a></td>
+                  <td>key</td>
+                  <td><a href="#policy.Key">policy.Key</a></td>
                   <td></td>
-                  <td><p>Optional </p></td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
@@ -10636,8 +11517,8 @@ <h3 id="policy.kasregistry.ListKeyAccessServersRequest">ListKeyAccessServersRequ
 
         
       
-        <h3 id="policy.kasregistry.ListKeyAccessServersResponse">ListKeyAccessServersResponse</h3>
-        <p></p>
+        <h3 id="policy.kasregistry.ChangeMappings">ChangeMappings</h3>
+        <p>Simplified information about the resources that were rotated as part of the key rotation process.</p>
 
         
           <table class="field-table">
@@ -10647,15 +11528,15 @@ <h3 id="policy.kasregistry.ListKeyAccessServersResponse">ListKeyAccessServersRes
             <tbody>
               
                 <tr>
-                  <td>key_access_servers</td>
-                  <td><a href="#policy.KeyAccessServer">policy.KeyAccessServer</a></td>
-                  <td>repeated</td>
+                  <td>id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
                   <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>pagination</td>
-                  <td><a href="#policy.PageResponse">policy.PageResponse</a></td>
+                  <td>fqn</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -10667,7 +11548,7 @@ <h3 id="policy.kasregistry.ListKeyAccessServersResponse">ListKeyAccessServersRes
 
         
       
-        <h3 id="policy.kasregistry.ListKeyMappingsRequest">ListKeyMappingsRequest</h3>
+        <h3 id="policy.kasregistry.CreateKeyAccessServerRequest">CreateKeyAccessServerRequest</h3>
         <p></p>
 
         
@@ -10678,24 +11559,38 @@ <h3 id="policy.kasregistry.ListKeyMappingsRequest">ListKeyMappingsRequest</h3>
             <tbody>
               
                 <tr>
-                  <td>id</td>
+                  <td>uri</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>The unique identifier of the key to retrieve </p></td>
+                  <td><p>Required </p></td>
                 </tr>
               
                 <tr>
-                  <td>key</td>
-                  <td><a href="#policy.kasregistry.KasKeyIdentifier">KasKeyIdentifier</a></td>
+                  <td>public_key</td>
+                  <td><a href="#policy.PublicKey">policy.PublicKey</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Deprecated </p></td>
                 </tr>
               
                 <tr>
-                  <td>pagination</td>
-                  <td><a href="#policy.PageRequest">policy.PageRequest</a></td>
+                  <td>source_type</td>
+                  <td><a href="#policy.SourceType">policy.SourceType</a></td>
                   <td></td>
-                  <td><p>Pagination request for the list of keys </p></td>
+                  <td><p>Optional </p></td>
+                </tr>
+              
+                <tr>
+                  <td>name</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Optional </p></td>
+                </tr>
+              
+                <tr>
+                  <td>metadata</td>
+                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
+                  <td></td>
+                  <td><p>Common metadata </p></td>
                 </tr>
               
             </tbody>
@@ -10705,7 +11600,7 @@ <h3 id="policy.kasregistry.ListKeyMappingsRequest">ListKeyMappingsRequest</h3>
 
         
       
-        <h3 id="policy.kasregistry.ListKeyMappingsResponse">ListKeyMappingsResponse</h3>
+        <h3 id="policy.kasregistry.CreateKeyAccessServerResponse">CreateKeyAccessServerResponse</h3>
         <p></p>
 
         
@@ -10716,17 +11611,10 @@ <h3 id="policy.kasregistry.ListKeyMappingsResponse">ListKeyMappingsResponse</h3>
             <tbody>
               
                 <tr>
-                  <td>key_mappings</td>
-                  <td><a href="#policy.kasregistry.KeyMapping">KeyMapping</a></td>
-                  <td>repeated</td>
-                  <td><p>The list of key mappings </p></td>
-                </tr>
-              
-                <tr>
-                  <td>pagination</td>
-                  <td><a href="#policy.PageResponse">policy.PageResponse</a></td>
+                  <td>key_access_server</td>
+                  <td><a href="#policy.KeyAccessServer">policy.KeyAccessServer</a></td>
                   <td></td>
-                  <td><p>Pagination response for the list of keys </p></td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
@@ -10736,8 +11624,8 @@ <h3 id="policy.kasregistry.ListKeyMappingsResponse">ListKeyMappingsResponse</h3>
 
         
       
-        <h3 id="policy.kasregistry.ListKeysRequest">ListKeysRequest</h3>
-        <p>List all asymmetric keys managed by a specific Key Access Server or with a given algorithm</p>
+        <h3 id="policy.kasregistry.CreateKeyRequest">CreateKeyRequest</h3>
+        <p>Create a new asymmetric key for the specified Key Access Server (KAS)</p>
 
         
           <table class="field-table">
@@ -10747,67 +11635,84 @@ <h3 id="policy.kasregistry.ListKeysRequest">ListKeysRequest</h3>
             <tbody>
               
                 <tr>
-                  <td>key_algorithm</td>
-                  <td><a href="#policy.Algorithm">policy.Algorithm</a></td>
+                  <td>kas_id</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Filter keys by algorithm </p></td>
+                  <td><p>Required
+
+The unique identifier of the Key Access Server </p></td>
                 </tr>
               
                 <tr>
-                  <td>kas_id</td>
+                  <td>key_id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Filter keys by the KAS ID </p></td>
+                  <td><p>Required
+
+A user-defined identifier for the key </p></td>
                 </tr>
               
                 <tr>
-                  <td>kas_name</td>
-                  <td><a href="#string">string</a></td>
+                  <td>key_algorithm</td>
+                  <td><a href="#policy.Algorithm">policy.Algorithm</a></td>
                   <td></td>
-                  <td><p>Filter keys by the KAS name </p></td>
+                  <td><p>Required
+
+The algorithm to be used for the key </p></td>
                 </tr>
               
                 <tr>
-                  <td>kas_uri</td>
-                  <td><a href="#string">string</a></td>
+                  <td>key_mode</td>
+                  <td><a href="#policy.KeyMode">policy.KeyMode</a></td>
                   <td></td>
-                  <td><p>Filter keys by the KAS URI </p></td>
+                  <td><p>Required
+
+The mode of the key (e.g., local or external) </p></td>
                 </tr>
               
                 <tr>
-                  <td>legacy</td>
-                  <td><a href="#bool">bool</a></td>
-                  <td>optional</td>
-                  <td><p>Optional
+                  <td>public_key_ctx</td>
+                  <td><a href="#policy.PublicKeyCtx">policy.PublicKeyCtx</a></td>
+                  <td></td>
+                  <td><p>Required
 
-Filter for legacy keys </p></td>
+Context or additional data specific to the public key, based on the key provider implementation </p></td>
                 </tr>
               
                 <tr>
-                  <td>pagination</td>
-                  <td><a href="#policy.PageRequest">policy.PageRequest</a></td>
+                  <td>private_key_ctx</td>
+                  <td><a href="#policy.PrivateKeyCtx">policy.PrivateKeyCtx</a></td>
+                  <td></td>
+                  <td><p>Conditionally Required
+
+Context or additional data specific to the private key, based on the key provider implementation </p></td>
+                </tr>
+              
+                <tr>
+                  <td>provider_config_id</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
                   <td><p>Optional
 
-Pagination request for the list of keys </p></td>
+Configuration ID for the key provider, if applicable </p></td>
                 </tr>
               
                 <tr>
-                  <td>sort</td>
-                  <td><a href="#policy.kasregistry.KasKeysSort">KasKeysSort</a></td>
-                  <td>repeated</td>
-                  <td><p>Optional - CONSTRAINT: max 1 item
-Sort defaults:
-  - direction UNSPECIFIED defaults to DESC for the specified field
-  - field UNSPECIFIED defaults to created_at with the specified direction
-  - both UNSPECIFIED or sort omitted defaults to created_at DESC </p></td>
+                  <td>legacy</td>
+                  <td><a href="#bool">bool</a></td>
+                  <td></td>
+                  <td><p>Optional
+
+Whether the key is a legacy key </p></td>
                 </tr>
               
                 <tr>
-                  <td>search</td>
-                  <td><a href="#policy.Search">policy.Search</a></td>
+                  <td>metadata</td>
+                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
                   <td></td>
-                  <td><p>Optional </p></td>
+                  <td><p>Common metadata
+
+Mutable metadata for the key </p></td>
                 </tr>
               
             </tbody>
@@ -10817,8 +11722,8 @@ <h3 id="policy.kasregistry.ListKeysRequest">ListKeysRequest</h3>
 
         
       
-        <h3 id="policy.kasregistry.ListKeysResponse">ListKeysResponse</h3>
-        <p>Response to a ListKeysRequest, containing the list of asymmetric keys and pagination information</p>
+        <h3 id="policy.kasregistry.CreateKeyResponse">CreateKeyResponse</h3>
+        <p>Response to a CreateKeyRequest, containing the created asymmetric key</p>
 
         
           <table class="field-table">
@@ -10828,17 +11733,10 @@ <h3 id="policy.kasregistry.ListKeysResponse">ListKeysResponse</h3>
             <tbody>
               
                 <tr>
-                  <td>kas_keys</td>
+                  <td>kas_key</td>
                   <td><a href="#policy.KasKey">policy.KasKey</a></td>
-                  <td>repeated</td>
-                  <td><p>The list of kas keys </p></td>
-                </tr>
-              
-                <tr>
-                  <td>pagination</td>
-                  <td><a href="#policy.PageResponse">policy.PageResponse</a></td>
                   <td></td>
-                  <td><p>Pagination response for the list of keys </p></td>
+                  <td><p>The created asymmetric key for a KAS. </p></td>
                 </tr>
               
             </tbody>
@@ -10848,7 +11746,7 @@ <h3 id="policy.kasregistry.ListKeysResponse">ListKeysResponse</h3>
 
         
       
-        <h3 id="policy.kasregistry.ListPublicKeyMappingRequest">ListPublicKeyMappingRequest</h3>
+        <h3 id="policy.kasregistry.CreatePublicKeyRequest">CreatePublicKeyRequest</h3>
         <p></p>
 
         
@@ -10862,35 +11760,21 @@ <h3 id="policy.kasregistry.ListPublicKeyMappingRequest">ListPublicKeyMappingRequ
                   <td>kas_id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Optional </p></td>
-                </tr>
-              
-                <tr>
-                  <td>kas_name</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Optional </p></td>
-                </tr>
-              
-                <tr>
-                  <td>kas_uri</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Optional </p></td>
+                  <td><p>Required </p></td>
                 </tr>
               
                 <tr>
-                  <td>public_key_id</td>
-                  <td><a href="#string">string</a></td>
+                  <td>key</td>
+                  <td><a href="#policy.KasPublicKey">policy.KasPublicKey</a></td>
                   <td></td>
-                  <td><p>Optional Public Key ID </p></td>
+                  <td><p>Required </p></td>
                 </tr>
               
                 <tr>
-                  <td>pagination</td>
-                  <td><a href="#policy.PageRequest">policy.PageRequest</a></td>
+                  <td>metadata</td>
+                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
                   <td></td>
-                  <td><p>Optional </p></td>
+                  <td><p>Common metadata </p></td>
                 </tr>
               
             </tbody>
@@ -10900,7 +11784,7 @@ <h3 id="policy.kasregistry.ListPublicKeyMappingRequest">ListPublicKeyMappingRequ
 
         
       
-        <h3 id="policy.kasregistry.ListPublicKeyMappingResponse">ListPublicKeyMappingResponse</h3>
+        <h3 id="policy.kasregistry.CreatePublicKeyResponse">CreatePublicKeyResponse</h3>
         <p></p>
 
         
@@ -10911,15 +11795,8 @@ <h3 id="policy.kasregistry.ListPublicKeyMappingResponse">ListPublicKeyMappingRes
             <tbody>
               
                 <tr>
-                  <td>public_key_mappings</td>
-                  <td><a href="#policy.kasregistry.ListPublicKeyMappingResponse.PublicKeyMapping">ListPublicKeyMappingResponse.PublicKeyMapping</a></td>
-                  <td>repeated</td>
-                  <td><p> </p></td>
-                </tr>
-              
-                <tr>
-                  <td>pagination</td>
-                  <td><a href="#policy.PageResponse">policy.PageResponse</a></td>
+                  <td>key</td>
+                  <td><a href="#policy.Key">policy.Key</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -10931,7 +11808,7 @@ <h3 id="policy.kasregistry.ListPublicKeyMappingResponse">ListPublicKeyMappingRes
 
         
       
-        <h3 id="policy.kasregistry.ListPublicKeyMappingResponse.Association">ListPublicKeyMappingResponse.Association</h3>
+        <h3 id="policy.kasregistry.DeactivatePublicKeyRequest">DeactivatePublicKeyRequest</h3>
         <p></p>
 
         
@@ -10948,13 +11825,6 @@ <h3 id="policy.kasregistry.ListPublicKeyMappingResponse.Association">ListPublicK
                   <td><p> </p></td>
                 </tr>
               
-                <tr>
-                  <td>fqn</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p> </p></td>
-                </tr>
-              
             </tbody>
           </table>
 
@@ -10962,7 +11832,7 @@ <h3 id="policy.kasregistry.ListPublicKeyMappingResponse.Association">ListPublicK
 
         
       
-        <h3 id="policy.kasregistry.ListPublicKeyMappingResponse.PublicKey">ListPublicKeyMappingResponse.PublicKey</h3>
+        <h3 id="policy.kasregistry.DeactivatePublicKeyResponse">DeactivatePublicKeyResponse</h3>
         <p></p>
 
         
@@ -10979,27 +11849,6 @@ <h3 id="policy.kasregistry.ListPublicKeyMappingResponse.PublicKey">ListPublicKey
                   <td><p> </p></td>
                 </tr>
               
-                <tr>
-                  <td>values</td>
-                  <td><a href="#policy.kasregistry.ListPublicKeyMappingResponse.Association">ListPublicKeyMappingResponse.Association</a></td>
-                  <td>repeated</td>
-                  <td><p> </p></td>
-                </tr>
-              
-                <tr>
-                  <td>definitions</td>
-                  <td><a href="#policy.kasregistry.ListPublicKeyMappingResponse.Association">ListPublicKeyMappingResponse.Association</a></td>
-                  <td>repeated</td>
-                  <td><p> </p></td>
-                </tr>
-              
-                <tr>
-                  <td>namespaces</td>
-                  <td><a href="#policy.kasregistry.ListPublicKeyMappingResponse.Association">ListPublicKeyMappingResponse.Association</a></td>
-                  <td>repeated</td>
-                  <td><p> </p></td>
-                </tr>
-              
             </tbody>
           </table>
 
@@ -11007,7 +11856,7 @@ <h3 id="policy.kasregistry.ListPublicKeyMappingResponse.PublicKey">ListPublicKey
 
         
       
-        <h3 id="policy.kasregistry.ListPublicKeyMappingResponse.PublicKeyMapping">ListPublicKeyMappingResponse.PublicKeyMapping</h3>
+        <h3 id="policy.kasregistry.DeleteKeyAccessServerRequest">DeleteKeyAccessServerRequest</h3>
         <p></p>
 
         
@@ -11018,31 +11867,10 @@ <h3 id="policy.kasregistry.ListPublicKeyMappingResponse.PublicKeyMapping">ListPu
             <tbody>
               
                 <tr>
-                  <td>kas_id</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p> </p></td>
-                </tr>
-              
-                <tr>
-                  <td>kas_name</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p> </p></td>
-                </tr>
-              
-                <tr>
-                  <td>kas_uri</td>
+                  <td>id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p> </p></td>
-                </tr>
-              
-                <tr>
-                  <td>public_keys</td>
-                  <td><a href="#policy.kasregistry.ListPublicKeyMappingResponse.PublicKey">ListPublicKeyMappingResponse.PublicKey</a></td>
-                  <td>repeated</td>
-                  <td><p> </p></td>
+                  <td><p>Required </p></td>
                 </tr>
               
             </tbody>
@@ -11052,7 +11880,7 @@ <h3 id="policy.kasregistry.ListPublicKeyMappingResponse.PublicKeyMapping">ListPu
 
         
       
-        <h3 id="policy.kasregistry.ListPublicKeysRequest">ListPublicKeysRequest</h3>
+        <h3 id="policy.kasregistry.DeleteKeyAccessServerResponse">DeleteKeyAccessServerResponse</h3>
         <p></p>
 
         
@@ -11063,31 +11891,10 @@ <h3 id="policy.kasregistry.ListPublicKeysRequest">ListPublicKeysRequest</h3>
             <tbody>
               
                 <tr>
-                  <td>kas_id</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Optional </p></td>
-                </tr>
-              
-                <tr>
-                  <td>kas_name</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Optional </p></td>
-                </tr>
-              
-                <tr>
-                  <td>kas_uri</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Optional </p></td>
-                </tr>
-              
-                <tr>
-                  <td>pagination</td>
-                  <td><a href="#policy.PageRequest">policy.PageRequest</a></td>
+                  <td>key_access_server</td>
+                  <td><a href="#policy.KeyAccessServer">policy.KeyAccessServer</a></td>
                   <td></td>
-                  <td><p>Optional </p></td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
@@ -11097,38 +11904,14 @@ <h3 id="policy.kasregistry.ListPublicKeysRequest">ListPublicKeysRequest</h3>
 
         
       
-        <h3 id="policy.kasregistry.ListPublicKeysResponse">ListPublicKeysResponse</h3>
+        <h3 id="policy.kasregistry.GetBaseKeyRequest">GetBaseKeyRequest</h3>
         <p></p>
 
         
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
-                <tr>
-                  <td>keys</td>
-                  <td><a href="#policy.Key">policy.Key</a></td>
-                  <td>repeated</td>
-                  <td><p> </p></td>
-                </tr>
-              
-                <tr>
-                  <td>pagination</td>
-                  <td><a href="#policy.PageResponse">policy.PageResponse</a></td>
-                  <td></td>
-                  <td><p> </p></td>
-                </tr>
-              
-            </tbody>
-          </table>
-
-          
 
         
       
-        <h3 id="policy.kasregistry.MappedPolicyObject">MappedPolicyObject</h3>
+        <h3 id="policy.kasregistry.GetBaseKeyResponse">GetBaseKeyResponse</h3>
         <p></p>
 
         
@@ -11139,17 +11922,10 @@ <h3 id="policy.kasregistry.MappedPolicyObject">MappedPolicyObject</h3>
             <tbody>
               
                 <tr>
-                  <td>id</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>The unique identifier of the policy object </p></td>
-                </tr>
-              
-                <tr>
-                  <td>fqn</td>
-                  <td><a href="#string">string</a></td>
+                  <td>base_key</td>
+                  <td><a href="#policy.SimpleKasKey">policy.SimpleKasKey</a></td>
                   <td></td>
-                  <td><p>The fully qualified name of the policy object </p></td>
+                  <td><p>The current base key </p></td>
                 </tr>
               
             </tbody>
@@ -11159,7 +11935,7 @@ <h3 id="policy.kasregistry.MappedPolicyObject">MappedPolicyObject</h3>
 
         
       
-        <h3 id="policy.kasregistry.RotateKeyRequest">RotateKeyRequest</h3>
+        <h3 id="policy.kasregistry.GetKeyAccessServerRequest">GetKeyAccessServerRequest</h3>
         <p></p>
 
         
@@ -11173,89 +11949,104 @@ <h3 id="policy.kasregistry.RotateKeyRequest">RotateKeyRequest</h3>
                   <td>id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Current Active Key UUID </p></td>
+                  <td><p><strong>Deprecated.</strong> Deprecated </p></td>
                 </tr>
               
                 <tr>
-                  <td>key</td>
-                  <td><a href="#policy.kasregistry.KasKeyIdentifier">KasKeyIdentifier</a></td>
+                  <td>kas_id</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Alternative way to specify the active key using KAS ID and Key ID </p></td>
+                  <td><p>option (buf.validate.oneof).required = true; // TODO: enable this when we remove the deprecated field </p></td>
                 </tr>
               
                 <tr>
-                  <td>new_key</td>
-                  <td><a href="#policy.kasregistry.RotateKeyRequest.NewKey">RotateKeyRequest.NewKey</a></td>
+                  <td>name</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Information about the new key to be rotated in </p></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>uri</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
           </table>
 
           
+            
+            
+            <h4>Fields with deprecated option</h4>
+            <table>
+              <thead>
+                <tr>
+                  <td>Name</td>
+                  <td>Option</td>
+                </tr>
+              </thead>
+              <tbody>
+              
+                <tr>
+                  <td>id</td>
+                  <td><p>true</p></td>
+                </tr>
+              
+              </tbody>
+            </table>
+            
+          
 
         
       
-        <h3 id="policy.kasregistry.RotateKeyRequest.NewKey">RotateKeyRequest.NewKey</h3>
-        <p>Nested message for specifying the new key details</p>
+        <h3 id="policy.kasregistry.GetKeyAccessServerResponse">GetKeyAccessServerResponse</h3>
+        <p></p>
 
         
           <table class="field-table">
             <thead>
               <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
-                <tr>
-                  <td>key_id</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Required </p></td>
-                </tr>
-              
-                <tr>
-                  <td>algorithm</td>
-                  <td><a href="#policy.Algorithm">policy.Algorithm</a></td>
-                  <td></td>
-                  <td><p>Required </p></td>
-                </tr>
-              
-                <tr>
-                  <td>key_mode</td>
-                  <td><a href="#policy.KeyMode">policy.KeyMode</a></td>
-                  <td></td>
-                  <td><p>Required </p></td>
-                </tr>
+            </thead>
+            <tbody>
               
                 <tr>
-                  <td>public_key_ctx</td>
-                  <td><a href="#policy.PublicKeyCtx">policy.PublicKeyCtx</a></td>
+                  <td>key_access_server</td>
+                  <td><a href="#policy.KeyAccessServer">policy.KeyAccessServer</a></td>
                   <td></td>
-                  <td><p>Required </p></td>
+                  <td><p> </p></td>
                 </tr>
               
-                <tr>
-                  <td>private_key_ctx</td>
-                  <td><a href="#policy.PrivateKeyCtx">policy.PrivateKeyCtx</a></td>
-                  <td></td>
-                  <td><p>Required </p></td>
-                </tr>
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.kasregistry.GetKeyRequest">GetKeyRequest</h3>
+        <p>Retrieve an existing asymmetric key from the Key Management System</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
               
                 <tr>
-                  <td>provider_config_id</td>
+                  <td>id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Conditionally Required.
-
-Validation handled by message-level CEL </p></td>
+                  <td><p>The unique identifier of the key to retrieve </p></td>
                 </tr>
               
                 <tr>
-                  <td>metadata</td>
-                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
+                  <td>key</td>
+                  <td><a href="#policy.kasregistry.KasKeyIdentifier">KasKeyIdentifier</a></td>
                   <td></td>
-                  <td><p>Common metadata fields </p></td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
@@ -11265,8 +12056,8 @@ <h3 id="policy.kasregistry.RotateKeyRequest.NewKey">RotateKeyRequest.NewKey</h3>
 
         
       
-        <h3 id="policy.kasregistry.RotateKeyResponse">RotateKeyResponse</h3>
-        <p>Response message for the RotateKey request</p>
+        <h3 id="policy.kasregistry.GetKeyResponse">GetKeyResponse</h3>
+        <p>Response to a GetKeyRequest, containing the requested asymmetric key</p>
 
         
           <table class="field-table">
@@ -11279,14 +12070,7 @@ <h3 id="policy.kasregistry.RotateKeyResponse">RotateKeyResponse</h3>
                   <td>kas_key</td>
                   <td><a href="#policy.KasKey">policy.KasKey</a></td>
                   <td></td>
-                  <td><p>The newly rotated Kas Key </p></td>
-                </tr>
-              
-                <tr>
-                  <td>rotated_resources</td>
-                  <td><a href="#policy.kasregistry.RotatedResources">RotatedResources</a></td>
-                  <td></td>
-                  <td><p>All resources that were rotated as part of the key rotation process </p></td>
+                  <td><p>The requested asymmetric key for a KAS. </p></td>
                 </tr>
               
             </tbody>
@@ -11296,8 +12080,8 @@ <h3 id="policy.kasregistry.RotateKeyResponse">RotateKeyResponse</h3>
 
         
       
-        <h3 id="policy.kasregistry.RotatedResources">RotatedResources</h3>
-        <p>All resources that were rotated as part of the key rotation process</p>
+        <h3 id="policy.kasregistry.GetPublicKeyRequest">GetPublicKeyRequest</h3>
+        <p></p>
 
         
           <table class="field-table">
@@ -11307,30 +12091,33 @@ <h3 id="policy.kasregistry.RotatedResources">RotatedResources</h3>
             <tbody>
               
                 <tr>
-                  <td>rotated_out_key</td>
-                  <td><a href="#policy.KasKey">policy.KasKey</a></td>
+                  <td>id</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>The old key that was rotated out </p></td>
-                </tr>
-              
-                <tr>
-                  <td>attribute_definition_mappings</td>
-                  <td><a href="#policy.kasregistry.ChangeMappings">ChangeMappings</a></td>
-                  <td>repeated</td>
                   <td><p> </p></td>
                 </tr>
               
-                <tr>
-                  <td>attribute_value_mappings</td>
-                  <td><a href="#policy.kasregistry.ChangeMappings">ChangeMappings</a></td>
-                  <td>repeated</td>
-                  <td><p> </p></td>
-                </tr>
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.kasregistry.GetPublicKeyResponse">GetPublicKeyResponse</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
               
                 <tr>
-                  <td>namespace_mappings</td>
-                  <td><a href="#policy.kasregistry.ChangeMappings">ChangeMappings</a></td>
-                  <td>repeated</td>
+                  <td>key</td>
+                  <td><a href="#policy.Key">policy.Key</a></td>
+                  <td></td>
                   <td><p> </p></td>
                 </tr>
               
@@ -11341,8 +12128,8 @@ <h3 id="policy.kasregistry.RotatedResources">RotatedResources</h3>
 
         
       
-        <h3 id="policy.kasregistry.SetBaseKeyRequest">SetBaseKeyRequest</h3>
-        <p>Sets the specified key as the base key for the Key Access Server</p><p>Note: The key must be active.</p>
+        <h3 id="policy.kasregistry.GrantedPolicyObject">GrantedPolicyObject</h3>
+        <p>Can be namespace, attribute definition, or value</p>
 
         
           <table class="field-table">
@@ -11355,14 +12142,14 @@ <h3 id="policy.kasregistry.SetBaseKeyRequest">SetBaseKeyRequest</h3>
                   <td>id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Current Key UUID tp be set as default </p></td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>key</td>
-                  <td><a href="#policy.kasregistry.KasKeyIdentifier">KasKeyIdentifier</a></td>
+                  <td>fqn</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Alternative way to specify the key using KAS ID and Key ID </p></td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
@@ -11372,8 +12159,8 @@ <h3 id="policy.kasregistry.SetBaseKeyRequest">SetBaseKeyRequest</h3>
 
         
       
-        <h3 id="policy.kasregistry.SetBaseKeyResponse">SetBaseKeyResponse</h3>
-        <p></p>
+        <h3 id="policy.kasregistry.KasKeyIdentifier">KasKeyIdentifier</h3>
+        <p>Nested message for specifying the active key using KAS ID and Key ID</p>
 
         
           <table class="field-table">
@@ -11383,17 +12170,31 @@ <h3 id="policy.kasregistry.SetBaseKeyResponse">SetBaseKeyResponse</h3>
             <tbody>
               
                 <tr>
-                  <td>new_base_key</td>
-                  <td><a href="#policy.SimpleKasKey">policy.SimpleKasKey</a></td>
+                  <td>kas_id</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>The key that was set as base </p></td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>previous_base_key</td>
-                  <td><a href="#policy.SimpleKasKey">policy.SimpleKasKey</a></td>
+                  <td>name</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>The previous base key, if any </p></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>uri</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>kid</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Required Key ID of the key in question </p></td>
                 </tr>
               
             </tbody>
@@ -11403,7 +12204,7 @@ <h3 id="policy.kasregistry.SetBaseKeyResponse">SetBaseKeyResponse</h3>
 
         
       
-        <h3 id="policy.kasregistry.UpdateKeyAccessServerRequest">UpdateKeyAccessServerRequest</h3>
+        <h3 id="policy.kasregistry.KasKeysSort">KasKeysSort</h3>
         <p></p>
 
         
@@ -11414,57 +12215,61 @@ <h3 id="policy.kasregistry.UpdateKeyAccessServerRequest">UpdateKeyAccessServerRe
             <tbody>
               
                 <tr>
-                  <td>id</td>
-                  <td><a href="#string">string</a></td>
+                  <td>field</td>
+                  <td><a href="#policy.kasregistry.SortKasKeysType">SortKasKeysType</a></td>
                   <td></td>
-                  <td><p>Required </p></td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>uri</td>
-                  <td><a href="#string">string</a></td>
+                  <td>direction</td>
+                  <td><a href="#policy.SortDirection">policy.SortDirection</a></td>
                   <td></td>
-                  <td><p>Optional </p></td>
+                  <td><p> </p></td>
                 </tr>
               
-                <tr>
-                  <td>public_key</td>
-                  <td><a href="#policy.PublicKey">policy.PublicKey</a></td>
-                  <td></td>
-                  <td><p>Deprecated
-Optional </p></td>
-                </tr>
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.kasregistry.KeyAccessServerGrants">KeyAccessServerGrants</h3>
+        <p>Deprecated</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
               
                 <tr>
-                  <td>source_type</td>
-                  <td><a href="#policy.SourceType">policy.SourceType</a></td>
+                  <td>key_access_server</td>
+                  <td><a href="#policy.KeyAccessServer">policy.KeyAccessServer</a></td>
                   <td></td>
-                  <td><p>Optional
-Using UNSPECIFIED will result in a successful update,
-but will not actually update the underlying source.
-You should not update KAS&#39;s from INTERNAL/EXTERNAL
-to unspecified. </p></td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>name</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Optional </p></td>
+                  <td>namespace_grants</td>
+                  <td><a href="#policy.kasregistry.GrantedPolicyObject">GrantedPolicyObject</a></td>
+                  <td>repeated</td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>metadata</td>
-                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
-                  <td></td>
-                  <td><p>Optional
-Common metadata </p></td>
+                  <td>attribute_grants</td>
+                  <td><a href="#policy.kasregistry.GrantedPolicyObject">GrantedPolicyObject</a></td>
+                  <td>repeated</td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>metadata_update_behavior</td>
-                  <td><a href="#common.MetadataUpdateEnum">common.MetadataUpdateEnum</a></td>
-                  <td></td>
+                  <td>value_grants</td>
+                  <td><a href="#policy.kasregistry.GrantedPolicyObject">GrantedPolicyObject</a></td>
+                  <td>repeated</td>
                   <td><p> </p></td>
                 </tr>
               
@@ -11475,7 +12280,7 @@ <h3 id="policy.kasregistry.UpdateKeyAccessServerRequest">UpdateKeyAccessServerRe
 
         
       
-        <h3 id="policy.kasregistry.UpdateKeyAccessServerResponse">UpdateKeyAccessServerResponse</h3>
+        <h3 id="policy.kasregistry.KeyAccessServersSort">KeyAccessServersSort</h3>
         <p></p>
 
         
@@ -11486,8 +12291,15 @@ <h3 id="policy.kasregistry.UpdateKeyAccessServerResponse">UpdateKeyAccessServerR
             <tbody>
               
                 <tr>
-                  <td>key_access_server</td>
-                  <td><a href="#policy.KeyAccessServer">policy.KeyAccessServer</a></td>
+                  <td>field</td>
+                  <td><a href="#policy.kasregistry.SortKeyAccessServersType">SortKeyAccessServersType</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>direction</td>
+                  <td><a href="#policy.SortDirection">policy.SortDirection</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -11499,8 +12311,8 @@ <h3 id="policy.kasregistry.UpdateKeyAccessServerResponse">UpdateKeyAccessServerR
 
         
       
-        <h3 id="policy.kasregistry.UpdateKeyRequest">UpdateKeyRequest</h3>
-        <p>Update an existing asymmetric key in the Key Management System</p>
+        <h3 id="policy.kasregistry.KeyMapping">KeyMapping</h3>
+        <p></p>
 
         
           <table class="field-table">
@@ -11510,29 +12322,38 @@ <h3 id="policy.kasregistry.UpdateKeyRequest">UpdateKeyRequest</h3>
             <tbody>
               
                 <tr>
-                  <td>id</td>
+                  <td>kid</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Required
-
-The unique identifier of the key to update </p></td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>metadata</td>
-                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
+                  <td>kas_uri</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Optional
-Common metadata
-
-Mutable metadata for the key </p></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>namespace_mappings</td>
+                  <td><a href="#policy.kasregistry.MappedPolicyObject">MappedPolicyObject</a></td>
+                  <td>repeated</td>
+                  <td><p>List of namespaces mapped to the key </p></td>
+                </tr>
+              
+                <tr>
+                  <td>attribute_mappings</td>
+                  <td><a href="#policy.kasregistry.MappedPolicyObject">MappedPolicyObject</a></td>
+                  <td>repeated</td>
+                  <td><p>List of attribute definitions mapped to the key </p></td>
                 </tr>
               
                 <tr>
-                  <td>metadata_update_behavior</td>
-                  <td><a href="#common.MetadataUpdateEnum">common.MetadataUpdateEnum</a></td>
-                  <td></td>
-                  <td><p>The behavior for updating the metadata </p></td>
+                  <td>value_mappings</td>
+                  <td><a href="#policy.kasregistry.MappedPolicyObject">MappedPolicyObject</a></td>
+                  <td>repeated</td>
+                  <td><p>List of attribute values mapped to the key </p></td>
                 </tr>
               
             </tbody>
@@ -11542,8 +12363,8 @@ <h3 id="policy.kasregistry.UpdateKeyRequest">UpdateKeyRequest</h3>
 
         
       
-        <h3 id="policy.kasregistry.UpdateKeyResponse">UpdateKeyResponse</h3>
-        <p>Response to an UpdateKeyRequest, containing the updated asymmetric key</p>
+        <h3 id="policy.kasregistry.ListKeyAccessServerGrantsRequest">ListKeyAccessServerGrantsRequest</h3>
+        <p>LIST of KAS Grants returns flat response of grants to all policy objects. It</p><p>does not employ selectors for grants to specific policy objects or build the</p><p>attribute tree relation. If grants to a known namespace, attribute, or value</p><p>are needed, use the respective GET request to the specific policy object.</p>
 
         
           <table class="field-table">
@@ -11553,49 +12374,40 @@ <h3 id="policy.kasregistry.UpdateKeyResponse">UpdateKeyResponse</h3>
             <tbody>
               
                 <tr>
-                  <td>kas_key</td>
-                  <td><a href="#policy.KasKey">policy.KasKey</a></td>
+                  <td>kas_id</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>The updated kas key </p></td>
+                  <td><p>Optional
+Filter LIST by ID of a registered Key Access Server.
+If neither is provided, grants from all registered KASs to policy attribute
+objects are returned. </p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="policy.kasregistry.UpdatePublicKeyRequest">UpdatePublicKeyRequest</h3>
-        <p></p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
                 <tr>
-                  <td>id</td>
+                  <td>kas_uri</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Required </p></td>
+                  <td><p>Optional
+Filter LIST by URI of a registered Key Access Server.
+If none is provided, grants from all registered KASs to policy attribute
+objects are returned. </p></td>
                 </tr>
               
                 <tr>
-                  <td>metadata</td>
-                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
+                  <td>kas_name</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
                   <td><p>Optional
-Common metadata </p></td>
+Filter LIST by name of a registered Key Access Server.
+If none are provided, grants from all registered KASs to policy attribute
+objects are returned. </p></td>
                 </tr>
               
                 <tr>
-                  <td>metadata_update_behavior</td>
-                  <td><a href="#common.MetadataUpdateEnum">common.MetadataUpdateEnum</a></td>
+                  <td>pagination</td>
+                  <td><a href="#policy.PageRequest">policy.PageRequest</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Optional </p></td>
                 </tr>
               
             </tbody>
@@ -11605,8 +12417,8 @@ <h3 id="policy.kasregistry.UpdatePublicKeyRequest">UpdatePublicKeyRequest</h3>
 
         
       
-        <h3 id="policy.kasregistry.UpdatePublicKeyResponse">UpdatePublicKeyResponse</h3>
-        <p></p>
+        <h3 id="policy.kasregistry.ListKeyAccessServerGrantsResponse">ListKeyAccessServerGrantsResponse</h3>
+        <p>Deprecated</p>
 
         
           <table class="field-table">
@@ -11616,274 +12428,122 @@ <h3 id="policy.kasregistry.UpdatePublicKeyResponse">UpdatePublicKeyResponse</h3>
             <tbody>
               
                 <tr>
-                  <td>key</td>
-                  <td><a href="#policy.Key">policy.Key</a></td>
-                  <td></td>
-                  <td><p> </p></td>
+                  <td>grants</td>
+                  <td><a href="#policy.kasregistry.KeyAccessServerGrants">KeyAccessServerGrants</a></td>
+                  <td>repeated</td>
+                  <td><p><strong>Deprecated.</strong>  </p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
-          
-
-        
-      
-
-      
-        <h3 id="policy.kasregistry.SortKasKeysType">SortKasKeysType</h3>
-        <p></p>
-        <table class="enum-table">
-          <thead>
-            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
-          </thead>
-          <tbody>
-            
-              <tr>
-                <td>SORT_KAS_KEYS_TYPE_UNSPECIFIED</td>
-                <td>0</td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>SORT_KAS_KEYS_TYPE_KEY_ID</td>
-                <td>1</td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>SORT_KAS_KEYS_TYPE_CREATED_AT</td>
-                <td>2</td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>SORT_KAS_KEYS_TYPE_UPDATED_AT</td>
-                <td>3</td>
-                <td><p></p></td>
-              </tr>
-            
-          </tbody>
-        </table>
-      
-        <h3 id="policy.kasregistry.SortKeyAccessServersType">SortKeyAccessServersType</h3>
-        <p></p>
-        <table class="enum-table">
-          <thead>
-            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
-          </thead>
-          <tbody>
-            
-              <tr>
-                <td>SORT_KEY_ACCESS_SERVERS_TYPE_UNSPECIFIED</td>
-                <td>0</td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>SORT_KEY_ACCESS_SERVERS_TYPE_NAME</td>
-                <td>1</td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>SORT_KEY_ACCESS_SERVERS_TYPE_URI</td>
-                <td>2</td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>SORT_KEY_ACCESS_SERVERS_TYPE_CREATED_AT</td>
-                <td>3</td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>SORT_KEY_ACCESS_SERVERS_TYPE_UPDATED_AT</td>
-                <td>4</td>
-                <td><p></p></td>
-              </tr>
-            
-          </tbody>
-        </table>
-      
-
-      
-
-      
-        <h3 id="policy.kasregistry.KeyAccessServerRegistryService">KeyAccessServerRegistryService</h3>
-        <p></p>
-        <table class="enum-table">
-          <thead>
-            <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
-          </thead>
-          <tbody>
-            
-              <tr>
-                <td>ListKeyAccessServers</td>
-                <td><a href="#policy.kasregistry.ListKeyAccessServersRequest">ListKeyAccessServersRequest</a></td>
-                <td><a href="#policy.kasregistry.ListKeyAccessServersResponse">ListKeyAccessServersResponse</a></td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>GetKeyAccessServer</td>
-                <td><a href="#policy.kasregistry.GetKeyAccessServerRequest">GetKeyAccessServerRequest</a></td>
-                <td><a href="#policy.kasregistry.GetKeyAccessServerResponse">GetKeyAccessServerResponse</a></td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>CreateKeyAccessServer</td>
-                <td><a href="#policy.kasregistry.CreateKeyAccessServerRequest">CreateKeyAccessServerRequest</a></td>
-                <td><a href="#policy.kasregistry.CreateKeyAccessServerResponse">CreateKeyAccessServerResponse</a></td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>UpdateKeyAccessServer</td>
-                <td><a href="#policy.kasregistry.UpdateKeyAccessServerRequest">UpdateKeyAccessServerRequest</a></td>
-                <td><a href="#policy.kasregistry.UpdateKeyAccessServerResponse">UpdateKeyAccessServerResponse</a></td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>DeleteKeyAccessServer</td>
-                <td><a href="#policy.kasregistry.DeleteKeyAccessServerRequest">DeleteKeyAccessServerRequest</a></td>
-                <td><a href="#policy.kasregistry.DeleteKeyAccessServerResponse">DeleteKeyAccessServerResponse</a></td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>ListKeyAccessServerGrants</td>
-                <td><a href="#policy.kasregistry.ListKeyAccessServerGrantsRequest">ListKeyAccessServerGrantsRequest</a></td>
-                <td><a href="#policy.kasregistry.ListKeyAccessServerGrantsResponse">ListKeyAccessServerGrantsResponse</a></td>
-                <td><p>Deprecated</p></td>
-              </tr>
-            
-              <tr>
-                <td>CreateKey</td>
-                <td><a href="#policy.kasregistry.CreateKeyRequest">CreateKeyRequest</a></td>
-                <td><a href="#policy.kasregistry.CreateKeyResponse">CreateKeyResponse</a></td>
-                <td><p>KAS Key Management
-Request to create a new key in the Key Access Service.</p></td>
-              </tr>
-            
-              <tr>
-                <td>GetKey</td>
-                <td><a href="#policy.kasregistry.GetKeyRequest">GetKeyRequest</a></td>
-                <td><a href="#policy.kasregistry.GetKeyResponse">GetKeyResponse</a></td>
-                <td><p>Request to retrieve a key from the Key Access Service.</p></td>
-              </tr>
-            
-              <tr>
-                <td>ListKeys</td>
-                <td><a href="#policy.kasregistry.ListKeysRequest">ListKeysRequest</a></td>
-                <td><a href="#policy.kasregistry.ListKeysResponse">ListKeysResponse</a></td>
-                <td><p>Request to list keys in the Key Access Service.</p></td>
-              </tr>
-            
-              <tr>
-                <td>UpdateKey</td>
-                <td><a href="#policy.kasregistry.UpdateKeyRequest">UpdateKeyRequest</a></td>
-                <td><a href="#policy.kasregistry.UpdateKeyResponse">UpdateKeyResponse</a></td>
-                <td><p>Request to update a key in the Key Access Service.</p></td>
-              </tr>
-            
-              <tr>
-                <td>RotateKey</td>
-                <td><a href="#policy.kasregistry.RotateKeyRequest">RotateKeyRequest</a></td>
-                <td><a href="#policy.kasregistry.RotateKeyResponse">RotateKeyResponse</a></td>
-                <td><p>Request to rotate a key in the Key Access Service.</p></td>
-              </tr>
-            
-              <tr>
-                <td>SetBaseKey</td>
-                <td><a href="#policy.kasregistry.SetBaseKeyRequest">SetBaseKeyRequest</a></td>
-                <td><a href="#policy.kasregistry.SetBaseKeyResponse">SetBaseKeyResponse</a></td>
-                <td><p>Request to set the default a default kas key.</p></td>
-              </tr>
+                <tr>
+                  <td>pagination</td>
+                  <td><a href="#policy.PageResponse">policy.PageResponse</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
             
-              <tr>
-                <td>GetBaseKey</td>
-                <td><a href="#policy.kasregistry.GetBaseKeyRequest">GetBaseKeyRequest</a></td>
-                <td><a href="#policy.kasregistry.GetBaseKeyResponse">GetBaseKeyResponse</a></td>
-                <td><p>Get Default kas keys</p></td>
-              </tr>
             
-              <tr>
-                <td>ListKeyMappings</td>
-                <td><a href="#policy.kasregistry.ListKeyMappingsRequest">ListKeyMappingsRequest</a></td>
-                <td><a href="#policy.kasregistry.ListKeyMappingsResponse">ListKeyMappingsResponse</a></td>
-                <td><p>Request to list key mappings in the Key Access Service.</p></td>
-              </tr>
+            <h4>Fields with deprecated option</h4>
+            <table>
+              <thead>
+                <tr>
+                  <td>Name</td>
+                  <td>Option</td>
+                </tr>
+              </thead>
+              <tbody>
+              
+                <tr>
+                  <td>grants</td>
+                  <td><p>true</p></td>
+                </tr>
+              
+              </tbody>
+            </table>
             
-          </tbody>
-        </table>
+          
 
         
-          
-          
-          <h4>Methods with deprecated option</h4>
-          <table>
+      
+        <h3 id="policy.kasregistry.ListKeyAccessServersRequest">ListKeyAccessServersRequest</h3>
+        <p></p>
+
+        
+          <table class="field-table">
             <thead>
-              <tr>
-                <td>Method Name</td>
-                <td>Option</td>
-              </tr>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
             </thead>
             <tbody>
-            
-              <tr>
-                <td>ListKeyAccessServerGrants</td>
-                <td><p>true</p></td>
-              </tr>
-            
+              
+                <tr>
+                  <td>pagination</td>
+                  <td><a href="#policy.PageRequest">policy.PageRequest</a></td>
+                  <td></td>
+                  <td><p>Optional </p></td>
+                </tr>
+              
+                <tr>
+                  <td>sort</td>
+                  <td><a href="#policy.kasregistry.KeyAccessServersSort">KeyAccessServersSort</a></td>
+                  <td>repeated</td>
+                  <td><p>Optional - CONSTRAINT: max 1 item
+Sort defaults:
+  - direction UNSPECIFIED defaults to DESC for the specified field
+  - field UNSPECIFIED defaults to created_at with the specified direction
+  - both UNSPECIFIED or sort omitted defaults to created_at DESC </p></td>
+                </tr>
+              
+                <tr>
+                  <td>search</td>
+                  <td><a href="#policy.Search">policy.Search</a></td>
+                  <td></td>
+                  <td><p>Optional </p></td>
+                </tr>
+              
             </tbody>
           </table>
+
           
+
         
-          
-          
-          <h4>Methods with idempotency_level option</h4>
-          <table>
+      
+        <h3 id="policy.kasregistry.ListKeyAccessServersResponse">ListKeyAccessServersResponse</h3>
+        <p></p>
+
+        
+          <table class="field-table">
             <thead>
-              <tr>
-                <td>Method Name</td>
-                <td>Option</td>
-              </tr>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
             </thead>
             <tbody>
-            
-              <tr>
-                <td>ListKeyAccessServers</td>
-                <td><p>NO_SIDE_EFFECTS</p></td>
-              </tr>
-            
-              <tr>
-                <td>GetKeyAccessServer</td>
-                <td><p>NO_SIDE_EFFECTS</p></td>
-              </tr>
-            
-              <tr>
-                <td>ListKeyAccessServerGrants</td>
-                <td><p>NO_SIDE_EFFECTS</p></td>
-              </tr>
-            
+              
+                <tr>
+                  <td>key_access_servers</td>
+                  <td><a href="#policy.KeyAccessServer">policy.KeyAccessServer</a></td>
+                  <td>repeated</td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>pagination</td>
+                  <td><a href="#policy.PageResponse">policy.PageResponse</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
             </tbody>
           </table>
+
           
-        
-    
-      
-      <div class="file-heading">
-        <h2 id="policy/keymanagement/key_management.proto">policy/keymanagement/key_management.proto</h2><a href="#title">Top</a>
-      </div>
-      <p></p>
 
+        
       
-        <h3 id="policy.keymanagement.CreateProviderConfigRequest">CreateProviderConfigRequest</h3>
-        <p>Provider Configuration Requests and Response Messages</p>
+        <h3 id="policy.kasregistry.ListKeyMappingsRequest">ListKeyMappingsRequest</h3>
+        <p></p>
 
         
           <table class="field-table">
@@ -11893,34 +12553,24 @@ <h3 id="policy.keymanagement.CreateProviderConfigRequest">CreateProviderConfigRe
             <tbody>
               
                 <tr>
-                  <td>name</td>
+                  <td>id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Required
-The name of the key provider. (e.g. &#34;AWS KMS Instance 1&#34;, &#34;Google Cloud KMS Instance 2&#34;) </p></td>
-                </tr>
-              
-                <tr>
-                  <td>config_json</td>
-                  <td><a href="#bytes">bytes</a></td>
-                  <td></td>
-                  <td><p>Required
-JSON configuration for the key provider. This is unique to individual key providers. </p></td>
+                  <td><p>The unique identifier of the key to retrieve </p></td>
                 </tr>
               
                 <tr>
-                  <td>manager</td>
-                  <td><a href="#string">string</a></td>
+                  <td>key</td>
+                  <td><a href="#policy.kasregistry.KasKeyIdentifier">KasKeyIdentifier</a></td>
                   <td></td>
-                  <td><p>Required
-The type of key manager (e.g. &#34;aws&#34;, &#34;gcp&#34;, &#34;azure&#34;, &#34;opentdf.io/basic&#34;) </p></td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>metadata</td>
-                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
+                  <td>pagination</td>
+                  <td><a href="#policy.PageRequest">policy.PageRequest</a></td>
                   <td></td>
-                  <td><p>Common metadata </p></td>
+                  <td><p>Pagination request for the list of keys </p></td>
                 </tr>
               
             </tbody>
@@ -11930,7 +12580,7 @@ <h3 id="policy.keymanagement.CreateProviderConfigRequest">CreateProviderConfigRe
 
         
       
-        <h3 id="policy.keymanagement.CreateProviderConfigResponse">CreateProviderConfigResponse</h3>
+        <h3 id="policy.kasregistry.ListKeyMappingsResponse">ListKeyMappingsResponse</h3>
         <p></p>
 
         
@@ -11941,10 +12591,17 @@ <h3 id="policy.keymanagement.CreateProviderConfigResponse">CreateProviderConfigR
             <tbody>
               
                 <tr>
-                  <td>provider_config</td>
-                  <td><a href="#policy.KeyProviderConfig">policy.KeyProviderConfig</a></td>
+                  <td>key_mappings</td>
+                  <td><a href="#policy.kasregistry.KeyMapping">KeyMapping</a></td>
+                  <td>repeated</td>
+                  <td><p>The list of key mappings </p></td>
+                </tr>
+              
+                <tr>
+                  <td>pagination</td>
+                  <td><a href="#policy.PageResponse">policy.PageResponse</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Pagination response for the list of keys </p></td>
                 </tr>
               
             </tbody>
@@ -11954,8 +12611,8 @@ <h3 id="policy.keymanagement.CreateProviderConfigResponse">CreateProviderConfigR
 
         
       
-        <h3 id="policy.keymanagement.DeleteProviderConfigRequest">DeleteProviderConfigRequest</h3>
-        <p>In order to delete a provider configuration you must first delete all keys associated with the provider.</p>
+        <h3 id="policy.kasregistry.ListKeysRequest">ListKeysRequest</h3>
+        <p>List all asymmetric keys managed by a specific Key Access Server or with a given algorithm</p>
 
         
           <table class="field-table">
@@ -11965,10 +12622,67 @@ <h3 id="policy.keymanagement.DeleteProviderConfigRequest">DeleteProviderConfigRe
             <tbody>
               
                 <tr>
-                  <td>id</td>
+                  <td>key_algorithm</td>
+                  <td><a href="#policy.Algorithm">policy.Algorithm</a></td>
+                  <td></td>
+                  <td><p>Filter keys by algorithm </p></td>
+                </tr>
+              
+                <tr>
+                  <td>kas_id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Required </p></td>
+                  <td><p>Filter keys by the KAS ID </p></td>
+                </tr>
+              
+                <tr>
+                  <td>kas_name</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Filter keys by the KAS name </p></td>
+                </tr>
+              
+                <tr>
+                  <td>kas_uri</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Filter keys by the KAS URI </p></td>
+                </tr>
+              
+                <tr>
+                  <td>legacy</td>
+                  <td><a href="#bool">bool</a></td>
+                  <td>optional</td>
+                  <td><p>Optional
+
+Filter for legacy keys </p></td>
+                </tr>
+              
+                <tr>
+                  <td>pagination</td>
+                  <td><a href="#policy.PageRequest">policy.PageRequest</a></td>
+                  <td></td>
+                  <td><p>Optional
+
+Pagination request for the list of keys </p></td>
+                </tr>
+              
+                <tr>
+                  <td>sort</td>
+                  <td><a href="#policy.kasregistry.KasKeysSort">KasKeysSort</a></td>
+                  <td>repeated</td>
+                  <td><p>Optional - CONSTRAINT: max 1 item
+Sort defaults:
+  - direction UNSPECIFIED defaults to DESC for the specified field
+  - field UNSPECIFIED defaults to created_at with the specified direction
+  - both UNSPECIFIED or sort omitted defaults to created_at DESC </p></td>
+                </tr>
+              
+                <tr>
+                  <td>search</td>
+                  <td><a href="#policy.Search">policy.Search</a></td>
+                  <td></td>
+                  <td><p>Optional </p></td>
                 </tr>
               
             </tbody>
@@ -11978,8 +12692,8 @@ <h3 id="policy.keymanagement.DeleteProviderConfigRequest">DeleteProviderConfigRe
 
         
       
-        <h3 id="policy.keymanagement.DeleteProviderConfigResponse">DeleteProviderConfigResponse</h3>
-        <p></p>
+        <h3 id="policy.kasregistry.ListKeysResponse">ListKeysResponse</h3>
+        <p>Response to a ListKeysRequest, containing the list of asymmetric keys and pagination information</p>
 
         
           <table class="field-table">
@@ -11989,10 +12703,17 @@ <h3 id="policy.keymanagement.DeleteProviderConfigResponse">DeleteProviderConfigR
             <tbody>
               
                 <tr>
-                  <td>provider_config</td>
-                  <td><a href="#policy.KeyProviderConfig">policy.KeyProviderConfig</a></td>
+                  <td>kas_keys</td>
+                  <td><a href="#policy.KasKey">policy.KasKey</a></td>
+                  <td>repeated</td>
+                  <td><p>The list of kas keys </p></td>
+                </tr>
+              
+                <tr>
+                  <td>pagination</td>
+                  <td><a href="#policy.PageResponse">policy.PageResponse</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Pagination response for the list of keys </p></td>
                 </tr>
               
             </tbody>
@@ -12002,7 +12723,7 @@ <h3 id="policy.keymanagement.DeleteProviderConfigResponse">DeleteProviderConfigR
 
         
       
-        <h3 id="policy.keymanagement.GetProviderConfigRequest">GetProviderConfigRequest</h3>
+        <h3 id="policy.kasregistry.ListPublicKeyMappingRequest">ListPublicKeyMappingRequest</h3>
         <p></p>
 
         
@@ -12013,67 +12734,33 @@ <h3 id="policy.keymanagement.GetProviderConfigRequest">GetProviderConfigRequest<
             <tbody>
               
                 <tr>
-                  <td>id</td>
+                  <td>kas_id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Optional </p></td>
                 </tr>
               
                 <tr>
-                  <td>name</td>
+                  <td>kas_name</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Optional </p></td>
                 </tr>
               
                 <tr>
-                  <td>manager</td>
+                  <td>kas_uri</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Optional - filter by manager type when searching by name </p></td>
+                  <td><p>Optional </p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="policy.keymanagement.GetProviderConfigResponse">GetProviderConfigResponse</h3>
-        <p></p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
                 <tr>
-                  <td>provider_config</td>
-                  <td><a href="#policy.KeyProviderConfig">policy.KeyProviderConfig</a></td>
+                  <td>public_key_id</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Optional Public Key ID </p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="policy.keymanagement.ListProviderConfigsRequest">ListProviderConfigsRequest</h3>
-        <p></p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
                 <tr>
                   <td>pagination</td>
                   <td><a href="#policy.PageRequest">policy.PageRequest</a></td>
@@ -12088,7 +12775,7 @@ <h3 id="policy.keymanagement.ListProviderConfigsRequest">ListProviderConfigsRequ
 
         
       
-        <h3 id="policy.keymanagement.ListProviderConfigsResponse">ListProviderConfigsResponse</h3>
+        <h3 id="policy.kasregistry.ListPublicKeyMappingResponse">ListPublicKeyMappingResponse</h3>
         <p></p>
 
         
@@ -12099,8 +12786,8 @@ <h3 id="policy.keymanagement.ListProviderConfigsResponse">ListProviderConfigsRes
             <tbody>
               
                 <tr>
-                  <td>provider_configs</td>
-                  <td><a href="#policy.KeyProviderConfig">policy.KeyProviderConfig</a></td>
+                  <td>public_key_mappings</td>
+                  <td><a href="#policy.kasregistry.ListPublicKeyMappingResponse.PublicKeyMapping">ListPublicKeyMappingResponse.PublicKeyMapping</a></td>
                   <td>repeated</td>
                   <td><p> </p></td>
                 </tr>
@@ -12119,7 +12806,7 @@ <h3 id="policy.keymanagement.ListProviderConfigsResponse">ListProviderConfigsRes
 
         
       
-        <h3 id="policy.keymanagement.UpdateProviderConfigRequest">UpdateProviderConfigRequest</h3>
+        <h3 id="policy.kasregistry.ListPublicKeyMappingResponse.Association">ListPublicKeyMappingResponse.Association</h3>
         <p></p>
 
         
@@ -12133,42 +12820,13 @@ <h3 id="policy.keymanagement.UpdateProviderConfigRequest">UpdateProviderConfigRe
                   <td>id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Required </p></td>
-                </tr>
-              
-                <tr>
-                  <td>name</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Optional </p></td>
-                </tr>
-              
-                <tr>
-                  <td>config_json</td>
-                  <td><a href="#bytes">bytes</a></td>
-                  <td></td>
-                  <td><p>Optional </p></td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>manager</td>
+                  <td>fqn</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Optional </p></td>
-                </tr>
-              
-                <tr>
-                  <td>metadata</td>
-                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
-                  <td></td>
-                  <td><p>Optional
-Common metadata </p></td>
-                </tr>
-              
-                <tr>
-                  <td>metadata_update_behavior</td>
-                  <td><a href="#common.MetadataUpdateEnum">common.MetadataUpdateEnum</a></td>
-                  <td></td>
                   <td><p> </p></td>
                 </tr>
               
@@ -12179,7 +12837,7 @@ <h3 id="policy.keymanagement.UpdateProviderConfigRequest">UpdateProviderConfigRe
 
         
       
-        <h3 id="policy.keymanagement.UpdateProviderConfigResponse">UpdateProviderConfigResponse</h3>
+        <h3 id="policy.kasregistry.ListPublicKeyMappingResponse.PublicKey">ListPublicKeyMappingResponse.PublicKey</h3>
         <p></p>
 
         
@@ -12190,12 +12848,33 @@ <h3 id="policy.keymanagement.UpdateProviderConfigResponse">UpdateProviderConfigR
             <tbody>
               
                 <tr>
-                  <td>provider_config</td>
-                  <td><a href="#policy.KeyProviderConfig">policy.KeyProviderConfig</a></td>
+                  <td>key</td>
+                  <td><a href="#policy.Key">policy.Key</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
               
+                <tr>
+                  <td>values</td>
+                  <td><a href="#policy.kasregistry.ListPublicKeyMappingResponse.Association">ListPublicKeyMappingResponse.Association</a></td>
+                  <td>repeated</td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>definitions</td>
+                  <td><a href="#policy.kasregistry.ListPublicKeyMappingResponse.Association">ListPublicKeyMappingResponse.Association</a></td>
+                  <td>repeated</td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>namespaces</td>
+                  <td><a href="#policy.kasregistry.ListPublicKeyMappingResponse.Association">ListPublicKeyMappingResponse.Association</a></td>
+                  <td>repeated</td>
+                  <td><p> </p></td>
+                </tr>
+              
             </tbody>
           </table>
 
@@ -12203,70 +12882,8 @@ <h3 id="policy.keymanagement.UpdateProviderConfigResponse">UpdateProviderConfigR
 
         
       
-
-      
-
-      
-
-      
-        <h3 id="policy.keymanagement.KeyManagementService">KeyManagementService</h3>
+        <h3 id="policy.kasregistry.ListPublicKeyMappingResponse.PublicKeyMapping">ListPublicKeyMappingResponse.PublicKeyMapping</h3>
         <p></p>
-        <table class="enum-table">
-          <thead>
-            <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
-          </thead>
-          <tbody>
-            
-              <tr>
-                <td>CreateProviderConfig</td>
-                <td><a href="#policy.keymanagement.CreateProviderConfigRequest">CreateProviderConfigRequest</a></td>
-                <td><a href="#policy.keymanagement.CreateProviderConfigResponse">CreateProviderConfigResponse</a></td>
-                <td><p>Key Management
-Provider Management</p></td>
-              </tr>
-            
-              <tr>
-                <td>GetProviderConfig</td>
-                <td><a href="#policy.keymanagement.GetProviderConfigRequest">GetProviderConfigRequest</a></td>
-                <td><a href="#policy.keymanagement.GetProviderConfigResponse">GetProviderConfigResponse</a></td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>ListProviderConfigs</td>
-                <td><a href="#policy.keymanagement.ListProviderConfigsRequest">ListProviderConfigsRequest</a></td>
-                <td><a href="#policy.keymanagement.ListProviderConfigsResponse">ListProviderConfigsResponse</a></td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>UpdateProviderConfig</td>
-                <td><a href="#policy.keymanagement.UpdateProviderConfigRequest">UpdateProviderConfigRequest</a></td>
-                <td><a href="#policy.keymanagement.UpdateProviderConfigResponse">UpdateProviderConfigResponse</a></td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>DeleteProviderConfig</td>
-                <td><a href="#policy.keymanagement.DeleteProviderConfigRequest">DeleteProviderConfigRequest</a></td>
-                <td><a href="#policy.keymanagement.DeleteProviderConfigResponse">DeleteProviderConfigResponse</a></td>
-                <td><p></p></td>
-              </tr>
-            
-          </tbody>
-        </table>
-
-        
-    
-      
-      <div class="file-heading">
-        <h2 id="policy/namespaces/namespaces.proto">policy/namespaces/namespaces.proto</h2><a href="#title">Top</a>
-      </div>
-      <p></p>
-
-      
-        <h3 id="policy.namespaces.AssignKeyAccessServerToNamespaceRequest">AssignKeyAccessServerToNamespaceRequest</h3>
-        <p>Deprecated: utilize AssignPublicKeyToNamespaceRequest</p>
 
         
           <table class="field-table">
@@ -12276,36 +12893,33 @@ <h3 id="policy.namespaces.AssignKeyAccessServerToNamespaceRequest">AssignKeyAcce
             <tbody>
               
                 <tr>
-                  <td>namespace_key_access_server</td>
-                  <td><a href="#policy.namespaces.NamespaceKeyAccessServer">NamespaceKeyAccessServer</a></td>
+                  <td>kas_id</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="policy.namespaces.AssignKeyAccessServerToNamespaceResponse">AssignKeyAccessServerToNamespaceResponse</h3>
-        <p></p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
+                <tr>
+                  <td>kas_name</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
               
                 <tr>
-                  <td>namespace_key_access_server</td>
-                  <td><a href="#policy.namespaces.NamespaceKeyAccessServer">NamespaceKeyAccessServer</a></td>
+                  <td>kas_uri</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
               
+                <tr>
+                  <td>public_keys</td>
+                  <td><a href="#policy.kasregistry.ListPublicKeyMappingResponse.PublicKey">ListPublicKeyMappingResponse.PublicKey</a></td>
+                  <td>repeated</td>
+                  <td><p> </p></td>
+                </tr>
+              
             </tbody>
           </table>
 
@@ -12313,8 +12927,8 @@ <h3 id="policy.namespaces.AssignKeyAccessServerToNamespaceResponse">AssignKeyAcc
 
         
       
-        <h3 id="policy.namespaces.AssignPublicKeyToNamespaceRequest">AssignPublicKeyToNamespaceRequest</h3>
-        <p>Assign Key to Namespace</p>
+        <h3 id="policy.kasregistry.ListPublicKeysRequest">ListPublicKeysRequest</h3>
+        <p></p>
 
         
           <table class="field-table">
@@ -12324,10 +12938,31 @@ <h3 id="policy.namespaces.AssignPublicKeyToNamespaceRequest">AssignPublicKeyToNa
             <tbody>
               
                 <tr>
-                  <td>namespace_key</td>
-                  <td><a href="#policy.namespaces.NamespaceKey">NamespaceKey</a></td>
+                  <td>kas_id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Optional </p></td>
+                </tr>
+              
+                <tr>
+                  <td>kas_name</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Optional </p></td>
+                </tr>
+              
+                <tr>
+                  <td>kas_uri</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Optional </p></td>
+                </tr>
+              
+                <tr>
+                  <td>pagination</td>
+                  <td><a href="#policy.PageRequest">policy.PageRequest</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Optional </p></td>
                 </tr>
               
             </tbody>
@@ -12337,7 +12972,7 @@ <h3 id="policy.namespaces.AssignPublicKeyToNamespaceRequest">AssignPublicKeyToNa
 
         
       
-        <h3 id="policy.namespaces.AssignPublicKeyToNamespaceResponse">AssignPublicKeyToNamespaceResponse</h3>
+        <h3 id="policy.kasregistry.ListPublicKeysResponse">ListPublicKeysResponse</h3>
         <p></p>
 
         
@@ -12348,8 +12983,15 @@ <h3 id="policy.namespaces.AssignPublicKeyToNamespaceResponse">AssignPublicKeyToN
             <tbody>
               
                 <tr>
-                  <td>namespace_key</td>
-                  <td><a href="#policy.namespaces.NamespaceKey">NamespaceKey</a></td>
+                  <td>keys</td>
+                  <td><a href="#policy.Key">policy.Key</a></td>
+                  <td>repeated</td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>pagination</td>
+                  <td><a href="#policy.PageResponse">policy.PageResponse</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -12361,7 +13003,7 @@ <h3 id="policy.namespaces.AssignPublicKeyToNamespaceResponse">AssignPublicKeyToN
 
         
       
-        <h3 id="policy.namespaces.CreateNamespaceRequest">CreateNamespaceRequest</h3>
+        <h3 id="policy.kasregistry.MappedPolicyObject">MappedPolicyObject</h3>
         <p></p>
 
         
@@ -12372,17 +13014,17 @@ <h3 id="policy.namespaces.CreateNamespaceRequest">CreateNamespaceRequest</h3>
             <tbody>
               
                 <tr>
-                  <td>name</td>
+                  <td>id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Required </p></td>
+                  <td><p>The unique identifier of the policy object </p></td>
                 </tr>
               
                 <tr>
-                  <td>metadata</td>
-                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
+                  <td>fqn</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Optional </p></td>
+                  <td><p>The fully qualified name of the policy object </p></td>
                 </tr>
               
             </tbody>
@@ -12392,7 +13034,7 @@ <h3 id="policy.namespaces.CreateNamespaceRequest">CreateNamespaceRequest</h3>
 
         
       
-        <h3 id="policy.namespaces.CreateNamespaceResponse">CreateNamespaceResponse</h3>
+        <h3 id="policy.kasregistry.RotateKeyRequest">RotateKeyRequest</h3>
         <p></p>
 
         
@@ -12403,10 +13045,24 @@ <h3 id="policy.namespaces.CreateNamespaceResponse">CreateNamespaceResponse</h3>
             <tbody>
               
                 <tr>
-                  <td>namespace</td>
-                  <td><a href="#policy.Namespace">policy.Namespace</a></td>
+                  <td>id</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Current Active Key UUID </p></td>
+                </tr>
+              
+                <tr>
+                  <td>key</td>
+                  <td><a href="#policy.kasregistry.KasKeyIdentifier">KasKeyIdentifier</a></td>
+                  <td></td>
+                  <td><p>Alternative way to specify the active key using KAS ID and Key ID </p></td>
+                </tr>
+              
+                <tr>
+                  <td>new_key</td>
+                  <td><a href="#policy.kasregistry.RotateKeyRequest.NewKey">RotateKeyRequest.NewKey</a></td>
+                  <td></td>
+                  <td><p>Information about the new key to be rotated in </p></td>
                 </tr>
               
             </tbody>
@@ -12416,8 +13072,8 @@ <h3 id="policy.namespaces.CreateNamespaceResponse">CreateNamespaceResponse</h3>
 
         
       
-        <h3 id="policy.namespaces.DeactivateNamespaceRequest">DeactivateNamespaceRequest</h3>
-        <p></p>
+        <h3 id="policy.kasregistry.RotateKeyRequest.NewKey">RotateKeyRequest.NewKey</h3>
+        <p>Nested message for specifying the new key details</p>
 
         
           <table class="field-table">
@@ -12427,87 +13083,65 @@ <h3 id="policy.namespaces.DeactivateNamespaceRequest">DeactivateNamespaceRequest
             <tbody>
               
                 <tr>
-                  <td>id</td>
+                  <td>key_id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
                   <td><p>Required </p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="policy.namespaces.DeactivateNamespaceResponse">DeactivateNamespaceResponse</h3>
-        <p></p>
-
-        
-
-        
-      
-        <h3 id="policy.namespaces.GetNamespaceRequest">GetNamespaceRequest</h3>
-        <p></p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
+                <tr>
+                  <td>algorithm</td>
+                  <td><a href="#policy.Algorithm">policy.Algorithm</a></td>
+                  <td></td>
+                  <td><p>Required </p></td>
+                </tr>
               
                 <tr>
-                  <td>id</td>
-                  <td><a href="#string">string</a></td>
+                  <td>key_mode</td>
+                  <td><a href="#policy.KeyMode">policy.KeyMode</a></td>
                   <td></td>
-                  <td><p><strong>Deprecated.</strong> Deprecated </p></td>
+                  <td><p>Required </p></td>
                 </tr>
               
                 <tr>
-                  <td>namespace_id</td>
-                  <td><a href="#string">string</a></td>
+                  <td>public_key_ctx</td>
+                  <td><a href="#policy.PublicKeyCtx">policy.PublicKeyCtx</a></td>
                   <td></td>
-                  <td><p>option (buf.validate.oneof).required = true; // TODO: enable this when we remove the deprecated field </p></td>
+                  <td><p>Required </p></td>
                 </tr>
               
                 <tr>
-                  <td>fqn</td>
-                  <td><a href="#string">string</a></td>
+                  <td>private_key_ctx</td>
+                  <td><a href="#policy.PrivateKeyCtx">policy.PrivateKeyCtx</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Required </p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
-          
-            
-            
-            <h4>Fields with deprecated option</h4>
-            <table>
-              <thead>
                 <tr>
-                  <td>Name</td>
-                  <td>Option</td>
+                  <td>provider_config_id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Conditionally Required.
+
+Validation handled by message-level CEL </p></td>
                 </tr>
-              </thead>
-              <tbody>
               
                 <tr>
-                  <td>id</td>
-                  <td><p>true</p></td>
+                  <td>metadata</td>
+                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
+                  <td></td>
+                  <td><p>Common metadata fields </p></td>
                 </tr>
               
-              </tbody>
-            </table>
-            
+            </tbody>
+          </table>
+
           
 
         
       
-        <h3 id="policy.namespaces.GetNamespaceResponse">GetNamespaceResponse</h3>
-        <p></p>
+        <h3 id="policy.kasregistry.RotateKeyResponse">RotateKeyResponse</h3>
+        <p>Response message for the RotateKey request</p>
 
         
           <table class="field-table">
@@ -12517,10 +13151,17 @@ <h3 id="policy.namespaces.GetNamespaceResponse">GetNamespaceResponse</h3>
             <tbody>
               
                 <tr>
-                  <td>namespace</td>
-                  <td><a href="#policy.Namespace">policy.Namespace</a></td>
+                  <td>kas_key</td>
+                  <td><a href="#policy.KasKey">policy.KasKey</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>The newly rotated Kas Key </p></td>
+                </tr>
+              
+                <tr>
+                  <td>rotated_resources</td>
+                  <td><a href="#policy.kasregistry.RotatedResources">RotatedResources</a></td>
+                  <td></td>
+                  <td><p>All resources that were rotated as part of the key rotation process </p></td>
                 </tr>
               
             </tbody>
@@ -12530,8 +13171,8 @@ <h3 id="policy.namespaces.GetNamespaceResponse">GetNamespaceResponse</h3>
 
         
       
-        <h3 id="policy.namespaces.ListNamespacesRequest">ListNamespacesRequest</h3>
-        <p></p>
+        <h3 id="policy.kasregistry.RotatedResources">RotatedResources</h3>
+        <p>All resources that were rotated as part of the key rotation process</p>
 
         
           <table class="field-table">
@@ -12541,36 +13182,31 @@ <h3 id="policy.namespaces.ListNamespacesRequest">ListNamespacesRequest</h3>
             <tbody>
               
                 <tr>
-                  <td>state</td>
-                  <td><a href="#common.ActiveStateEnum">common.ActiveStateEnum</a></td>
+                  <td>rotated_out_key</td>
+                  <td><a href="#policy.KasKey">policy.KasKey</a></td>
                   <td></td>
-                  <td><p>Optional
-ACTIVE by default when not specified </p></td>
+                  <td><p>The old key that was rotated out </p></td>
                 </tr>
               
                 <tr>
-                  <td>pagination</td>
-                  <td><a href="#policy.PageRequest">policy.PageRequest</a></td>
-                  <td></td>
-                  <td><p>Optional </p></td>
+                  <td>attribute_definition_mappings</td>
+                  <td><a href="#policy.kasregistry.ChangeMappings">ChangeMappings</a></td>
+                  <td>repeated</td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>sort</td>
-                  <td><a href="#policy.namespaces.NamespacesSort">NamespacesSort</a></td>
+                  <td>attribute_value_mappings</td>
+                  <td><a href="#policy.kasregistry.ChangeMappings">ChangeMappings</a></td>
                   <td>repeated</td>
-                  <td><p>Optional - CONSTRAINT: max 1 item
-Sort defaults:
-  - direction UNSPECIFIED defaults to DESC for the specified field
-  - field UNSPECIFIED defaults to created_at with the specified direction
-  - both UNSPECIFIED or sort omitted defaults to created_at DESC </p></td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>search</td>
-                  <td><a href="#policy.Search">policy.Search</a></td>
-                  <td></td>
-                  <td><p>Optional </p></td>
+                  <td>namespace_mappings</td>
+                  <td><a href="#policy.kasregistry.ChangeMappings">ChangeMappings</a></td>
+                  <td>repeated</td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
@@ -12580,8 +13216,8 @@ <h3 id="policy.namespaces.ListNamespacesRequest">ListNamespacesRequest</h3>
 
         
       
-        <h3 id="policy.namespaces.ListNamespacesResponse">ListNamespacesResponse</h3>
-        <p></p>
+        <h3 id="policy.kasregistry.SetBaseKeyRequest">SetBaseKeyRequest</h3>
+        <p>Sets the specified key as the base key for the Key Access Server</p><p>Note: The key must be active.</p>
 
         
           <table class="field-table">
@@ -12591,17 +13227,17 @@ <h3 id="policy.namespaces.ListNamespacesResponse">ListNamespacesResponse</h3>
             <tbody>
               
                 <tr>
-                  <td>namespaces</td>
-                  <td><a href="#policy.Namespace">policy.Namespace</a></td>
-                  <td>repeated</td>
-                  <td><p> </p></td>
+                  <td>id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Current Key UUID tp be set as default </p></td>
                 </tr>
               
                 <tr>
-                  <td>pagination</td>
-                  <td><a href="#policy.PageResponse">policy.PageResponse</a></td>
+                  <td>key</td>
+                  <td><a href="#policy.kasregistry.KasKeyIdentifier">KasKeyIdentifier</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Alternative way to specify the key using KAS ID and Key ID </p></td>
                 </tr>
               
             </tbody>
@@ -12611,7 +13247,7 @@ <h3 id="policy.namespaces.ListNamespacesResponse">ListNamespacesResponse</h3>
 
         
       
-        <h3 id="policy.namespaces.NamespaceKey">NamespaceKey</h3>
+        <h3 id="policy.kasregistry.SetBaseKeyResponse">SetBaseKeyResponse</h3>
         <p></p>
 
         
@@ -12622,17 +13258,17 @@ <h3 id="policy.namespaces.NamespaceKey">NamespaceKey</h3>
             <tbody>
               
                 <tr>
-                  <td>namespace_id</td>
-                  <td><a href="#string">string</a></td>
+                  <td>new_base_key</td>
+                  <td><a href="#policy.SimpleKasKey">policy.SimpleKasKey</a></td>
                   <td></td>
-                  <td><p>Required </p></td>
+                  <td><p>The key that was set as base </p></td>
                 </tr>
               
                 <tr>
-                  <td>key_id</td>
-                  <td><a href="#string">string</a></td>
+                  <td>previous_base_key</td>
+                  <td><a href="#policy.SimpleKasKey">policy.SimpleKasKey</a></td>
                   <td></td>
-                  <td><p>Required (The id from the Asymmetric Key object) </p></td>
+                  <td><p>The previous base key, if any </p></td>
                 </tr>
               
             </tbody>
@@ -12642,8 +13278,8 @@ <h3 id="policy.namespaces.NamespaceKey">NamespaceKey</h3>
 
         
       
-        <h3 id="policy.namespaces.NamespaceKeyAccessServer">NamespaceKeyAccessServer</h3>
-        <p>Deprecated</p>
+        <h3 id="policy.kasregistry.UpdateKeyAccessServerRequest">UpdateKeyAccessServerRequest</h3>
+        <p></p>
 
         
           <table class="field-table">
@@ -12653,46 +13289,56 @@ <h3 id="policy.namespaces.NamespaceKeyAccessServer">NamespaceKeyAccessServer</h3
             <tbody>
               
                 <tr>
-                  <td>namespace_id</td>
+                  <td>id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Required </p></td>
+                </tr>
+              
+                <tr>
+                  <td>uri</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Required </p></td>
+                  <td><p>Optional </p></td>
+                </tr>
+              
+                <tr>
+                  <td>public_key</td>
+                  <td><a href="#policy.PublicKey">policy.PublicKey</a></td>
+                  <td></td>
+                  <td><p>Deprecated
+Optional </p></td>
+                </tr>
+              
+                <tr>
+                  <td>source_type</td>
+                  <td><a href="#policy.SourceType">policy.SourceType</a></td>
+                  <td></td>
+                  <td><p>Optional
+Using UNSPECIFIED will result in a successful update,
+but will not actually update the underlying source.
+You should not update KAS&#39;s from INTERNAL/EXTERNAL
+to unspecified. </p></td>
                 </tr>
               
                 <tr>
-                  <td>key_access_server_id</td>
+                  <td>name</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Required </p></td>
+                  <td><p>Optional </p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="policy.namespaces.NamespacesSort">NamespacesSort</h3>
-        <p></p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
                 <tr>
-                  <td>field</td>
-                  <td><a href="#policy.namespaces.SortNamespacesType">SortNamespacesType</a></td>
+                  <td>metadata</td>
+                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Optional
+Common metadata </p></td>
                 </tr>
               
                 <tr>
-                  <td>direction</td>
-                  <td><a href="#policy.SortDirection">policy.SortDirection</a></td>
+                  <td>metadata_update_behavior</td>
+                  <td><a href="#common.MetadataUpdateEnum">common.MetadataUpdateEnum</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -12704,8 +13350,8 @@ <h3 id="policy.namespaces.NamespacesSort">NamespacesSort</h3>
 
         
       
-        <h3 id="policy.namespaces.RemoveKeyAccessServerFromNamespaceRequest">RemoveKeyAccessServerFromNamespaceRequest</h3>
-        <p>Deprecated: utilize RemovePublicKeyFromNamespaceRequest</p>
+        <h3 id="policy.kasregistry.UpdateKeyAccessServerResponse">UpdateKeyAccessServerResponse</h3>
+        <p></p>
 
         
           <table class="field-table">
@@ -12715,8 +13361,8 @@ <h3 id="policy.namespaces.RemoveKeyAccessServerFromNamespaceRequest">RemoveKeyAc
             <tbody>
               
                 <tr>
-                  <td>namespace_key_access_server</td>
-                  <td><a href="#policy.namespaces.NamespaceKeyAccessServer">NamespaceKeyAccessServer</a></td>
+                  <td>key_access_server</td>
+                  <td><a href="#policy.KeyAccessServer">policy.KeyAccessServer</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -12728,8 +13374,8 @@ <h3 id="policy.namespaces.RemoveKeyAccessServerFromNamespaceRequest">RemoveKeyAc
 
         
       
-        <h3 id="policy.namespaces.RemoveKeyAccessServerFromNamespaceResponse">RemoveKeyAccessServerFromNamespaceResponse</h3>
-        <p></p>
+        <h3 id="policy.kasregistry.UpdateKeyRequest">UpdateKeyRequest</h3>
+        <p>Update an existing asymmetric key in the Key Management System</p>
 
         
           <table class="field-table">
@@ -12739,34 +13385,29 @@ <h3 id="policy.namespaces.RemoveKeyAccessServerFromNamespaceResponse">RemoveKeyA
             <tbody>
               
                 <tr>
-                  <td>namespace_key_access_server</td>
-                  <td><a href="#policy.namespaces.NamespaceKeyAccessServer">NamespaceKeyAccessServer</a></td>
+                  <td>id</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Required
+
+The unique identifier of the key to update </p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="policy.namespaces.RemovePublicKeyFromNamespaceRequest">RemovePublicKeyFromNamespaceRequest</h3>
-        <p></p>
+                <tr>
+                  <td>metadata</td>
+                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
+                  <td></td>
+                  <td><p>Optional
+Common metadata
 
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
+Mutable metadata for the key </p></td>
+                </tr>
               
                 <tr>
-                  <td>namespace_key</td>
-                  <td><a href="#policy.namespaces.NamespaceKey">NamespaceKey</a></td>
+                  <td>metadata_update_behavior</td>
+                  <td><a href="#common.MetadataUpdateEnum">common.MetadataUpdateEnum</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>The behavior for updating the metadata </p></td>
                 </tr>
               
             </tbody>
@@ -12776,8 +13417,8 @@ <h3 id="policy.namespaces.RemovePublicKeyFromNamespaceRequest">RemovePublicKeyFr
 
         
       
-        <h3 id="policy.namespaces.RemovePublicKeyFromNamespaceResponse">RemovePublicKeyFromNamespaceResponse</h3>
-        <p></p>
+        <h3 id="policy.kasregistry.UpdateKeyResponse">UpdateKeyResponse</h3>
+        <p>Response to an UpdateKeyRequest, containing the updated asymmetric key</p>
 
         
           <table class="field-table">
@@ -12787,10 +13428,10 @@ <h3 id="policy.namespaces.RemovePublicKeyFromNamespaceResponse">RemovePublicKeyF
             <tbody>
               
                 <tr>
-                  <td>namespace_key</td>
-                  <td><a href="#policy.namespaces.NamespaceKey">NamespaceKey</a></td>
+                  <td>kas_key</td>
+                  <td><a href="#policy.KasKey">policy.KasKey</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>The updated kas key </p></td>
                 </tr>
               
             </tbody>
@@ -12800,7 +13441,7 @@ <h3 id="policy.namespaces.RemovePublicKeyFromNamespaceResponse">RemovePublicKeyF
 
         
       
-        <h3 id="policy.namespaces.UpdateNamespaceRequest">UpdateNamespaceRequest</h3>
+        <h3 id="policy.kasregistry.UpdatePublicKeyRequest">UpdatePublicKeyRequest</h3>
         <p></p>
 
         
@@ -12821,7 +13462,8 @@ <h3 id="policy.namespaces.UpdateNamespaceRequest">UpdateNamespaceRequest</h3>
                   <td>metadata</td>
                   <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
                   <td></td>
-                  <td><p>Optional </p></td>
+                  <td><p>Optional
+Common metadata </p></td>
                 </tr>
               
                 <tr>
@@ -12838,7 +13480,7 @@ <h3 id="policy.namespaces.UpdateNamespaceRequest">UpdateNamespaceRequest</h3>
 
         
       
-        <h3 id="policy.namespaces.UpdateNamespaceResponse">UpdateNamespaceResponse</h3>
+        <h3 id="policy.kasregistry.UpdatePublicKeyResponse">UpdatePublicKeyResponse</h3>
         <p></p>
 
         
@@ -12849,8 +13491,8 @@ <h3 id="policy.namespaces.UpdateNamespaceResponse">UpdateNamespaceResponse</h3>
             <tbody>
               
                 <tr>
-                  <td>namespace</td>
-                  <td><a href="#policy.Namespace">policy.Namespace</a></td>
+                  <td>key</td>
+                  <td><a href="#policy.Key">policy.Key</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -12864,7 +13506,7 @@ <h3 id="policy.namespaces.UpdateNamespaceResponse">UpdateNamespaceResponse</h3>
       
 
       
-        <h3 id="policy.namespaces.SortNamespacesType">SortNamespacesType</h3>
+        <h3 id="policy.kasregistry.SortKasKeysType">SortKasKeysType</h3>
         <p></p>
         <table class="enum-table">
           <thead>
@@ -12873,31 +13515,66 @@ <h3 id="policy.namespaces.SortNamespacesType">SortNamespacesType</h3>
           <tbody>
             
               <tr>
-                <td>SORT_NAMESPACES_TYPE_UNSPECIFIED</td>
+                <td>SORT_KAS_KEYS_TYPE_UNSPECIFIED</td>
                 <td>0</td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>SORT_NAMESPACES_TYPE_NAME</td>
+                <td>SORT_KAS_KEYS_TYPE_KEY_ID</td>
                 <td>1</td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>SORT_NAMESPACES_TYPE_FQN</td>
+                <td>SORT_KAS_KEYS_TYPE_CREATED_AT</td>
                 <td>2</td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>SORT_NAMESPACES_TYPE_CREATED_AT</td>
+                <td>SORT_KAS_KEYS_TYPE_UPDATED_AT</td>
+                <td>3</td>
+                <td><p></p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+      
+        <h3 id="policy.kasregistry.SortKeyAccessServersType">SortKeyAccessServersType</h3>
+        <p></p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>SORT_KEY_ACCESS_SERVERS_TYPE_UNSPECIFIED</td>
+                <td>0</td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>SORT_KEY_ACCESS_SERVERS_TYPE_NAME</td>
+                <td>1</td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>SORT_KEY_ACCESS_SERVERS_TYPE_URI</td>
+                <td>2</td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>SORT_KEY_ACCESS_SERVERS_TYPE_CREATED_AT</td>
                 <td>3</td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>SORT_NAMESPACES_TYPE_UPDATED_AT</td>
+                <td>SORT_KEY_ACCESS_SERVERS_TYPE_UPDATED_AT</td>
                 <td>4</td>
                 <td><p></p></td>
               </tr>
@@ -12909,7 +13586,7 @@ <h3 id="policy.namespaces.SortNamespacesType">SortNamespacesType</h3>
       
 
       
-        <h3 id="policy.namespaces.NamespaceService">NamespaceService</h3>
+        <h3 id="policy.kasregistry.KeyAccessServerRegistryService">KeyAccessServerRegistryService</h3>
         <p></p>
         <table class="enum-table">
           <thead>
@@ -12918,68 +13595,102 @@ <h3 id="policy.namespaces.NamespaceService">NamespaceService</h3>
           <tbody>
             
               <tr>
-                <td>GetNamespace</td>
-                <td><a href="#policy.namespaces.GetNamespaceRequest">GetNamespaceRequest</a></td>
-                <td><a href="#policy.namespaces.GetNamespaceResponse">GetNamespaceResponse</a></td>
+                <td>ListKeyAccessServers</td>
+                <td><a href="#policy.kasregistry.ListKeyAccessServersRequest">ListKeyAccessServersRequest</a></td>
+                <td><a href="#policy.kasregistry.ListKeyAccessServersResponse">ListKeyAccessServersResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>ListNamespaces</td>
-                <td><a href="#policy.namespaces.ListNamespacesRequest">ListNamespacesRequest</a></td>
-                <td><a href="#policy.namespaces.ListNamespacesResponse">ListNamespacesResponse</a></td>
+                <td>GetKeyAccessServer</td>
+                <td><a href="#policy.kasregistry.GetKeyAccessServerRequest">GetKeyAccessServerRequest</a></td>
+                <td><a href="#policy.kasregistry.GetKeyAccessServerResponse">GetKeyAccessServerResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>CreateNamespace</td>
-                <td><a href="#policy.namespaces.CreateNamespaceRequest">CreateNamespaceRequest</a></td>
-                <td><a href="#policy.namespaces.CreateNamespaceResponse">CreateNamespaceResponse</a></td>
+                <td>CreateKeyAccessServer</td>
+                <td><a href="#policy.kasregistry.CreateKeyAccessServerRequest">CreateKeyAccessServerRequest</a></td>
+                <td><a href="#policy.kasregistry.CreateKeyAccessServerResponse">CreateKeyAccessServerResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>UpdateNamespace</td>
-                <td><a href="#policy.namespaces.UpdateNamespaceRequest">UpdateNamespaceRequest</a></td>
-                <td><a href="#policy.namespaces.UpdateNamespaceResponse">UpdateNamespaceResponse</a></td>
+                <td>UpdateKeyAccessServer</td>
+                <td><a href="#policy.kasregistry.UpdateKeyAccessServerRequest">UpdateKeyAccessServerRequest</a></td>
+                <td><a href="#policy.kasregistry.UpdateKeyAccessServerResponse">UpdateKeyAccessServerResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>DeactivateNamespace</td>
-                <td><a href="#policy.namespaces.DeactivateNamespaceRequest">DeactivateNamespaceRequest</a></td>
-                <td><a href="#policy.namespaces.DeactivateNamespaceResponse">DeactivateNamespaceResponse</a></td>
+                <td>DeleteKeyAccessServer</td>
+                <td><a href="#policy.kasregistry.DeleteKeyAccessServerRequest">DeleteKeyAccessServerRequest</a></td>
+                <td><a href="#policy.kasregistry.DeleteKeyAccessServerResponse">DeleteKeyAccessServerResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>AssignKeyAccessServerToNamespace</td>
-                <td><a href="#policy.namespaces.AssignKeyAccessServerToNamespaceRequest">AssignKeyAccessServerToNamespaceRequest</a></td>
-                <td><a href="#policy.namespaces.AssignKeyAccessServerToNamespaceResponse">AssignKeyAccessServerToNamespaceResponse</a></td>
-                <td><p>Deprecated: utilize AssignPublicKeyToNamespace</p></td>
+                <td>ListKeyAccessServerGrants</td>
+                <td><a href="#policy.kasregistry.ListKeyAccessServerGrantsRequest">ListKeyAccessServerGrantsRequest</a></td>
+                <td><a href="#policy.kasregistry.ListKeyAccessServerGrantsResponse">ListKeyAccessServerGrantsResponse</a></td>
+                <td><p>Deprecated</p></td>
               </tr>
             
               <tr>
-                <td>RemoveKeyAccessServerFromNamespace</td>
-                <td><a href="#policy.namespaces.RemoveKeyAccessServerFromNamespaceRequest">RemoveKeyAccessServerFromNamespaceRequest</a></td>
-                <td><a href="#policy.namespaces.RemoveKeyAccessServerFromNamespaceResponse">RemoveKeyAccessServerFromNamespaceResponse</a></td>
-                <td><p>Deprecated: utilize RemovePublicKeyFromNamespace</p></td>
+                <td>CreateKey</td>
+                <td><a href="#policy.kasregistry.CreateKeyRequest">CreateKeyRequest</a></td>
+                <td><a href="#policy.kasregistry.CreateKeyResponse">CreateKeyResponse</a></td>
+                <td><p>KAS Key Management
+Request to create a new key in the Key Access Service.</p></td>
               </tr>
             
               <tr>
-                <td>AssignPublicKeyToNamespace</td>
-                <td><a href="#policy.namespaces.AssignPublicKeyToNamespaceRequest">AssignPublicKeyToNamespaceRequest</a></td>
-                <td><a href="#policy.namespaces.AssignPublicKeyToNamespaceResponse">AssignPublicKeyToNamespaceResponse</a></td>
-                <td><p>--------------------------------------*
-Namespace &lt;&gt; Key RPCs
----------------------------------------</p></td>
+                <td>GetKey</td>
+                <td><a href="#policy.kasregistry.GetKeyRequest">GetKeyRequest</a></td>
+                <td><a href="#policy.kasregistry.GetKeyResponse">GetKeyResponse</a></td>
+                <td><p>Request to retrieve a key from the Key Access Service.</p></td>
               </tr>
             
               <tr>
-                <td>RemovePublicKeyFromNamespace</td>
-                <td><a href="#policy.namespaces.RemovePublicKeyFromNamespaceRequest">RemovePublicKeyFromNamespaceRequest</a></td>
-                <td><a href="#policy.namespaces.RemovePublicKeyFromNamespaceResponse">RemovePublicKeyFromNamespaceResponse</a></td>
-                <td><p></p></td>
+                <td>ListKeys</td>
+                <td><a href="#policy.kasregistry.ListKeysRequest">ListKeysRequest</a></td>
+                <td><a href="#policy.kasregistry.ListKeysResponse">ListKeysResponse</a></td>
+                <td><p>Request to list keys in the Key Access Service.</p></td>
+              </tr>
+            
+              <tr>
+                <td>UpdateKey</td>
+                <td><a href="#policy.kasregistry.UpdateKeyRequest">UpdateKeyRequest</a></td>
+                <td><a href="#policy.kasregistry.UpdateKeyResponse">UpdateKeyResponse</a></td>
+                <td><p>Request to update a key in the Key Access Service.</p></td>
+              </tr>
+            
+              <tr>
+                <td>RotateKey</td>
+                <td><a href="#policy.kasregistry.RotateKeyRequest">RotateKeyRequest</a></td>
+                <td><a href="#policy.kasregistry.RotateKeyResponse">RotateKeyResponse</a></td>
+                <td><p>Request to rotate a key in the Key Access Service.</p></td>
+              </tr>
+            
+              <tr>
+                <td>SetBaseKey</td>
+                <td><a href="#policy.kasregistry.SetBaseKeyRequest">SetBaseKeyRequest</a></td>
+                <td><a href="#policy.kasregistry.SetBaseKeyResponse">SetBaseKeyResponse</a></td>
+                <td><p>Request to set the default a default kas key.</p></td>
+              </tr>
+            
+              <tr>
+                <td>GetBaseKey</td>
+                <td><a href="#policy.kasregistry.GetBaseKeyRequest">GetBaseKeyRequest</a></td>
+                <td><a href="#policy.kasregistry.GetBaseKeyResponse">GetBaseKeyResponse</a></td>
+                <td><p>Get Default kas keys</p></td>
+              </tr>
+            
+              <tr>
+                <td>ListKeyMappings</td>
+                <td><a href="#policy.kasregistry.ListKeyMappingsRequest">ListKeyMappingsRequest</a></td>
+                <td><a href="#policy.kasregistry.ListKeyMappingsResponse">ListKeyMappingsResponse</a></td>
+                <td><p>Request to list key mappings in the Key Access Service.</p></td>
               </tr>
             
           </tbody>
@@ -12999,12 +13710,7 @@ <h4>Methods with deprecated option</h4>
             <tbody>
             
               <tr>
-                <td>AssignKeyAccessServerToNamespace</td>
-                <td><p>true</p></td>
-              </tr>
-            
-              <tr>
-                <td>RemoveKeyAccessServerFromNamespace</td>
+                <td>ListKeyAccessServerGrants</td>
                 <td><p>true</p></td>
               </tr>
             
@@ -13025,12 +13731,17 @@ <h4>Methods with idempotency_level option</h4>
             <tbody>
             
               <tr>
-                <td>GetNamespace</td>
+                <td>ListKeyAccessServers</td>
                 <td><p>NO_SIDE_EFFECTS</p></td>
               </tr>
             
               <tr>
-                <td>ListNamespaces</td>
+                <td>GetKeyAccessServer</td>
+                <td><p>NO_SIDE_EFFECTS</p></td>
+              </tr>
+            
+              <tr>
+                <td>ListKeyAccessServerGrants</td>
                 <td><p>NO_SIDE_EFFECTS</p></td>
               </tr>
             
@@ -13041,13 +13752,13 @@ <h4>Methods with idempotency_level option</h4>
     
       
       <div class="file-heading">
-        <h2 id="policy/obligations/obligations.proto">policy/obligations/obligations.proto</h2><a href="#title">Top</a>
+        <h2 id="policy/keymanagement/key_management.proto">policy/keymanagement/key_management.proto</h2><a href="#title">Top</a>
       </div>
       <p></p>
 
       
-        <h3 id="policy.obligations.AddObligationTriggerRequest">AddObligationTriggerRequest</h3>
-        <p>Obligation Triggers are owned by the namespace that owns the action and attribute value, which must</p><p>be the same. In this way, a trigger can intentionally cross namespace boundaries: associating</p><p>obligation values of a different namespace than the one that owns the action being taken or the attribute value.</p>
+        <h3 id="policy.keymanagement.CreateProviderConfigRequest">CreateProviderConfigRequest</h3>
+        <p>Provider Configuration Requests and Response Messages</p>
 
         
           <table class="field-table">
@@ -13057,40 +13768,34 @@ <h3 id="policy.obligations.AddObligationTriggerRequest">AddObligationTriggerRequ
             <tbody>
               
                 <tr>
-                  <td>obligation_value</td>
-                  <td><a href="#common.IdFqnIdentifier">common.IdFqnIdentifier</a></td>
-                  <td></td>
-                  <td><p>Required </p></td>
-                </tr>
-              
-                <tr>
-                  <td>action</td>
-                  <td><a href="#common.IdNameIdentifier">common.IdNameIdentifier</a></td>
+                  <td>name</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Required </p></td>
+                  <td><p>Required
+The name of the key provider. (e.g. &#34;AWS KMS Instance 1&#34;, &#34;Google Cloud KMS Instance 2&#34;) </p></td>
                 </tr>
               
                 <tr>
-                  <td>attribute_value</td>
-                  <td><a href="#common.IdFqnIdentifier">common.IdFqnIdentifier</a></td>
+                  <td>config_json</td>
+                  <td><a href="#bytes">bytes</a></td>
                   <td></td>
-                  <td><p>Required </p></td>
+                  <td><p>Required
+JSON configuration for the key provider. This is unique to individual key providers. </p></td>
                 </tr>
               
                 <tr>
-                  <td>context</td>
-                  <td><a href="#policy.RequestContext">policy.RequestContext</a></td>
+                  <td>manager</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Optional
-The request context for this obligation value policy decisioning. </p></td>
+                  <td><p>Required
+The type of key manager (e.g. &#34;aws&#34;, &#34;gcp&#34;, &#34;azure&#34;, &#34;opentdf.io/basic&#34;) </p></td>
                 </tr>
               
                 <tr>
                   <td>metadata</td>
                   <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
                   <td></td>
-                  <td><p>Optional
-Common metadata </p></td>
+                  <td><p>Common metadata </p></td>
                 </tr>
               
             </tbody>
@@ -13100,7 +13805,7 @@ <h3 id="policy.obligations.AddObligationTriggerRequest">AddObligationTriggerRequ
 
         
       
-        <h3 id="policy.obligations.AddObligationTriggerResponse">AddObligationTriggerResponse</h3>
+        <h3 id="policy.keymanagement.CreateProviderConfigResponse">CreateProviderConfigResponse</h3>
         <p></p>
 
         
@@ -13111,8 +13816,8 @@ <h3 id="policy.obligations.AddObligationTriggerResponse">AddObligationTriggerRes
             <tbody>
               
                 <tr>
-                  <td>trigger</td>
-                  <td><a href="#policy.ObligationTrigger">policy.ObligationTrigger</a></td>
+                  <td>provider_config</td>
+                  <td><a href="#policy.KeyProviderConfig">policy.KeyProviderConfig</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -13124,8 +13829,8 @@ <h3 id="policy.obligations.AddObligationTriggerResponse">AddObligationTriggerRes
 
         
       
-        <h3 id="policy.obligations.CreateObligationRequest">CreateObligationRequest</h3>
-        <p></p>
+        <h3 id="policy.keymanagement.DeleteProviderConfigRequest">DeleteProviderConfigRequest</h3>
+        <p>In order to delete a provider configuration you must first delete all keys associated with the provider.</p>
 
         
           <table class="field-table">
@@ -13135,39 +13840,10 @@ <h3 id="policy.obligations.CreateObligationRequest">CreateObligationRequest</h3>
             <tbody>
               
                 <tr>
-                  <td>namespace_id</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p> </p></td>
-                </tr>
-              
-                <tr>
-                  <td>namespace_fqn</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p> </p></td>
-                </tr>
-              
-                <tr>
-                  <td>name</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p> </p></td>
-                </tr>
-              
-                <tr>
-                  <td>values</td>
+                  <td>id</td>
                   <td><a href="#string">string</a></td>
-                  <td>repeated</td>
-                  <td><p>Optional </p></td>
-                </tr>
-              
-                <tr>
-                  <td>metadata</td>
-                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
                   <td></td>
-                  <td><p>Optional
-Common metadata </p></td>
+                  <td><p>Required </p></td>
                 </tr>
               
             </tbody>
@@ -13177,7 +13853,7 @@ <h3 id="policy.obligations.CreateObligationRequest">CreateObligationRequest</h3>
 
         
       
-        <h3 id="policy.obligations.CreateObligationResponse">CreateObligationResponse</h3>
+        <h3 id="policy.keymanagement.DeleteProviderConfigResponse">DeleteProviderConfigResponse</h3>
         <p></p>
 
         
@@ -13188,8 +13864,8 @@ <h3 id="policy.obligations.CreateObligationResponse">CreateObligationResponse</h
             <tbody>
               
                 <tr>
-                  <td>obligation</td>
-                  <td><a href="#policy.Obligation">policy.Obligation</a></td>
+                  <td>provider_config</td>
+                  <td><a href="#policy.KeyProviderConfig">policy.KeyProviderConfig</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -13201,7 +13877,7 @@ <h3 id="policy.obligations.CreateObligationResponse">CreateObligationResponse</h
 
         
       
-        <h3 id="policy.obligations.CreateObligationValueRequest">CreateObligationValueRequest</h3>
+        <h3 id="policy.keymanagement.GetProviderConfigRequest">GetProviderConfigRequest</h3>
         <p></p>
 
         
@@ -13212,40 +13888,48 @@ <h3 id="policy.obligations.CreateObligationValueRequest">CreateObligationValueRe
             <tbody>
               
                 <tr>
-                  <td>obligation_id</td>
+                  <td>id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>obligation_fqn</td>
+                  <td>name</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>value</td>
+                  <td>manager</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Optional - filter by manager type when searching by name </p></td>
                 </tr>
               
-                <tr>
-                  <td>triggers</td>
-                  <td><a href="#policy.obligations.ValueTriggerRequest">ValueTriggerRequest</a></td>
-                  <td>repeated</td>
-                  <td><p>Optional
-Combination of action and attribute_value that will trigger this obligation value policy decisioning. </p></td>
-                </tr>
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.keymanagement.GetProviderConfigResponse">GetProviderConfigResponse</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
               
                 <tr>
-                  <td>metadata</td>
-                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
+                  <td>provider_config</td>
+                  <td><a href="#policy.KeyProviderConfig">policy.KeyProviderConfig</a></td>
                   <td></td>
-                  <td><p>Optional
-Common metadata </p></td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
@@ -13255,7 +13939,7 @@ <h3 id="policy.obligations.CreateObligationValueRequest">CreateObligationValueRe
 
         
       
-        <h3 id="policy.obligations.CreateObligationValueResponse">CreateObligationValueResponse</h3>
+        <h3 id="policy.keymanagement.ListProviderConfigsRequest">ListProviderConfigsRequest</h3>
         <p></p>
 
         
@@ -13266,10 +13950,10 @@ <h3 id="policy.obligations.CreateObligationValueResponse">CreateObligationValueR
             <tbody>
               
                 <tr>
-                  <td>value</td>
-                  <td><a href="#policy.ObligationValue">policy.ObligationValue</a></td>
+                  <td>pagination</td>
+                  <td><a href="#policy.PageRequest">policy.PageRequest</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Optional </p></td>
                 </tr>
               
             </tbody>
@@ -13279,7 +13963,7 @@ <h3 id="policy.obligations.CreateObligationValueResponse">CreateObligationValueR
 
         
       
-        <h3 id="policy.obligations.DeleteObligationRequest">DeleteObligationRequest</h3>
+        <h3 id="policy.keymanagement.ListProviderConfigsResponse">ListProviderConfigsResponse</h3>
         <p></p>
 
         
@@ -13290,15 +13974,15 @@ <h3 id="policy.obligations.DeleteObligationRequest">DeleteObligationRequest</h3>
             <tbody>
               
                 <tr>
-                  <td>id</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
+                  <td>provider_configs</td>
+                  <td><a href="#policy.KeyProviderConfig">policy.KeyProviderConfig</a></td>
+                  <td>repeated</td>
                   <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>fqn</td>
-                  <td><a href="#string">string</a></td>
+                  <td>pagination</td>
+                  <td><a href="#policy.PageResponse">policy.PageResponse</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -13310,7 +13994,7 @@ <h3 id="policy.obligations.DeleteObligationRequest">DeleteObligationRequest</h3>
 
         
       
-        <h3 id="policy.obligations.DeleteObligationResponse">DeleteObligationResponse</h3>
+        <h3 id="policy.keymanagement.UpdateProviderConfigRequest">UpdateProviderConfigRequest</h3>
         <p></p>
 
         
@@ -13321,8 +14005,44 @@ <h3 id="policy.obligations.DeleteObligationResponse">DeleteObligationResponse</h
             <tbody>
               
                 <tr>
-                  <td>obligation</td>
-                  <td><a href="#policy.Obligation">policy.Obligation</a></td>
+                  <td>id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Required </p></td>
+                </tr>
+              
+                <tr>
+                  <td>name</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Optional </p></td>
+                </tr>
+              
+                <tr>
+                  <td>config_json</td>
+                  <td><a href="#bytes">bytes</a></td>
+                  <td></td>
+                  <td><p>Optional </p></td>
+                </tr>
+              
+                <tr>
+                  <td>manager</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Optional </p></td>
+                </tr>
+              
+                <tr>
+                  <td>metadata</td>
+                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
+                  <td></td>
+                  <td><p>Optional
+Common metadata </p></td>
+                </tr>
+              
+                <tr>
+                  <td>metadata_update_behavior</td>
+                  <td><a href="#common.MetadataUpdateEnum">common.MetadataUpdateEnum</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -13334,7 +14054,7 @@ <h3 id="policy.obligations.DeleteObligationResponse">DeleteObligationResponse</h
 
         
       
-        <h3 id="policy.obligations.DeleteObligationValueRequest">DeleteObligationValueRequest</h3>
+        <h3 id="policy.keymanagement.UpdateProviderConfigResponse">UpdateProviderConfigResponse</h3>
         <p></p>
 
         
@@ -13345,15 +14065,8 @@ <h3 id="policy.obligations.DeleteObligationValueRequest">DeleteObligationValueRe
             <tbody>
               
                 <tr>
-                  <td>id</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p> </p></td>
-                </tr>
-              
-                <tr>
-                  <td>fqn</td>
-                  <td><a href="#string">string</a></td>
+                  <td>provider_config</td>
+                  <td><a href="#policy.KeyProviderConfig">policy.KeyProviderConfig</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -13365,32 +14078,70 @@ <h3 id="policy.obligations.DeleteObligationValueRequest">DeleteObligationValueRe
 
         
       
-        <h3 id="policy.obligations.DeleteObligationValueResponse">DeleteObligationValueResponse</h3>
-        <p></p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
-                <tr>
-                  <td>value</td>
-                  <td><a href="#policy.ObligationValue">policy.ObligationValue</a></td>
-                  <td></td>
-                  <td><p> </p></td>
-                </tr>
-              
-            </tbody>
-          </table>
-
-          
 
-        
       
-        <h3 id="policy.obligations.GetObligationRequest">GetObligationRequest</h3>
-        <p></p>
+
+      
+
+      
+        <h3 id="policy.keymanagement.KeyManagementService">KeyManagementService</h3>
+        <p></p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>CreateProviderConfig</td>
+                <td><a href="#policy.keymanagement.CreateProviderConfigRequest">CreateProviderConfigRequest</a></td>
+                <td><a href="#policy.keymanagement.CreateProviderConfigResponse">CreateProviderConfigResponse</a></td>
+                <td><p>Key Management
+Provider Management</p></td>
+              </tr>
+            
+              <tr>
+                <td>GetProviderConfig</td>
+                <td><a href="#policy.keymanagement.GetProviderConfigRequest">GetProviderConfigRequest</a></td>
+                <td><a href="#policy.keymanagement.GetProviderConfigResponse">GetProviderConfigResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>ListProviderConfigs</td>
+                <td><a href="#policy.keymanagement.ListProviderConfigsRequest">ListProviderConfigsRequest</a></td>
+                <td><a href="#policy.keymanagement.ListProviderConfigsResponse">ListProviderConfigsResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>UpdateProviderConfig</td>
+                <td><a href="#policy.keymanagement.UpdateProviderConfigRequest">UpdateProviderConfigRequest</a></td>
+                <td><a href="#policy.keymanagement.UpdateProviderConfigResponse">UpdateProviderConfigResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>DeleteProviderConfig</td>
+                <td><a href="#policy.keymanagement.DeleteProviderConfigRequest">DeleteProviderConfigRequest</a></td>
+                <td><a href="#policy.keymanagement.DeleteProviderConfigResponse">DeleteProviderConfigResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+
+        
+    
+      
+      <div class="file-heading">
+        <h2 id="policy/namespaces/namespaces.proto">policy/namespaces/namespaces.proto</h2><a href="#title">Top</a>
+      </div>
+      <p></p>
+
+      
+        <h3 id="policy.namespaces.AssignKeyAccessServerToNamespaceRequest">AssignKeyAccessServerToNamespaceRequest</h3>
+        <p>Deprecated: utilize AssignPublicKeyToNamespaceRequest</p>
 
         
           <table class="field-table">
@@ -13400,15 +14151,8 @@ <h3 id="policy.obligations.GetObligationRequest">GetObligationRequest</h3>
             <tbody>
               
                 <tr>
-                  <td>id</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p> </p></td>
-                </tr>
-              
-                <tr>
-                  <td>fqn</td>
-                  <td><a href="#string">string</a></td>
+                  <td>namespace_key_access_server</td>
+                  <td><a href="#policy.namespaces.NamespaceKeyAccessServer">NamespaceKeyAccessServer</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -13420,7 +14164,7 @@ <h3 id="policy.obligations.GetObligationRequest">GetObligationRequest</h3>
 
         
       
-        <h3 id="policy.obligations.GetObligationResponse">GetObligationResponse</h3>
+        <h3 id="policy.namespaces.AssignKeyAccessServerToNamespaceResponse">AssignKeyAccessServerToNamespaceResponse</h3>
         <p></p>
 
         
@@ -13431,8 +14175,8 @@ <h3 id="policy.obligations.GetObligationResponse">GetObligationResponse</h3>
             <tbody>
               
                 <tr>
-                  <td>obligation</td>
-                  <td><a href="#policy.Obligation">policy.Obligation</a></td>
+                  <td>namespace_key_access_server</td>
+                  <td><a href="#policy.namespaces.NamespaceKeyAccessServer">NamespaceKeyAccessServer</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -13444,8 +14188,8 @@ <h3 id="policy.obligations.GetObligationResponse">GetObligationResponse</h3>
 
         
       
-        <h3 id="policy.obligations.GetObligationTriggerRequest">GetObligationTriggerRequest</h3>
-        <p>Triggers</p>
+        <h3 id="policy.namespaces.AssignPublicKeyToNamespaceRequest">AssignPublicKeyToNamespaceRequest</h3>
+        <p>Assign Key to Namespace</p>
 
         
           <table class="field-table">
@@ -13455,10 +14199,10 @@ <h3 id="policy.obligations.GetObligationTriggerRequest">GetObligationTriggerRequ
             <tbody>
               
                 <tr>
-                  <td>id</td>
-                  <td><a href="#string">string</a></td>
+                  <td>namespace_key</td>
+                  <td><a href="#policy.namespaces.NamespaceKey">NamespaceKey</a></td>
                   <td></td>
-                  <td><p>Required </p></td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
@@ -13468,7 +14212,7 @@ <h3 id="policy.obligations.GetObligationTriggerRequest">GetObligationTriggerRequ
 
         
       
-        <h3 id="policy.obligations.GetObligationTriggerResponse">GetObligationTriggerResponse</h3>
+        <h3 id="policy.namespaces.AssignPublicKeyToNamespaceResponse">AssignPublicKeyToNamespaceResponse</h3>
         <p></p>
 
         
@@ -13479,8 +14223,8 @@ <h3 id="policy.obligations.GetObligationTriggerResponse">GetObligationTriggerRes
             <tbody>
               
                 <tr>
-                  <td>trigger</td>
-                  <td><a href="#policy.ObligationTrigger">policy.ObligationTrigger</a></td>
+                  <td>namespace_key</td>
+                  <td><a href="#policy.namespaces.NamespaceKey">NamespaceKey</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -13492,8 +14236,8 @@ <h3 id="policy.obligations.GetObligationTriggerResponse">GetObligationTriggerRes
 
         
       
-        <h3 id="policy.obligations.GetObligationValueRequest">GetObligationValueRequest</h3>
-        <p>Values</p>
+        <h3 id="policy.namespaces.CreateNamespaceRequest">CreateNamespaceRequest</h3>
+        <p></p>
 
         
           <table class="field-table">
@@ -13503,17 +14247,17 @@ <h3 id="policy.obligations.GetObligationValueRequest">GetObligationValueRequest<
             <tbody>
               
                 <tr>
-                  <td>id</td>
+                  <td>name</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Required </p></td>
                 </tr>
               
                 <tr>
-                  <td>fqn</td>
-                  <td><a href="#string">string</a></td>
+                  <td>metadata</td>
+                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Optional </p></td>
                 </tr>
               
             </tbody>
@@ -13523,7 +14267,7 @@ <h3 id="policy.obligations.GetObligationValueRequest">GetObligationValueRequest<
 
         
       
-        <h3 id="policy.obligations.GetObligationValueResponse">GetObligationValueResponse</h3>
+        <h3 id="policy.namespaces.CreateNamespaceResponse">CreateNamespaceResponse</h3>
         <p></p>
 
         
@@ -13534,8 +14278,8 @@ <h3 id="policy.obligations.GetObligationValueResponse">GetObligationValueRespons
             <tbody>
               
                 <tr>
-                  <td>value</td>
-                  <td><a href="#policy.ObligationValue">policy.ObligationValue</a></td>
+                  <td>namespace</td>
+                  <td><a href="#policy.Namespace">policy.Namespace</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -13547,7 +14291,7 @@ <h3 id="policy.obligations.GetObligationValueResponse">GetObligationValueRespons
 
         
       
-        <h3 id="policy.obligations.GetObligationValuesByFQNsRequest">GetObligationValuesByFQNsRequest</h3>
+        <h3 id="policy.namespaces.DeactivateNamespaceRequest">DeactivateNamespaceRequest</h3>
         <p></p>
 
         
@@ -13558,10 +14302,10 @@ <h3 id="policy.obligations.GetObligationValuesByFQNsRequest">GetObligationValues
             <tbody>
               
                 <tr>
-                  <td>fqns</td>
+                  <td>id</td>
                   <td><a href="#string">string</a></td>
-                  <td>repeated</td>
-                  <td><p> </p></td>
+                  <td></td>
+                  <td><p>Required </p></td>
                 </tr>
               
             </tbody>
@@ -13571,31 +14315,14 @@ <h3 id="policy.obligations.GetObligationValuesByFQNsRequest">GetObligationValues
 
         
       
-        <h3 id="policy.obligations.GetObligationValuesByFQNsResponse">GetObligationValuesByFQNsResponse</h3>
+        <h3 id="policy.namespaces.DeactivateNamespaceResponse">DeactivateNamespaceResponse</h3>
         <p></p>
 
         
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
-                <tr>
-                  <td>fqn_value_map</td>
-                  <td><a href="#policy.obligations.GetObligationValuesByFQNsResponse.FqnValueMapEntry">GetObligationValuesByFQNsResponse.FqnValueMapEntry</a></td>
-                  <td>repeated</td>
-                  <td><p> </p></td>
-                </tr>
-              
-            </tbody>
-          </table>
-
-          
 
         
       
-        <h3 id="policy.obligations.GetObligationValuesByFQNsResponse.FqnValueMapEntry">GetObligationValuesByFQNsResponse.FqnValueMapEntry</h3>
+        <h3 id="policy.namespaces.GetNamespaceRequest">GetNamespaceRequest</h3>
         <p></p>
 
         
@@ -13606,40 +14333,23 @@ <h3 id="policy.obligations.GetObligationValuesByFQNsResponse.FqnValueMapEntry">G
             <tbody>
               
                 <tr>
-                  <td>key</td>
+                  <td>id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p><strong>Deprecated.</strong> Deprecated </p></td>
                 </tr>
               
                 <tr>
-                  <td>value</td>
-                  <td><a href="#policy.ObligationValue">policy.ObligationValue</a></td>
+                  <td>namespace_id</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>option (buf.validate.oneof).required = true; // TODO: enable this when we remove the deprecated field </p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="policy.obligations.GetObligationsByFQNsRequest">GetObligationsByFQNsRequest</h3>
-        <p></p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
                 <tr>
-                  <td>fqns</td>
+                  <td>fqn</td>
                   <td><a href="#string">string</a></td>
-                  <td>repeated</td>
+                  <td></td>
                   <td><p> </p></td>
                 </tr>
               
@@ -13647,34 +14357,31 @@ <h3 id="policy.obligations.GetObligationsByFQNsRequest">GetObligationsByFQNsRequ
           </table>
 
           
-
-        
-      
-        <h3 id="policy.obligations.GetObligationsByFQNsResponse">GetObligationsByFQNsResponse</h3>
-        <p></p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
+            
+            
+            <h4>Fields with deprecated option</h4>
+            <table>
+              <thead>
+                <tr>
+                  <td>Name</td>
+                  <td>Option</td>
+                </tr>
+              </thead>
+              <tbody>
               
                 <tr>
-                  <td>fqn_obligation_map</td>
-                  <td><a href="#policy.obligations.GetObligationsByFQNsResponse.FqnObligationMapEntry">GetObligationsByFQNsResponse.FqnObligationMapEntry</a></td>
-                  <td>repeated</td>
-                  <td><p> </p></td>
+                  <td>id</td>
+                  <td><p>true</p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
+              </tbody>
+            </table>
+            
           
 
         
       
-        <h3 id="policy.obligations.GetObligationsByFQNsResponse.FqnObligationMapEntry">GetObligationsByFQNsResponse.FqnObligationMapEntry</h3>
+        <h3 id="policy.namespaces.GetNamespaceResponse">GetNamespaceResponse</h3>
         <p></p>
 
         
@@ -13685,15 +14392,8 @@ <h3 id="policy.obligations.GetObligationsByFQNsResponse.FqnObligationMapEntry">G
             <tbody>
               
                 <tr>
-                  <td>key</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p> </p></td>
-                </tr>
-              
-                <tr>
-                  <td>value</td>
-                  <td><a href="#policy.Obligation">policy.Obligation</a></td>
+                  <td>namespace</td>
+                  <td><a href="#policy.Namespace">policy.Namespace</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -13705,7 +14405,7 @@ <h3 id="policy.obligations.GetObligationsByFQNsResponse.FqnObligationMapEntry">G
 
         
       
-        <h3 id="policy.obligations.ListObligationTriggersRequest">ListObligationTriggersRequest</h3>
+        <h3 id="policy.namespaces.ListNamespacesRequest">ListNamespacesRequest</h3>
         <p></p>
 
         
@@ -13716,22 +14416,34 @@ <h3 id="policy.obligations.ListObligationTriggersRequest">ListObligationTriggers
             <tbody>
               
                 <tr>
-                  <td>namespace_id</td>
-                  <td><a href="#string">string</a></td>
+                  <td>state</td>
+                  <td><a href="#common.ActiveStateEnum">common.ActiveStateEnum</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Optional
+ACTIVE by default when not specified </p></td>
                 </tr>
               
                 <tr>
-                  <td>namespace_fqn</td>
-                  <td><a href="#string">string</a></td>
+                  <td>pagination</td>
+                  <td><a href="#policy.PageRequest">policy.PageRequest</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Optional </p></td>
                 </tr>
               
                 <tr>
-                  <td>pagination</td>
-                  <td><a href="#policy.PageRequest">policy.PageRequest</a></td>
+                  <td>sort</td>
+                  <td><a href="#policy.namespaces.NamespacesSort">NamespacesSort</a></td>
+                  <td>repeated</td>
+                  <td><p>Optional - CONSTRAINT: max 1 item
+Sort defaults:
+  - direction UNSPECIFIED defaults to DESC for the specified field
+  - field UNSPECIFIED defaults to created_at with the specified direction
+  - both UNSPECIFIED or sort omitted defaults to created_at DESC </p></td>
+                </tr>
+              
+                <tr>
+                  <td>search</td>
+                  <td><a href="#policy.Search">policy.Search</a></td>
                   <td></td>
                   <td><p>Optional </p></td>
                 </tr>
@@ -13743,7 +14455,7 @@ <h3 id="policy.obligations.ListObligationTriggersRequest">ListObligationTriggers
 
         
       
-        <h3 id="policy.obligations.ListObligationTriggersResponse">ListObligationTriggersResponse</h3>
+        <h3 id="policy.namespaces.ListNamespacesResponse">ListNamespacesResponse</h3>
         <p></p>
 
         
@@ -13754,8 +14466,8 @@ <h3 id="policy.obligations.ListObligationTriggersResponse">ListObligationTrigger
             <tbody>
               
                 <tr>
-                  <td>triggers</td>
-                  <td><a href="#policy.ObligationTrigger">policy.ObligationTrigger</a></td>
+                  <td>namespaces</td>
+                  <td><a href="#policy.Namespace">policy.Namespace</a></td>
                   <td>repeated</td>
                   <td><p> </p></td>
                 </tr>
@@ -13774,7 +14486,7 @@ <h3 id="policy.obligations.ListObligationTriggersResponse">ListObligationTrigger
 
         
       
-        <h3 id="policy.obligations.ListObligationsRequest">ListObligationsRequest</h3>
+        <h3 id="policy.namespaces.NamespaceKey">NamespaceKey</h3>
         <p></p>
 
         
@@ -13785,42 +14497,17 @@ <h3 id="policy.obligations.ListObligationsRequest">ListObligationsRequest</h3>
             <tbody>
               
                 <tr>
-                  <td>namespace_id</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p> </p></td>
-                </tr>
-              
-                <tr>
-                  <td>namespace_fqn</td>
+                  <td>namespace_id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p> </p></td>
-                </tr>
-              
-                <tr>
-                  <td>pagination</td>
-                  <td><a href="#policy.PageRequest">policy.PageRequest</a></td>
-                  <td></td>
-                  <td><p>Optional </p></td>
-                </tr>
-              
-                <tr>
-                  <td>sort</td>
-                  <td><a href="#policy.obligations.ObligationsSort">ObligationsSort</a></td>
-                  <td>repeated</td>
-                  <td><p>Optional - CONSTRAINT: max 1 item
-Sort defaults:
-  - direction UNSPECIFIED defaults to DESC for the specified field
-  - field UNSPECIFIED defaults to created_at with the specified direction
-  - both UNSPECIFIED or sort omitted defaults to created_at DESC </p></td>
+                  <td><p>Required </p></td>
                 </tr>
               
                 <tr>
-                  <td>search</td>
-                  <td><a href="#policy.Search">policy.Search</a></td>
+                  <td>key_id</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Optional </p></td>
+                  <td><p>Required (The id from the Asymmetric Key object) </p></td>
                 </tr>
               
             </tbody>
@@ -13830,8 +14517,8 @@ <h3 id="policy.obligations.ListObligationsRequest">ListObligationsRequest</h3>
 
         
       
-        <h3 id="policy.obligations.ListObligationsResponse">ListObligationsResponse</h3>
-        <p></p>
+        <h3 id="policy.namespaces.NamespaceKeyAccessServer">NamespaceKeyAccessServer</h3>
+        <p>Deprecated</p>
 
         
           <table class="field-table">
@@ -13841,17 +14528,17 @@ <h3 id="policy.obligations.ListObligationsResponse">ListObligationsResponse</h3>
             <tbody>
               
                 <tr>
-                  <td>obligations</td>
-                  <td><a href="#policy.Obligation">policy.Obligation</a></td>
-                  <td>repeated</td>
-                  <td><p> </p></td>
+                  <td>namespace_id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Required </p></td>
                 </tr>
               
                 <tr>
-                  <td>pagination</td>
-                  <td><a href="#policy.PageResponse">policy.PageResponse</a></td>
+                  <td>key_access_server_id</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Required </p></td>
                 </tr>
               
             </tbody>
@@ -13861,7 +14548,7 @@ <h3 id="policy.obligations.ListObligationsResponse">ListObligationsResponse</h3>
 
         
       
-        <h3 id="policy.obligations.ObligationsSort">ObligationsSort</h3>
+        <h3 id="policy.namespaces.NamespacesSort">NamespacesSort</h3>
         <p></p>
 
         
@@ -13873,7 +14560,7 @@ <h3 id="policy.obligations.ObligationsSort">ObligationsSort</h3>
               
                 <tr>
                   <td>field</td>
-                  <td><a href="#policy.obligations.SortObligationsType">SortObligationsType</a></td>
+                  <td><a href="#policy.namespaces.SortNamespacesType">SortNamespacesType</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -13892,8 +14579,8 @@ <h3 id="policy.obligations.ObligationsSort">ObligationsSort</h3>
 
         
       
-        <h3 id="policy.obligations.RemoveObligationTriggerRequest">RemoveObligationTriggerRequest</h3>
-        <p></p>
+        <h3 id="policy.namespaces.RemoveKeyAccessServerFromNamespaceRequest">RemoveKeyAccessServerFromNamespaceRequest</h3>
+        <p>Deprecated: utilize RemovePublicKeyFromNamespaceRequest</p>
 
         
           <table class="field-table">
@@ -13903,10 +14590,10 @@ <h3 id="policy.obligations.RemoveObligationTriggerRequest">RemoveObligationTrigg
             <tbody>
               
                 <tr>
-                  <td>id</td>
-                  <td><a href="#string">string</a></td>
+                  <td>namespace_key_access_server</td>
+                  <td><a href="#policy.namespaces.NamespaceKeyAccessServer">NamespaceKeyAccessServer</a></td>
                   <td></td>
-                  <td><p>Required </p></td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
@@ -13916,7 +14603,7 @@ <h3 id="policy.obligations.RemoveObligationTriggerRequest">RemoveObligationTrigg
 
         
       
-        <h3 id="policy.obligations.RemoveObligationTriggerResponse">RemoveObligationTriggerResponse</h3>
+        <h3 id="policy.namespaces.RemoveKeyAccessServerFromNamespaceResponse">RemoveKeyAccessServerFromNamespaceResponse</h3>
         <p></p>
 
         
@@ -13927,8 +14614,8 @@ <h3 id="policy.obligations.RemoveObligationTriggerResponse">RemoveObligationTrig
             <tbody>
               
                 <tr>
-                  <td>trigger</td>
-                  <td><a href="#policy.ObligationTrigger">policy.ObligationTrigger</a></td>
+                  <td>namespace_key_access_server</td>
+                  <td><a href="#policy.namespaces.NamespaceKeyAccessServer">NamespaceKeyAccessServer</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -13940,7 +14627,7 @@ <h3 id="policy.obligations.RemoveObligationTriggerResponse">RemoveObligationTrig
 
         
       
-        <h3 id="policy.obligations.UpdateObligationRequest">UpdateObligationRequest</h3>
+        <h3 id="policy.namespaces.RemovePublicKeyFromNamespaceRequest">RemovePublicKeyFromNamespaceRequest</h3>
         <p></p>
 
         
@@ -13951,29 +14638,8 @@ <h3 id="policy.obligations.UpdateObligationRequest">UpdateObligationRequest</h3>
             <tbody>
               
                 <tr>
-                  <td>id</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Required </p></td>
-                </tr>
-              
-                <tr>
-                  <td>name</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Optional </p></td>
-                </tr>
-              
-                <tr>
-                  <td>metadata</td>
-                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
-                  <td></td>
-                  <td><p> </p></td>
-                </tr>
-              
-                <tr>
-                  <td>metadata_update_behavior</td>
-                  <td><a href="#common.MetadataUpdateEnum">common.MetadataUpdateEnum</a></td>
+                  <td>namespace_key</td>
+                  <td><a href="#policy.namespaces.NamespaceKey">NamespaceKey</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -13985,7 +14651,7 @@ <h3 id="policy.obligations.UpdateObligationRequest">UpdateObligationRequest</h3>
 
         
       
-        <h3 id="policy.obligations.UpdateObligationResponse">UpdateObligationResponse</h3>
+        <h3 id="policy.namespaces.RemovePublicKeyFromNamespaceResponse">RemovePublicKeyFromNamespaceResponse</h3>
         <p></p>
 
         
@@ -13996,8 +14662,8 @@ <h3 id="policy.obligations.UpdateObligationResponse">UpdateObligationResponse</h
             <tbody>
               
                 <tr>
-                  <td>obligation</td>
-                  <td><a href="#policy.Obligation">policy.Obligation</a></td>
+                  <td>namespace_key</td>
+                  <td><a href="#policy.namespaces.NamespaceKey">NamespaceKey</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -14009,7 +14675,7 @@ <h3 id="policy.obligations.UpdateObligationResponse">UpdateObligationResponse</h
 
         
       
-        <h3 id="policy.obligations.UpdateObligationValueRequest">UpdateObligationValueRequest</h3>
+        <h3 id="policy.namespaces.UpdateNamespaceRequest">UpdateNamespaceRequest</h3>
         <p></p>
 
         
@@ -14026,27 +14692,11 @@ <h3 id="policy.obligations.UpdateObligationValueRequest">UpdateObligationValueRe
                   <td><p>Required </p></td>
                 </tr>
               
-                <tr>
-                  <td>value</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Optional </p></td>
-                </tr>
-              
-                <tr>
-                  <td>triggers</td>
-                  <td><a href="#policy.obligations.ValueTriggerRequest">ValueTriggerRequest</a></td>
-                  <td>repeated</td>
-                  <td><p>Optional
-Obligation Triggers provided here will replace all existing records in the database. </p></td>
-                </tr>
-              
                 <tr>
                   <td>metadata</td>
                   <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
                   <td></td>
-                  <td><p>Optional
-Common metadata </p></td>
+                  <td><p>Optional </p></td>
                 </tr>
               
                 <tr>
@@ -14063,7 +14713,7 @@ <h3 id="policy.obligations.UpdateObligationValueRequest">UpdateObligationValueRe
 
         
       
-        <h3 id="policy.obligations.UpdateObligationValueResponse">UpdateObligationValueResponse</h3>
+        <h3 id="policy.namespaces.UpdateNamespaceResponse">UpdateNamespaceResponse</h3>
         <p></p>
 
         
@@ -14074,8 +14724,8 @@ <h3 id="policy.obligations.UpdateObligationValueResponse">UpdateObligationValueR
             <tbody>
               
                 <tr>
-                  <td>value</td>
-                  <td><a href="#policy.ObligationValue">policy.ObligationValue</a></td>
+                  <td>namespace</td>
+                  <td><a href="#policy.Namespace">policy.Namespace</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -14087,47 +14737,9 @@ <h3 id="policy.obligations.UpdateObligationValueResponse">UpdateObligationValueR
 
         
       
-        <h3 id="policy.obligations.ValueTriggerRequest">ValueTriggerRequest</h3>
-        <p></p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
-                <tr>
-                  <td>action</td>
-                  <td><a href="#common.IdNameIdentifier">common.IdNameIdentifier</a></td>
-                  <td></td>
-                  <td><p>Required. The ID of the action that will trigger this obligation value policy decisioning. </p></td>
-                </tr>
-              
-                <tr>
-                  <td>attribute_value</td>
-                  <td><a href="#common.IdFqnIdentifier">common.IdFqnIdentifier</a></td>
-                  <td></td>
-                  <td><p>Required. The attribute value ID that will trigger this obligation value policy decisioning. </p></td>
-                </tr>
-              
-                <tr>
-                  <td>context</td>
-                  <td><a href="#policy.RequestContext">policy.RequestContext</a></td>
-                  <td></td>
-                  <td><p>Optional. The request context for this obligation value policy decisioning. </p></td>
-                </tr>
-              
-            </tbody>
-          </table>
-
-          
-
-        
-      
 
       
-        <h3 id="policy.obligations.SortObligationsType">SortObligationsType</h3>
+        <h3 id="policy.namespaces.SortNamespacesType">SortNamespacesType</h3>
         <p></p>
         <table class="enum-table">
           <thead>
@@ -14136,31 +14748,31 @@ <h3 id="policy.obligations.SortObligationsType">SortObligationsType</h3>
           <tbody>
             
               <tr>
-                <td>SORT_OBLIGATIONS_TYPE_UNSPECIFIED</td>
+                <td>SORT_NAMESPACES_TYPE_UNSPECIFIED</td>
                 <td>0</td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>SORT_OBLIGATIONS_TYPE_NAME</td>
+                <td>SORT_NAMESPACES_TYPE_NAME</td>
                 <td>1</td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>SORT_OBLIGATIONS_TYPE_FQN</td>
+                <td>SORT_NAMESPACES_TYPE_FQN</td>
                 <td>2</td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>SORT_OBLIGATIONS_TYPE_CREATED_AT</td>
+                <td>SORT_NAMESPACES_TYPE_CREATED_AT</td>
                 <td>3</td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>SORT_OBLIGATIONS_TYPE_UPDATED_AT</td>
+                <td>SORT_NAMESPACES_TYPE_UPDATED_AT</td>
                 <td>4</td>
                 <td><p></p></td>
               </tr>
@@ -14172,8 +14784,8 @@ <h3 id="policy.obligations.SortObligationsType">SortObligationsType</h3>
       
 
       
-        <h3 id="policy.obligations.Service">Service</h3>
-        <p>Obligation Service</p><p>/</p>
+        <h3 id="policy.namespaces.NamespaceService">NamespaceService</h3>
+        <p></p>
         <table class="enum-table">
           <thead>
             <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
@@ -14181,107 +14793,67 @@ <h3 id="policy.obligations.Service">Service</h3>
           <tbody>
             
               <tr>
-                <td>ListObligations</td>
-                <td><a href="#policy.obligations.ListObligationsRequest">ListObligationsRequest</a></td>
-                <td><a href="#policy.obligations.ListObligationsResponse">ListObligationsResponse</a></td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>GetObligation</td>
-                <td><a href="#policy.obligations.GetObligationRequest">GetObligationRequest</a></td>
-                <td><a href="#policy.obligations.GetObligationResponse">GetObligationResponse</a></td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>GetObligationsByFQNs</td>
-                <td><a href="#policy.obligations.GetObligationsByFQNsRequest">GetObligationsByFQNsRequest</a></td>
-                <td><a href="#policy.obligations.GetObligationsByFQNsResponse">GetObligationsByFQNsResponse</a></td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>CreateObligation</td>
-                <td><a href="#policy.obligations.CreateObligationRequest">CreateObligationRequest</a></td>
-                <td><a href="#policy.obligations.CreateObligationResponse">CreateObligationResponse</a></td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>UpdateObligation</td>
-                <td><a href="#policy.obligations.UpdateObligationRequest">UpdateObligationRequest</a></td>
-                <td><a href="#policy.obligations.UpdateObligationResponse">UpdateObligationResponse</a></td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>DeleteObligation</td>
-                <td><a href="#policy.obligations.DeleteObligationRequest">DeleteObligationRequest</a></td>
-                <td><a href="#policy.obligations.DeleteObligationResponse">DeleteObligationResponse</a></td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>GetObligationValue</td>
-                <td><a href="#policy.obligations.GetObligationValueRequest">GetObligationValueRequest</a></td>
-                <td><a href="#policy.obligations.GetObligationValueResponse">GetObligationValueResponse</a></td>
+                <td>GetNamespace</td>
+                <td><a href="#policy.namespaces.GetNamespaceRequest">GetNamespaceRequest</a></td>
+                <td><a href="#policy.namespaces.GetNamespaceResponse">GetNamespaceResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>GetObligationValuesByFQNs</td>
-                <td><a href="#policy.obligations.GetObligationValuesByFQNsRequest">GetObligationValuesByFQNsRequest</a></td>
-                <td><a href="#policy.obligations.GetObligationValuesByFQNsResponse">GetObligationValuesByFQNsResponse</a></td>
+                <td>ListNamespaces</td>
+                <td><a href="#policy.namespaces.ListNamespacesRequest">ListNamespacesRequest</a></td>
+                <td><a href="#policy.namespaces.ListNamespacesResponse">ListNamespacesResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>CreateObligationValue</td>
-                <td><a href="#policy.obligations.CreateObligationValueRequest">CreateObligationValueRequest</a></td>
-                <td><a href="#policy.obligations.CreateObligationValueResponse">CreateObligationValueResponse</a></td>
+                <td>CreateNamespace</td>
+                <td><a href="#policy.namespaces.CreateNamespaceRequest">CreateNamespaceRequest</a></td>
+                <td><a href="#policy.namespaces.CreateNamespaceResponse">CreateNamespaceResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>UpdateObligationValue</td>
-                <td><a href="#policy.obligations.UpdateObligationValueRequest">UpdateObligationValueRequest</a></td>
-                <td><a href="#policy.obligations.UpdateObligationValueResponse">UpdateObligationValueResponse</a></td>
+                <td>UpdateNamespace</td>
+                <td><a href="#policy.namespaces.UpdateNamespaceRequest">UpdateNamespaceRequest</a></td>
+                <td><a href="#policy.namespaces.UpdateNamespaceResponse">UpdateNamespaceResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>DeleteObligationValue</td>
-                <td><a href="#policy.obligations.DeleteObligationValueRequest">DeleteObligationValueRequest</a></td>
-                <td><a href="#policy.obligations.DeleteObligationValueResponse">DeleteObligationValueResponse</a></td>
+                <td>DeactivateNamespace</td>
+                <td><a href="#policy.namespaces.DeactivateNamespaceRequest">DeactivateNamespaceRequest</a></td>
+                <td><a href="#policy.namespaces.DeactivateNamespaceResponse">DeactivateNamespaceResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>GetObligationTrigger</td>
-                <td><a href="#policy.obligations.GetObligationTriggerRequest">GetObligationTriggerRequest</a></td>
-                <td><a href="#policy.obligations.GetObligationTriggerResponse">GetObligationTriggerResponse</a></td>
-                <td><p></p></td>
+                <td>AssignKeyAccessServerToNamespace</td>
+                <td><a href="#policy.namespaces.AssignKeyAccessServerToNamespaceRequest">AssignKeyAccessServerToNamespaceRequest</a></td>
+                <td><a href="#policy.namespaces.AssignKeyAccessServerToNamespaceResponse">AssignKeyAccessServerToNamespaceResponse</a></td>
+                <td><p>Deprecated: utilize AssignPublicKeyToNamespace</p></td>
               </tr>
             
               <tr>
-                <td>AddObligationTrigger</td>
-                <td><a href="#policy.obligations.AddObligationTriggerRequest">AddObligationTriggerRequest</a></td>
-                <td><a href="#policy.obligations.AddObligationTriggerResponse">AddObligationTriggerResponse</a></td>
-                <td><p></p></td>
+                <td>RemoveKeyAccessServerFromNamespace</td>
+                <td><a href="#policy.namespaces.RemoveKeyAccessServerFromNamespaceRequest">RemoveKeyAccessServerFromNamespaceRequest</a></td>
+                <td><a href="#policy.namespaces.RemoveKeyAccessServerFromNamespaceResponse">RemoveKeyAccessServerFromNamespaceResponse</a></td>
+                <td><p>Deprecated: utilize RemovePublicKeyFromNamespace</p></td>
               </tr>
             
               <tr>
-                <td>RemoveObligationTrigger</td>
-                <td><a href="#policy.obligations.RemoveObligationTriggerRequest">RemoveObligationTriggerRequest</a></td>
-                <td><a href="#policy.obligations.RemoveObligationTriggerResponse">RemoveObligationTriggerResponse</a></td>
-                <td><p></p></td>
+                <td>AssignPublicKeyToNamespace</td>
+                <td><a href="#policy.namespaces.AssignPublicKeyToNamespaceRequest">AssignPublicKeyToNamespaceRequest</a></td>
+                <td><a href="#policy.namespaces.AssignPublicKeyToNamespaceResponse">AssignPublicKeyToNamespaceResponse</a></td>
+                <td><p>--------------------------------------*
+Namespace &lt;&gt; Key RPCs
+---------------------------------------</p></td>
               </tr>
             
               <tr>
-                <td>ListObligationTriggers</td>
-                <td><a href="#policy.obligations.ListObligationTriggersRequest">ListObligationTriggersRequest</a></td>
-                <td><a href="#policy.obligations.ListObligationTriggersResponse">ListObligationTriggersResponse</a></td>
+                <td>RemovePublicKeyFromNamespace</td>
+                <td><a href="#policy.namespaces.RemovePublicKeyFromNamespaceRequest">RemovePublicKeyFromNamespaceRequest</a></td>
+                <td><a href="#policy.namespaces.RemovePublicKeyFromNamespaceResponse">RemovePublicKeyFromNamespaceResponse</a></td>
                 <td><p></p></td>
               </tr>
             
@@ -14291,7 +14863,7 @@ <h3 id="policy.obligations.Service">Service</h3>
         
           
           
-          <h4>Methods with idempotency_level option</h4>
+          <h4>Methods with deprecated option</h4>
           <table>
             <thead>
               <tr>
@@ -14302,37 +14874,38 @@ <h4>Methods with idempotency_level option</h4>
             <tbody>
             
               <tr>
-                <td>ListObligations</td>
-                <td><p>NO_SIDE_EFFECTS</p></td>
-              </tr>
-            
-              <tr>
-                <td>GetObligation</td>
-                <td><p>NO_SIDE_EFFECTS</p></td>
-              </tr>
-            
-              <tr>
-                <td>GetObligationsByFQNs</td>
-                <td><p>NO_SIDE_EFFECTS</p></td>
+                <td>AssignKeyAccessServerToNamespace</td>
+                <td><p>true</p></td>
               </tr>
             
               <tr>
-                <td>GetObligationValue</td>
-                <td><p>NO_SIDE_EFFECTS</p></td>
+                <td>RemoveKeyAccessServerFromNamespace</td>
+                <td><p>true</p></td>
               </tr>
             
+            </tbody>
+          </table>
+          
+        
+          
+          
+          <h4>Methods with idempotency_level option</h4>
+          <table>
+            <thead>
               <tr>
-                <td>GetObligationValuesByFQNs</td>
-                <td><p>NO_SIDE_EFFECTS</p></td>
+                <td>Method Name</td>
+                <td>Option</td>
               </tr>
+            </thead>
+            <tbody>
             
               <tr>
-                <td>GetObligationTrigger</td>
+                <td>GetNamespace</td>
                 <td><p>NO_SIDE_EFFECTS</p></td>
               </tr>
             
               <tr>
-                <td>ListObligationTriggers</td>
+                <td>ListNamespaces</td>
                 <td><p>NO_SIDE_EFFECTS</p></td>
               </tr>
             
@@ -14343,12 +14916,66 @@ <h4>Methods with idempotency_level option</h4>
     
       
       <div class="file-heading">
-        <h2 id="policy/registeredresources/registered_resources.proto">policy/registeredresources/registered_resources.proto</h2><a href="#title">Top</a>
+        <h2 id="policy/obligations/obligations.proto">policy/obligations/obligations.proto</h2><a href="#title">Top</a>
       </div>
       <p></p>
 
       
-        <h3 id="policy.registeredresources.ActionAttributeValue">ActionAttributeValue</h3>
+        <h3 id="policy.obligations.AddObligationTriggerRequest">AddObligationTriggerRequest</h3>
+        <p>Obligation Triggers are owned by the namespace that owns the action and attribute value, which must</p><p>be the same. In this way, a trigger can intentionally cross namespace boundaries: associating</p><p>obligation values of a different namespace than the one that owns the action being taken or the attribute value.</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>obligation_value</td>
+                  <td><a href="#common.IdFqnIdentifier">common.IdFqnIdentifier</a></td>
+                  <td></td>
+                  <td><p>Required </p></td>
+                </tr>
+              
+                <tr>
+                  <td>action</td>
+                  <td><a href="#common.IdNameIdentifier">common.IdNameIdentifier</a></td>
+                  <td></td>
+                  <td><p>Required </p></td>
+                </tr>
+              
+                <tr>
+                  <td>attribute_value</td>
+                  <td><a href="#common.IdFqnIdentifier">common.IdFqnIdentifier</a></td>
+                  <td></td>
+                  <td><p>Required </p></td>
+                </tr>
+              
+                <tr>
+                  <td>context</td>
+                  <td><a href="#policy.RequestContext">policy.RequestContext</a></td>
+                  <td></td>
+                  <td><p>Optional
+The request context for this obligation value policy decisioning. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>metadata</td>
+                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
+                  <td></td>
+                  <td><p>Optional
+Common metadata </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.obligations.AddObligationTriggerResponse">AddObligationTriggerResponse</h3>
         <p></p>
 
         
@@ -14359,29 +14986,85 @@ <h3 id="policy.registeredresources.ActionAttributeValue">ActionAttributeValue</h
             <tbody>
               
                 <tr>
-                  <td>action_id</td>
+                  <td>trigger</td>
+                  <td><a href="#policy.ObligationTrigger">policy.ObligationTrigger</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.obligations.CreateObligationRequest">CreateObligationRequest</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>namespace_id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>action_name</td>
+                  <td>namespace_fqn</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>attribute_value_id</td>
+                  <td>name</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>attribute_value_fqn</td>
+                  <td>values</td>
                   <td><a href="#string">string</a></td>
+                  <td>repeated</td>
+                  <td><p>Optional </p></td>
+                </tr>
+              
+                <tr>
+                  <td>metadata</td>
+                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
+                  <td></td>
+                  <td><p>Optional
+Common metadata </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.obligations.CreateObligationResponse">CreateObligationResponse</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>obligation</td>
+                  <td><a href="#policy.Obligation">policy.Obligation</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -14393,7 +15076,7 @@ <h3 id="policy.registeredresources.ActionAttributeValue">ActionAttributeValue</h
 
         
       
-        <h3 id="policy.registeredresources.CreateRegisteredResourceRequest">CreateRegisteredResourceRequest</h3>
+        <h3 id="policy.obligations.CreateObligationValueRequest">CreateObligationValueRequest</h3>
         <p></p>
 
         
@@ -14404,43 +15087,97 @@ <h3 id="policy.registeredresources.CreateRegisteredResourceRequest">CreateRegist
             <tbody>
               
                 <tr>
-                  <td>name</td>
+                  <td>obligation_id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Required </p></td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>values</td>
+                  <td>obligation_fqn</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>value</td>
                   <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>triggers</td>
+                  <td><a href="#policy.obligations.ValueTriggerRequest">ValueTriggerRequest</a></td>
                   <td>repeated</td>
                   <td><p>Optional
-Registered Resource Values (when provided) must be alphanumeric strings, allowing hyphens and underscores but not as the first or last character.
-The stored value will be normalized to lower case. </p></td>
+Combination of action and attribute_value that will trigger this obligation value policy decisioning. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>metadata</td>
+                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
+                  <td></td>
+                  <td><p>Optional
+Common metadata </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.obligations.CreateObligationValueResponse">CreateObligationValueResponse</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>value</td>
+                  <td><a href="#policy.ObligationValue">policy.ObligationValue</a></td>
+                  <td></td>
+                  <td><p> </p></td>
                 </tr>
               
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.obligations.DeleteObligationRequest">DeleteObligationRequest</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
                 <tr>
-                  <td>namespace_id</td>
+                  <td>id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>namespace_fqn</td>
+                  <td>fqn</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
               
-                <tr>
-                  <td>metadata</td>
-                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
-                  <td></td>
-                  <td><p>Optional
-Common metadata </p></td>
-                </tr>
-              
             </tbody>
           </table>
 
@@ -14448,7 +15185,7 @@ <h3 id="policy.registeredresources.CreateRegisteredResourceRequest">CreateRegist
 
         
       
-        <h3 id="policy.registeredresources.CreateRegisteredResourceResponse">CreateRegisteredResourceResponse</h3>
+        <h3 id="policy.obligations.DeleteObligationResponse">DeleteObligationResponse</h3>
         <p></p>
 
         
@@ -14459,8 +15196,8 @@ <h3 id="policy.registeredresources.CreateRegisteredResourceResponse">CreateRegis
             <tbody>
               
                 <tr>
-                  <td>resource</td>
-                  <td><a href="#policy.RegisteredResource">policy.RegisteredResource</a></td>
+                  <td>obligation</td>
+                  <td><a href="#policy.Obligation">policy.Obligation</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -14472,7 +15209,7 @@ <h3 id="policy.registeredresources.CreateRegisteredResourceResponse">CreateRegis
 
         
       
-        <h3 id="policy.registeredresources.CreateRegisteredResourceValueRequest">CreateRegisteredResourceValueRequest</h3>
+        <h3 id="policy.obligations.DeleteObligationValueRequest">DeleteObligationValueRequest</h3>
         <p></p>
 
         
@@ -14483,34 +15220,17 @@ <h3 id="policy.registeredresources.CreateRegisteredResourceValueRequest">CreateR
             <tbody>
               
                 <tr>
-                  <td>resource_id</td>
+                  <td>id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Required </p></td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>value</td>
+                  <td>fqn</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Required </p></td>
-                </tr>
-              
-                <tr>
-                  <td>action_attribute_values</td>
-                  <td><a href="#policy.registeredresources.ActionAttributeValue">ActionAttributeValue</a></td>
-                  <td>repeated</td>
-                  <td><p>Optional
-The associated Action &lt;&gt; AttributeValue combinations to be utilized in authorization/entitlement decisioning
-(i.e. action read -&gt; attribute value https://example.com/attr/department/value/marketing) </p></td>
-                </tr>
-              
-                <tr>
-                  <td>metadata</td>
-                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
-                  <td></td>
-                  <td><p>Optional
-Common metadata </p></td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
@@ -14520,7 +15240,7 @@ <h3 id="policy.registeredresources.CreateRegisteredResourceValueRequest">CreateR
 
         
       
-        <h3 id="policy.registeredresources.CreateRegisteredResourceValueResponse">CreateRegisteredResourceValueResponse</h3>
+        <h3 id="policy.obligations.DeleteObligationValueResponse">DeleteObligationValueResponse</h3>
         <p></p>
 
         
@@ -14532,7 +15252,7 @@ <h3 id="policy.registeredresources.CreateRegisteredResourceValueResponse">Create
               
                 <tr>
                   <td>value</td>
-                  <td><a href="#policy.RegisteredResourceValue">policy.RegisteredResourceValue</a></td>
+                  <td><a href="#policy.ObligationValue">policy.ObligationValue</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -14544,7 +15264,7 @@ <h3 id="policy.registeredresources.CreateRegisteredResourceValueResponse">Create
 
         
       
-        <h3 id="policy.registeredresources.DeleteRegisteredResourceRequest">DeleteRegisteredResourceRequest</h3>
+        <h3 id="policy.obligations.GetObligationRequest">GetObligationRequest</h3>
         <p></p>
 
         
@@ -14558,7 +15278,14 @@ <h3 id="policy.registeredresources.DeleteRegisteredResourceRequest">DeleteRegist
                   <td>id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Required </p></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>fqn</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
@@ -14568,7 +15295,7 @@ <h3 id="policy.registeredresources.DeleteRegisteredResourceRequest">DeleteRegist
 
         
       
-        <h3 id="policy.registeredresources.DeleteRegisteredResourceResponse">DeleteRegisteredResourceResponse</h3>
+        <h3 id="policy.obligations.GetObligationResponse">GetObligationResponse</h3>
         <p></p>
 
         
@@ -14579,8 +15306,8 @@ <h3 id="policy.registeredresources.DeleteRegisteredResourceResponse">DeleteRegis
             <tbody>
               
                 <tr>
-                  <td>resource</td>
-                  <td><a href="#policy.RegisteredResource">policy.RegisteredResource</a></td>
+                  <td>obligation</td>
+                  <td><a href="#policy.Obligation">policy.Obligation</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -14592,8 +15319,8 @@ <h3 id="policy.registeredresources.DeleteRegisteredResourceResponse">DeleteRegis
 
         
       
-        <h3 id="policy.registeredresources.DeleteRegisteredResourceValueRequest">DeleteRegisteredResourceValueRequest</h3>
-        <p></p>
+        <h3 id="policy.obligations.GetObligationTriggerRequest">GetObligationTriggerRequest</h3>
+        <p>Triggers</p>
 
         
           <table class="field-table">
@@ -14616,7 +15343,7 @@ <h3 id="policy.registeredresources.DeleteRegisteredResourceValueRequest">DeleteR
 
         
       
-        <h3 id="policy.registeredresources.DeleteRegisteredResourceValueResponse">DeleteRegisteredResourceValueResponse</h3>
+        <h3 id="policy.obligations.GetObligationTriggerResponse">GetObligationTriggerResponse</h3>
         <p></p>
 
         
@@ -14627,8 +15354,8 @@ <h3 id="policy.registeredresources.DeleteRegisteredResourceValueResponse">Delete
             <tbody>
               
                 <tr>
-                  <td>value</td>
-                  <td><a href="#policy.RegisteredResourceValue">policy.RegisteredResourceValue</a></td>
+                  <td>trigger</td>
+                  <td><a href="#policy.ObligationTrigger">policy.ObligationTrigger</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -14640,8 +15367,8 @@ <h3 id="policy.registeredresources.DeleteRegisteredResourceValueResponse">Delete
 
         
       
-        <h3 id="policy.registeredresources.GetRegisteredResourceRequest">GetRegisteredResourceRequest</h3>
-        <p></p>
+        <h3 id="policy.obligations.GetObligationValueRequest">GetObligationValueRequest</h3>
+        <p>Values</p>
 
         
           <table class="field-table">
@@ -14658,21 +15385,7 @@ <h3 id="policy.registeredresources.GetRegisteredResourceRequest">GetRegisteredRe
                 </tr>
               
                 <tr>
-                  <td>name</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p> </p></td>
-                </tr>
-              
-                <tr>
-                  <td>namespace_fqn</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p> </p></td>
-                </tr>
-              
-                <tr>
-                  <td>namespace_id</td>
+                  <td>fqn</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
                   <td><p> </p></td>
@@ -14685,7 +15398,7 @@ <h3 id="policy.registeredresources.GetRegisteredResourceRequest">GetRegisteredRe
 
         
       
-        <h3 id="policy.registeredresources.GetRegisteredResourceResponse">GetRegisteredResourceResponse</h3>
+        <h3 id="policy.obligations.GetObligationValueResponse">GetObligationValueResponse</h3>
         <p></p>
 
         
@@ -14696,8 +15409,8 @@ <h3 id="policy.registeredresources.GetRegisteredResourceResponse">GetRegisteredR
             <tbody>
               
                 <tr>
-                  <td>resource</td>
-                  <td><a href="#policy.RegisteredResource">policy.RegisteredResource</a></td>
+                  <td>value</td>
+                  <td><a href="#policy.ObligationValue">policy.ObligationValue</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -14709,7 +15422,7 @@ <h3 id="policy.registeredresources.GetRegisteredResourceResponse">GetRegisteredR
 
         
       
-        <h3 id="policy.registeredresources.GetRegisteredResourceValueRequest">GetRegisteredResourceValueRequest</h3>
+        <h3 id="policy.obligations.GetObligationValuesByFQNsRequest">GetObligationValuesByFQNsRequest</h3>
         <p></p>
 
         
@@ -14720,16 +15433,33 @@ <h3 id="policy.registeredresources.GetRegisteredResourceValueRequest">GetRegiste
             <tbody>
               
                 <tr>
-                  <td>id</td>
+                  <td>fqns</td>
                   <td><a href="#string">string</a></td>
-                  <td></td>
+                  <td>repeated</td>
                   <td><p> </p></td>
                 </tr>
               
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.obligations.GetObligationValuesByFQNsResponse">GetObligationValuesByFQNsResponse</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
                 <tr>
-                  <td>fqn</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
+                  <td>fqn_value_map</td>
+                  <td><a href="#policy.obligations.GetObligationValuesByFQNsResponse.FqnValueMapEntry">GetObligationValuesByFQNsResponse.FqnValueMapEntry</a></td>
+                  <td>repeated</td>
                   <td><p> </p></td>
                 </tr>
               
@@ -14740,7 +15470,7 @@ <h3 id="policy.registeredresources.GetRegisteredResourceValueRequest">GetRegiste
 
         
       
-        <h3 id="policy.registeredresources.GetRegisteredResourceValueResponse">GetRegisteredResourceValueResponse</h3>
+        <h3 id="policy.obligations.GetObligationValuesByFQNsResponse.FqnValueMapEntry">GetObligationValuesByFQNsResponse.FqnValueMapEntry</h3>
         <p></p>
 
         
@@ -14750,9 +15480,16 @@ <h3 id="policy.registeredresources.GetRegisteredResourceValueResponse">GetRegist
             </thead>
             <tbody>
               
+                <tr>
+                  <td>key</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
                 <tr>
                   <td>value</td>
-                  <td><a href="#policy.RegisteredResourceValue">policy.RegisteredResourceValue</a></td>
+                  <td><a href="#policy.ObligationValue">policy.ObligationValue</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -14764,7 +15501,7 @@ <h3 id="policy.registeredresources.GetRegisteredResourceValueResponse">GetRegist
 
         
       
-        <h3 id="policy.registeredresources.GetRegisteredResourceValuesByFQNsRequest">GetRegisteredResourceValuesByFQNsRequest</h3>
+        <h3 id="policy.obligations.GetObligationsByFQNsRequest">GetObligationsByFQNsRequest</h3>
         <p></p>
 
         
@@ -14778,7 +15515,7 @@ <h3 id="policy.registeredresources.GetRegisteredResourceValuesByFQNsRequest">Get
                   <td>fqns</td>
                   <td><a href="#string">string</a></td>
                   <td>repeated</td>
-                  <td><p>Required </p></td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
@@ -14788,7 +15525,7 @@ <h3 id="policy.registeredresources.GetRegisteredResourceValuesByFQNsRequest">Get
 
         
       
-        <h3 id="policy.registeredresources.GetRegisteredResourceValuesByFQNsResponse">GetRegisteredResourceValuesByFQNsResponse</h3>
+        <h3 id="policy.obligations.GetObligationsByFQNsResponse">GetObligationsByFQNsResponse</h3>
         <p></p>
 
         
@@ -14799,8 +15536,8 @@ <h3 id="policy.registeredresources.GetRegisteredResourceValuesByFQNsResponse">Ge
             <tbody>
               
                 <tr>
-                  <td>fqn_value_map</td>
-                  <td><a href="#policy.registeredresources.GetRegisteredResourceValuesByFQNsResponse.FqnValueMapEntry">GetRegisteredResourceValuesByFQNsResponse.FqnValueMapEntry</a></td>
+                  <td>fqn_obligation_map</td>
+                  <td><a href="#policy.obligations.GetObligationsByFQNsResponse.FqnObligationMapEntry">GetObligationsByFQNsResponse.FqnObligationMapEntry</a></td>
                   <td>repeated</td>
                   <td><p> </p></td>
                 </tr>
@@ -14812,7 +15549,7 @@ <h3 id="policy.registeredresources.GetRegisteredResourceValuesByFQNsResponse">Ge
 
         
       
-        <h3 id="policy.registeredresources.GetRegisteredResourceValuesByFQNsResponse.FqnValueMapEntry">GetRegisteredResourceValuesByFQNsResponse.FqnValueMapEntry</h3>
+        <h3 id="policy.obligations.GetObligationsByFQNsResponse.FqnObligationMapEntry">GetObligationsByFQNsResponse.FqnObligationMapEntry</h3>
         <p></p>
 
         
@@ -14831,7 +15568,7 @@ <h3 id="policy.registeredresources.GetRegisteredResourceValuesByFQNsResponse.Fqn
               
                 <tr>
                   <td>value</td>
-                  <td><a href="#policy.RegisteredResourceValue">policy.RegisteredResourceValue</a></td>
+                  <td><a href="#policy.Obligation">policy.Obligation</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -14843,7 +15580,7 @@ <h3 id="policy.registeredresources.GetRegisteredResourceValuesByFQNsResponse.Fqn
 
         
       
-        <h3 id="policy.registeredresources.ListRegisteredResourceValuesRequest">ListRegisteredResourceValuesRequest</h3>
+        <h3 id="policy.obligations.ListObligationTriggersRequest">ListObligationTriggersRequest</h3>
         <p></p>
 
         
@@ -14854,10 +15591,17 @@ <h3 id="policy.registeredresources.ListRegisteredResourceValuesRequest">ListRegi
             <tbody>
               
                 <tr>
-                  <td>resource_id</td>
+                  <td>namespace_id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Optional </p></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>namespace_fqn</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
@@ -14874,7 +15618,7 @@ <h3 id="policy.registeredresources.ListRegisteredResourceValuesRequest">ListRegi
 
         
       
-        <h3 id="policy.registeredresources.ListRegisteredResourceValuesResponse">ListRegisteredResourceValuesResponse</h3>
+        <h3 id="policy.obligations.ListObligationTriggersResponse">ListObligationTriggersResponse</h3>
         <p></p>
 
         
@@ -14885,8 +15629,8 @@ <h3 id="policy.registeredresources.ListRegisteredResourceValuesResponse">ListReg
             <tbody>
               
                 <tr>
-                  <td>values</td>
-                  <td><a href="#policy.RegisteredResourceValue">policy.RegisteredResourceValue</a></td>
+                  <td>triggers</td>
+                  <td><a href="#policy.ObligationTrigger">policy.ObligationTrigger</a></td>
                   <td>repeated</td>
                   <td><p> </p></td>
                 </tr>
@@ -14905,7 +15649,7 @@ <h3 id="policy.registeredresources.ListRegisteredResourceValuesResponse">ListReg
 
         
       
-        <h3 id="policy.registeredresources.ListRegisteredResourcesRequest">ListRegisteredResourcesRequest</h3>
+        <h3 id="policy.obligations.ListObligationsRequest">ListObligationsRequest</h3>
         <p></p>
 
         
@@ -14938,7 +15682,7 @@ <h3 id="policy.registeredresources.ListRegisteredResourcesRequest">ListRegistere
               
                 <tr>
                   <td>sort</td>
-                  <td><a href="#policy.registeredresources.RegisteredResourcesSort">RegisteredResourcesSort</a></td>
+                  <td><a href="#policy.obligations.ObligationsSort">ObligationsSort</a></td>
                   <td>repeated</td>
                   <td><p>Optional - CONSTRAINT: max 1 item
 Sort defaults:
@@ -14961,7 +15705,7 @@ <h3 id="policy.registeredresources.ListRegisteredResourcesRequest">ListRegistere
 
         
       
-        <h3 id="policy.registeredresources.ListRegisteredResourcesResponse">ListRegisteredResourcesResponse</h3>
+        <h3 id="policy.obligations.ListObligationsResponse">ListObligationsResponse</h3>
         <p></p>
 
         
@@ -14972,8 +15716,8 @@ <h3 id="policy.registeredresources.ListRegisteredResourcesResponse">ListRegister
             <tbody>
               
                 <tr>
-                  <td>resources</td>
-                  <td><a href="#policy.RegisteredResource">policy.RegisteredResource</a></td>
+                  <td>obligations</td>
+                  <td><a href="#policy.Obligation">policy.Obligation</a></td>
                   <td>repeated</td>
                   <td><p> </p></td>
                 </tr>
@@ -14992,7 +15736,7 @@ <h3 id="policy.registeredresources.ListRegisteredResourcesResponse">ListRegister
 
         
       
-        <h3 id="policy.registeredresources.RegisteredResourcesSort">RegisteredResourcesSort</h3>
+        <h3 id="policy.obligations.ObligationsSort">ObligationsSort</h3>
         <p></p>
 
         
@@ -15004,7 +15748,7 @@ <h3 id="policy.registeredresources.RegisteredResourcesSort">RegisteredResourcesS
               
                 <tr>
                   <td>field</td>
-                  <td><a href="#policy.registeredresources.SortRegisteredResourcesType">SortRegisteredResourcesType</a></td>
+                  <td><a href="#policy.obligations.SortObligationsType">SortObligationsType</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -15023,7 +15767,55 @@ <h3 id="policy.registeredresources.RegisteredResourcesSort">RegisteredResourcesS
 
         
       
-        <h3 id="policy.registeredresources.UpdateRegisteredResourceRequest">UpdateRegisteredResourceRequest</h3>
+        <h3 id="policy.obligations.RemoveObligationTriggerRequest">RemoveObligationTriggerRequest</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Required </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.obligations.RemoveObligationTriggerResponse">RemoveObligationTriggerResponse</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>trigger</td>
+                  <td><a href="#policy.ObligationTrigger">policy.ObligationTrigger</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.obligations.UpdateObligationRequest">UpdateObligationRequest</h3>
         <p></p>
 
         
@@ -15051,8 +15843,7 @@ <h3 id="policy.registeredresources.UpdateRegisteredResourceRequest">UpdateRegist
                   <td>metadata</td>
                   <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
                   <td></td>
-                  <td><p>Optional
-Common metadata </p></td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
@@ -15069,7 +15860,7 @@ <h3 id="policy.registeredresources.UpdateRegisteredResourceRequest">UpdateRegist
 
         
       
-        <h3 id="policy.registeredresources.UpdateRegisteredResourceResponse">UpdateRegisteredResourceResponse</h3>
+        <h3 id="policy.obligations.UpdateObligationResponse">UpdateObligationResponse</h3>
         <p></p>
 
         
@@ -15080,8 +15871,8 @@ <h3 id="policy.registeredresources.UpdateRegisteredResourceResponse">UpdateRegis
             <tbody>
               
                 <tr>
-                  <td>resource</td>
-                  <td><a href="#policy.RegisteredResource">policy.RegisteredResource</a></td>
+                  <td>obligation</td>
+                  <td><a href="#policy.Obligation">policy.Obligation</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -15093,7 +15884,7 @@ <h3 id="policy.registeredresources.UpdateRegisteredResourceResponse">UpdateRegis
 
         
       
-        <h3 id="policy.registeredresources.UpdateRegisteredResourceValueRequest">UpdateRegisteredResourceValueRequest</h3>
+        <h3 id="policy.obligations.UpdateObligationValueRequest">UpdateObligationValueRequest</h3>
         <p></p>
 
         
@@ -15118,11 +15909,11 @@ <h3 id="policy.registeredresources.UpdateRegisteredResourceValueRequest">UpdateR
                 </tr>
               
                 <tr>
-                  <td>action_attribute_values</td>
-                  <td><a href="#policy.registeredresources.ActionAttributeValue">ActionAttributeValue</a></td>
+                  <td>triggers</td>
+                  <td><a href="#policy.obligations.ValueTriggerRequest">ValueTriggerRequest</a></td>
                   <td>repeated</td>
                   <td><p>Optional
-Action Attribute Values provided here will replace all existing records in the database. To delete all action attribute values, set this field to an empty list. </p></td>
+Obligation Triggers provided here will replace all existing records in the database. </p></td>
                 </tr>
               
                 <tr>
@@ -15147,7 +15938,7 @@ <h3 id="policy.registeredresources.UpdateRegisteredResourceValueRequest">UpdateR
 
         
       
-        <h3 id="policy.registeredresources.UpdateRegisteredResourceValueResponse">UpdateRegisteredResourceValueResponse</h3>
+        <h3 id="policy.obligations.UpdateObligationValueResponse">UpdateObligationValueResponse</h3>
         <p></p>
 
         
@@ -15159,7 +15950,7 @@ <h3 id="policy.registeredresources.UpdateRegisteredResourceValueResponse">Update
               
                 <tr>
                   <td>value</td>
-                  <td><a href="#policy.RegisteredResourceValue">policy.RegisteredResourceValue</a></td>
+                  <td><a href="#policy.ObligationValue">policy.ObligationValue</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -15171,9 +15962,47 @@ <h3 id="policy.registeredresources.UpdateRegisteredResourceValueResponse">Update
 
         
       
+        <h3 id="policy.obligations.ValueTriggerRequest">ValueTriggerRequest</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>action</td>
+                  <td><a href="#common.IdNameIdentifier">common.IdNameIdentifier</a></td>
+                  <td></td>
+                  <td><p>Required. The ID of the action that will trigger this obligation value policy decisioning. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>attribute_value</td>
+                  <td><a href="#common.IdFqnIdentifier">common.IdFqnIdentifier</a></td>
+                  <td></td>
+                  <td><p>Required. The attribute value ID that will trigger this obligation value policy decisioning. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>context</td>
+                  <td><a href="#policy.RequestContext">policy.RequestContext</a></td>
+                  <td></td>
+                  <td><p>Optional. The request context for this obligation value policy decisioning. </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
 
       
-        <h3 id="policy.registeredresources.SortRegisteredResourcesType">SortRegisteredResourcesType</h3>
+        <h3 id="policy.obligations.SortObligationsType">SortObligationsType</h3>
         <p></p>
         <table class="enum-table">
           <thead>
@@ -15182,29 +16011,35 @@ <h3 id="policy.registeredresources.SortRegisteredResourcesType">SortRegisteredRe
           <tbody>
             
               <tr>
-                <td>SORT_REGISTERED_RESOURCES_TYPE_UNSPECIFIED</td>
+                <td>SORT_OBLIGATIONS_TYPE_UNSPECIFIED</td>
                 <td>0</td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>SORT_REGISTERED_RESOURCES_TYPE_NAME</td>
+                <td>SORT_OBLIGATIONS_TYPE_NAME</td>
                 <td>1</td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>SORT_REGISTERED_RESOURCES_TYPE_CREATED_AT</td>
+                <td>SORT_OBLIGATIONS_TYPE_FQN</td>
                 <td>2</td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>SORT_REGISTERED_RESOURCES_TYPE_UPDATED_AT</td>
+                <td>SORT_OBLIGATIONS_TYPE_CREATED_AT</td>
                 <td>3</td>
                 <td><p></p></td>
               </tr>
             
+              <tr>
+                <td>SORT_OBLIGATIONS_TYPE_UPDATED_AT</td>
+                <td>4</td>
+                <td><p></p></td>
+              </tr>
+            
           </tbody>
         </table>
       
@@ -15212,8 +16047,8 @@ <h3 id="policy.registeredresources.SortRegisteredResourcesType">SortRegisteredRe
       
 
       
-        <h3 id="policy.registeredresources.RegisteredResourcesService">RegisteredResourcesService</h3>
-        <p>Registered Resources</p>
+        <h3 id="policy.obligations.Service">Service</h3>
+        <p>Obligation Service</p><p>/</p>
         <table class="enum-table">
           <thead>
             <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
@@ -15221,95 +16056,219 @@ <h3 id="policy.registeredresources.RegisteredResourcesService">RegisteredResourc
           <tbody>
             
               <tr>
-                <td>CreateRegisteredResource</td>
-                <td><a href="#policy.registeredresources.CreateRegisteredResourceRequest">CreateRegisteredResourceRequest</a></td>
-                <td><a href="#policy.registeredresources.CreateRegisteredResourceResponse">CreateRegisteredResourceResponse</a></td>
+                <td>ListObligations</td>
+                <td><a href="#policy.obligations.ListObligationsRequest">ListObligationsRequest</a></td>
+                <td><a href="#policy.obligations.ListObligationsResponse">ListObligationsResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>GetRegisteredResource</td>
-                <td><a href="#policy.registeredresources.GetRegisteredResourceRequest">GetRegisteredResourceRequest</a></td>
-                <td><a href="#policy.registeredresources.GetRegisteredResourceResponse">GetRegisteredResourceResponse</a></td>
+                <td>GetObligation</td>
+                <td><a href="#policy.obligations.GetObligationRequest">GetObligationRequest</a></td>
+                <td><a href="#policy.obligations.GetObligationResponse">GetObligationResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>ListRegisteredResources</td>
-                <td><a href="#policy.registeredresources.ListRegisteredResourcesRequest">ListRegisteredResourcesRequest</a></td>
-                <td><a href="#policy.registeredresources.ListRegisteredResourcesResponse">ListRegisteredResourcesResponse</a></td>
+                <td>GetObligationsByFQNs</td>
+                <td><a href="#policy.obligations.GetObligationsByFQNsRequest">GetObligationsByFQNsRequest</a></td>
+                <td><a href="#policy.obligations.GetObligationsByFQNsResponse">GetObligationsByFQNsResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>UpdateRegisteredResource</td>
-                <td><a href="#policy.registeredresources.UpdateRegisteredResourceRequest">UpdateRegisteredResourceRequest</a></td>
-                <td><a href="#policy.registeredresources.UpdateRegisteredResourceResponse">UpdateRegisteredResourceResponse</a></td>
+                <td>CreateObligation</td>
+                <td><a href="#policy.obligations.CreateObligationRequest">CreateObligationRequest</a></td>
+                <td><a href="#policy.obligations.CreateObligationResponse">CreateObligationResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>DeleteRegisteredResource</td>
-                <td><a href="#policy.registeredresources.DeleteRegisteredResourceRequest">DeleteRegisteredResourceRequest</a></td>
-                <td><a href="#policy.registeredresources.DeleteRegisteredResourceResponse">DeleteRegisteredResourceResponse</a></td>
+                <td>UpdateObligation</td>
+                <td><a href="#policy.obligations.UpdateObligationRequest">UpdateObligationRequest</a></td>
+                <td><a href="#policy.obligations.UpdateObligationResponse">UpdateObligationResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>CreateRegisteredResourceValue</td>
-                <td><a href="#policy.registeredresources.CreateRegisteredResourceValueRequest">CreateRegisteredResourceValueRequest</a></td>
-                <td><a href="#policy.registeredresources.CreateRegisteredResourceValueResponse">CreateRegisteredResourceValueResponse</a></td>
+                <td>DeleteObligation</td>
+                <td><a href="#policy.obligations.DeleteObligationRequest">DeleteObligationRequest</a></td>
+                <td><a href="#policy.obligations.DeleteObligationResponse">DeleteObligationResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>GetRegisteredResourceValue</td>
-                <td><a href="#policy.registeredresources.GetRegisteredResourceValueRequest">GetRegisteredResourceValueRequest</a></td>
-                <td><a href="#policy.registeredresources.GetRegisteredResourceValueResponse">GetRegisteredResourceValueResponse</a></td>
+                <td>GetObligationValue</td>
+                <td><a href="#policy.obligations.GetObligationValueRequest">GetObligationValueRequest</a></td>
+                <td><a href="#policy.obligations.GetObligationValueResponse">GetObligationValueResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>GetRegisteredResourceValuesByFQNs</td>
-                <td><a href="#policy.registeredresources.GetRegisteredResourceValuesByFQNsRequest">GetRegisteredResourceValuesByFQNsRequest</a></td>
-                <td><a href="#policy.registeredresources.GetRegisteredResourceValuesByFQNsResponse">GetRegisteredResourceValuesByFQNsResponse</a></td>
+                <td>GetObligationValuesByFQNs</td>
+                <td><a href="#policy.obligations.GetObligationValuesByFQNsRequest">GetObligationValuesByFQNsRequest</a></td>
+                <td><a href="#policy.obligations.GetObligationValuesByFQNsResponse">GetObligationValuesByFQNsResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>ListRegisteredResourceValues</td>
-                <td><a href="#policy.registeredresources.ListRegisteredResourceValuesRequest">ListRegisteredResourceValuesRequest</a></td>
-                <td><a href="#policy.registeredresources.ListRegisteredResourceValuesResponse">ListRegisteredResourceValuesResponse</a></td>
+                <td>CreateObligationValue</td>
+                <td><a href="#policy.obligations.CreateObligationValueRequest">CreateObligationValueRequest</a></td>
+                <td><a href="#policy.obligations.CreateObligationValueResponse">CreateObligationValueResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>UpdateRegisteredResourceValue</td>
-                <td><a href="#policy.registeredresources.UpdateRegisteredResourceValueRequest">UpdateRegisteredResourceValueRequest</a></td>
-                <td><a href="#policy.registeredresources.UpdateRegisteredResourceValueResponse">UpdateRegisteredResourceValueResponse</a></td>
+                <td>UpdateObligationValue</td>
+                <td><a href="#policy.obligations.UpdateObligationValueRequest">UpdateObligationValueRequest</a></td>
+                <td><a href="#policy.obligations.UpdateObligationValueResponse">UpdateObligationValueResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>DeleteRegisteredResourceValue</td>
-                <td><a href="#policy.registeredresources.DeleteRegisteredResourceValueRequest">DeleteRegisteredResourceValueRequest</a></td>
-                <td><a href="#policy.registeredresources.DeleteRegisteredResourceValueResponse">DeleteRegisteredResourceValueResponse</a></td>
+                <td>DeleteObligationValue</td>
+                <td><a href="#policy.obligations.DeleteObligationValueRequest">DeleteObligationValueRequest</a></td>
+                <td><a href="#policy.obligations.DeleteObligationValueResponse">DeleteObligationValueResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>GetObligationTrigger</td>
+                <td><a href="#policy.obligations.GetObligationTriggerRequest">GetObligationTriggerRequest</a></td>
+                <td><a href="#policy.obligations.GetObligationTriggerResponse">GetObligationTriggerResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>AddObligationTrigger</td>
+                <td><a href="#policy.obligations.AddObligationTriggerRequest">AddObligationTriggerRequest</a></td>
+                <td><a href="#policy.obligations.AddObligationTriggerResponse">AddObligationTriggerResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>RemoveObligationTrigger</td>
+                <td><a href="#policy.obligations.RemoveObligationTriggerRequest">RemoveObligationTriggerRequest</a></td>
+                <td><a href="#policy.obligations.RemoveObligationTriggerResponse">RemoveObligationTriggerResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>ListObligationTriggers</td>
+                <td><a href="#policy.obligations.ListObligationTriggersRequest">ListObligationTriggersRequest</a></td>
+                <td><a href="#policy.obligations.ListObligationTriggersResponse">ListObligationTriggersResponse</a></td>
                 <td><p></p></td>
               </tr>
             
           </tbody>
         </table>
 
-        
-    
-      
-      <div class="file-heading">
-        <h2 id="policy/resourcemapping/resource_mapping.proto">policy/resourcemapping/resource_mapping.proto</h2><a href="#title">Top</a>
-      </div>
-      <p></p>
+        
+          
+          
+          <h4>Methods with idempotency_level option</h4>
+          <table>
+            <thead>
+              <tr>
+                <td>Method Name</td>
+                <td>Option</td>
+              </tr>
+            </thead>
+            <tbody>
+            
+              <tr>
+                <td>ListObligations</td>
+                <td><p>NO_SIDE_EFFECTS</p></td>
+              </tr>
+            
+              <tr>
+                <td>GetObligation</td>
+                <td><p>NO_SIDE_EFFECTS</p></td>
+              </tr>
+            
+              <tr>
+                <td>GetObligationsByFQNs</td>
+                <td><p>NO_SIDE_EFFECTS</p></td>
+              </tr>
+            
+              <tr>
+                <td>GetObligationValue</td>
+                <td><p>NO_SIDE_EFFECTS</p></td>
+              </tr>
+            
+              <tr>
+                <td>GetObligationValuesByFQNs</td>
+                <td><p>NO_SIDE_EFFECTS</p></td>
+              </tr>
+            
+              <tr>
+                <td>GetObligationTrigger</td>
+                <td><p>NO_SIDE_EFFECTS</p></td>
+              </tr>
+            
+              <tr>
+                <td>ListObligationTriggers</td>
+                <td><p>NO_SIDE_EFFECTS</p></td>
+              </tr>
+            
+            </tbody>
+          </table>
+          
+        
+    
+      
+      <div class="file-heading">
+        <h2 id="policy/registeredresources/registered_resources.proto">policy/registeredresources/registered_resources.proto</h2><a href="#title">Top</a>
+      </div>
+      <p></p>
+
+      
+        <h3 id="policy.registeredresources.ActionAttributeValue">ActionAttributeValue</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>action_id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>action_name</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>attribute_value_id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>attribute_value_fqn</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
 
+        
       
-        <h3 id="policy.resourcemapping.CreateResourceMappingGroupRequest">CreateResourceMappingGroupRequest</h3>
+        <h3 id="policy.registeredresources.CreateRegisteredResourceRequest">CreateRegisteredResourceRequest</h3>
         <p></p>
 
         
@@ -15320,31 +16279,41 @@ <h3 id="policy.resourcemapping.CreateResourceMappingGroupRequest">CreateResource
             <tbody>
               
                 <tr>
-                  <td>namespace_id</td>
+                  <td>name</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Required </p></td>
                 </tr>
               
                 <tr>
-                  <td>namespace_fqn</td>
+                  <td>values</td>
+                  <td><a href="#string">string</a></td>
+                  <td>repeated</td>
+                  <td><p>Optional
+Registered Resource Values (when provided) must be alphanumeric strings, allowing hyphens and underscores but not as the first or last character.
+The stored value will be normalized to lower case. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>namespace_id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>name</td>
+                  <td>namespace_fqn</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Required </p></td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
                   <td>metadata</td>
                   <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
                   <td></td>
-                  <td><p>Common metadata </p></td>
+                  <td><p>Optional
+Common metadata </p></td>
                 </tr>
               
             </tbody>
@@ -15354,7 +16323,7 @@ <h3 id="policy.resourcemapping.CreateResourceMappingGroupRequest">CreateResource
 
         
       
-        <h3 id="policy.resourcemapping.CreateResourceMappingGroupResponse">CreateResourceMappingGroupResponse</h3>
+        <h3 id="policy.registeredresources.CreateRegisteredResourceResponse">CreateRegisteredResourceResponse</h3>
         <p></p>
 
         
@@ -15365,8 +16334,8 @@ <h3 id="policy.resourcemapping.CreateResourceMappingGroupResponse">CreateResourc
             <tbody>
               
                 <tr>
-                  <td>resource_mapping_group</td>
-                  <td><a href="#policy.ResourceMappingGroup">policy.ResourceMappingGroup</a></td>
+                  <td>resource</td>
+                  <td><a href="#policy.RegisteredResource">policy.RegisteredResource</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -15378,7 +16347,7 @@ <h3 id="policy.resourcemapping.CreateResourceMappingGroupResponse">CreateResourc
 
         
       
-        <h3 id="policy.resourcemapping.CreateResourceMappingRequest">CreateResourceMappingRequest</h3>
+        <h3 id="policy.registeredresources.CreateRegisteredResourceValueRequest">CreateRegisteredResourceValueRequest</h3>
         <p></p>
 
         
@@ -15389,48 +16358,34 @@ <h3 id="policy.resourcemapping.CreateResourceMappingRequest">CreateResourceMappi
             <tbody>
               
                 <tr>
-                  <td>attribute_value_id</td>
+                  <td>resource_id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
                   <td><p>Required </p></td>
                 </tr>
               
                 <tr>
-                  <td>terms</td>
-                  <td><a href="#string">string</a></td>
-                  <td>repeated</td>
-                  <td><p>Required </p></td>
-                </tr>
-              
-                <tr>
-                  <td>group_id</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Optional </p></td>
-                </tr>
-              
-                <tr>
-                  <td>namespace_id</td>
+                  <td>value</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Optional
-The namespace that owns this resource mapping. If a group_id is provided,
-this must match the group&#39;s namespace (and may be omitted to inherit it). </p></td>
+                  <td><p>Required </p></td>
                 </tr>
               
                 <tr>
-                  <td>namespace_fqn</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
+                  <td>action_attribute_values</td>
+                  <td><a href="#policy.registeredresources.ActionAttributeValue">ActionAttributeValue</a></td>
+                  <td>repeated</td>
                   <td><p>Optional
-Alternative to namespace_id; the FQN of the owning namespace. </p></td>
+The associated Action &lt;&gt; AttributeValue combinations to be utilized in authorization/entitlement decisioning
+(i.e. action read -&gt; attribute value https://example.com/attr/department/value/marketing) </p></td>
                 </tr>
               
                 <tr>
                   <td>metadata</td>
                   <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
                   <td></td>
-                  <td><p>Optional </p></td>
+                  <td><p>Optional
+Common metadata </p></td>
                 </tr>
               
             </tbody>
@@ -15440,7 +16395,7 @@ <h3 id="policy.resourcemapping.CreateResourceMappingRequest">CreateResourceMappi
 
         
       
-        <h3 id="policy.resourcemapping.CreateResourceMappingResponse">CreateResourceMappingResponse</h3>
+        <h3 id="policy.registeredresources.CreateRegisteredResourceValueResponse">CreateRegisteredResourceValueResponse</h3>
         <p></p>
 
         
@@ -15451,8 +16406,8 @@ <h3 id="policy.resourcemapping.CreateResourceMappingResponse">CreateResourceMapp
             <tbody>
               
                 <tr>
-                  <td>resource_mapping</td>
-                  <td><a href="#policy.ResourceMapping">policy.ResourceMapping</a></td>
+                  <td>value</td>
+                  <td><a href="#policy.RegisteredResourceValue">policy.RegisteredResourceValue</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -15464,7 +16419,7 @@ <h3 id="policy.resourcemapping.CreateResourceMappingResponse">CreateResourceMapp
 
         
       
-        <h3 id="policy.resourcemapping.DeleteResourceMappingGroupRequest">DeleteResourceMappingGroupRequest</h3>
+        <h3 id="policy.registeredresources.DeleteRegisteredResourceRequest">DeleteRegisteredResourceRequest</h3>
         <p></p>
 
         
@@ -15488,7 +16443,7 @@ <h3 id="policy.resourcemapping.DeleteResourceMappingGroupRequest">DeleteResource
 
         
       
-        <h3 id="policy.resourcemapping.DeleteResourceMappingGroupResponse">DeleteResourceMappingGroupResponse</h3>
+        <h3 id="policy.registeredresources.DeleteRegisteredResourceResponse">DeleteRegisteredResourceResponse</h3>
         <p></p>
 
         
@@ -15499,8 +16454,8 @@ <h3 id="policy.resourcemapping.DeleteResourceMappingGroupResponse">DeleteResourc
             <tbody>
               
                 <tr>
-                  <td>resource_mapping_group</td>
-                  <td><a href="#policy.ResourceMappingGroup">policy.ResourceMappingGroup</a></td>
+                  <td>resource</td>
+                  <td><a href="#policy.RegisteredResource">policy.RegisteredResource</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -15512,7 +16467,7 @@ <h3 id="policy.resourcemapping.DeleteResourceMappingGroupResponse">DeleteResourc
 
         
       
-        <h3 id="policy.resourcemapping.DeleteResourceMappingRequest">DeleteResourceMappingRequest</h3>
+        <h3 id="policy.registeredresources.DeleteRegisteredResourceValueRequest">DeleteRegisteredResourceValueRequest</h3>
         <p></p>
 
         
@@ -15536,7 +16491,7 @@ <h3 id="policy.resourcemapping.DeleteResourceMappingRequest">DeleteResourceMappi
 
         
       
-        <h3 id="policy.resourcemapping.DeleteResourceMappingResponse">DeleteResourceMappingResponse</h3>
+        <h3 id="policy.registeredresources.DeleteRegisteredResourceValueResponse">DeleteRegisteredResourceValueResponse</h3>
         <p></p>
 
         
@@ -15547,8 +16502,8 @@ <h3 id="policy.resourcemapping.DeleteResourceMappingResponse">DeleteResourceMapp
             <tbody>
               
                 <tr>
-                  <td>resource_mapping</td>
-                  <td><a href="#policy.ResourceMapping">policy.ResourceMapping</a></td>
+                  <td>value</td>
+                  <td><a href="#policy.RegisteredResourceValue">policy.RegisteredResourceValue</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -15560,7 +16515,7 @@ <h3 id="policy.resourcemapping.DeleteResourceMappingResponse">DeleteResourceMapp
 
         
       
-        <h3 id="policy.resourcemapping.GetResourceMappingGroupRequest">GetResourceMappingGroupRequest</h3>
+        <h3 id="policy.registeredresources.GetRegisteredResourceRequest">GetRegisteredResourceRequest</h3>
         <p></p>
 
         
@@ -15574,7 +16529,28 @@ <h3 id="policy.resourcemapping.GetResourceMappingGroupRequest">GetResourceMappin
                   <td>id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Required </p></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>name</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>namespace_fqn</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>namespace_id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
@@ -15584,7 +16560,7 @@ <h3 id="policy.resourcemapping.GetResourceMappingGroupRequest">GetResourceMappin
 
         
       
-        <h3 id="policy.resourcemapping.GetResourceMappingGroupResponse">GetResourceMappingGroupResponse</h3>
+        <h3 id="policy.registeredresources.GetRegisteredResourceResponse">GetRegisteredResourceResponse</h3>
         <p></p>
 
         
@@ -15595,8 +16571,8 @@ <h3 id="policy.resourcemapping.GetResourceMappingGroupResponse">GetResourceMappi
             <tbody>
               
                 <tr>
-                  <td>resource_mapping_group</td>
-                  <td><a href="#policy.ResourceMappingGroup">policy.ResourceMappingGroup</a></td>
+                  <td>resource</td>
+                  <td><a href="#policy.RegisteredResource">policy.RegisteredResource</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -15608,7 +16584,7 @@ <h3 id="policy.resourcemapping.GetResourceMappingGroupResponse">GetResourceMappi
 
         
       
-        <h3 id="policy.resourcemapping.GetResourceMappingRequest">GetResourceMappingRequest</h3>
+        <h3 id="policy.registeredresources.GetRegisteredResourceValueRequest">GetRegisteredResourceValueRequest</h3>
         <p></p>
 
         
@@ -15622,7 +16598,14 @@ <h3 id="policy.resourcemapping.GetResourceMappingRequest">GetResourceMappingRequ
                   <td>id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Required </p></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>fqn</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
@@ -15632,7 +16615,7 @@ <h3 id="policy.resourcemapping.GetResourceMappingRequest">GetResourceMappingRequ
 
         
       
-        <h3 id="policy.resourcemapping.GetResourceMappingResponse">GetResourceMappingResponse</h3>
+        <h3 id="policy.registeredresources.GetRegisteredResourceValueResponse">GetRegisteredResourceValueResponse</h3>
         <p></p>
 
         
@@ -15643,8 +16626,8 @@ <h3 id="policy.resourcemapping.GetResourceMappingResponse">GetResourceMappingRes
             <tbody>
               
                 <tr>
-                  <td>resource_mapping</td>
-                  <td><a href="#policy.ResourceMapping">policy.ResourceMapping</a></td>
+                  <td>value</td>
+                  <td><a href="#policy.RegisteredResourceValue">policy.RegisteredResourceValue</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -15656,7 +16639,7 @@ <h3 id="policy.resourcemapping.GetResourceMappingResponse">GetResourceMappingRes
 
         
       
-        <h3 id="policy.resourcemapping.ListResourceMappingGroupsRequest">ListResourceMappingGroupsRequest</h3>
+        <h3 id="policy.registeredresources.GetRegisteredResourceValuesByFQNsRequest">GetRegisteredResourceValuesByFQNsRequest</h3>
         <p></p>
 
         
@@ -15667,24 +16650,10 @@ <h3 id="policy.resourcemapping.ListResourceMappingGroupsRequest">ListResourceMap
             <tbody>
               
                 <tr>
-                  <td>namespace_id</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Optional </p></td>
-                </tr>
-              
-                <tr>
-                  <td>namespace_fqn</td>
+                  <td>fqns</td>
                   <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Optional </p></td>
-                </tr>
-              
-                <tr>
-                  <td>pagination</td>
-                  <td><a href="#policy.PageRequest">policy.PageRequest</a></td>
-                  <td></td>
-                  <td><p>Optional </p></td>
+                  <td>repeated</td>
+                  <td><p>Required </p></td>
                 </tr>
               
             </tbody>
@@ -15694,7 +16663,7 @@ <h3 id="policy.resourcemapping.ListResourceMappingGroupsRequest">ListResourceMap
 
         
       
-        <h3 id="policy.resourcemapping.ListResourceMappingGroupsResponse">ListResourceMappingGroupsResponse</h3>
+        <h3 id="policy.registeredresources.GetRegisteredResourceValuesByFQNsResponse">GetRegisteredResourceValuesByFQNsResponse</h3>
         <p></p>
 
         
@@ -15705,19 +16674,12 @@ <h3 id="policy.resourcemapping.ListResourceMappingGroupsResponse">ListResourceMa
             <tbody>
               
                 <tr>
-                  <td>resource_mapping_groups</td>
-                  <td><a href="#policy.ResourceMappingGroup">policy.ResourceMappingGroup</a></td>
+                  <td>fqn_value_map</td>
+                  <td><a href="#policy.registeredresources.GetRegisteredResourceValuesByFQNsResponse.FqnValueMapEntry">GetRegisteredResourceValuesByFQNsResponse.FqnValueMapEntry</a></td>
                   <td>repeated</td>
                   <td><p> </p></td>
                 </tr>
               
-                <tr>
-                  <td>pagination</td>
-                  <td><a href="#policy.PageResponse">policy.PageResponse</a></td>
-                  <td></td>
-                  <td><p> </p></td>
-                </tr>
-              
             </tbody>
           </table>
 
@@ -15725,7 +16687,7 @@ <h3 id="policy.resourcemapping.ListResourceMappingGroupsResponse">ListResourceMa
 
         
       
-        <h3 id="policy.resourcemapping.ListResourceMappingsByGroupFqnsRequest">ListResourceMappingsByGroupFqnsRequest</h3>
+        <h3 id="policy.registeredresources.GetRegisteredResourceValuesByFQNsResponse.FqnValueMapEntry">GetRegisteredResourceValuesByFQNsResponse.FqnValueMapEntry</h3>
         <p></p>
 
         
@@ -15736,11 +16698,17 @@ <h3 id="policy.resourcemapping.ListResourceMappingsByGroupFqnsRequest">ListResou
             <tbody>
               
                 <tr>
-                  <td>fqns</td>
+                  <td>key</td>
                   <td><a href="#string">string</a></td>
-                  <td>repeated</td>
-                  <td><p>Required
-Structure of the RM Group FQN is &#39;https://&lt;namespace&gt;/resm/&lt;group name&gt;&#39; </p></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>value</td>
+                  <td><a href="#policy.RegisteredResourceValue">policy.RegisteredResourceValue</a></td>
+                  <td></td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
@@ -15750,7 +16718,7 @@ <h3 id="policy.resourcemapping.ListResourceMappingsByGroupFqnsRequest">ListResou
 
         
       
-        <h3 id="policy.resourcemapping.ListResourceMappingsByGroupFqnsResponse">ListResourceMappingsByGroupFqnsResponse</h3>
+        <h3 id="policy.registeredresources.ListRegisteredResourceValuesRequest">ListRegisteredResourceValuesRequest</h3>
         <p></p>
 
         
@@ -15761,10 +16729,17 @@ <h3 id="policy.resourcemapping.ListResourceMappingsByGroupFqnsResponse">ListReso
             <tbody>
               
                 <tr>
-                  <td>fqn_resource_mapping_groups</td>
-                  <td><a href="#policy.resourcemapping.ListResourceMappingsByGroupFqnsResponse.FqnResourceMappingGroupsEntry">ListResourceMappingsByGroupFqnsResponse.FqnResourceMappingGroupsEntry</a></td>
-                  <td>repeated</td>
-                  <td><p> </p></td>
+                  <td>resource_id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Optional </p></td>
+                </tr>
+              
+                <tr>
+                  <td>pagination</td>
+                  <td><a href="#policy.PageRequest">policy.PageRequest</a></td>
+                  <td></td>
+                  <td><p>Optional </p></td>
                 </tr>
               
             </tbody>
@@ -15774,7 +16749,7 @@ <h3 id="policy.resourcemapping.ListResourceMappingsByGroupFqnsResponse">ListReso
 
         
       
-        <h3 id="policy.resourcemapping.ListResourceMappingsByGroupFqnsResponse.FqnResourceMappingGroupsEntry">ListResourceMappingsByGroupFqnsResponse.FqnResourceMappingGroupsEntry</h3>
+        <h3 id="policy.registeredresources.ListRegisteredResourceValuesResponse">ListRegisteredResourceValuesResponse</h3>
         <p></p>
 
         
@@ -15785,15 +16760,15 @@ <h3 id="policy.resourcemapping.ListResourceMappingsByGroupFqnsResponse.FqnResour
             <tbody>
               
                 <tr>
-                  <td>key</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
+                  <td>values</td>
+                  <td><a href="#policy.RegisteredResourceValue">policy.RegisteredResourceValue</a></td>
+                  <td>repeated</td>
                   <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>value</td>
-                  <td><a href="#policy.resourcemapping.ResourceMappingsByGroup">ResourceMappingsByGroup</a></td>
+                  <td>pagination</td>
+                  <td><a href="#policy.PageResponse">policy.PageResponse</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -15805,7 +16780,7 @@ <h3 id="policy.resourcemapping.ListResourceMappingsByGroupFqnsResponse.FqnResour
 
         
       
-        <h3 id="policy.resourcemapping.ListResourceMappingsRequest">ListResourceMappingsRequest</h3>
+        <h3 id="policy.registeredresources.ListRegisteredResourcesRequest">ListRegisteredResourcesRequest</h3>
         <p></p>
 
         
@@ -15816,31 +16791,40 @@ <h3 id="policy.resourcemapping.ListResourceMappingsRequest">ListResourceMappings
             <tbody>
               
                 <tr>
-                  <td>group_id</td>
+                  <td>namespace_id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Optional </p></td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>namespace_id</td>
+                  <td>namespace_fqn</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Optional
-Filter the list to resource mappings owned by this namespace. </p></td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>namespace_fqn</td>
-                  <td><a href="#string">string</a></td>
+                  <td>pagination</td>
+                  <td><a href="#policy.PageRequest">policy.PageRequest</a></td>
                   <td></td>
-                  <td><p>Optional
-Filter the list to resource mappings owned by this namespace. </p></td>
+                  <td><p>Optional </p></td>
+                </tr>
+              
+                <tr>
+                  <td>sort</td>
+                  <td><a href="#policy.registeredresources.RegisteredResourcesSort">RegisteredResourcesSort</a></td>
+                  <td>repeated</td>
+                  <td><p>Optional - CONSTRAINT: max 1 item
+Sort defaults:
+  - direction UNSPECIFIED defaults to DESC for the specified field
+  - field UNSPECIFIED defaults to created_at with the specified direction
+  - both UNSPECIFIED or sort omitted defaults to created_at DESC </p></td>
                 </tr>
               
                 <tr>
-                  <td>pagination</td>
-                  <td><a href="#policy.PageRequest">policy.PageRequest</a></td>
+                  <td>search</td>
+                  <td><a href="#policy.Search">policy.Search</a></td>
                   <td></td>
                   <td><p>Optional </p></td>
                 </tr>
@@ -15852,7 +16836,7 @@ <h3 id="policy.resourcemapping.ListResourceMappingsRequest">ListResourceMappings
 
         
       
-        <h3 id="policy.resourcemapping.ListResourceMappingsResponse">ListResourceMappingsResponse</h3>
+        <h3 id="policy.registeredresources.ListRegisteredResourcesResponse">ListRegisteredResourcesResponse</h3>
         <p></p>
 
         
@@ -15863,8 +16847,8 @@ <h3 id="policy.resourcemapping.ListResourceMappingsResponse">ListResourceMapping
             <tbody>
               
                 <tr>
-                  <td>resource_mappings</td>
-                  <td><a href="#policy.ResourceMapping">policy.ResourceMapping</a></td>
+                  <td>resources</td>
+                  <td><a href="#policy.RegisteredResource">policy.RegisteredResource</a></td>
                   <td>repeated</td>
                   <td><p> </p></td>
                 </tr>
@@ -15883,7 +16867,7 @@ <h3 id="policy.resourcemapping.ListResourceMappingsResponse">ListResourceMapping
 
         
       
-        <h3 id="policy.resourcemapping.ResourceMappingsByGroup">ResourceMappingsByGroup</h3>
+        <h3 id="policy.registeredresources.RegisteredResourcesSort">RegisteredResourcesSort</h3>
         <p></p>
 
         
@@ -15894,16 +16878,16 @@ <h3 id="policy.resourcemapping.ResourceMappingsByGroup">ResourceMappingsByGroup<
             <tbody>
               
                 <tr>
-                  <td>group</td>
-                  <td><a href="#policy.ResourceMappingGroup">policy.ResourceMappingGroup</a></td>
+                  <td>field</td>
+                  <td><a href="#policy.registeredresources.SortRegisteredResourcesType">SortRegisteredResourcesType</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>mappings</td>
-                  <td><a href="#policy.ResourceMapping">policy.ResourceMapping</a></td>
-                  <td>repeated</td>
+                  <td>direction</td>
+                  <td><a href="#policy.SortDirection">policy.SortDirection</a></td>
+                  <td></td>
                   <td><p> </p></td>
                 </tr>
               
@@ -15914,7 +16898,7 @@ <h3 id="policy.resourcemapping.ResourceMappingsByGroup">ResourceMappingsByGroup<
 
         
       
-        <h3 id="policy.resourcemapping.UpdateResourceMappingGroupRequest">UpdateResourceMappingGroupRequest</h3>
+        <h3 id="policy.registeredresources.UpdateRegisteredResourceRequest">UpdateRegisteredResourceRequest</h3>
         <p></p>
 
         
@@ -15931,20 +16915,6 @@ <h3 id="policy.resourcemapping.UpdateResourceMappingGroupRequest">UpdateResource
                   <td><p>Required </p></td>
                 </tr>
               
-                <tr>
-                  <td>namespace_id</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Optional </p></td>
-                </tr>
-              
-                <tr>
-                  <td>namespace_fqn</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Optional </p></td>
-                </tr>
-              
                 <tr>
                   <td>name</td>
                   <td><a href="#string">string</a></td>
@@ -15956,7 +16926,8 @@ <h3 id="policy.resourcemapping.UpdateResourceMappingGroupRequest">UpdateResource
                   <td>metadata</td>
                   <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
                   <td></td>
-                  <td><p>Common metadata </p></td>
+                  <td><p>Optional
+Common metadata </p></td>
                 </tr>
               
                 <tr>
@@ -15973,7 +16944,7 @@ <h3 id="policy.resourcemapping.UpdateResourceMappingGroupRequest">UpdateResource
 
         
       
-        <h3 id="policy.resourcemapping.UpdateResourceMappingGroupResponse">UpdateResourceMappingGroupResponse</h3>
+        <h3 id="policy.registeredresources.UpdateRegisteredResourceResponse">UpdateRegisteredResourceResponse</h3>
         <p></p>
 
         
@@ -15984,8 +16955,8 @@ <h3 id="policy.resourcemapping.UpdateResourceMappingGroupResponse">UpdateResourc
             <tbody>
               
                 <tr>
-                  <td>resource_mapping_group</td>
-                  <td><a href="#policy.ResourceMappingGroup">policy.ResourceMappingGroup</a></td>
+                  <td>resource</td>
+                  <td><a href="#policy.RegisteredResource">policy.RegisteredResource</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -15997,7 +16968,7 @@ <h3 id="policy.resourcemapping.UpdateResourceMappingGroupResponse">UpdateResourc
 
         
       
-        <h3 id="policy.resourcemapping.UpdateResourceMappingRequest">UpdateResourceMappingRequest</h3>
+        <h3 id="policy.registeredresources.UpdateRegisteredResourceValueRequest">UpdateRegisteredResourceValueRequest</h3>
         <p></p>
 
         
@@ -16015,41 +16986,18 @@ <h3 id="policy.resourcemapping.UpdateResourceMappingRequest">UpdateResourceMappi
                 </tr>
               
                 <tr>
-                  <td>attribute_value_id</td>
+                  <td>value</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
                   <td><p>Optional </p></td>
                 </tr>
               
                 <tr>
-                  <td>terms</td>
-                  <td><a href="#string">string</a></td>
+                  <td>action_attribute_values</td>
+                  <td><a href="#policy.registeredresources.ActionAttributeValue">ActionAttributeValue</a></td>
                   <td>repeated</td>
-                  <td><p>Optional </p></td>
-                </tr>
-              
-                <tr>
-                  <td>group_id</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Optional </p></td>
-                </tr>
-              
-                <tr>
-                  <td>namespace_id</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p>Optional
-The namespace that owns this resource mapping. If a group_id is set on the
-mapping, this must match the group&#39;s namespace. </p></td>
-                </tr>
-              
-                <tr>
-                  <td>namespace_fqn</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
                   <td><p>Optional
-Alternative to namespace_id; the FQN of the owning namespace. </p></td>
+Action Attribute Values provided here will replace all existing records in the database. To delete all action attribute values, set this field to an empty list. </p></td>
                 </tr>
               
                 <tr>
@@ -16057,7 +17005,7 @@ <h3 id="policy.resourcemapping.UpdateResourceMappingRequest">UpdateResourceMappi
                   <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
                   <td></td>
                   <td><p>Optional
-Common Metadata </p></td>
+Common metadata </p></td>
                 </tr>
               
                 <tr>
@@ -16074,7 +17022,7 @@ <h3 id="policy.resourcemapping.UpdateResourceMappingRequest">UpdateResourceMappi
 
         
       
-        <h3 id="policy.resourcemapping.UpdateResourceMappingResponse">UpdateResourceMappingResponse</h3>
+        <h3 id="policy.registeredresources.UpdateRegisteredResourceValueResponse">UpdateRegisteredResourceValueResponse</h3>
         <p></p>
 
         
@@ -16085,8 +17033,8 @@ <h3 id="policy.resourcemapping.UpdateResourceMappingResponse">UpdateResourceMapp
             <tbody>
               
                 <tr>
-                  <td>resource_mapping</td>
-                  <td><a href="#policy.ResourceMapping">policy.ResourceMapping</a></td>
+                  <td>value</td>
+                  <td><a href="#policy.RegisteredResourceValue">policy.RegisteredResourceValue</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -16100,149 +17048,143 @@ <h3 id="policy.resourcemapping.UpdateResourceMappingResponse">UpdateResourceMapp
       
 
       
-
-      
-
-      
-        <h3 id="policy.resourcemapping.ResourceMappingService">ResourceMappingService</h3>
-        <p>Resource Mapping Groups</p>
+        <h3 id="policy.registeredresources.SortRegisteredResourcesType">SortRegisteredResourcesType</h3>
+        <p></p>
         <table class="enum-table">
           <thead>
-            <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
+            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
           </thead>
           <tbody>
             
               <tr>
-                <td>ListResourceMappingGroups</td>
-                <td><a href="#policy.resourcemapping.ListResourceMappingGroupsRequest">ListResourceMappingGroupsRequest</a></td>
-                <td><a href="#policy.resourcemapping.ListResourceMappingGroupsResponse">ListResourceMappingGroupsResponse</a></td>
+                <td>SORT_REGISTERED_RESOURCES_TYPE_UNSPECIFIED</td>
+                <td>0</td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>GetResourceMappingGroup</td>
-                <td><a href="#policy.resourcemapping.GetResourceMappingGroupRequest">GetResourceMappingGroupRequest</a></td>
-                <td><a href="#policy.resourcemapping.GetResourceMappingGroupResponse">GetResourceMappingGroupResponse</a></td>
+                <td>SORT_REGISTERED_RESOURCES_TYPE_NAME</td>
+                <td>1</td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>CreateResourceMappingGroup</td>
-                <td><a href="#policy.resourcemapping.CreateResourceMappingGroupRequest">CreateResourceMappingGroupRequest</a></td>
-                <td><a href="#policy.resourcemapping.CreateResourceMappingGroupResponse">CreateResourceMappingGroupResponse</a></td>
+                <td>SORT_REGISTERED_RESOURCES_TYPE_CREATED_AT</td>
+                <td>2</td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>UpdateResourceMappingGroup</td>
-                <td><a href="#policy.resourcemapping.UpdateResourceMappingGroupRequest">UpdateResourceMappingGroupRequest</a></td>
-                <td><a href="#policy.resourcemapping.UpdateResourceMappingGroupResponse">UpdateResourceMappingGroupResponse</a></td>
+                <td>SORT_REGISTERED_RESOURCES_TYPE_UPDATED_AT</td>
+                <td>3</td>
                 <td><p></p></td>
               </tr>
             
-              <tr>
-                <td>DeleteResourceMappingGroup</td>
-                <td><a href="#policy.resourcemapping.DeleteResourceMappingGroupRequest">DeleteResourceMappingGroupRequest</a></td>
-                <td><a href="#policy.resourcemapping.DeleteResourceMappingGroupResponse">DeleteResourceMappingGroupResponse</a></td>
-                <td><p></p></td>
-              </tr>
+          </tbody>
+        </table>
+      
+
+      
+
+      
+        <h3 id="policy.registeredresources.RegisteredResourcesService">RegisteredResourcesService</h3>
+        <p>Registered Resources</p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
+          </thead>
+          <tbody>
             
               <tr>
-                <td>ListResourceMappings</td>
-                <td><a href="#policy.resourcemapping.ListResourceMappingsRequest">ListResourceMappingsRequest</a></td>
-                <td><a href="#policy.resourcemapping.ListResourceMappingsResponse">ListResourceMappingsResponse</a></td>
+                <td>CreateRegisteredResource</td>
+                <td><a href="#policy.registeredresources.CreateRegisteredResourceRequest">CreateRegisteredResourceRequest</a></td>
+                <td><a href="#policy.registeredresources.CreateRegisteredResourceResponse">CreateRegisteredResourceResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>ListResourceMappingsByGroupFqns</td>
-                <td><a href="#policy.resourcemapping.ListResourceMappingsByGroupFqnsRequest">ListResourceMappingsByGroupFqnsRequest</a></td>
-                <td><a href="#policy.resourcemapping.ListResourceMappingsByGroupFqnsResponse">ListResourceMappingsByGroupFqnsResponse</a></td>
+                <td>GetRegisteredResource</td>
+                <td><a href="#policy.registeredresources.GetRegisteredResourceRequest">GetRegisteredResourceRequest</a></td>
+                <td><a href="#policy.registeredresources.GetRegisteredResourceResponse">GetRegisteredResourceResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>GetResourceMapping</td>
-                <td><a href="#policy.resourcemapping.GetResourceMappingRequest">GetResourceMappingRequest</a></td>
-                <td><a href="#policy.resourcemapping.GetResourceMappingResponse">GetResourceMappingResponse</a></td>
+                <td>ListRegisteredResources</td>
+                <td><a href="#policy.registeredresources.ListRegisteredResourcesRequest">ListRegisteredResourcesRequest</a></td>
+                <td><a href="#policy.registeredresources.ListRegisteredResourcesResponse">ListRegisteredResourcesResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>CreateResourceMapping</td>
-                <td><a href="#policy.resourcemapping.CreateResourceMappingRequest">CreateResourceMappingRequest</a></td>
-                <td><a href="#policy.resourcemapping.CreateResourceMappingResponse">CreateResourceMappingResponse</a></td>
+                <td>UpdateRegisteredResource</td>
+                <td><a href="#policy.registeredresources.UpdateRegisteredResourceRequest">UpdateRegisteredResourceRequest</a></td>
+                <td><a href="#policy.registeredresources.UpdateRegisteredResourceResponse">UpdateRegisteredResourceResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>UpdateResourceMapping</td>
-                <td><a href="#policy.resourcemapping.UpdateResourceMappingRequest">UpdateResourceMappingRequest</a></td>
-                <td><a href="#policy.resourcemapping.UpdateResourceMappingResponse">UpdateResourceMappingResponse</a></td>
+                <td>DeleteRegisteredResource</td>
+                <td><a href="#policy.registeredresources.DeleteRegisteredResourceRequest">DeleteRegisteredResourceRequest</a></td>
+                <td><a href="#policy.registeredresources.DeleteRegisteredResourceResponse">DeleteRegisteredResourceResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>DeleteResourceMapping</td>
-                <td><a href="#policy.resourcemapping.DeleteResourceMappingRequest">DeleteResourceMappingRequest</a></td>
-                <td><a href="#policy.resourcemapping.DeleteResourceMappingResponse">DeleteResourceMappingResponse</a></td>
+                <td>CreateRegisteredResourceValue</td>
+                <td><a href="#policy.registeredresources.CreateRegisteredResourceValueRequest">CreateRegisteredResourceValueRequest</a></td>
+                <td><a href="#policy.registeredresources.CreateRegisteredResourceValueResponse">CreateRegisteredResourceValueResponse</a></td>
                 <td><p></p></td>
               </tr>
             
-          </tbody>
-        </table>
-
-        
-          
-          
-          <h4>Methods with idempotency_level option</h4>
-          <table>
-            <thead>
-              <tr>
-                <td>Method Name</td>
-                <td>Option</td>
-              </tr>
-            </thead>
-            <tbody>
-            
               <tr>
-                <td>ListResourceMappingGroups</td>
-                <td><p>NO_SIDE_EFFECTS</p></td>
+                <td>GetRegisteredResourceValue</td>
+                <td><a href="#policy.registeredresources.GetRegisteredResourceValueRequest">GetRegisteredResourceValueRequest</a></td>
+                <td><a href="#policy.registeredresources.GetRegisteredResourceValueResponse">GetRegisteredResourceValueResponse</a></td>
+                <td><p></p></td>
               </tr>
             
               <tr>
-                <td>GetResourceMappingGroup</td>
-                <td><p>NO_SIDE_EFFECTS</p></td>
+                <td>GetRegisteredResourceValuesByFQNs</td>
+                <td><a href="#policy.registeredresources.GetRegisteredResourceValuesByFQNsRequest">GetRegisteredResourceValuesByFQNsRequest</a></td>
+                <td><a href="#policy.registeredresources.GetRegisteredResourceValuesByFQNsResponse">GetRegisteredResourceValuesByFQNsResponse</a></td>
+                <td><p></p></td>
               </tr>
             
               <tr>
-                <td>ListResourceMappings</td>
-                <td><p>NO_SIDE_EFFECTS</p></td>
+                <td>ListRegisteredResourceValues</td>
+                <td><a href="#policy.registeredresources.ListRegisteredResourceValuesRequest">ListRegisteredResourceValuesRequest</a></td>
+                <td><a href="#policy.registeredresources.ListRegisteredResourceValuesResponse">ListRegisteredResourceValuesResponse</a></td>
+                <td><p></p></td>
               </tr>
             
               <tr>
-                <td>ListResourceMappingsByGroupFqns</td>
-                <td><p>NO_SIDE_EFFECTS</p></td>
+                <td>UpdateRegisteredResourceValue</td>
+                <td><a href="#policy.registeredresources.UpdateRegisteredResourceValueRequest">UpdateRegisteredResourceValueRequest</a></td>
+                <td><a href="#policy.registeredresources.UpdateRegisteredResourceValueResponse">UpdateRegisteredResourceValueResponse</a></td>
+                <td><p></p></td>
               </tr>
             
               <tr>
-                <td>GetResourceMapping</td>
-                <td><p>NO_SIDE_EFFECTS</p></td>
+                <td>DeleteRegisteredResourceValue</td>
+                <td><a href="#policy.registeredresources.DeleteRegisteredResourceValueRequest">DeleteRegisteredResourceValueRequest</a></td>
+                <td><a href="#policy.registeredresources.DeleteRegisteredResourceValueResponse">DeleteRegisteredResourceValueResponse</a></td>
+                <td><p></p></td>
               </tr>
             
-            </tbody>
-          </table>
-          
+          </tbody>
+        </table>
+
         
     
       
       <div class="file-heading">
-        <h2 id="policy/subjectmapping/subject_mapping.proto">policy/subjectmapping/subject_mapping.proto</h2><a href="#title">Top</a>
+        <h2 id="policy/resourcemapping/resource_mapping.proto">policy/resourcemapping/resource_mapping.proto</h2><a href="#title">Top</a>
       </div>
       <p></p>
 
       
-        <h3 id="policy.subjectmapping.CreateSubjectConditionSetRequest">CreateSubjectConditionSetRequest</h3>
+        <h3 id="policy.resourcemapping.CreateResourceMappingGroupRequest">CreateResourceMappingGroupRequest</h3>
         <p></p>
 
         
@@ -16253,24 +17195,31 @@ <h3 id="policy.subjectmapping.CreateSubjectConditionSetRequest">CreateSubjectCon
             <tbody>
               
                 <tr>
-                  <td>subject_condition_set</td>
-                  <td><a href="#policy.subjectmapping.SubjectConditionSetCreate">SubjectConditionSetCreate</a></td>
+                  <td>namespace_id</td>
+                  <td><a href="#string">string</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>namespace_id</td>
+                  <td>namespace_fqn</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>namespace_fqn</td>
+                  <td>name</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Required </p></td>
+                </tr>
+              
+                <tr>
+                  <td>metadata</td>
+                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
+                  <td></td>
+                  <td><p>Common metadata </p></td>
                 </tr>
               
             </tbody>
@@ -16280,7 +17229,7 @@ <h3 id="policy.subjectmapping.CreateSubjectConditionSetRequest">CreateSubjectCon
 
         
       
-        <h3 id="policy.subjectmapping.CreateSubjectConditionSetResponse">CreateSubjectConditionSetResponse</h3>
+        <h3 id="policy.resourcemapping.CreateResourceMappingGroupResponse">CreateResourceMappingGroupResponse</h3>
         <p></p>
 
         
@@ -16291,8 +17240,8 @@ <h3 id="policy.subjectmapping.CreateSubjectConditionSetResponse">CreateSubjectCo
             <tbody>
               
                 <tr>
-                  <td>subject_condition_set</td>
-                  <td><a href="#policy.SubjectConditionSet">policy.SubjectConditionSet</a></td>
+                  <td>resource_mapping_group</td>
+                  <td><a href="#policy.ResourceMappingGroup">policy.ResourceMappingGroup</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -16304,7 +17253,7 @@ <h3 id="policy.subjectmapping.CreateSubjectConditionSetResponse">CreateSubjectCo
 
         
       
-        <h3 id="policy.subjectmapping.CreateSubjectMappingRequest">CreateSubjectMappingRequest</h3>
+        <h3 id="policy.resourcemapping.CreateResourceMappingRequest">CreateResourceMappingRequest</h3>
         <p></p>
 
         
@@ -16318,31 +17267,21 @@ <h3 id="policy.subjectmapping.CreateSubjectMappingRequest">CreateSubjectMappingR
                   <td>attribute_value_id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Required
-Attribute Value to be mapped to </p></td>
+                  <td><p>Required </p></td>
                 </tr>
               
                 <tr>
-                  <td>actions</td>
-                  <td><a href="#policy.Action">policy.Action</a></td>
+                  <td>terms</td>
+                  <td><a href="#string">string</a></td>
                   <td>repeated</td>
-                  <td><p>Required
-The actions permitted by subjects in this mapping </p></td>
+                  <td><p>Required </p></td>
                 </tr>
               
                 <tr>
-                  <td>existing_subject_condition_set_id</td>
+                  <td>group_id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Either of the following:
-Reuse existing SubjectConditionSet (NOTE: prioritized over new_subject_condition_set) </p></td>
-                </tr>
-              
-                <tr>
-                  <td>new_subject_condition_set</td>
-                  <td><a href="#policy.subjectmapping.SubjectConditionSetCreate">SubjectConditionSetCreate</a></td>
-                  <td></td>
-                  <td><p>Create new SubjectConditionSet (NOTE: ignored if existing_subject_condition_set_id is provided) </p></td>
+                  <td><p>Optional </p></td>
                 </tr>
               
                 <tr>
@@ -16350,14 +17289,16 @@ <h3 id="policy.subjectmapping.CreateSubjectMappingRequest">CreateSubjectMappingR
                   <td><a href="#string">string</a></td>
                   <td></td>
                   <td><p>Optional
-Namespace ID or FQN for the subject mapping </p></td>
+The namespace that owns this resource mapping. If a group_id is provided,
+this must match the group&#39;s namespace (and may be omitted to inherit it). </p></td>
                 </tr>
               
                 <tr>
                   <td>namespace_fqn</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Optional
+Alternative to namespace_id; the FQN of the owning namespace. </p></td>
                 </tr>
               
                 <tr>
@@ -16374,7 +17315,7 @@ <h3 id="policy.subjectmapping.CreateSubjectMappingRequest">CreateSubjectMappingR
 
         
       
-        <h3 id="policy.subjectmapping.CreateSubjectMappingResponse">CreateSubjectMappingResponse</h3>
+        <h3 id="policy.resourcemapping.CreateResourceMappingResponse">CreateResourceMappingResponse</h3>
         <p></p>
 
         
@@ -16385,8 +17326,8 @@ <h3 id="policy.subjectmapping.CreateSubjectMappingResponse">CreateSubjectMapping
             <tbody>
               
                 <tr>
-                  <td>subject_mapping</td>
-                  <td><a href="#policy.SubjectMapping">policy.SubjectMapping</a></td>
+                  <td>resource_mapping</td>
+                  <td><a href="#policy.ResourceMapping">policy.ResourceMapping</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -16398,38 +17339,7 @@ <h3 id="policy.subjectmapping.CreateSubjectMappingResponse">CreateSubjectMapping
 
         
       
-        <h3 id="policy.subjectmapping.DeleteAllUnmappedSubjectConditionSetsRequest">DeleteAllUnmappedSubjectConditionSetsRequest</h3>
-        <p>Prune any Subject Condition Sets not utilized within a Subject Mapping</p>
-
-        
-
-        
-      
-        <h3 id="policy.subjectmapping.DeleteAllUnmappedSubjectConditionSetsResponse">DeleteAllUnmappedSubjectConditionSetsResponse</h3>
-        <p></p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
-                <tr>
-                  <td>subject_condition_sets</td>
-                  <td><a href="#policy.SubjectConditionSet">policy.SubjectConditionSet</a></td>
-                  <td>repeated</td>
-                  <td><p>Only IDs of any deleted Subject Condition Set provided </p></td>
-                </tr>
-              
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="policy.subjectmapping.DeleteSubjectConditionSetRequest">DeleteSubjectConditionSetRequest</h3>
+        <h3 id="policy.resourcemapping.DeleteResourceMappingGroupRequest">DeleteResourceMappingGroupRequest</h3>
         <p></p>
 
         
@@ -16453,7 +17363,7 @@ <h3 id="policy.subjectmapping.DeleteSubjectConditionSetRequest">DeleteSubjectCon
 
         
       
-        <h3 id="policy.subjectmapping.DeleteSubjectConditionSetResponse">DeleteSubjectConditionSetResponse</h3>
+        <h3 id="policy.resourcemapping.DeleteResourceMappingGroupResponse">DeleteResourceMappingGroupResponse</h3>
         <p></p>
 
         
@@ -16464,10 +17374,10 @@ <h3 id="policy.subjectmapping.DeleteSubjectConditionSetResponse">DeleteSubjectCo
             <tbody>
               
                 <tr>
-                  <td>subject_condition_set</td>
-                  <td><a href="#policy.SubjectConditionSet">policy.SubjectConditionSet</a></td>
+                  <td>resource_mapping_group</td>
+                  <td><a href="#policy.ResourceMappingGroup">policy.ResourceMappingGroup</a></td>
                   <td></td>
-                  <td><p>Only ID of deleted Subject Condition Set provided </p></td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
@@ -16477,7 +17387,7 @@ <h3 id="policy.subjectmapping.DeleteSubjectConditionSetResponse">DeleteSubjectCo
 
         
       
-        <h3 id="policy.subjectmapping.DeleteSubjectMappingRequest">DeleteSubjectMappingRequest</h3>
+        <h3 id="policy.resourcemapping.DeleteResourceMappingRequest">DeleteResourceMappingRequest</h3>
         <p></p>
 
         
@@ -16501,7 +17411,7 @@ <h3 id="policy.subjectmapping.DeleteSubjectMappingRequest">DeleteSubjectMappingR
 
         
       
-        <h3 id="policy.subjectmapping.DeleteSubjectMappingResponse">DeleteSubjectMappingResponse</h3>
+        <h3 id="policy.resourcemapping.DeleteResourceMappingResponse">DeleteResourceMappingResponse</h3>
         <p></p>
 
         
@@ -16512,10 +17422,10 @@ <h3 id="policy.subjectmapping.DeleteSubjectMappingResponse">DeleteSubjectMapping
             <tbody>
               
                 <tr>
-                  <td>subject_mapping</td>
-                  <td><a href="#policy.SubjectMapping">policy.SubjectMapping</a></td>
+                  <td>resource_mapping</td>
+                  <td><a href="#policy.ResourceMapping">policy.ResourceMapping</a></td>
                   <td></td>
-                  <td><p>Only ID of the updated Subject Mapping provided </p></td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
@@ -16525,7 +17435,7 @@ <h3 id="policy.subjectmapping.DeleteSubjectMappingResponse">DeleteSubjectMapping
 
         
       
-        <h3 id="policy.subjectmapping.GetSubjectConditionSetRequest">GetSubjectConditionSetRequest</h3>
+        <h3 id="policy.resourcemapping.GetResourceMappingGroupRequest">GetResourceMappingGroupRequest</h3>
         <p></p>
 
         
@@ -16549,7 +17459,7 @@ <h3 id="policy.subjectmapping.GetSubjectConditionSetRequest">GetSubjectCondition
 
         
       
-        <h3 id="policy.subjectmapping.GetSubjectConditionSetResponse">GetSubjectConditionSetResponse</h3>
+        <h3 id="policy.resourcemapping.GetResourceMappingGroupResponse">GetResourceMappingGroupResponse</h3>
         <p></p>
 
         
@@ -16560,19 +17470,12 @@ <h3 id="policy.subjectmapping.GetSubjectConditionSetResponse">GetSubjectConditio
             <tbody>
               
                 <tr>
-                  <td>subject_condition_set</td>
-                  <td><a href="#policy.SubjectConditionSet">policy.SubjectConditionSet</a></td>
+                  <td>resource_mapping_group</td>
+                  <td><a href="#policy.ResourceMappingGroup">policy.ResourceMappingGroup</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
               
-                <tr>
-                  <td>associated_subject_mappings</td>
-                  <td><a href="#policy.SubjectMapping">policy.SubjectMapping</a></td>
-                  <td>repeated</td>
-                  <td><p>contextualized Subject Mappings associated with this SubjectConditionSet </p></td>
-                </tr>
-              
             </tbody>
           </table>
 
@@ -16580,7 +17483,7 @@ <h3 id="policy.subjectmapping.GetSubjectConditionSetResponse">GetSubjectConditio
 
         
       
-        <h3 id="policy.subjectmapping.GetSubjectMappingRequest">GetSubjectMappingRequest</h3>
+        <h3 id="policy.resourcemapping.GetResourceMappingRequest">GetResourceMappingRequest</h3>
         <p></p>
 
         
@@ -16604,7 +17507,7 @@ <h3 id="policy.subjectmapping.GetSubjectMappingRequest">GetSubjectMappingRequest
 
         
       
-        <h3 id="policy.subjectmapping.GetSubjectMappingResponse">GetSubjectMappingResponse</h3>
+        <h3 id="policy.resourcemapping.GetResourceMappingResponse">GetResourceMappingResponse</h3>
         <p></p>
 
         
@@ -16615,8 +17518,8 @@ <h3 id="policy.subjectmapping.GetSubjectMappingResponse">GetSubjectMappingRespon
             <tbody>
               
                 <tr>
-                  <td>subject_mapping</td>
-                  <td><a href="#policy.SubjectMapping">policy.SubjectMapping</a></td>
+                  <td>resource_mapping</td>
+                  <td><a href="#policy.ResourceMapping">policy.ResourceMapping</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -16628,7 +17531,7 @@ <h3 id="policy.subjectmapping.GetSubjectMappingResponse">GetSubjectMappingRespon
 
         
       
-        <h3 id="policy.subjectmapping.ListSubjectConditionSetsRequest">ListSubjectConditionSetsRequest</h3>
+        <h3 id="policy.resourcemapping.ListResourceMappingGroupsRequest">ListResourceMappingGroupsRequest</h3>
         <p></p>
 
         
@@ -16642,14 +17545,14 @@ <h3 id="policy.subjectmapping.ListSubjectConditionSetsRequest">ListSubjectCondit
                   <td>namespace_id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Optional </p></td>
                 </tr>
               
                 <tr>
                   <td>namespace_fqn</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>Optional </p></td>
                 </tr>
               
                 <tr>
@@ -16659,24 +17562,6 @@ <h3 id="policy.subjectmapping.ListSubjectConditionSetsRequest">ListSubjectCondit
                   <td><p>Optional </p></td>
                 </tr>
               
-                <tr>
-                  <td>sort</td>
-                  <td><a href="#policy.subjectmapping.SubjectConditionSetsSort">SubjectConditionSetsSort</a></td>
-                  <td>repeated</td>
-                  <td><p>Optional - CONSTRAINT: max 1 item
-Sort defaults:
-  - direction UNSPECIFIED defaults to DESC for the specified field
-  - field UNSPECIFIED defaults to created_at with the specified direction
-  - both UNSPECIFIED or sort omitted defaults to created_at DESC </p></td>
-                </tr>
-              
-                <tr>
-                  <td>search</td>
-                  <td><a href="#policy.Search">policy.Search</a></td>
-                  <td></td>
-                  <td><p>Optional </p></td>
-                </tr>
-              
             </tbody>
           </table>
 
@@ -16684,7 +17569,7 @@ <h3 id="policy.subjectmapping.ListSubjectConditionSetsRequest">ListSubjectCondit
 
         
       
-        <h3 id="policy.subjectmapping.ListSubjectConditionSetsResponse">ListSubjectConditionSetsResponse</h3>
+        <h3 id="policy.resourcemapping.ListResourceMappingGroupsResponse">ListResourceMappingGroupsResponse</h3>
         <p></p>
 
         
@@ -16695,8 +17580,8 @@ <h3 id="policy.subjectmapping.ListSubjectConditionSetsResponse">ListSubjectCondi
             <tbody>
               
                 <tr>
-                  <td>subject_condition_sets</td>
-                  <td><a href="#policy.SubjectConditionSet">policy.SubjectConditionSet</a></td>
+                  <td>resource_mapping_groups</td>
+                  <td><a href="#policy.ResourceMappingGroup">policy.ResourceMappingGroup</a></td>
                   <td>repeated</td>
                   <td><p> </p></td>
                 </tr>
@@ -16715,7 +17600,7 @@ <h3 id="policy.subjectmapping.ListSubjectConditionSetsResponse">ListSubjectCondi
 
         
       
-        <h3 id="policy.subjectmapping.ListSubjectMappingsRequest">ListSubjectMappingsRequest</h3>
+        <h3 id="policy.resourcemapping.ListResourceMappingsByGroupFqnsRequest">ListResourceMappingsByGroupFqnsRequest</h3>
         <p></p>
 
         
@@ -16726,42 +17611,11 @@ <h3 id="policy.subjectmapping.ListSubjectMappingsRequest">ListSubjectMappingsReq
             <tbody>
               
                 <tr>
-                  <td>namespace_id</td>
-                  <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p> </p></td>
-                </tr>
-              
-                <tr>
-                  <td>namespace_fqn</td>
+                  <td>fqns</td>
                   <td><a href="#string">string</a></td>
-                  <td></td>
-                  <td><p> </p></td>
-                </tr>
-              
-                <tr>
-                  <td>pagination</td>
-                  <td><a href="#policy.PageRequest">policy.PageRequest</a></td>
-                  <td></td>
-                  <td><p>Optional </p></td>
-                </tr>
-              
-                <tr>
-                  <td>sort</td>
-                  <td><a href="#policy.subjectmapping.SubjectMappingsSort">SubjectMappingsSort</a></td>
                   <td>repeated</td>
-                  <td><p>Optional - CONSTRAINT: max 1 item
-Sort defaults:
-  - direction UNSPECIFIED defaults to DESC for the specified field
-  - field UNSPECIFIED defaults to created_at with the specified direction
-  - both UNSPECIFIED or sort omitted defaults to created_at DESC </p></td>
-                </tr>
-              
-                <tr>
-                  <td>search</td>
-                  <td><a href="#policy.Search">policy.Search</a></td>
-                  <td></td>
-                  <td><p>Optional </p></td>
+                  <td><p>Required
+Structure of the RM Group FQN is &#39;https://&lt;namespace&gt;/resm/&lt;group name&gt;&#39; </p></td>
                 </tr>
               
             </tbody>
@@ -16771,7 +17625,7 @@ <h3 id="policy.subjectmapping.ListSubjectMappingsRequest">ListSubjectMappingsReq
 
         
       
-        <h3 id="policy.subjectmapping.ListSubjectMappingsResponse">ListSubjectMappingsResponse</h3>
+        <h3 id="policy.resourcemapping.ListResourceMappingsByGroupFqnsResponse">ListResourceMappingsByGroupFqnsResponse</h3>
         <p></p>
 
         
@@ -16782,19 +17636,12 @@ <h3 id="policy.subjectmapping.ListSubjectMappingsResponse">ListSubjectMappingsRe
             <tbody>
               
                 <tr>
-                  <td>subject_mappings</td>
-                  <td><a href="#policy.SubjectMapping">policy.SubjectMapping</a></td>
+                  <td>fqn_resource_mapping_groups</td>
+                  <td><a href="#policy.resourcemapping.ListResourceMappingsByGroupFqnsResponse.FqnResourceMappingGroupsEntry">ListResourceMappingsByGroupFqnsResponse.FqnResourceMappingGroupsEntry</a></td>
                   <td>repeated</td>
                   <td><p> </p></td>
                 </tr>
               
-                <tr>
-                  <td>pagination</td>
-                  <td><a href="#policy.PageResponse">policy.PageResponse</a></td>
-                  <td></td>
-                  <td><p> </p></td>
-                </tr>
-              
             </tbody>
           </table>
 
@@ -16802,8 +17649,8 @@ <h3 id="policy.subjectmapping.ListSubjectMappingsResponse">ListSubjectMappingsRe
 
         
       
-        <h3 id="policy.subjectmapping.MatchSubjectMappingsRequest">MatchSubjectMappingsRequest</h3>
-        <p>MatchSubjectMappingsRequest liberally returns a list of SubjectMappings based on the provided SubjectProperties.</p><p>The SubjectMappings are returned if an external selector field matches.</p>
+        <h3 id="policy.resourcemapping.ListResourceMappingsByGroupFqnsResponse.FqnResourceMappingGroupsEntry">ListResourceMappingsByGroupFqnsResponse.FqnResourceMappingGroupsEntry</h3>
+        <p></p>
 
         
           <table class="field-table">
@@ -16813,33 +17660,16 @@ <h3 id="policy.subjectmapping.MatchSubjectMappingsRequest">MatchSubjectMappingsR
             <tbody>
               
                 <tr>
-                  <td>subject_properties</td>
-                  <td><a href="#policy.SubjectProperty">policy.SubjectProperty</a></td>
-                  <td>repeated</td>
+                  <td>key</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
                   <td><p> </p></td>
                 </tr>
               
-            </tbody>
-          </table>
-
-          
-
-        
-      
-        <h3 id="policy.subjectmapping.MatchSubjectMappingsResponse">MatchSubjectMappingsResponse</h3>
-        <p></p>
-
-        
-          <table class="field-table">
-            <thead>
-              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
-            </thead>
-            <tbody>
-              
                 <tr>
-                  <td>subject_mappings</td>
-                  <td><a href="#policy.SubjectMapping">policy.SubjectMapping</a></td>
-                  <td>repeated</td>
+                  <td>value</td>
+                  <td><a href="#policy.resourcemapping.ResourceMappingsByGroup">ResourceMappingsByGroup</a></td>
+                  <td></td>
                   <td><p> </p></td>
                 </tr>
               
@@ -16850,7 +17680,7 @@ <h3 id="policy.subjectmapping.MatchSubjectMappingsResponse">MatchSubjectMappings
 
         
       
-        <h3 id="policy.subjectmapping.SubjectConditionSetCreate">SubjectConditionSetCreate</h3>
+        <h3 id="policy.resourcemapping.ListResourceMappingsRequest">ListResourceMappingsRequest</h3>
         <p></p>
 
         
@@ -16861,18 +17691,33 @@ <h3 id="policy.subjectmapping.SubjectConditionSetCreate">SubjectConditionSetCrea
             <tbody>
               
                 <tr>
-                  <td>subject_sets</td>
-                  <td><a href="#policy.SubjectSet">policy.SubjectSet</a></td>
-                  <td>repeated</td>
-                  <td><p>Required </p></td>
+                  <td>group_id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Optional </p></td>
                 </tr>
               
                 <tr>
-                  <td>metadata</td>
-                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
+                  <td>namespace_id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Optional
+Filter the list to resource mappings owned by this namespace. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>namespace_fqn</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Optional
+Filter the list to resource mappings owned by this namespace. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>pagination</td>
+                  <td><a href="#policy.PageRequest">policy.PageRequest</a></td>
                   <td></td>
-                  <td><p>Optional
-Common metadata </p></td>
+                  <td><p>Optional </p></td>
                 </tr>
               
             </tbody>
@@ -16882,7 +17727,7 @@ <h3 id="policy.subjectmapping.SubjectConditionSetCreate">SubjectConditionSetCrea
 
         
       
-        <h3 id="policy.subjectmapping.SubjectConditionSetsSort">SubjectConditionSetsSort</h3>
+        <h3 id="policy.resourcemapping.ListResourceMappingsResponse">ListResourceMappingsResponse</h3>
         <p></p>
 
         
@@ -16893,15 +17738,15 @@ <h3 id="policy.subjectmapping.SubjectConditionSetsSort">SubjectConditionSetsSort
             <tbody>
               
                 <tr>
-                  <td>field</td>
-                  <td><a href="#policy.subjectmapping.SortSubjectConditionSetsType">SortSubjectConditionSetsType</a></td>
-                  <td></td>
+                  <td>resource_mappings</td>
+                  <td><a href="#policy.ResourceMapping">policy.ResourceMapping</a></td>
+                  <td>repeated</td>
                   <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>direction</td>
-                  <td><a href="#policy.SortDirection">policy.SortDirection</a></td>
+                  <td>pagination</td>
+                  <td><a href="#policy.PageResponse">policy.PageResponse</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
@@ -16913,7 +17758,7 @@ <h3 id="policy.subjectmapping.SubjectConditionSetsSort">SubjectConditionSetsSort
 
         
       
-        <h3 id="policy.subjectmapping.SubjectMappingsSort">SubjectMappingsSort</h3>
+        <h3 id="policy.resourcemapping.ResourceMappingsByGroup">ResourceMappingsByGroup</h3>
         <p></p>
 
         
@@ -16924,16 +17769,16 @@ <h3 id="policy.subjectmapping.SubjectMappingsSort">SubjectMappingsSort</h3>
             <tbody>
               
                 <tr>
-                  <td>field</td>
-                  <td><a href="#policy.subjectmapping.SortSubjectMappingsType">SortSubjectMappingsType</a></td>
+                  <td>group</td>
+                  <td><a href="#policy.ResourceMappingGroup">policy.ResourceMappingGroup</a></td>
                   <td></td>
                   <td><p> </p></td>
                 </tr>
               
                 <tr>
-                  <td>direction</td>
-                  <td><a href="#policy.SortDirection">policy.SortDirection</a></td>
-                  <td></td>
+                  <td>mappings</td>
+                  <td><a href="#policy.ResourceMapping">policy.ResourceMapping</a></td>
+                  <td>repeated</td>
                   <td><p> </p></td>
                 </tr>
               
@@ -16944,7 +17789,7 @@ <h3 id="policy.subjectmapping.SubjectMappingsSort">SubjectMappingsSort</h3>
 
         
       
-        <h3 id="policy.subjectmapping.UpdateSubjectConditionSetRequest">UpdateSubjectConditionSetRequest</h3>
+        <h3 id="policy.resourcemapping.UpdateResourceMappingGroupRequest">UpdateResourceMappingGroupRequest</h3>
         <p></p>
 
         
@@ -16962,11 +17807,24 @@ <h3 id="policy.subjectmapping.UpdateSubjectConditionSetRequest">UpdateSubjectCon
                 </tr>
               
                 <tr>
-                  <td>subject_sets</td>
-                  <td><a href="#policy.SubjectSet">policy.SubjectSet</a></td>
-                  <td>repeated</td>
-                  <td><p>Optional
-If provided, replaces entire existing structure of Subject Sets, Condition Groups, &amp; Conditions </p></td>
+                  <td>namespace_id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Optional </p></td>
+                </tr>
+              
+                <tr>
+                  <td>namespace_fqn</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Optional </p></td>
+                </tr>
+              
+                <tr>
+                  <td>name</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Optional </p></td>
                 </tr>
               
                 <tr>
@@ -16990,7 +17848,7 @@ <h3 id="policy.subjectmapping.UpdateSubjectConditionSetRequest">UpdateSubjectCon
 
         
       
-        <h3 id="policy.subjectmapping.UpdateSubjectConditionSetResponse">UpdateSubjectConditionSetResponse</h3>
+        <h3 id="policy.resourcemapping.UpdateResourceMappingGroupResponse">UpdateResourceMappingGroupResponse</h3>
         <p></p>
 
         
@@ -17001,10 +17859,10 @@ <h3 id="policy.subjectmapping.UpdateSubjectConditionSetResponse">UpdateSubjectCo
             <tbody>
               
                 <tr>
-                  <td>subject_condition_set</td>
-                  <td><a href="#policy.SubjectConditionSet">policy.SubjectConditionSet</a></td>
+                  <td>resource_mapping_group</td>
+                  <td><a href="#policy.ResourceMappingGroup">policy.ResourceMappingGroup</a></td>
                   <td></td>
-                  <td><p>Only ID of updated Subject Condition Set provided </p></td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
@@ -17014,7 +17872,7 @@ <h3 id="policy.subjectmapping.UpdateSubjectConditionSetResponse">UpdateSubjectCo
 
         
       
-        <h3 id="policy.subjectmapping.UpdateSubjectMappingRequest">UpdateSubjectMappingRequest</h3>
+        <h3 id="policy.resourcemapping.UpdateResourceMappingRequest">UpdateResourceMappingRequest</h3>
         <p></p>
 
         
@@ -17032,26 +17890,49 @@ <h3 id="policy.subjectmapping.UpdateSubjectMappingRequest">UpdateSubjectMappingR
                 </tr>
               
                 <tr>
-                  <td>subject_condition_set_id</td>
+                  <td>attribute_value_id</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>Optional
-Replaces the existing SubjectConditionSet id with a new one </p></td>
+                  <td><p>Optional </p></td>
                 </tr>
               
                 <tr>
-                  <td>actions</td>
-                  <td><a href="#policy.Action">policy.Action</a></td>
+                  <td>terms</td>
+                  <td><a href="#string">string</a></td>
                   <td>repeated</td>
+                  <td><p>Optional </p></td>
+                </tr>
+              
+                <tr>
+                  <td>group_id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Optional </p></td>
+                </tr>
+              
+                <tr>
+                  <td>namespace_id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
                   <td><p>Optional
-Replaces entire list of actions permitted by subjects </p></td>
+The namespace that owns this resource mapping. If a group_id is set on the
+mapping, this must match the group&#39;s namespace. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>namespace_fqn</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Optional
+Alternative to namespace_id; the FQN of the owning namespace. </p></td>
                 </tr>
               
                 <tr>
                   <td>metadata</td>
                   <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
                   <td></td>
-                  <td><p>Common metadata </p></td>
+                  <td><p>Optional
+Common Metadata </p></td>
                 </tr>
               
                 <tr>
@@ -17068,7 +17949,7 @@ <h3 id="policy.subjectmapping.UpdateSubjectMappingRequest">UpdateSubjectMappingR
 
         
       
-        <h3 id="policy.subjectmapping.UpdateSubjectMappingResponse">UpdateSubjectMappingResponse</h3>
+        <h3 id="policy.resourcemapping.UpdateResourceMappingResponse">UpdateResourceMappingResponse</h3>
         <p></p>
 
         
@@ -17079,10 +17960,10 @@ <h3 id="policy.subjectmapping.UpdateSubjectMappingResponse">UpdateSubjectMapping
             <tbody>
               
                 <tr>
-                  <td>subject_mapping</td>
-                  <td><a href="#policy.SubjectMapping">policy.SubjectMapping</a></td>
+                  <td>resource_mapping</td>
+                  <td><a href="#policy.ResourceMapping">policy.ResourceMapping</a></td>
                   <td></td>
-                  <td><p>Only ID of the updated Subject Mapping provided </p></td>
+                  <td><p> </p></td>
                 </tr>
               
             </tbody>
@@ -17094,70 +17975,12 @@ <h3 id="policy.subjectmapping.UpdateSubjectMappingResponse">UpdateSubjectMapping
       
 
       
-        <h3 id="policy.subjectmapping.SortSubjectConditionSetsType">SortSubjectConditionSetsType</h3>
-        <p></p>
-        <table class="enum-table">
-          <thead>
-            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
-          </thead>
-          <tbody>
-            
-              <tr>
-                <td>SORT_SUBJECT_CONDITION_SETS_TYPE_UNSPECIFIED</td>
-                <td>0</td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>SORT_SUBJECT_CONDITION_SETS_TYPE_CREATED_AT</td>
-                <td>1</td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>SORT_SUBJECT_CONDITION_SETS_TYPE_UPDATED_AT</td>
-                <td>2</td>
-                <td><p></p></td>
-              </tr>
-            
-          </tbody>
-        </table>
-      
-        <h3 id="policy.subjectmapping.SortSubjectMappingsType">SortSubjectMappingsType</h3>
-        <p></p>
-        <table class="enum-table">
-          <thead>
-            <tr><td>Name</td><td>Number</td><td>Description</td></tr>
-          </thead>
-          <tbody>
-            
-              <tr>
-                <td>SORT_SUBJECT_MAPPINGS_TYPE_UNSPECIFIED</td>
-                <td>0</td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>SORT_SUBJECT_MAPPINGS_TYPE_CREATED_AT</td>
-                <td>1</td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>SORT_SUBJECT_MAPPINGS_TYPE_UPDATED_AT</td>
-                <td>2</td>
-                <td><p></p></td>
-              </tr>
-            
-          </tbody>
-        </table>
-      
 
       
 
       
-        <h3 id="policy.subjectmapping.SubjectMappingService">SubjectMappingService</h3>
-        <p></p>
+        <h3 id="policy.resourcemapping.ResourceMappingService">ResourceMappingService</h3>
+        <p>Resource Mapping Groups</p>
         <table class="enum-table">
           <thead>
             <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
@@ -17165,86 +17988,79 @@ <h3 id="policy.subjectmapping.SubjectMappingService">SubjectMappingService</h3>
           <tbody>
             
               <tr>
-                <td>MatchSubjectMappings</td>
-                <td><a href="#policy.subjectmapping.MatchSubjectMappingsRequest">MatchSubjectMappingsRequest</a></td>
-                <td><a href="#policy.subjectmapping.MatchSubjectMappingsResponse">MatchSubjectMappingsResponse</a></td>
-                <td><p>Find matching Subject Mappings for a given Subject</p></td>
-              </tr>
-            
-              <tr>
-                <td>ListSubjectMappings</td>
-                <td><a href="#policy.subjectmapping.ListSubjectMappingsRequest">ListSubjectMappingsRequest</a></td>
-                <td><a href="#policy.subjectmapping.ListSubjectMappingsResponse">ListSubjectMappingsResponse</a></td>
+                <td>ListResourceMappingGroups</td>
+                <td><a href="#policy.resourcemapping.ListResourceMappingGroupsRequest">ListResourceMappingGroupsRequest</a></td>
+                <td><a href="#policy.resourcemapping.ListResourceMappingGroupsResponse">ListResourceMappingGroupsResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>GetSubjectMapping</td>
-                <td><a href="#policy.subjectmapping.GetSubjectMappingRequest">GetSubjectMappingRequest</a></td>
-                <td><a href="#policy.subjectmapping.GetSubjectMappingResponse">GetSubjectMappingResponse</a></td>
+                <td>GetResourceMappingGroup</td>
+                <td><a href="#policy.resourcemapping.GetResourceMappingGroupRequest">GetResourceMappingGroupRequest</a></td>
+                <td><a href="#policy.resourcemapping.GetResourceMappingGroupResponse">GetResourceMappingGroupResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>CreateSubjectMapping</td>
-                <td><a href="#policy.subjectmapping.CreateSubjectMappingRequest">CreateSubjectMappingRequest</a></td>
-                <td><a href="#policy.subjectmapping.CreateSubjectMappingResponse">CreateSubjectMappingResponse</a></td>
+                <td>CreateResourceMappingGroup</td>
+                <td><a href="#policy.resourcemapping.CreateResourceMappingGroupRequest">CreateResourceMappingGroupRequest</a></td>
+                <td><a href="#policy.resourcemapping.CreateResourceMappingGroupResponse">CreateResourceMappingGroupResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>UpdateSubjectMapping</td>
-                <td><a href="#policy.subjectmapping.UpdateSubjectMappingRequest">UpdateSubjectMappingRequest</a></td>
-                <td><a href="#policy.subjectmapping.UpdateSubjectMappingResponse">UpdateSubjectMappingResponse</a></td>
+                <td>UpdateResourceMappingGroup</td>
+                <td><a href="#policy.resourcemapping.UpdateResourceMappingGroupRequest">UpdateResourceMappingGroupRequest</a></td>
+                <td><a href="#policy.resourcemapping.UpdateResourceMappingGroupResponse">UpdateResourceMappingGroupResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>DeleteSubjectMapping</td>
-                <td><a href="#policy.subjectmapping.DeleteSubjectMappingRequest">DeleteSubjectMappingRequest</a></td>
-                <td><a href="#policy.subjectmapping.DeleteSubjectMappingResponse">DeleteSubjectMappingResponse</a></td>
+                <td>DeleteResourceMappingGroup</td>
+                <td><a href="#policy.resourcemapping.DeleteResourceMappingGroupRequest">DeleteResourceMappingGroupRequest</a></td>
+                <td><a href="#policy.resourcemapping.DeleteResourceMappingGroupResponse">DeleteResourceMappingGroupResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>ListSubjectConditionSets</td>
-                <td><a href="#policy.subjectmapping.ListSubjectConditionSetsRequest">ListSubjectConditionSetsRequest</a></td>
-                <td><a href="#policy.subjectmapping.ListSubjectConditionSetsResponse">ListSubjectConditionSetsResponse</a></td>
+                <td>ListResourceMappings</td>
+                <td><a href="#policy.resourcemapping.ListResourceMappingsRequest">ListResourceMappingsRequest</a></td>
+                <td><a href="#policy.resourcemapping.ListResourceMappingsResponse">ListResourceMappingsResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>GetSubjectConditionSet</td>
-                <td><a href="#policy.subjectmapping.GetSubjectConditionSetRequest">GetSubjectConditionSetRequest</a></td>
-                <td><a href="#policy.subjectmapping.GetSubjectConditionSetResponse">GetSubjectConditionSetResponse</a></td>
+                <td>ListResourceMappingsByGroupFqns</td>
+                <td><a href="#policy.resourcemapping.ListResourceMappingsByGroupFqnsRequest">ListResourceMappingsByGroupFqnsRequest</a></td>
+                <td><a href="#policy.resourcemapping.ListResourceMappingsByGroupFqnsResponse">ListResourceMappingsByGroupFqnsResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>CreateSubjectConditionSet</td>
-                <td><a href="#policy.subjectmapping.CreateSubjectConditionSetRequest">CreateSubjectConditionSetRequest</a></td>
-                <td><a href="#policy.subjectmapping.CreateSubjectConditionSetResponse">CreateSubjectConditionSetResponse</a></td>
+                <td>GetResourceMapping</td>
+                <td><a href="#policy.resourcemapping.GetResourceMappingRequest">GetResourceMappingRequest</a></td>
+                <td><a href="#policy.resourcemapping.GetResourceMappingResponse">GetResourceMappingResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>UpdateSubjectConditionSet</td>
-                <td><a href="#policy.subjectmapping.UpdateSubjectConditionSetRequest">UpdateSubjectConditionSetRequest</a></td>
-                <td><a href="#policy.subjectmapping.UpdateSubjectConditionSetResponse">UpdateSubjectConditionSetResponse</a></td>
+                <td>CreateResourceMapping</td>
+                <td><a href="#policy.resourcemapping.CreateResourceMappingRequest">CreateResourceMappingRequest</a></td>
+                <td><a href="#policy.resourcemapping.CreateResourceMappingResponse">CreateResourceMappingResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>DeleteSubjectConditionSet</td>
-                <td><a href="#policy.subjectmapping.DeleteSubjectConditionSetRequest">DeleteSubjectConditionSetRequest</a></td>
-                <td><a href="#policy.subjectmapping.DeleteSubjectConditionSetResponse">DeleteSubjectConditionSetResponse</a></td>
+                <td>UpdateResourceMapping</td>
+                <td><a href="#policy.resourcemapping.UpdateResourceMappingRequest">UpdateResourceMappingRequest</a></td>
+                <td><a href="#policy.resourcemapping.UpdateResourceMappingResponse">UpdateResourceMappingResponse</a></td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>DeleteAllUnmappedSubjectConditionSets</td>
-                <td><a href="#policy.subjectmapping.DeleteAllUnmappedSubjectConditionSetsRequest">DeleteAllUnmappedSubjectConditionSetsRequest</a></td>
-                <td><a href="#policy.subjectmapping.DeleteAllUnmappedSubjectConditionSetsResponse">DeleteAllUnmappedSubjectConditionSetsResponse</a></td>
+                <td>DeleteResourceMapping</td>
+                <td><a href="#policy.resourcemapping.DeleteResourceMappingRequest">DeleteResourceMappingRequest</a></td>
+                <td><a href="#policy.resourcemapping.DeleteResourceMappingResponse">DeleteResourceMappingResponse</a></td>
                 <td><p></p></td>
               </tr>
             
@@ -17265,22 +18081,27 @@ <h4>Methods with idempotency_level option</h4>
             <tbody>
             
               <tr>
-                <td>ListSubjectMappings</td>
+                <td>ListResourceMappingGroups</td>
                 <td><p>NO_SIDE_EFFECTS</p></td>
               </tr>
             
               <tr>
-                <td>GetSubjectMapping</td>
+                <td>GetResourceMappingGroup</td>
                 <td><p>NO_SIDE_EFFECTS</p></td>
               </tr>
             
               <tr>
-                <td>ListSubjectConditionSets</td>
+                <td>ListResourceMappings</td>
                 <td><p>NO_SIDE_EFFECTS</p></td>
               </tr>
             
               <tr>
-                <td>GetSubjectConditionSet</td>
+                <td>ListResourceMappingsByGroupFqns</td>
+                <td><p>NO_SIDE_EFFECTS</p></td>
+              </tr>
+            
+              <tr>
+                <td>GetResourceMapping</td>
                 <td><p>NO_SIDE_EFFECTS</p></td>
               </tr>
             
diff --git a/docs/openapi/policy/actions/actions.openapi.yaml b/docs/openapi/policy/actions/actions.openapi.yaml
index da57657292..3f16ddef73 100644
--- a/docs/openapi/policy/actions/actions.openapi.yaml
+++ b/docs/openapi/policy/actions/actions.openapi.yaml
@@ -222,6 +222,28 @@ components:
         - CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED
         - CONDITION_BOOLEAN_TYPE_ENUM_AND
         - CONDITION_BOOLEAN_TYPE_ENUM_OR
+    policy.ConditionComparisonOperatorEnum:
+      type: string
+      title: ConditionComparisonOperatorEnum
+      enum:
+        - CONDITION_COMPARISON_OPERATOR_ENUM_UNSPECIFIED
+        - CONDITION_COMPARISON_OPERATOR_ENUM_EQUALS
+        - CONDITION_COMPARISON_OPERATOR_ENUM_CONTAINS
+        - CONDITION_COMPARISON_OPERATOR_ENUM_STARTS_WITH
+        - CONDITION_COMPARISON_OPERATOR_ENUM_ENDS_WITH
+      description: |-
+        How a selector result is compared against a comparison value. Replaces the all-in-one
+         SubjectMappingOperatorEnum by separating the comparison from the quantifier (see
+         ConditionQuantifierEnum) and case sensitivity.
+    policy.ConditionQuantifierEnum:
+      type: string
+      title: ConditionQuantifierEnum
+      enum:
+        - CONDITION_QUANTIFIER_ENUM_UNSPECIFIED
+        - CONDITION_QUANTIFIER_ENUM_ANY
+        - CONDITION_QUANTIFIER_ENUM_ALL
+        - CONDITION_QUANTIFIER_ENUM_NONE
+      description: How matches are aggregated across the comparison set (subject_external_values).
     policy.KasPublicKeyAlgEnum:
       type: string
       title: KasPublicKeyAlgEnum
@@ -518,7 +540,10 @@ components:
              from idP/LDAP)
         operator:
           title: operator
-          description: the evaluation operator of relation
+          description: |-
+            Deprecated: use comparison + quantifier (+ case_insensitive) instead. Normalized to the
+             decomposed fields in the service layer for backward compatibility.
+          deprecated: true
           $ref: '#/components/schemas/policy.SubjectMappingOperatorEnum'
         subjectExternalValues:
           type: array
@@ -531,10 +556,23 @@ components:
             list of comparison values for the result of applying the
              subject_external_selector_value on a flattened Entity Representation
              (Subject), evaluated by the operator
+        comparison:
+          title: comparison
+          description: how each selector result is compared to subject_external_values entries
+          $ref: '#/components/schemas/policy.ConditionComparisonOperatorEnum'
+        quantifier:
+          title: quantifier
+          description: how matches are aggregated across subject_external_values
+          $ref: '#/components/schemas/policy.ConditionQuantifierEnum'
+        caseInsensitive:
+          title: case_insensitive
+          description: |-
+            when set true, comparison is case-insensitive; unset is treated as case-sensitive. Modeled as
+             BoolValue so an explicit false is distinguishable from unset, leaving room to change the default.
+          $ref: '#/components/schemas/google.protobuf.BoolValue'
       title: Condition
       required:
         - subjectExternalSelectorValue
-        - operator
       additionalProperties: false
       description: |-
         *
diff --git a/docs/openapi/policy/attributes/attributes.openapi.yaml b/docs/openapi/policy/attributes/attributes.openapi.yaml
index cbdde67a8c..b5270ccdb5 100644
--- a/docs/openapi/policy/attributes/attributes.openapi.yaml
+++ b/docs/openapi/policy/attributes/attributes.openapi.yaml
@@ -741,6 +741,28 @@ components:
         - CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED
         - CONDITION_BOOLEAN_TYPE_ENUM_AND
         - CONDITION_BOOLEAN_TYPE_ENUM_OR
+    policy.ConditionComparisonOperatorEnum:
+      type: string
+      title: ConditionComparisonOperatorEnum
+      enum:
+        - CONDITION_COMPARISON_OPERATOR_ENUM_UNSPECIFIED
+        - CONDITION_COMPARISON_OPERATOR_ENUM_EQUALS
+        - CONDITION_COMPARISON_OPERATOR_ENUM_CONTAINS
+        - CONDITION_COMPARISON_OPERATOR_ENUM_STARTS_WITH
+        - CONDITION_COMPARISON_OPERATOR_ENUM_ENDS_WITH
+      description: |-
+        How a selector result is compared against a comparison value. Replaces the all-in-one
+         SubjectMappingOperatorEnum by separating the comparison from the quantifier (see
+         ConditionQuantifierEnum) and case sensitivity.
+    policy.ConditionQuantifierEnum:
+      type: string
+      title: ConditionQuantifierEnum
+      enum:
+        - CONDITION_QUANTIFIER_ENUM_UNSPECIFIED
+        - CONDITION_QUANTIFIER_ENUM_ANY
+        - CONDITION_QUANTIFIER_ENUM_ALL
+        - CONDITION_QUANTIFIER_ENUM_NONE
+      description: How matches are aggregated across the comparison set (subject_external_values).
     policy.KasPublicKeyAlgEnum:
       type: string
       title: KasPublicKeyAlgEnum
@@ -1091,7 +1113,10 @@ components:
              from idP/LDAP)
         operator:
           title: operator
-          description: the evaluation operator of relation
+          description: |-
+            Deprecated: use comparison + quantifier (+ case_insensitive) instead. Normalized to the
+             decomposed fields in the service layer for backward compatibility.
+          deprecated: true
           $ref: '#/components/schemas/policy.SubjectMappingOperatorEnum'
         subjectExternalValues:
           type: array
@@ -1104,10 +1129,23 @@ components:
             list of comparison values for the result of applying the
              subject_external_selector_value on a flattened Entity Representation
              (Subject), evaluated by the operator
+        comparison:
+          title: comparison
+          description: how each selector result is compared to subject_external_values entries
+          $ref: '#/components/schemas/policy.ConditionComparisonOperatorEnum'
+        quantifier:
+          title: quantifier
+          description: how matches are aggregated across subject_external_values
+          $ref: '#/components/schemas/policy.ConditionQuantifierEnum'
+        caseInsensitive:
+          title: case_insensitive
+          description: |-
+            when set true, comparison is case-insensitive; unset is treated as case-sensitive. Modeled as
+             BoolValue so an explicit false is distinguishable from unset, leaving room to change the default.
+          $ref: '#/components/schemas/google.protobuf.BoolValue'
       title: Condition
       required:
         - subjectExternalSelectorValue
-        - operator
       additionalProperties: false
       description: |-
         *
diff --git a/docs/openapi/policy/dynamicvaluemapping/dynamic_value_mapping.openapi.yaml b/docs/openapi/policy/dynamicvaluemapping/dynamic_value_mapping.openapi.yaml
new file mode 100644
index 0000000000..c05551ba69
--- /dev/null
+++ b/docs/openapi/policy/dynamicvaluemapping/dynamic_value_mapping.openapi.yaml
@@ -0,0 +1,1504 @@
+openapi: 3.1.0
+info:
+  title: policy.dynamicvaluemapping
+paths:
+  /policy.dynamicvaluemapping.DynamicValueMappingService/ListDynamicValueMappings:
+    post:
+      tags:
+        - policy.dynamicvaluemapping.DynamicValueMappingService
+      summary: ListDynamicValueMappings
+      operationId: policy.dynamicvaluemapping.DynamicValueMappingService.ListDynamicValueMappings
+      parameters:
+        - name: Connect-Protocol-Version
+          in: header
+          required: true
+          schema:
+            $ref: '#/components/schemas/connect-protocol-version'
+        - name: Connect-Timeout-Ms
+          in: header
+          schema:
+            $ref: '#/components/schemas/connect-timeout-header'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/policy.dynamicvaluemapping.ListDynamicValueMappingsRequest'
+        required: true
+      responses:
+        default:
+          description: Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connect.error'
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/policy.dynamicvaluemapping.ListDynamicValueMappingsResponse'
+  /policy.dynamicvaluemapping.DynamicValueMappingService/GetDynamicValueMapping:
+    post:
+      tags:
+        - policy.dynamicvaluemapping.DynamicValueMappingService
+      summary: GetDynamicValueMapping
+      operationId: policy.dynamicvaluemapping.DynamicValueMappingService.GetDynamicValueMapping
+      parameters:
+        - name: Connect-Protocol-Version
+          in: header
+          required: true
+          schema:
+            $ref: '#/components/schemas/connect-protocol-version'
+        - name: Connect-Timeout-Ms
+          in: header
+          schema:
+            $ref: '#/components/schemas/connect-timeout-header'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/policy.dynamicvaluemapping.GetDynamicValueMappingRequest'
+        required: true
+      responses:
+        default:
+          description: Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connect.error'
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/policy.dynamicvaluemapping.GetDynamicValueMappingResponse'
+  /policy.dynamicvaluemapping.DynamicValueMappingService/CreateDynamicValueMapping:
+    post:
+      tags:
+        - policy.dynamicvaluemapping.DynamicValueMappingService
+      summary: CreateDynamicValueMapping
+      operationId: policy.dynamicvaluemapping.DynamicValueMappingService.CreateDynamicValueMapping
+      parameters:
+        - name: Connect-Protocol-Version
+          in: header
+          required: true
+          schema:
+            $ref: '#/components/schemas/connect-protocol-version'
+        - name: Connect-Timeout-Ms
+          in: header
+          schema:
+            $ref: '#/components/schemas/connect-timeout-header'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/policy.dynamicvaluemapping.CreateDynamicValueMappingRequest'
+        required: true
+      responses:
+        default:
+          description: Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connect.error'
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/policy.dynamicvaluemapping.CreateDynamicValueMappingResponse'
+  /policy.dynamicvaluemapping.DynamicValueMappingService/UpdateDynamicValueMapping:
+    post:
+      tags:
+        - policy.dynamicvaluemapping.DynamicValueMappingService
+      summary: UpdateDynamicValueMapping
+      operationId: policy.dynamicvaluemapping.DynamicValueMappingService.UpdateDynamicValueMapping
+      parameters:
+        - name: Connect-Protocol-Version
+          in: header
+          required: true
+          schema:
+            $ref: '#/components/schemas/connect-protocol-version'
+        - name: Connect-Timeout-Ms
+          in: header
+          schema:
+            $ref: '#/components/schemas/connect-timeout-header'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/policy.dynamicvaluemapping.UpdateDynamicValueMappingRequest'
+        required: true
+      responses:
+        default:
+          description: Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connect.error'
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/policy.dynamicvaluemapping.UpdateDynamicValueMappingResponse'
+  /policy.dynamicvaluemapping.DynamicValueMappingService/DeleteDynamicValueMapping:
+    post:
+      tags:
+        - policy.dynamicvaluemapping.DynamicValueMappingService
+      summary: DeleteDynamicValueMapping
+      operationId: policy.dynamicvaluemapping.DynamicValueMappingService.DeleteDynamicValueMapping
+      parameters:
+        - name: Connect-Protocol-Version
+          in: header
+          required: true
+          schema:
+            $ref: '#/components/schemas/connect-protocol-version'
+        - name: Connect-Timeout-Ms
+          in: header
+          schema:
+            $ref: '#/components/schemas/connect-timeout-header'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/policy.dynamicvaluemapping.DeleteDynamicValueMappingRequest'
+        required: true
+      responses:
+        default:
+          description: Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connect.error'
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/policy.dynamicvaluemapping.DeleteDynamicValueMappingResponse'
+components:
+  schemas:
+    common.MetadataUpdateEnum:
+      type: string
+      title: MetadataUpdateEnum
+      enum:
+        - METADATA_UPDATE_ENUM_UNSPECIFIED
+        - METADATA_UPDATE_ENUM_EXTEND
+        - METADATA_UPDATE_ENUM_REPLACE
+    policy.Action.StandardAction:
+      type: string
+      title: StandardAction
+      enum:
+        - STANDARD_ACTION_UNSPECIFIED
+        - STANDARD_ACTION_DECRYPT
+        - STANDARD_ACTION_TRANSMIT
+    policy.Algorithm:
+      type: string
+      title: Algorithm
+      enum:
+        - ALGORITHM_UNSPECIFIED
+        - ALGORITHM_RSA_2048
+        - ALGORITHM_RSA_4096
+        - ALGORITHM_EC_P256
+        - ALGORITHM_EC_P384
+        - ALGORITHM_EC_P521
+        - ALGORITHM_HPQT_XWING
+        - ALGORITHM_HPQT_SECP256R1_MLKEM768
+        - ALGORITHM_HPQT_SECP384R1_MLKEM1024
+      description: Supported key algorithms.
+    policy.AttributeRuleTypeEnum:
+      type: string
+      title: AttributeRuleTypeEnum
+      enum:
+        - ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED
+        - ATTRIBUTE_RULE_TYPE_ENUM_ALL_OF
+        - ATTRIBUTE_RULE_TYPE_ENUM_ANY_OF
+        - ATTRIBUTE_RULE_TYPE_ENUM_HIERARCHY
+    policy.ConditionBooleanTypeEnum:
+      type: string
+      title: ConditionBooleanTypeEnum
+      enum:
+        - CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED
+        - CONDITION_BOOLEAN_TYPE_ENUM_AND
+        - CONDITION_BOOLEAN_TYPE_ENUM_OR
+    policy.ConditionComparisonOperatorEnum:
+      type: string
+      title: ConditionComparisonOperatorEnum
+      enum:
+        - CONDITION_COMPARISON_OPERATOR_ENUM_UNSPECIFIED
+        - CONDITION_COMPARISON_OPERATOR_ENUM_EQUALS
+        - CONDITION_COMPARISON_OPERATOR_ENUM_CONTAINS
+        - CONDITION_COMPARISON_OPERATOR_ENUM_STARTS_WITH
+        - CONDITION_COMPARISON_OPERATOR_ENUM_ENDS_WITH
+      description: |-
+        How a selector result is compared against a comparison value. Replaces the all-in-one
+         SubjectMappingOperatorEnum by separating the comparison from the quantifier (see
+         ConditionQuantifierEnum) and case sensitivity.
+    policy.ConditionQuantifierEnum:
+      type: string
+      title: ConditionQuantifierEnum
+      enum:
+        - CONDITION_QUANTIFIER_ENUM_UNSPECIFIED
+        - CONDITION_QUANTIFIER_ENUM_ANY
+        - CONDITION_QUANTIFIER_ENUM_ALL
+        - CONDITION_QUANTIFIER_ENUM_NONE
+      description: How matches are aggregated across the comparison set (subject_external_values).
+    policy.KasPublicKeyAlgEnum:
+      type: string
+      title: KasPublicKeyAlgEnum
+      enum:
+        - KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED
+        - KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048
+        - KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096
+        - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1
+        - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1
+        - KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1
+        - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_XWING
+        - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP256R1_MLKEM768
+        - KAS_PUBLIC_KEY_ALG_ENUM_HPQT_SECP384R1_MLKEM1024
+    policy.SortDirection:
+      type: string
+      title: SortDirection
+      enum:
+        - SORT_DIRECTION_UNSPECIFIED
+        - SORT_DIRECTION_ASC
+        - SORT_DIRECTION_DESC
+      description: |-
+        Sorting direction shared across list APIs.
+         When the 'sort' field is omitted or the chosen sort 'field' is UNSPECIFIED,
+         the endpoint's request message defines the default ordering; see the
+         specific List* request docs.
+    policy.SourceType:
+      type: string
+      title: SourceType
+      enum:
+        - SOURCE_TYPE_UNSPECIFIED
+        - SOURCE_TYPE_INTERNAL
+        - SOURCE_TYPE_EXTERNAL
+      description: |-
+        Describes whether this kas is managed by the organization or if they imported
+         the kas information from an external party. These two modes are necessary in order
+         to encrypt a tdf dek with an external parties kas public key.
+    policy.SubjectMappingOperatorEnum:
+      type: string
+      title: SubjectMappingOperatorEnum
+      enum:
+        - SUBJECT_MAPPING_OPERATOR_ENUM_UNSPECIFIED
+        - SUBJECT_MAPPING_OPERATOR_ENUM_IN
+        - SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN
+        - SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS
+    policy.dynamicvaluemapping.SortDynamicValueMappingsType:
+      type: string
+      title: SortDynamicValueMappingsType
+      enum:
+        - SORT_DYNAMIC_VALUE_MAPPINGS_TYPE_UNSPECIFIED
+        - SORT_DYNAMIC_VALUE_MAPPINGS_TYPE_CREATED_AT
+        - SORT_DYNAMIC_VALUE_MAPPINGS_TYPE_UPDATED_AT
+    common.Metadata:
+      type: object
+      properties:
+        createdAt:
+          title: created_at
+          description: created_at set by server (entity who created will recorded in an audit event)
+          $ref: '#/components/schemas/google.protobuf.Timestamp'
+        updatedAt:
+          title: updated_at
+          description: updated_at set by server (entity who updated will recorded in an audit event)
+          $ref: '#/components/schemas/google.protobuf.Timestamp'
+        labels:
+          type: object
+          title: labels
+          additionalProperties:
+            type: string
+            title: value
+          description: optional short description
+      title: Metadata
+      additionalProperties: false
+      description: Struct to uniquely identify a resource with optional additional metadata
+    common.Metadata.LabelsEntry:
+      type: object
+      properties:
+        key:
+          type: string
+          title: key
+        value:
+          type: string
+          title: value
+      title: LabelsEntry
+      additionalProperties: false
+    common.MetadataMutable:
+      type: object
+      properties:
+        labels:
+          type: object
+          title: labels
+          additionalProperties:
+            type: string
+            title: value
+          description: optional labels
+      title: MetadataMutable
+      additionalProperties: false
+    common.MetadataMutable.LabelsEntry:
+      type: object
+      properties:
+        key:
+          type: string
+          title: key
+        value:
+          type: string
+          title: value
+      title: LabelsEntry
+      additionalProperties: false
+    google.protobuf.BoolValue:
+      type: boolean
+      description: |-
+        Wrapper message for `bool`.
+
+         The JSON representation for `BoolValue` is JSON `true` and `false`.
+
+         Not recommended for use in new APIs, but still useful for legacy APIs and
+         has no plan to be removed.
+    google.protobuf.Timestamp:
+      type: string
+      examples:
+        - 1s
+        - 1.000340012s
+      format: date-time
+      description: |-
+        A Timestamp represents a point in time independent of any time zone or local
+         calendar, encoded as a count of seconds and fractions of seconds at
+         nanosecond resolution. The count is relative to an epoch at UTC midnight on
+         January 1, 1970, in the proleptic Gregorian calendar which extends the
+         Gregorian calendar backwards to year one.
+
+         All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap
+         second table is needed for interpretation, using a [24-hour linear
+         smear](https://developers.google.com/time/smear).
+
+         The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By
+         restricting to that range, we ensure that we can convert to and from [RFC
+         3339](https://www.ietf.org/rfc/rfc3339.txt) date strings.
+
+         # Examples
+
+         Example 1: Compute Timestamp from POSIX `time()`.
+
+             Timestamp timestamp;
+             timestamp.set_seconds(time(NULL));
+             timestamp.set_nanos(0);
+
+         Example 2: Compute Timestamp from POSIX `gettimeofday()`.
+
+             struct timeval tv;
+             gettimeofday(&tv, NULL);
+
+             Timestamp timestamp;
+             timestamp.set_seconds(tv.tv_sec);
+             timestamp.set_nanos(tv.tv_usec * 1000);
+
+         Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`.
+
+             FILETIME ft;
+             GetSystemTimeAsFileTime(&ft);
+             UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime;
+
+             // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z
+             // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z.
+             Timestamp timestamp;
+             timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL));
+             timestamp.set_nanos((INT32) ((ticks % 10000000) * 100));
+
+         Example 4: Compute Timestamp from Java `System.currentTimeMillis()`.
+
+             long millis = System.currentTimeMillis();
+
+             Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000)
+                 .setNanos((int) ((millis % 1000) * 1000000)).build();
+
+         Example 5: Compute Timestamp from Java `Instant.now()`.
+
+             Instant now = Instant.now();
+
+             Timestamp timestamp =
+                 Timestamp.newBuilder().setSeconds(now.getEpochSecond())
+                     .setNanos(now.getNano()).build();
+
+         Example 6: Compute Timestamp from current time in Python.
+
+             timestamp = Timestamp()
+             timestamp.GetCurrentTime()
+
+         # JSON Mapping
+
+         In JSON format, the Timestamp type is encoded as a string in the
+         [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format. That is, the
+         format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z"
+         where {year} is always expressed using four digits while {month}, {day},
+         {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional
+         seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution),
+         are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone
+         is required. A proto3 JSON serializer should always use UTC (as indicated by
+         "Z") when printing the Timestamp type and a proto3 JSON parser should be
+         able to accept both UTC and other timezones (as indicated by an offset).
+
+         For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past
+         01:30 UTC on January 15, 2017.
+
+         In JavaScript, one can convert a Date object to this format using the
+         standard
+         [toISOString()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString)
+         method. In Python, a standard `datetime.datetime` object can be converted
+         to this format using
+         [`strftime`](https://docs.python.org/2/library/time.html#time.strftime) with
+         the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use
+         the Joda Time's [`ISODateTimeFormat.dateTime()`](
+         http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime()
+         ) to obtain a formatter capable of generating timestamps in this format.
+    policy.Action:
+      type: object
+      oneOf:
+        - properties:
+            custom:
+              type: string
+              title: custom
+              description: Deprecated
+          title: custom
+          required:
+            - custom
+        - properties:
+            standard:
+              title: standard
+              description: Deprecated
+              $ref: '#/components/schemas/policy.Action.StandardAction'
+          title: standard
+          required:
+            - standard
+      properties:
+        id:
+          type: string
+          title: id
+          description: Generated uuid in database
+        name:
+          type: string
+          title: name
+        namespace:
+          title: namespace
+          description: Namespace context for this action
+          $ref: '#/components/schemas/policy.Namespace'
+        metadata:
+          title: metadata
+          $ref: '#/components/schemas/common.Metadata'
+      title: Action
+      additionalProperties: false
+      description: An action an entity can take
+    policy.Attribute:
+      type: object
+      properties:
+        id:
+          type: string
+          title: id
+        namespace:
+          title: namespace
+          description: namespace of the attribute
+          $ref: '#/components/schemas/policy.Namespace'
+        name:
+          type: string
+          title: name
+          description: attribute name
+        rule:
+          title: rule
+          description: attribute rule enum
+          $ref: '#/components/schemas/policy.AttributeRuleTypeEnum'
+        values:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.Value'
+          title: values
+        grants:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.KeyAccessServer'
+          title: grants
+          description: Deprecated KAS grants for the attribute. Use kas_keys instead.
+        fqn:
+          type: string
+          title: fqn
+        active:
+          title: active
+          description: active by default until explicitly deactivated
+          $ref: '#/components/schemas/google.protobuf.BoolValue'
+        kasKeys:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.SimpleKasKey'
+          title: kas_keys
+          description: Keys associated with the attribute
+        allowTraversal:
+          title: allow_traversal
+          description: |-
+            Whether or not we will use the attribute definition during encryption
+             if the attribute value is missing.
+          $ref: '#/components/schemas/google.protobuf.BoolValue'
+        metadata:
+          title: metadata
+          description: Common metadata
+          $ref: '#/components/schemas/common.Metadata'
+      title: Attribute
+      required:
+        - rule
+      additionalProperties: false
+    policy.Condition:
+      type: object
+      properties:
+        subjectExternalSelectorValue:
+          type: string
+          title: subject_external_selector_value
+          description: |-
+            a selector for a field value on a flattened Entity Representation (such as
+             from idP/LDAP)
+        operator:
+          title: operator
+          description: |-
+            Deprecated: use comparison + quantifier (+ case_insensitive) instead. Normalized to the
+             decomposed fields in the service layer for backward compatibility.
+          deprecated: true
+          $ref: '#/components/schemas/policy.SubjectMappingOperatorEnum'
+        subjectExternalValues:
+          type: array
+          items:
+            type: string
+            minItems: 1
+          title: subject_external_values
+          minItems: 1
+          description: |-
+            list of comparison values for the result of applying the
+             subject_external_selector_value on a flattened Entity Representation
+             (Subject), evaluated by the operator
+        comparison:
+          title: comparison
+          description: how each selector result is compared to subject_external_values entries
+          $ref: '#/components/schemas/policy.ConditionComparisonOperatorEnum'
+        quantifier:
+          title: quantifier
+          description: how matches are aggregated across subject_external_values
+          $ref: '#/components/schemas/policy.ConditionQuantifierEnum'
+        caseInsensitive:
+          title: case_insensitive
+          description: |-
+            when set true, comparison is case-insensitive; unset is treated as case-sensitive. Modeled as
+             BoolValue so an explicit false is distinguishable from unset, leaving room to change the default.
+          $ref: '#/components/schemas/google.protobuf.BoolValue'
+      title: Condition
+      required:
+        - subjectExternalSelectorValue
+      additionalProperties: false
+      description: |-
+        *
+        A Condition defines a rule of <the value at the flattened 'selector value'
+        location> <operator> <subject external values>
+    policy.ConditionGroup:
+      type: object
+      properties:
+        conditions:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.Condition'
+          title: conditions
+          minItems: 1
+        booleanOperator:
+          title: boolean_operator
+          description: the boolean evaluation type across the conditions
+          $ref: '#/components/schemas/policy.ConditionBooleanTypeEnum'
+      title: ConditionGroup
+      required:
+        - booleanOperator
+      additionalProperties: false
+      description: A collection of Conditions evaluated by the boolean_operator provided
+    policy.DynamicValueMapping:
+      type: object
+      properties:
+        id:
+          type: string
+          title: id
+        attributeDefinition:
+          title: attribute_definition
+          description: the Attribute Definition whose values are entitled dynamically
+          $ref: '#/components/schemas/policy.Attribute'
+        valueResolver:
+          title: value_resolver
+          description: the dynamic resolver matched against the requested resource value segment
+          $ref: '#/components/schemas/policy.DynamicValueResolver'
+        subjectConditionSet:
+          title: subject_condition_set
+          description: |-
+            optional static pre-gate on the entity, evaluated with normal SubjectConditionSet
+             semantics (no dynamic overload). When present, both the gate and the resolver must
+             pass for entitlement.
+          $ref: '#/components/schemas/policy.SubjectConditionSet'
+        actions:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.Action'
+          title: actions
+          description: the actions permitted by subjects in this mapping
+        namespace:
+          title: namespace
+          description: the namespace containing this mapping
+          $ref: '#/components/schemas/policy.Namespace'
+        metadata:
+          title: metadata
+          $ref: '#/components/schemas/common.Metadata'
+      title: DynamicValueMapping
+      additionalProperties: false
+      description: |-
+        Dynamic Value Mapping: a Policy assigning permitted action(s) to
+        dynamically-requested values under an Attribute Definition. It raises entitlement
+        authority from a concrete Attribute Value to the Attribute Definition: at decision time
+        the value_resolver compares the requested resource value segment against the entity
+        representation, avoiding pre-provisioning a value + subject mapping per discrete value.
+    policy.DynamicValueResolver:
+      type: object
+      properties:
+        subjectExternalSelectorValue:
+          type: string
+          title: subject_external_selector_value
+          description: |-
+            a selector for a field value on a flattened Entity Representation (such as from
+             idP/LDAP), e.g. ".patientAssignments[]"
+        comparison:
+          title: comparison
+          description: |-
+            how the requested resource value segment is compared against each value the selector
+             resolves from the entity representation
+          $ref: '#/components/schemas/policy.ConditionComparisonOperatorEnum'
+        caseInsensitive:
+          title: case_insensitive
+          description: |-
+            when set true, comparison is case-insensitive; unset is treated as case-sensitive. Modeled as
+             BoolValue so an explicit false is distinguishable from unset, leaving room to change the default.
+          $ref: '#/components/schemas/google.protobuf.BoolValue'
+      title: DynamicValueResolver
+      required:
+        - subjectExternalSelectorValue
+        - comparison
+      additionalProperties: false
+      description: |-
+        Dynamic Value Resolver: the dynamic half of a DynamicValueMapping. It resolves a selector
+        against the entity representation, then tests whether any resolved entity value matches the
+        requested resource value segment under comparison. The match is inherently existential over
+        the resolved entity values, so no quantifier is carried here.
+    policy.KasPublicKey:
+      type: object
+      properties:
+        pem:
+          type: string
+          title: pem
+          maxLength: 8192
+          minLength: 1
+          description: x509 ASN.1 content in PEM envelope, usually
+        kid:
+          type: string
+          title: kid
+          maxLength: 32
+          minLength: 1
+          description: A unique string identifier for this key
+        alg:
+          not:
+            enum:
+              - 0
+          title: alg
+          description: |-
+            A known algorithm type with any additional parameters encoded.
+             To start, these may be `rsa:2048` for RSA-based wrapping and
+             `ec:secp256r1` for EC-based wrapping, but more formats may be added as needed.
+          $ref: '#/components/schemas/policy.KasPublicKeyAlgEnum'
+      title: KasPublicKey
+      additionalProperties: false
+      description: |-
+        Deprecated
+         A KAS public key and some associated metadata for further identifcation
+    policy.KasPublicKeySet:
+      type: object
+      properties:
+        keys:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.KasPublicKey'
+          title: keys
+      title: KasPublicKeySet
+      additionalProperties: false
+      description: |-
+        Deprecated
+         A list of known KAS public keys
+    policy.KeyAccessServer:
+      type: object
+      properties:
+        id:
+          type: string
+          title: id
+        uri:
+          type: string
+          title: uri
+          description: |+
+            Address of a KAS instance
+            URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.:
+            ```
+            this.matches('^https?://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(:[0-9]+)?(/.*)?$')
+            ```
+
+        publicKey:
+          title: public_key
+          description: 'Deprecated: KAS can have multiple key pairs'
+          $ref: '#/components/schemas/policy.PublicKey'
+        sourceType:
+          title: source_type
+          description: 'The source of the KAS: (INTERNAL, EXTERNAL)'
+          $ref: '#/components/schemas/policy.SourceType'
+        kasKeys:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.SimpleKasKey'
+          title: kas_keys
+          description: Kas keys associated with this KAS
+        name:
+          type: string
+          title: name
+          description: |-
+            Optional
+             Unique name of the KAS instance
+        metadata:
+          title: metadata
+          description: Common metadata
+          $ref: '#/components/schemas/common.Metadata'
+      title: KeyAccessServer
+      additionalProperties: false
+      description: Key Access Server Registry
+    policy.Namespace:
+      type: object
+      properties:
+        id:
+          type: string
+          title: id
+          description: generated uuid in database
+        name:
+          type: string
+          title: name
+          description: |-
+            used to partition Attribute Definitions, support by namespace AuthN and
+             enable federation
+        fqn:
+          type: string
+          title: fqn
+        active:
+          title: active
+          description: active by default until explicitly deactivated
+          $ref: '#/components/schemas/google.protobuf.BoolValue'
+        metadata:
+          title: metadata
+          $ref: '#/components/schemas/common.Metadata'
+        grants:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.KeyAccessServer'
+          title: grants
+          description: Deprecated KAS grants for the namespace. Use kas_keys instead.
+        kasKeys:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.SimpleKasKey'
+          title: kas_keys
+          description: Keys for the namespace
+      title: Namespace
+      additionalProperties: false
+    policy.Obligation:
+      type: object
+      properties:
+        id:
+          type: string
+          title: id
+        namespace:
+          title: namespace
+          $ref: '#/components/schemas/policy.Namespace'
+        name:
+          type: string
+          title: name
+        values:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.ObligationValue'
+          title: values
+        fqn:
+          type: string
+          title: fqn
+        metadata:
+          title: metadata
+          $ref: '#/components/schemas/common.Metadata'
+      title: Obligation
+      additionalProperties: false
+    policy.ObligationTrigger:
+      type: object
+      properties:
+        id:
+          type: string
+          title: id
+        obligationValue:
+          title: obligation_value
+          $ref: '#/components/schemas/policy.ObligationValue'
+        action:
+          title: action
+          $ref: '#/components/schemas/policy.Action'
+        attributeValue:
+          title: attribute_value
+          $ref: '#/components/schemas/policy.Value'
+        context:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.RequestContext'
+          title: context
+        namespace:
+          title: namespace
+          description: The source namespace for this trigger, derived from the attribute value and action.
+          $ref: '#/components/schemas/policy.Namespace'
+        metadata:
+          title: metadata
+          $ref: '#/components/schemas/common.Metadata'
+      title: ObligationTrigger
+      additionalProperties: false
+    policy.ObligationValue:
+      type: object
+      properties:
+        id:
+          type: string
+          title: id
+        obligation:
+          title: obligation
+          $ref: '#/components/schemas/policy.Obligation'
+        value:
+          type: string
+          title: value
+        triggers:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.ObligationTrigger'
+          title: triggers
+        fqn:
+          type: string
+          title: fqn
+        metadata:
+          title: metadata
+          $ref: '#/components/schemas/common.Metadata'
+      title: ObligationValue
+      additionalProperties: false
+    policy.PageRequest:
+      type: object
+      properties:
+        limit:
+          type: integer
+          title: limit
+          format: int32
+          description: |-
+            Optional
+             Set to configured default limit if not provided
+             Maximum limit set in platform config and enforced by services
+        offset:
+          type: integer
+          title: offset
+          format: int32
+          description: |-
+            Optional
+             Defaulted if not provided
+      title: PageRequest
+      additionalProperties: false
+    policy.PageResponse:
+      type: object
+      properties:
+        currentOffset:
+          type: integer
+          title: current_offset
+          format: int32
+          description: Requested pagination offset
+        nextOffset:
+          type: integer
+          title: next_offset
+          format: int32
+          description: |-
+            Calculated with request limit + offset or defaults
+             Empty when none remain after current page
+        total:
+          type: integer
+          title: total
+          format: int32
+          description: Total count of entire list
+      title: PageResponse
+      additionalProperties: false
+    policy.PolicyEnforcementPoint:
+      type: object
+      properties:
+        clientId:
+          type: string
+          title: client_id
+          minLength: 1
+      title: PolicyEnforcementPoint
+      additionalProperties: false
+    policy.PublicKey:
+      type: object
+      oneOf:
+        - properties:
+            cached:
+              title: cached
+              description: public key with additional information. Current preferred version
+              $ref: '#/components/schemas/policy.KasPublicKeySet'
+          title: cached
+          required:
+            - cached
+        - properties:
+            remote:
+              type: string
+              title: remote
+              description: |+
+                kas public key url - optional since can also be retrieved via public key
+                URI must be a valid URL (e.g., 'https://demo.com/') followed by additional segments. Each segment must start and end with an alphanumeric character, can contain hyphens, alphanumeric characters, and slashes.:
+                ```
+                this.matches('^https://[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9\\-]{0,61}[a-zA-Z0-9])?)*(/.*)?$')
+                ```
+
+          title: remote
+          required:
+            - remote
+      title: PublicKey
+      additionalProperties: false
+      description: Deprecated
+    policy.RequestContext:
+      type: object
+      properties:
+        pep:
+          title: pep
+          $ref: '#/components/schemas/policy.PolicyEnforcementPoint'
+      title: RequestContext
+      required:
+        - pep
+      additionalProperties: false
+      description: Holds the context needed for obligation fulfillment
+    policy.ResourceMapping:
+      type: object
+      properties:
+        id:
+          type: string
+          title: id
+        metadata:
+          title: metadata
+          $ref: '#/components/schemas/common.Metadata'
+        attributeValue:
+          title: attribute_value
+          $ref: '#/components/schemas/policy.Value'
+        terms:
+          type: array
+          items:
+            type: string
+          title: terms
+        group:
+          title: group
+          $ref: '#/components/schemas/policy.ResourceMappingGroup'
+        namespace:
+          title: namespace
+          description: |-
+            The namespace that optionally owns this resource mapping. When the mapping
+             belongs to a group, this matches the group's namespace. The mapped
+             attribute value may belong to a different namespace.
+          $ref: '#/components/schemas/policy.Namespace'
+      title: ResourceMapping
+      required:
+        - attributeValue
+      additionalProperties: false
+      description: |-
+        Resource Mappings (aka Access Control Resource Encodings aka ACRE) are
+        structures supporting the mapping of Resources and Attribute Values
+    policy.ResourceMappingGroup:
+      type: object
+      properties:
+        id:
+          type: string
+          title: id
+        namespaceId:
+          type: string
+          title: namespace_id
+          description: the namespace containing the group of resource mappings
+        name:
+          type: string
+          title: name
+          description: |-
+            the common name for the group of resource mappings, which must be unique
+             per namespace
+        fqn:
+          type: string
+          title: fqn
+          description: the fully qualified name of the resource mapping group
+        metadata:
+          title: metadata
+          description: Common metadata
+          $ref: '#/components/schemas/common.Metadata'
+      title: ResourceMappingGroup
+      required:
+        - namespaceId
+        - name
+      additionalProperties: false
+      description: |-
+        Resource Mapping Groups are namespaced collections of Resource Mappings
+        associated under a common group name.
+    policy.SimpleKasKey:
+      type: object
+      properties:
+        kasUri:
+          type: string
+          title: kas_uri
+          description: The URL of the Key Access Server
+        publicKey:
+          title: public_key
+          description: The public key of the Key that belongs to the KAS
+          $ref: '#/components/schemas/policy.SimpleKasPublicKey'
+        kasId:
+          type: string
+          title: kas_id
+          description: The ID of the Key Access Server
+      title: SimpleKasKey
+      additionalProperties: false
+    policy.SimpleKasPublicKey:
+      type: object
+      properties:
+        algorithm:
+          title: algorithm
+          $ref: '#/components/schemas/policy.Algorithm'
+        kid:
+          type: string
+          title: kid
+        pem:
+          type: string
+          title: pem
+      title: SimpleKasPublicKey
+      additionalProperties: false
+    policy.SubjectConditionSet:
+      type: object
+      properties:
+        id:
+          type: string
+          title: id
+        namespace:
+          title: namespace
+          description: |-
+            the namespace containing this subject condition set
+             possible this is empty in the case a subject condition set
+             has not been migrated to a namespace.
+          $ref: '#/components/schemas/policy.Namespace'
+        subjectSets:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.SubjectSet'
+          title: subject_sets
+          minItems: 1
+        metadata:
+          title: metadata
+          $ref: '#/components/schemas/common.Metadata'
+      title: SubjectConditionSet
+      additionalProperties: false
+      description: |-
+        A container for multiple Subject Sets, each containing Condition Groups, each
+        containing Conditions. Multiple Subject Sets in a SubjectConditionSet are
+        evaluated with AND logic. As each Subject Mapping has only one Attribute
+        Value, the SubjectConditionSet is reusable across multiple Subject Mappings /
+        Attribute Values and is an independent unit.
+    policy.SubjectMapping:
+      type: object
+      properties:
+        id:
+          type: string
+          title: id
+        attributeValue:
+          title: attribute_value
+          description: 'the Attribute Value mapped to; aka: "The Entity Entitlement Attribute"'
+          $ref: '#/components/schemas/policy.Value'
+        subjectConditionSet:
+          title: subject_condition_set
+          description: the reusable SubjectConditionSet mapped to the given Attribute Value
+          $ref: '#/components/schemas/policy.SubjectConditionSet'
+        actions:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.Action'
+          title: actions
+          description: The actions permitted by subjects in this mapping
+        namespace:
+          title: namespace
+          description: |-
+            the namespace containing this subject mapping
+             possible this is empty. If so that means
+             the Subject Mapping has not been migrated to a namespace.
+          $ref: '#/components/schemas/policy.Namespace'
+        metadata:
+          title: metadata
+          $ref: '#/components/schemas/common.Metadata'
+      title: SubjectMapping
+      additionalProperties: false
+      description: |-
+        Subject Mapping: A Policy assigning Subject Set(s) to a permitted attribute
+        value + action(s) combination
+    policy.SubjectSet:
+      type: object
+      properties:
+        conditionGroups:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.ConditionGroup'
+          title: condition_groups
+          minItems: 1
+          description: multiple Condition Groups are evaluated with AND logic
+      title: SubjectSet
+      additionalProperties: false
+      description: A collection of Condition Groups
+    policy.Value:
+      type: object
+      properties:
+        id:
+          type: string
+          title: id
+          description: generated uuid in database
+        attribute:
+          title: attribute
+          $ref: '#/components/schemas/policy.Attribute'
+        value:
+          type: string
+          title: value
+        grants:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.KeyAccessServer'
+          title: grants
+          description: Deprecated KAS grants for the value. Use kas_keys instead.
+        fqn:
+          type: string
+          title: fqn
+        active:
+          title: active
+          description: active by default until explicitly deactivated
+          $ref: '#/components/schemas/google.protobuf.BoolValue'
+        subjectMappings:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.SubjectMapping'
+          title: subject_mappings
+          description: subject mapping
+        kasKeys:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.SimpleKasKey'
+          title: kas_keys
+        resourceMappings:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.ResourceMapping'
+          title: resource_mappings
+        obligations:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.Obligation'
+          title: obligations
+        metadata:
+          title: metadata
+          description: Common metadata
+          $ref: '#/components/schemas/common.Metadata'
+      title: Value
+      additionalProperties: false
+    policy.dynamicvaluemapping.CreateDynamicValueMappingRequest:
+      type: object
+      properties:
+        attributeDefinitionId:
+          type: string
+          title: attribute_definition_id
+          format: uuid
+        attributeDefinitionFqn:
+          type: string
+          title: attribute_definition_fqn
+          minLength: 1
+          format: uri
+        valueResolver:
+          title: value_resolver
+          description: 'Required: the dynamic resolver comparing entity selector result to the resource value segment'
+          $ref: '#/components/schemas/policy.DynamicValueResolver'
+        actions:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.Action'
+          title: actions
+          minItems: 1
+          description: |+
+            Required: actions permitted on a matched value
+            Action name or ID must not be empty if provided:
+            ```
+            this.all(item, item.name != '' || item.id != '')
+            ```
+
+        existingSubjectConditionSetId:
+          type: string
+          title: existing_subject_condition_set_id
+          description: |+
+            Optional static pre-gate. Reuse an existing SubjectConditionSet (prioritized) ...
+            Optional field must be a valid UUID:
+            ```
+            size(this) == 0 || this.matches('[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}')
+            ```
+
+        newSubjectConditionSet:
+          title: new_subject_condition_set
+          description: '... or create a new one (ignored if existing_subject_condition_set_id is provided)'
+          $ref: '#/components/schemas/policy.subjectmapping.SubjectConditionSetCreate'
+        namespaceId:
+          type: string
+          title: namespace_id
+          format: uuid
+          description: 'Optional: namespace ID or FQN for the mapping'
+        namespaceFqn:
+          type: string
+          title: namespace_fqn
+          minLength: 1
+          format: uri
+        metadata:
+          title: metadata
+          description: Optional
+          $ref: '#/components/schemas/common.MetadataMutable'
+      title: CreateDynamicValueMappingRequest
+      required:
+        - valueResolver
+      additionalProperties: false
+    policy.dynamicvaluemapping.CreateDynamicValueMappingResponse:
+      type: object
+      properties:
+        dynamicValueMapping:
+          title: dynamic_value_mapping
+          $ref: '#/components/schemas/policy.DynamicValueMapping'
+      title: CreateDynamicValueMappingResponse
+      additionalProperties: false
+    policy.dynamicvaluemapping.DeleteDynamicValueMappingRequest:
+      type: object
+      properties:
+        id:
+          type: string
+          title: id
+          format: uuid
+          description: Required
+      title: DeleteDynamicValueMappingRequest
+      additionalProperties: false
+    policy.dynamicvaluemapping.DeleteDynamicValueMappingResponse:
+      type: object
+      properties:
+        dynamicValueMapping:
+          title: dynamic_value_mapping
+          description: Only ID of the deleted mapping provided
+          $ref: '#/components/schemas/policy.DynamicValueMapping'
+      title: DeleteDynamicValueMappingResponse
+      additionalProperties: false
+    policy.dynamicvaluemapping.DynamicValueMappingsSort:
+      type: object
+      properties:
+        field:
+          title: field
+          $ref: '#/components/schemas/policy.dynamicvaluemapping.SortDynamicValueMappingsType'
+        direction:
+          title: direction
+          $ref: '#/components/schemas/policy.SortDirection'
+      title: DynamicValueMappingsSort
+      additionalProperties: false
+    policy.dynamicvaluemapping.GetDynamicValueMappingRequest:
+      type: object
+      properties:
+        id:
+          type: string
+          title: id
+          format: uuid
+          description: Required
+      title: GetDynamicValueMappingRequest
+      additionalProperties: false
+    policy.dynamicvaluemapping.GetDynamicValueMappingResponse:
+      type: object
+      properties:
+        dynamicValueMapping:
+          title: dynamic_value_mapping
+          $ref: '#/components/schemas/policy.DynamicValueMapping'
+      title: GetDynamicValueMappingResponse
+      additionalProperties: false
+    policy.dynamicvaluemapping.ListDynamicValueMappingsRequest:
+      type: object
+      properties:
+        namespaceId:
+          type: string
+          title: namespace_id
+          format: uuid
+        namespaceFqn:
+          type: string
+          title: namespace_fqn
+          minLength: 1
+          format: uri
+        attributeDefinitionId:
+          type: string
+          title: attribute_definition_id
+          description: |+
+            Optional: Attribute Definition ID to filter by
+            Optional field must be a valid UUID:
+            ```
+            size(this) == 0 || this.matches('[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}')
+            ```
+
+        pagination:
+          title: pagination
+          description: Optional
+          $ref: '#/components/schemas/policy.PageRequest'
+        sort:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.dynamicvaluemapping.DynamicValueMappingsSort'
+          title: sort
+          maxItems: 1
+          description: 'Optional - CONSTRAINT: max 1 item'
+      title: ListDynamicValueMappingsRequest
+      additionalProperties: false
+    policy.dynamicvaluemapping.ListDynamicValueMappingsResponse:
+      type: object
+      properties:
+        dynamicValueMappings:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.DynamicValueMapping'
+          title: dynamic_value_mappings
+        pagination:
+          title: pagination
+          $ref: '#/components/schemas/policy.PageResponse'
+      title: ListDynamicValueMappingsResponse
+      additionalProperties: false
+    policy.dynamicvaluemapping.UpdateDynamicValueMappingRequest:
+      type: object
+      properties:
+        id:
+          type: string
+          title: id
+          format: uuid
+          description: Required
+        valueResolver:
+          title: value_resolver
+          description: 'Optional: replace the dynamic resolver'
+          $ref: '#/components/schemas/policy.DynamicValueResolver'
+        subjectConditionSetId:
+          type: string
+          title: subject_condition_set_id
+          description: |+
+            Optional: replace the static pre-gate SubjectConditionSet by id
+            Optional field must be a valid UUID:
+            ```
+            size(this) == 0 || this.matches('[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}')
+            ```
+
+        actions:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.Action'
+          title: actions
+          description: |+
+            Optional: replace the entire list of actions
+            Action name or ID must not be empty if provided:
+            ```
+            this.size() == 0 || this.all(item, item.name != '' || item.id != '')
+            ```
+
+        metadata:
+          title: metadata
+          description: Common metadata
+          $ref: '#/components/schemas/common.MetadataMutable'
+        metadataUpdateBehavior:
+          title: metadata_update_behavior
+          $ref: '#/components/schemas/common.MetadataUpdateEnum'
+      title: UpdateDynamicValueMappingRequest
+      additionalProperties: false
+    policy.dynamicvaluemapping.UpdateDynamicValueMappingResponse:
+      type: object
+      properties:
+        dynamicValueMapping:
+          title: dynamic_value_mapping
+          $ref: '#/components/schemas/policy.DynamicValueMapping'
+      title: UpdateDynamicValueMappingResponse
+      additionalProperties: false
+    policy.subjectmapping.SubjectConditionSetCreate:
+      type: object
+      properties:
+        subjectSets:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.SubjectSet'
+          title: subject_sets
+          minItems: 1
+          description: Required
+        metadata:
+          title: metadata
+          description: |-
+            Optional
+             Common metadata
+          $ref: '#/components/schemas/common.MetadataMutable'
+      title: SubjectConditionSetCreate
+      additionalProperties: false
+    connect-protocol-version:
+      type: number
+      title: Connect-Protocol-Version
+      enum:
+        - 1
+      description: Define the version of the Connect protocol
+      const: 1
+    connect-timeout-header:
+      type: number
+      title: Connect-Timeout-Ms
+      description: Define the timeout, in ms
+    connect.error:
+      type: object
+      properties:
+        code:
+          type: string
+          examples:
+            - not_found
+          enum:
+            - canceled
+            - unknown
+            - invalid_argument
+            - deadline_exceeded
+            - not_found
+            - already_exists
+            - permission_denied
+            - resource_exhausted
+            - failed_precondition
+            - aborted
+            - out_of_range
+            - unimplemented
+            - internal
+            - unavailable
+            - data_loss
+            - unauthenticated
+          description: The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
+        message:
+          type: string
+          description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
+        detail:
+          $ref: '#/components/schemas/google.protobuf.Any'
+      title: Connect Error
+      additionalProperties: true
+      description: 'Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation'
+    google.protobuf.Any:
+      type: object
+      properties:
+        type:
+          type: string
+        value:
+          type: string
+          format: binary
+        debug:
+          type: object
+          additionalProperties: true
+      additionalProperties: true
+      description: Contains an arbitrary serialized message along with a @type that describes the type of the serialized message.
+security: []
+tags:
+  - name: policy.dynamicvaluemapping.DynamicValueMappingService
diff --git a/docs/openapi/policy/objects.openapi.yaml b/docs/openapi/policy/objects.openapi.yaml
index 00630c5163..b888894b3c 100644
--- a/docs/openapi/policy/objects.openapi.yaml
+++ b/docs/openapi/policy/objects.openapi.yaml
@@ -40,6 +40,28 @@ components:
         - CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED
         - CONDITION_BOOLEAN_TYPE_ENUM_AND
         - CONDITION_BOOLEAN_TYPE_ENUM_OR
+    policy.ConditionComparisonOperatorEnum:
+      type: string
+      title: ConditionComparisonOperatorEnum
+      enum:
+        - CONDITION_COMPARISON_OPERATOR_ENUM_UNSPECIFIED
+        - CONDITION_COMPARISON_OPERATOR_ENUM_EQUALS
+        - CONDITION_COMPARISON_OPERATOR_ENUM_CONTAINS
+        - CONDITION_COMPARISON_OPERATOR_ENUM_STARTS_WITH
+        - CONDITION_COMPARISON_OPERATOR_ENUM_ENDS_WITH
+      description: |-
+        How a selector result is compared against a comparison value. Replaces the all-in-one
+         SubjectMappingOperatorEnum by separating the comparison from the quantifier (see
+         ConditionQuantifierEnum) and case sensitivity.
+    policy.ConditionQuantifierEnum:
+      type: string
+      title: ConditionQuantifierEnum
+      enum:
+        - CONDITION_QUANTIFIER_ENUM_UNSPECIFIED
+        - CONDITION_QUANTIFIER_ENUM_ANY
+        - CONDITION_QUANTIFIER_ENUM_ALL
+        - CONDITION_QUANTIFIER_ENUM_NONE
+      description: How matches are aggregated across the comparison set (subject_external_values).
     policy.KasPublicKeyAlgEnum:
       type: string
       title: KasPublicKeyAlgEnum
@@ -376,7 +398,10 @@ components:
              from idP/LDAP)
         operator:
           title: operator
-          description: the evaluation operator of relation
+          description: |-
+            Deprecated: use comparison + quantifier (+ case_insensitive) instead. Normalized to the
+             decomposed fields in the service layer for backward compatibility.
+          deprecated: true
           $ref: '#/components/schemas/policy.SubjectMappingOperatorEnum'
         subjectExternalValues:
           type: array
@@ -389,10 +414,23 @@ components:
             list of comparison values for the result of applying the
              subject_external_selector_value on a flattened Entity Representation
              (Subject), evaluated by the operator
+        comparison:
+          title: comparison
+          description: how each selector result is compared to subject_external_values entries
+          $ref: '#/components/schemas/policy.ConditionComparisonOperatorEnum'
+        quantifier:
+          title: quantifier
+          description: how matches are aggregated across subject_external_values
+          $ref: '#/components/schemas/policy.ConditionQuantifierEnum'
+        caseInsensitive:
+          title: case_insensitive
+          description: |-
+            when set true, comparison is case-insensitive; unset is treated as case-sensitive. Modeled as
+             BoolValue so an explicit false is distinguishable from unset, leaving room to change the default.
+          $ref: '#/components/schemas/google.protobuf.BoolValue'
       title: Condition
       required:
         - subjectExternalSelectorValue
-        - operator
       additionalProperties: false
       description: |-
         *
@@ -416,6 +454,79 @@ components:
         - booleanOperator
       additionalProperties: false
       description: A collection of Conditions evaluated by the boolean_operator provided
+    policy.DynamicValueMapping:
+      type: object
+      properties:
+        id:
+          type: string
+          title: id
+        attributeDefinition:
+          title: attribute_definition
+          description: the Attribute Definition whose values are entitled dynamically
+          $ref: '#/components/schemas/policy.Attribute'
+        valueResolver:
+          title: value_resolver
+          description: the dynamic resolver matched against the requested resource value segment
+          $ref: '#/components/schemas/policy.DynamicValueResolver'
+        subjectConditionSet:
+          title: subject_condition_set
+          description: |-
+            optional static pre-gate on the entity, evaluated with normal SubjectConditionSet
+             semantics (no dynamic overload). When present, both the gate and the resolver must
+             pass for entitlement.
+          $ref: '#/components/schemas/policy.SubjectConditionSet'
+        actions:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.Action'
+          title: actions
+          description: the actions permitted by subjects in this mapping
+        namespace:
+          title: namespace
+          description: the namespace containing this mapping
+          $ref: '#/components/schemas/policy.Namespace'
+        metadata:
+          title: metadata
+          $ref: '#/components/schemas/common.Metadata'
+      title: DynamicValueMapping
+      additionalProperties: false
+      description: |-
+        Dynamic Value Mapping: a Policy assigning permitted action(s) to
+        dynamically-requested values under an Attribute Definition. It raises entitlement
+        authority from a concrete Attribute Value to the Attribute Definition: at decision time
+        the value_resolver compares the requested resource value segment against the entity
+        representation, avoiding pre-provisioning a value + subject mapping per discrete value.
+    policy.DynamicValueResolver:
+      type: object
+      properties:
+        subjectExternalSelectorValue:
+          type: string
+          title: subject_external_selector_value
+          description: |-
+            a selector for a field value on a flattened Entity Representation (such as from
+             idP/LDAP), e.g. ".patientAssignments[]"
+        comparison:
+          title: comparison
+          description: |-
+            how the requested resource value segment is compared against each value the selector
+             resolves from the entity representation
+          $ref: '#/components/schemas/policy.ConditionComparisonOperatorEnum'
+        caseInsensitive:
+          title: case_insensitive
+          description: |-
+            when set true, comparison is case-insensitive; unset is treated as case-sensitive. Modeled as
+             BoolValue so an explicit false is distinguishable from unset, leaving room to change the default.
+          $ref: '#/components/schemas/google.protobuf.BoolValue'
+      title: DynamicValueResolver
+      required:
+        - subjectExternalSelectorValue
+        - comparison
+      additionalProperties: false
+      description: |-
+        Dynamic Value Resolver: the dynamic half of a DynamicValueMapping. It resolves a selector
+        against the entity representation, then tests whether any resolved entity value matches the
+        requested resource value segment under comparison. The match is inherently existential over
+        the resolved entity values, so no quantifier is carried here.
     policy.KasKey:
       type: object
       properties:
diff --git a/docs/openapi/policy/obligations/obligations.openapi.yaml b/docs/openapi/policy/obligations/obligations.openapi.yaml
index 562045f797..01fcb57b6a 100644
--- a/docs/openapi/policy/obligations/obligations.openapi.yaml
+++ b/docs/openapi/policy/obligations/obligations.openapi.yaml
@@ -572,6 +572,28 @@ components:
         - CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED
         - CONDITION_BOOLEAN_TYPE_ENUM_AND
         - CONDITION_BOOLEAN_TYPE_ENUM_OR
+    policy.ConditionComparisonOperatorEnum:
+      type: string
+      title: ConditionComparisonOperatorEnum
+      enum:
+        - CONDITION_COMPARISON_OPERATOR_ENUM_UNSPECIFIED
+        - CONDITION_COMPARISON_OPERATOR_ENUM_EQUALS
+        - CONDITION_COMPARISON_OPERATOR_ENUM_CONTAINS
+        - CONDITION_COMPARISON_OPERATOR_ENUM_STARTS_WITH
+        - CONDITION_COMPARISON_OPERATOR_ENUM_ENDS_WITH
+      description: |-
+        How a selector result is compared against a comparison value. Replaces the all-in-one
+         SubjectMappingOperatorEnum by separating the comparison from the quantifier (see
+         ConditionQuantifierEnum) and case sensitivity.
+    policy.ConditionQuantifierEnum:
+      type: string
+      title: ConditionQuantifierEnum
+      enum:
+        - CONDITION_QUANTIFIER_ENUM_UNSPECIFIED
+        - CONDITION_QUANTIFIER_ENUM_ANY
+        - CONDITION_QUANTIFIER_ENUM_ALL
+        - CONDITION_QUANTIFIER_ENUM_NONE
+      description: How matches are aggregated across the comparison set (subject_external_values).
     policy.KasPublicKeyAlgEnum:
       type: string
       title: KasPublicKeyAlgEnum
@@ -923,7 +945,10 @@ components:
              from idP/LDAP)
         operator:
           title: operator
-          description: the evaluation operator of relation
+          description: |-
+            Deprecated: use comparison + quantifier (+ case_insensitive) instead. Normalized to the
+             decomposed fields in the service layer for backward compatibility.
+          deprecated: true
           $ref: '#/components/schemas/policy.SubjectMappingOperatorEnum'
         subjectExternalValues:
           type: array
@@ -936,10 +961,23 @@ components:
             list of comparison values for the result of applying the
              subject_external_selector_value on a flattened Entity Representation
              (Subject), evaluated by the operator
+        comparison:
+          title: comparison
+          description: how each selector result is compared to subject_external_values entries
+          $ref: '#/components/schemas/policy.ConditionComparisonOperatorEnum'
+        quantifier:
+          title: quantifier
+          description: how matches are aggregated across subject_external_values
+          $ref: '#/components/schemas/policy.ConditionQuantifierEnum'
+        caseInsensitive:
+          title: case_insensitive
+          description: |-
+            when set true, comparison is case-insensitive; unset is treated as case-sensitive. Modeled as
+             BoolValue so an explicit false is distinguishable from unset, leaving room to change the default.
+          $ref: '#/components/schemas/google.protobuf.BoolValue'
       title: Condition
       required:
         - subjectExternalSelectorValue
-        - operator
       additionalProperties: false
       description: |-
         *
diff --git a/docs/openapi/policy/registeredresources/registered_resources.openapi.yaml b/docs/openapi/policy/registeredresources/registered_resources.openapi.yaml
index ca41d4841e..cf6f526825 100644
--- a/docs/openapi/policy/registeredresources/registered_resources.openapi.yaml
+++ b/docs/openapi/policy/registeredresources/registered_resources.openapi.yaml
@@ -432,6 +432,28 @@ components:
         - CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED
         - CONDITION_BOOLEAN_TYPE_ENUM_AND
         - CONDITION_BOOLEAN_TYPE_ENUM_OR
+    policy.ConditionComparisonOperatorEnum:
+      type: string
+      title: ConditionComparisonOperatorEnum
+      enum:
+        - CONDITION_COMPARISON_OPERATOR_ENUM_UNSPECIFIED
+        - CONDITION_COMPARISON_OPERATOR_ENUM_EQUALS
+        - CONDITION_COMPARISON_OPERATOR_ENUM_CONTAINS
+        - CONDITION_COMPARISON_OPERATOR_ENUM_STARTS_WITH
+        - CONDITION_COMPARISON_OPERATOR_ENUM_ENDS_WITH
+      description: |-
+        How a selector result is compared against a comparison value. Replaces the all-in-one
+         SubjectMappingOperatorEnum by separating the comparison from the quantifier (see
+         ConditionQuantifierEnum) and case sensitivity.
+    policy.ConditionQuantifierEnum:
+      type: string
+      title: ConditionQuantifierEnum
+      enum:
+        - CONDITION_QUANTIFIER_ENUM_UNSPECIFIED
+        - CONDITION_QUANTIFIER_ENUM_ANY
+        - CONDITION_QUANTIFIER_ENUM_ALL
+        - CONDITION_QUANTIFIER_ENUM_NONE
+      description: How matches are aggregated across the comparison set (subject_external_values).
     policy.KasPublicKeyAlgEnum:
       type: string
       title: KasPublicKeyAlgEnum
@@ -748,7 +770,10 @@ components:
              from idP/LDAP)
         operator:
           title: operator
-          description: the evaluation operator of relation
+          description: |-
+            Deprecated: use comparison + quantifier (+ case_insensitive) instead. Normalized to the
+             decomposed fields in the service layer for backward compatibility.
+          deprecated: true
           $ref: '#/components/schemas/policy.SubjectMappingOperatorEnum'
         subjectExternalValues:
           type: array
@@ -761,10 +786,23 @@ components:
             list of comparison values for the result of applying the
              subject_external_selector_value on a flattened Entity Representation
              (Subject), evaluated by the operator
+        comparison:
+          title: comparison
+          description: how each selector result is compared to subject_external_values entries
+          $ref: '#/components/schemas/policy.ConditionComparisonOperatorEnum'
+        quantifier:
+          title: quantifier
+          description: how matches are aggregated across subject_external_values
+          $ref: '#/components/schemas/policy.ConditionQuantifierEnum'
+        caseInsensitive:
+          title: case_insensitive
+          description: |-
+            when set true, comparison is case-insensitive; unset is treated as case-sensitive. Modeled as
+             BoolValue so an explicit false is distinguishable from unset, leaving room to change the default.
+          $ref: '#/components/schemas/google.protobuf.BoolValue'
       title: Condition
       required:
         - subjectExternalSelectorValue
-        - operator
       additionalProperties: false
       description: |-
         *
diff --git a/docs/openapi/policy/resourcemapping/resource_mapping.openapi.yaml b/docs/openapi/policy/resourcemapping/resource_mapping.openapi.yaml
index a11306bc24..c17e546137 100644
--- a/docs/openapi/policy/resourcemapping/resource_mapping.openapi.yaml
+++ b/docs/openapi/policy/resourcemapping/resource_mapping.openapi.yaml
@@ -432,6 +432,28 @@ components:
         - CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED
         - CONDITION_BOOLEAN_TYPE_ENUM_AND
         - CONDITION_BOOLEAN_TYPE_ENUM_OR
+    policy.ConditionComparisonOperatorEnum:
+      type: string
+      title: ConditionComparisonOperatorEnum
+      enum:
+        - CONDITION_COMPARISON_OPERATOR_ENUM_UNSPECIFIED
+        - CONDITION_COMPARISON_OPERATOR_ENUM_EQUALS
+        - CONDITION_COMPARISON_OPERATOR_ENUM_CONTAINS
+        - CONDITION_COMPARISON_OPERATOR_ENUM_STARTS_WITH
+        - CONDITION_COMPARISON_OPERATOR_ENUM_ENDS_WITH
+      description: |-
+        How a selector result is compared against a comparison value. Replaces the all-in-one
+         SubjectMappingOperatorEnum by separating the comparison from the quantifier (see
+         ConditionQuantifierEnum) and case sensitivity.
+    policy.ConditionQuantifierEnum:
+      type: string
+      title: ConditionQuantifierEnum
+      enum:
+        - CONDITION_QUANTIFIER_ENUM_UNSPECIFIED
+        - CONDITION_QUANTIFIER_ENUM_ANY
+        - CONDITION_QUANTIFIER_ENUM_ALL
+        - CONDITION_QUANTIFIER_ENUM_NONE
+      description: How matches are aggregated across the comparison set (subject_external_values).
     policy.KasPublicKeyAlgEnum:
       type: string
       title: KasPublicKeyAlgEnum
@@ -728,7 +750,10 @@ components:
              from idP/LDAP)
         operator:
           title: operator
-          description: the evaluation operator of relation
+          description: |-
+            Deprecated: use comparison + quantifier (+ case_insensitive) instead. Normalized to the
+             decomposed fields in the service layer for backward compatibility.
+          deprecated: true
           $ref: '#/components/schemas/policy.SubjectMappingOperatorEnum'
         subjectExternalValues:
           type: array
@@ -741,10 +766,23 @@ components:
             list of comparison values for the result of applying the
              subject_external_selector_value on a flattened Entity Representation
              (Subject), evaluated by the operator
+        comparison:
+          title: comparison
+          description: how each selector result is compared to subject_external_values entries
+          $ref: '#/components/schemas/policy.ConditionComparisonOperatorEnum'
+        quantifier:
+          title: quantifier
+          description: how matches are aggregated across subject_external_values
+          $ref: '#/components/schemas/policy.ConditionQuantifierEnum'
+        caseInsensitive:
+          title: case_insensitive
+          description: |-
+            when set true, comparison is case-insensitive; unset is treated as case-sensitive. Modeled as
+             BoolValue so an explicit false is distinguishable from unset, leaving room to change the default.
+          $ref: '#/components/schemas/google.protobuf.BoolValue'
       title: Condition
       required:
         - subjectExternalSelectorValue
-        - operator
       additionalProperties: false
       description: |-
         *
diff --git a/docs/openapi/policy/subjectmapping/subject_mapping.openapi.yaml b/docs/openapi/policy/subjectmapping/subject_mapping.openapi.yaml
index 4c78ec9f8d..1113568374 100644
--- a/docs/openapi/policy/subjectmapping/subject_mapping.openapi.yaml
+++ b/docs/openapi/policy/subjectmapping/subject_mapping.openapi.yaml
@@ -468,6 +468,28 @@ components:
         - CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED
         - CONDITION_BOOLEAN_TYPE_ENUM_AND
         - CONDITION_BOOLEAN_TYPE_ENUM_OR
+    policy.ConditionComparisonOperatorEnum:
+      type: string
+      title: ConditionComparisonOperatorEnum
+      enum:
+        - CONDITION_COMPARISON_OPERATOR_ENUM_UNSPECIFIED
+        - CONDITION_COMPARISON_OPERATOR_ENUM_EQUALS
+        - CONDITION_COMPARISON_OPERATOR_ENUM_CONTAINS
+        - CONDITION_COMPARISON_OPERATOR_ENUM_STARTS_WITH
+        - CONDITION_COMPARISON_OPERATOR_ENUM_ENDS_WITH
+      description: |-
+        How a selector result is compared against a comparison value. Replaces the all-in-one
+         SubjectMappingOperatorEnum by separating the comparison from the quantifier (see
+         ConditionQuantifierEnum) and case sensitivity.
+    policy.ConditionQuantifierEnum:
+      type: string
+      title: ConditionQuantifierEnum
+      enum:
+        - CONDITION_QUANTIFIER_ENUM_UNSPECIFIED
+        - CONDITION_QUANTIFIER_ENUM_ANY
+        - CONDITION_QUANTIFIER_ENUM_ALL
+        - CONDITION_QUANTIFIER_ENUM_NONE
+      description: How matches are aggregated across the comparison set (subject_external_values).
     policy.KasPublicKeyAlgEnum:
       type: string
       title: KasPublicKeyAlgEnum
@@ -790,7 +812,10 @@ components:
              from idP/LDAP)
         operator:
           title: operator
-          description: the evaluation operator of relation
+          description: |-
+            Deprecated: use comparison + quantifier (+ case_insensitive) instead. Normalized to the
+             decomposed fields in the service layer for backward compatibility.
+          deprecated: true
           $ref: '#/components/schemas/policy.SubjectMappingOperatorEnum'
         subjectExternalValues:
           type: array
@@ -803,10 +828,23 @@ components:
             list of comparison values for the result of applying the
              subject_external_selector_value on a flattened Entity Representation
              (Subject), evaluated by the operator
+        comparison:
+          title: comparison
+          description: how each selector result is compared to subject_external_values entries
+          $ref: '#/components/schemas/policy.ConditionComparisonOperatorEnum'
+        quantifier:
+          title: quantifier
+          description: how matches are aggregated across subject_external_values
+          $ref: '#/components/schemas/policy.ConditionQuantifierEnum'
+        caseInsensitive:
+          title: case_insensitive
+          description: |-
+            when set true, comparison is case-insensitive; unset is treated as case-sensitive. Modeled as
+             BoolValue so an explicit false is distinguishable from unset, leaving room to change the default.
+          $ref: '#/components/schemas/google.protobuf.BoolValue'
       title: Condition
       required:
         - subjectExternalSelectorValue
-        - operator
       additionalProperties: false
       description: |-
         *
diff --git a/docs/openapi/policy/unsafe/unsafe.openapi.yaml b/docs/openapi/policy/unsafe/unsafe.openapi.yaml
index 09ebdf2e85..eff9dbd4d7 100644
--- a/docs/openapi/policy/unsafe/unsafe.openapi.yaml
+++ b/docs/openapi/policy/unsafe/unsafe.openapi.yaml
@@ -406,6 +406,28 @@ components:
         - CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED
         - CONDITION_BOOLEAN_TYPE_ENUM_AND
         - CONDITION_BOOLEAN_TYPE_ENUM_OR
+    policy.ConditionComparisonOperatorEnum:
+      type: string
+      title: ConditionComparisonOperatorEnum
+      enum:
+        - CONDITION_COMPARISON_OPERATOR_ENUM_UNSPECIFIED
+        - CONDITION_COMPARISON_OPERATOR_ENUM_EQUALS
+        - CONDITION_COMPARISON_OPERATOR_ENUM_CONTAINS
+        - CONDITION_COMPARISON_OPERATOR_ENUM_STARTS_WITH
+        - CONDITION_COMPARISON_OPERATOR_ENUM_ENDS_WITH
+      description: |-
+        How a selector result is compared against a comparison value. Replaces the all-in-one
+         SubjectMappingOperatorEnum by separating the comparison from the quantifier (see
+         ConditionQuantifierEnum) and case sensitivity.
+    policy.ConditionQuantifierEnum:
+      type: string
+      title: ConditionQuantifierEnum
+      enum:
+        - CONDITION_QUANTIFIER_ENUM_UNSPECIFIED
+        - CONDITION_QUANTIFIER_ENUM_ANY
+        - CONDITION_QUANTIFIER_ENUM_ALL
+        - CONDITION_QUANTIFIER_ENUM_NONE
+      description: How matches are aggregated across the comparison set (subject_external_values).
     policy.KasPublicKeyAlgEnum:
       type: string
       title: KasPublicKeyAlgEnum
@@ -742,7 +764,10 @@ components:
              from idP/LDAP)
         operator:
           title: operator
-          description: the evaluation operator of relation
+          description: |-
+            Deprecated: use comparison + quantifier (+ case_insensitive) instead. Normalized to the
+             decomposed fields in the service layer for backward compatibility.
+          deprecated: true
           $ref: '#/components/schemas/policy.SubjectMappingOperatorEnum'
         subjectExternalValues:
           type: array
@@ -755,10 +780,23 @@ components:
             list of comparison values for the result of applying the
              subject_external_selector_value on a flattened Entity Representation
              (Subject), evaluated by the operator
+        comparison:
+          title: comparison
+          description: how each selector result is compared to subject_external_values entries
+          $ref: '#/components/schemas/policy.ConditionComparisonOperatorEnum'
+        quantifier:
+          title: quantifier
+          description: how matches are aggregated across subject_external_values
+          $ref: '#/components/schemas/policy.ConditionQuantifierEnum'
+        caseInsensitive:
+          title: case_insensitive
+          description: |-
+            when set true, comparison is case-insensitive; unset is treated as case-sensitive. Modeled as
+             BoolValue so an explicit false is distinguishable from unset, leaving room to change the default.
+          $ref: '#/components/schemas/google.protobuf.BoolValue'
       title: Condition
       required:
         - subjectExternalSelectorValue
-        - operator
       additionalProperties: false
       description: |-
         *
diff --git a/protocol/go/internal/policy/enums.go b/protocol/go/internal/policy/enums.go
index 6ed689d857..3e236543a6 100644
--- a/protocol/go/internal/policy/enums.go
+++ b/protocol/go/internal/policy/enums.go
@@ -20,6 +20,30 @@ const (
 	OperatorInContains = policy.SubjectMappingOperatorEnum_SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS
 )
 
+// Shorthand constants for ConditionComparisonOperatorEnum.
+//
+// Example:
+//
+//	condition := &policy.Condition{
+//	    SubjectExternalSelectorValue: ".email",
+//	    Comparison:                   policy.ComparisonEndsWith,
+//	    Quantifier:                   policy.QuantifierAny,
+//	    SubjectExternalValues:        []string{"@example.com"},
+//	}
+const (
+	ComparisonEquals     = policy.ConditionComparisonOperatorEnum_CONDITION_COMPARISON_OPERATOR_ENUM_EQUALS
+	ComparisonContains   = policy.ConditionComparisonOperatorEnum_CONDITION_COMPARISON_OPERATOR_ENUM_CONTAINS
+	ComparisonStartsWith = policy.ConditionComparisonOperatorEnum_CONDITION_COMPARISON_OPERATOR_ENUM_STARTS_WITH
+	ComparisonEndsWith   = policy.ConditionComparisonOperatorEnum_CONDITION_COMPARISON_OPERATOR_ENUM_ENDS_WITH
+)
+
+// Shorthand constants for ConditionQuantifierEnum.
+const (
+	QuantifierAny  = policy.ConditionQuantifierEnum_CONDITION_QUANTIFIER_ENUM_ANY
+	QuantifierAll  = policy.ConditionQuantifierEnum_CONDITION_QUANTIFIER_ENUM_ALL
+	QuantifierNone = policy.ConditionQuantifierEnum_CONDITION_QUANTIFIER_ENUM_NONE
+)
+
 // Shorthand constants for ConditionBooleanTypeEnum.
 //
 // Example:
diff --git a/protocol/go/internal/policy/enums_test.go b/protocol/go/internal/policy/enums_test.go
index 8fa7e37bd3..73334c1ee6 100644
--- a/protocol/go/internal/policy/enums_test.go
+++ b/protocol/go/internal/policy/enums_test.go
@@ -19,6 +19,33 @@ func TestOperatorConstants(t *testing.T) {
 	}
 }
 
+func TestComparisonConstants(t *testing.T) {
+	if ComparisonEquals != policyproto.ConditionComparisonOperatorEnum_CONDITION_COMPARISON_OPERATOR_ENUM_EQUALS {
+		t.Errorf("ComparisonEquals = %d, want %d", ComparisonEquals, policyproto.ConditionComparisonOperatorEnum_CONDITION_COMPARISON_OPERATOR_ENUM_EQUALS)
+	}
+	if ComparisonContains != policyproto.ConditionComparisonOperatorEnum_CONDITION_COMPARISON_OPERATOR_ENUM_CONTAINS {
+		t.Errorf("ComparisonContains = %d, want %d", ComparisonContains, policyproto.ConditionComparisonOperatorEnum_CONDITION_COMPARISON_OPERATOR_ENUM_CONTAINS)
+	}
+	if ComparisonStartsWith != policyproto.ConditionComparisonOperatorEnum_CONDITION_COMPARISON_OPERATOR_ENUM_STARTS_WITH {
+		t.Errorf("ComparisonStartsWith = %d, want %d", ComparisonStartsWith, policyproto.ConditionComparisonOperatorEnum_CONDITION_COMPARISON_OPERATOR_ENUM_STARTS_WITH)
+	}
+	if ComparisonEndsWith != policyproto.ConditionComparisonOperatorEnum_CONDITION_COMPARISON_OPERATOR_ENUM_ENDS_WITH {
+		t.Errorf("ComparisonEndsWith = %d, want %d", ComparisonEndsWith, policyproto.ConditionComparisonOperatorEnum_CONDITION_COMPARISON_OPERATOR_ENUM_ENDS_WITH)
+	}
+}
+
+func TestQuantifierConstants(t *testing.T) {
+	if QuantifierAny != policyproto.ConditionQuantifierEnum_CONDITION_QUANTIFIER_ENUM_ANY {
+		t.Errorf("QuantifierAny = %d, want %d", QuantifierAny, policyproto.ConditionQuantifierEnum_CONDITION_QUANTIFIER_ENUM_ANY)
+	}
+	if QuantifierAll != policyproto.ConditionQuantifierEnum_CONDITION_QUANTIFIER_ENUM_ALL {
+		t.Errorf("QuantifierAll = %d, want %d", QuantifierAll, policyproto.ConditionQuantifierEnum_CONDITION_QUANTIFIER_ENUM_ALL)
+	}
+	if QuantifierNone != policyproto.ConditionQuantifierEnum_CONDITION_QUANTIFIER_ENUM_NONE {
+		t.Errorf("QuantifierNone = %d, want %d", QuantifierNone, policyproto.ConditionQuantifierEnum_CONDITION_QUANTIFIER_ENUM_NONE)
+	}
+}
+
 func TestBooleanConstants(t *testing.T) {
 	if BooleanAnd != policyproto.ConditionBooleanTypeEnum_CONDITION_BOOLEAN_TYPE_ENUM_AND {
 		t.Errorf("BooleanAnd = %d, want %d", BooleanAnd, policyproto.ConditionBooleanTypeEnum_CONDITION_BOOLEAN_TYPE_ENUM_AND)
diff --git a/protocol/go/policy/dynamicvaluemapping/dynamic_value_mapping.pb.go b/protocol/go/policy/dynamicvaluemapping/dynamic_value_mapping.pb.go
new file mode 100644
index 0000000000..054858e1c2
--- /dev/null
+++ b/protocol/go/policy/dynamicvaluemapping/dynamic_value_mapping.pb.go
@@ -0,0 +1,1294 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.33.0
+// 	protoc        (unknown)
+// source: policy/dynamicvaluemapping/dynamic_value_mapping.proto
+
+package dynamicvaluemapping
+
+import (
+	_ "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate"
+	common "github.com/opentdf/platform/protocol/go/common"
+	policy "github.com/opentdf/platform/protocol/go/policy"
+	subjectmapping "github.com/opentdf/platform/protocol/go/policy/subjectmapping"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type SortDynamicValueMappingsType int32
+
+const (
+	SortDynamicValueMappingsType_SORT_DYNAMIC_VALUE_MAPPINGS_TYPE_UNSPECIFIED SortDynamicValueMappingsType = 0
+	SortDynamicValueMappingsType_SORT_DYNAMIC_VALUE_MAPPINGS_TYPE_CREATED_AT  SortDynamicValueMappingsType = 1
+	SortDynamicValueMappingsType_SORT_DYNAMIC_VALUE_MAPPINGS_TYPE_UPDATED_AT  SortDynamicValueMappingsType = 2
+)
+
+// Enum value maps for SortDynamicValueMappingsType.
+var (
+	SortDynamicValueMappingsType_name = map[int32]string{
+		0: "SORT_DYNAMIC_VALUE_MAPPINGS_TYPE_UNSPECIFIED",
+		1: "SORT_DYNAMIC_VALUE_MAPPINGS_TYPE_CREATED_AT",
+		2: "SORT_DYNAMIC_VALUE_MAPPINGS_TYPE_UPDATED_AT",
+	}
+	SortDynamicValueMappingsType_value = map[string]int32{
+		"SORT_DYNAMIC_VALUE_MAPPINGS_TYPE_UNSPECIFIED": 0,
+		"SORT_DYNAMIC_VALUE_MAPPINGS_TYPE_CREATED_AT":  1,
+		"SORT_DYNAMIC_VALUE_MAPPINGS_TYPE_UPDATED_AT":  2,
+	}
+)
+
+func (x SortDynamicValueMappingsType) Enum() *SortDynamicValueMappingsType {
+	p := new(SortDynamicValueMappingsType)
+	*p = x
+	return p
+}
+
+func (x SortDynamicValueMappingsType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (SortDynamicValueMappingsType) Descriptor() protoreflect.EnumDescriptor {
+	return file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_enumTypes[0].Descriptor()
+}
+
+func (SortDynamicValueMappingsType) Type() protoreflect.EnumType {
+	return &file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_enumTypes[0]
+}
+
+func (x SortDynamicValueMappingsType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use SortDynamicValueMappingsType.Descriptor instead.
+func (SortDynamicValueMappingsType) EnumDescriptor() ([]byte, []int) {
+	return file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_rawDescGZIP(), []int{0}
+}
+
+type GetDynamicValueMappingRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Required
+	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+}
+
+func (x *GetDynamicValueMappingRequest) Reset() {
+	*x = GetDynamicValueMappingRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetDynamicValueMappingRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetDynamicValueMappingRequest) ProtoMessage() {}
+
+func (x *GetDynamicValueMappingRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetDynamicValueMappingRequest.ProtoReflect.Descriptor instead.
+func (*GetDynamicValueMappingRequest) Descriptor() ([]byte, []int) {
+	return file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *GetDynamicValueMappingRequest) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+type GetDynamicValueMappingResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	DynamicValueMapping *policy.DynamicValueMapping `protobuf:"bytes,1,opt,name=dynamic_value_mapping,json=dynamicValueMapping,proto3" json:"dynamic_value_mapping,omitempty"`
+}
+
+func (x *GetDynamicValueMappingResponse) Reset() {
+	*x = GetDynamicValueMappingResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetDynamicValueMappingResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetDynamicValueMappingResponse) ProtoMessage() {}
+
+func (x *GetDynamicValueMappingResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetDynamicValueMappingResponse.ProtoReflect.Descriptor instead.
+func (*GetDynamicValueMappingResponse) Descriptor() ([]byte, []int) {
+	return file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *GetDynamicValueMappingResponse) GetDynamicValueMapping() *policy.DynamicValueMapping {
+	if x != nil {
+		return x.DynamicValueMapping
+	}
+	return nil
+}
+
+type DynamicValueMappingsSort struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Field     SortDynamicValueMappingsType `protobuf:"varint,1,opt,name=field,proto3,enum=policy.dynamicvaluemapping.SortDynamicValueMappingsType" json:"field,omitempty"`
+	Direction policy.SortDirection         `protobuf:"varint,2,opt,name=direction,proto3,enum=policy.SortDirection" json:"direction,omitempty"`
+}
+
+func (x *DynamicValueMappingsSort) Reset() {
+	*x = DynamicValueMappingsSort{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DynamicValueMappingsSort) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DynamicValueMappingsSort) ProtoMessage() {}
+
+func (x *DynamicValueMappingsSort) ProtoReflect() protoreflect.Message {
+	mi := &file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DynamicValueMappingsSort.ProtoReflect.Descriptor instead.
+func (*DynamicValueMappingsSort) Descriptor() ([]byte, []int) {
+	return file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *DynamicValueMappingsSort) GetField() SortDynamicValueMappingsType {
+	if x != nil {
+		return x.Field
+	}
+	return SortDynamicValueMappingsType_SORT_DYNAMIC_VALUE_MAPPINGS_TYPE_UNSPECIFIED
+}
+
+func (x *DynamicValueMappingsSort) GetDirection() policy.SortDirection {
+	if x != nil {
+		return x.Direction
+	}
+	return policy.SortDirection(0)
+}
+
+type ListDynamicValueMappingsRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	NamespaceId  string `protobuf:"bytes,1,opt,name=namespace_id,json=namespaceId,proto3" json:"namespace_id,omitempty"`
+	NamespaceFqn string `protobuf:"bytes,2,opt,name=namespace_fqn,json=namespaceFqn,proto3" json:"namespace_fqn,omitempty"`
+	// Optional: Attribute Definition ID to filter by
+	AttributeDefinitionId string `protobuf:"bytes,3,opt,name=attribute_definition_id,json=attributeDefinitionId,proto3" json:"attribute_definition_id,omitempty"`
+	// Optional
+	Pagination *policy.PageRequest `protobuf:"bytes,10,opt,name=pagination,proto3" json:"pagination,omitempty"`
+	// Optional - CONSTRAINT: max 1 item
+	Sort []*DynamicValueMappingsSort `protobuf:"bytes,11,rep,name=sort,proto3" json:"sort,omitempty"`
+}
+
+func (x *ListDynamicValueMappingsRequest) Reset() {
+	*x = ListDynamicValueMappingsRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListDynamicValueMappingsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListDynamicValueMappingsRequest) ProtoMessage() {}
+
+func (x *ListDynamicValueMappingsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListDynamicValueMappingsRequest.ProtoReflect.Descriptor instead.
+func (*ListDynamicValueMappingsRequest) Descriptor() ([]byte, []int) {
+	return file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *ListDynamicValueMappingsRequest) GetNamespaceId() string {
+	if x != nil {
+		return x.NamespaceId
+	}
+	return ""
+}
+
+func (x *ListDynamicValueMappingsRequest) GetNamespaceFqn() string {
+	if x != nil {
+		return x.NamespaceFqn
+	}
+	return ""
+}
+
+func (x *ListDynamicValueMappingsRequest) GetAttributeDefinitionId() string {
+	if x != nil {
+		return x.AttributeDefinitionId
+	}
+	return ""
+}
+
+func (x *ListDynamicValueMappingsRequest) GetPagination() *policy.PageRequest {
+	if x != nil {
+		return x.Pagination
+	}
+	return nil
+}
+
+func (x *ListDynamicValueMappingsRequest) GetSort() []*DynamicValueMappingsSort {
+	if x != nil {
+		return x.Sort
+	}
+	return nil
+}
+
+type ListDynamicValueMappingsResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	DynamicValueMappings []*policy.DynamicValueMapping `protobuf:"bytes,1,rep,name=dynamic_value_mappings,json=dynamicValueMappings,proto3" json:"dynamic_value_mappings,omitempty"`
+	Pagination           *policy.PageResponse          `protobuf:"bytes,10,opt,name=pagination,proto3" json:"pagination,omitempty"`
+}
+
+func (x *ListDynamicValueMappingsResponse) Reset() {
+	*x = ListDynamicValueMappingsResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListDynamicValueMappingsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListDynamicValueMappingsResponse) ProtoMessage() {}
+
+func (x *ListDynamicValueMappingsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListDynamicValueMappingsResponse.ProtoReflect.Descriptor instead.
+func (*ListDynamicValueMappingsResponse) Descriptor() ([]byte, []int) {
+	return file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *ListDynamicValueMappingsResponse) GetDynamicValueMappings() []*policy.DynamicValueMapping {
+	if x != nil {
+		return x.DynamicValueMappings
+	}
+	return nil
+}
+
+func (x *ListDynamicValueMappingsResponse) GetPagination() *policy.PageResponse {
+	if x != nil {
+		return x.Pagination
+	}
+	return nil
+}
+
+type CreateDynamicValueMappingRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	AttributeDefinitionId  string `protobuf:"bytes,1,opt,name=attribute_definition_id,json=attributeDefinitionId,proto3" json:"attribute_definition_id,omitempty"`
+	AttributeDefinitionFqn string `protobuf:"bytes,2,opt,name=attribute_definition_fqn,json=attributeDefinitionFqn,proto3" json:"attribute_definition_fqn,omitempty"`
+	// Required: the dynamic resolver comparing entity selector result to the resource value segment
+	ValueResolver *policy.DynamicValueResolver `protobuf:"bytes,3,opt,name=value_resolver,json=valueResolver,proto3" json:"value_resolver,omitempty"`
+	// Required: actions permitted on a matched value
+	Actions []*policy.Action `protobuf:"bytes,4,rep,name=actions,proto3" json:"actions,omitempty"`
+	// Optional static pre-gate. Reuse an existing SubjectConditionSet (prioritized) ...
+	ExistingSubjectConditionSetId string `protobuf:"bytes,5,opt,name=existing_subject_condition_set_id,json=existingSubjectConditionSetId,proto3" json:"existing_subject_condition_set_id,omitempty"`
+	// ... or create a new one (ignored if existing_subject_condition_set_id is provided)
+	NewSubjectConditionSet *subjectmapping.SubjectConditionSetCreate `protobuf:"bytes,6,opt,name=new_subject_condition_set,json=newSubjectConditionSet,proto3" json:"new_subject_condition_set,omitempty"`
+	// Optional: namespace ID or FQN for the mapping
+	NamespaceId  string `protobuf:"bytes,7,opt,name=namespace_id,json=namespaceId,proto3" json:"namespace_id,omitempty"`
+	NamespaceFqn string `protobuf:"bytes,8,opt,name=namespace_fqn,json=namespaceFqn,proto3" json:"namespace_fqn,omitempty"`
+	// Optional
+	Metadata *common.MetadataMutable `protobuf:"bytes,100,opt,name=metadata,proto3" json:"metadata,omitempty"`
+}
+
+func (x *CreateDynamicValueMappingRequest) Reset() {
+	*x = CreateDynamicValueMappingRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CreateDynamicValueMappingRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateDynamicValueMappingRequest) ProtoMessage() {}
+
+func (x *CreateDynamicValueMappingRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateDynamicValueMappingRequest.ProtoReflect.Descriptor instead.
+func (*CreateDynamicValueMappingRequest) Descriptor() ([]byte, []int) {
+	return file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *CreateDynamicValueMappingRequest) GetAttributeDefinitionId() string {
+	if x != nil {
+		return x.AttributeDefinitionId
+	}
+	return ""
+}
+
+func (x *CreateDynamicValueMappingRequest) GetAttributeDefinitionFqn() string {
+	if x != nil {
+		return x.AttributeDefinitionFqn
+	}
+	return ""
+}
+
+func (x *CreateDynamicValueMappingRequest) GetValueResolver() *policy.DynamicValueResolver {
+	if x != nil {
+		return x.ValueResolver
+	}
+	return nil
+}
+
+func (x *CreateDynamicValueMappingRequest) GetActions() []*policy.Action {
+	if x != nil {
+		return x.Actions
+	}
+	return nil
+}
+
+func (x *CreateDynamicValueMappingRequest) GetExistingSubjectConditionSetId() string {
+	if x != nil {
+		return x.ExistingSubjectConditionSetId
+	}
+	return ""
+}
+
+func (x *CreateDynamicValueMappingRequest) GetNewSubjectConditionSet() *subjectmapping.SubjectConditionSetCreate {
+	if x != nil {
+		return x.NewSubjectConditionSet
+	}
+	return nil
+}
+
+func (x *CreateDynamicValueMappingRequest) GetNamespaceId() string {
+	if x != nil {
+		return x.NamespaceId
+	}
+	return ""
+}
+
+func (x *CreateDynamicValueMappingRequest) GetNamespaceFqn() string {
+	if x != nil {
+		return x.NamespaceFqn
+	}
+	return ""
+}
+
+func (x *CreateDynamicValueMappingRequest) GetMetadata() *common.MetadataMutable {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+type CreateDynamicValueMappingResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	DynamicValueMapping *policy.DynamicValueMapping `protobuf:"bytes,1,opt,name=dynamic_value_mapping,json=dynamicValueMapping,proto3" json:"dynamic_value_mapping,omitempty"`
+}
+
+func (x *CreateDynamicValueMappingResponse) Reset() {
+	*x = CreateDynamicValueMappingResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CreateDynamicValueMappingResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateDynamicValueMappingResponse) ProtoMessage() {}
+
+func (x *CreateDynamicValueMappingResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateDynamicValueMappingResponse.ProtoReflect.Descriptor instead.
+func (*CreateDynamicValueMappingResponse) Descriptor() ([]byte, []int) {
+	return file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *CreateDynamicValueMappingResponse) GetDynamicValueMapping() *policy.DynamicValueMapping {
+	if x != nil {
+		return x.DynamicValueMapping
+	}
+	return nil
+}
+
+type UpdateDynamicValueMappingRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Required
+	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	// Optional: replace the dynamic resolver
+	ValueResolver *policy.DynamicValueResolver `protobuf:"bytes,2,opt,name=value_resolver,json=valueResolver,proto3" json:"value_resolver,omitempty"`
+	// Optional: replace the static pre-gate SubjectConditionSet by id
+	SubjectConditionSetId string `protobuf:"bytes,3,opt,name=subject_condition_set_id,json=subjectConditionSetId,proto3" json:"subject_condition_set_id,omitempty"`
+	// Optional: replace the entire list of actions
+	Actions []*policy.Action `protobuf:"bytes,4,rep,name=actions,proto3" json:"actions,omitempty"`
+	// Common metadata
+	Metadata               *common.MetadataMutable   `protobuf:"bytes,100,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	MetadataUpdateBehavior common.MetadataUpdateEnum `protobuf:"varint,101,opt,name=metadata_update_behavior,json=metadataUpdateBehavior,proto3,enum=common.MetadataUpdateEnum" json:"metadata_update_behavior,omitempty"`
+}
+
+func (x *UpdateDynamicValueMappingRequest) Reset() {
+	*x = UpdateDynamicValueMappingRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UpdateDynamicValueMappingRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateDynamicValueMappingRequest) ProtoMessage() {}
+
+func (x *UpdateDynamicValueMappingRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateDynamicValueMappingRequest.ProtoReflect.Descriptor instead.
+func (*UpdateDynamicValueMappingRequest) Descriptor() ([]byte, []int) {
+	return file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *UpdateDynamicValueMappingRequest) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *UpdateDynamicValueMappingRequest) GetValueResolver() *policy.DynamicValueResolver {
+	if x != nil {
+		return x.ValueResolver
+	}
+	return nil
+}
+
+func (x *UpdateDynamicValueMappingRequest) GetSubjectConditionSetId() string {
+	if x != nil {
+		return x.SubjectConditionSetId
+	}
+	return ""
+}
+
+func (x *UpdateDynamicValueMappingRequest) GetActions() []*policy.Action {
+	if x != nil {
+		return x.Actions
+	}
+	return nil
+}
+
+func (x *UpdateDynamicValueMappingRequest) GetMetadata() *common.MetadataMutable {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *UpdateDynamicValueMappingRequest) GetMetadataUpdateBehavior() common.MetadataUpdateEnum {
+	if x != nil {
+		return x.MetadataUpdateBehavior
+	}
+	return common.MetadataUpdateEnum(0)
+}
+
+type UpdateDynamicValueMappingResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	DynamicValueMapping *policy.DynamicValueMapping `protobuf:"bytes,1,opt,name=dynamic_value_mapping,json=dynamicValueMapping,proto3" json:"dynamic_value_mapping,omitempty"`
+}
+
+func (x *UpdateDynamicValueMappingResponse) Reset() {
+	*x = UpdateDynamicValueMappingResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[8]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UpdateDynamicValueMappingResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateDynamicValueMappingResponse) ProtoMessage() {}
+
+func (x *UpdateDynamicValueMappingResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[8]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateDynamicValueMappingResponse.ProtoReflect.Descriptor instead.
+func (*UpdateDynamicValueMappingResponse) Descriptor() ([]byte, []int) {
+	return file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *UpdateDynamicValueMappingResponse) GetDynamicValueMapping() *policy.DynamicValueMapping {
+	if x != nil {
+		return x.DynamicValueMapping
+	}
+	return nil
+}
+
+type DeleteDynamicValueMappingRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Required
+	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+}
+
+func (x *DeleteDynamicValueMappingRequest) Reset() {
+	*x = DeleteDynamicValueMappingRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DeleteDynamicValueMappingRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteDynamicValueMappingRequest) ProtoMessage() {}
+
+func (x *DeleteDynamicValueMappingRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteDynamicValueMappingRequest.ProtoReflect.Descriptor instead.
+func (*DeleteDynamicValueMappingRequest) Descriptor() ([]byte, []int) {
+	return file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *DeleteDynamicValueMappingRequest) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+type DeleteDynamicValueMappingResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Only ID of the deleted mapping provided
+	DynamicValueMapping *policy.DynamicValueMapping `protobuf:"bytes,1,opt,name=dynamic_value_mapping,json=dynamicValueMapping,proto3" json:"dynamic_value_mapping,omitempty"`
+}
+
+func (x *DeleteDynamicValueMappingResponse) Reset() {
+	*x = DeleteDynamicValueMappingResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[10]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DeleteDynamicValueMappingResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteDynamicValueMappingResponse) ProtoMessage() {}
+
+func (x *DeleteDynamicValueMappingResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[10]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteDynamicValueMappingResponse.ProtoReflect.Descriptor instead.
+func (*DeleteDynamicValueMappingResponse) Descriptor() ([]byte, []int) {
+	return file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *DeleteDynamicValueMappingResponse) GetDynamicValueMapping() *policy.DynamicValueMapping {
+	if x != nil {
+		return x.DynamicValueMapping
+	}
+	return nil
+}
+
+var File_policy_dynamicvaluemapping_dynamic_value_mapping_proto protoreflect.FileDescriptor
+
+var file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_rawDesc = []byte{
+	0x0a, 0x36, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x64, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x2f, 0x64, 0x79, 0x6e,
+	0x61, 0x6d, 0x69, 0x63, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x5f, 0x6d, 0x61, 0x70, 0x70, 0x69,
+	0x6e, 0x67, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x1a, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x2e, 0x64, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x6d, 0x61, 0x70,
+	0x70, 0x69, 0x6e, 0x67, 0x1a, 0x1b, 0x62, 0x75, 0x66, 0x2f, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61,
+	0x74, 0x65, 0x2f, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x1a, 0x13, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x14, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x6f,
+	0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x16, 0x70, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x2f, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x2b, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x73, 0x75, 0x62,
+	0x6a, 0x65, 0x63, 0x74, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x2f, 0x73, 0x75, 0x62, 0x6a,
+	0x65, 0x63, 0x74, 0x5f, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x22, 0x39, 0x0a, 0x1d, 0x47, 0x65, 0x74, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56,
+	0x61, 0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08,
+	0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x52, 0x02, 0x69, 0x64, 0x22, 0x71, 0x0a, 0x1e,
+	0x47, 0x65, 0x74, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4d,
+	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4f,
+	0x0a, 0x15, 0x64, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x5f,
+	0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e,
+	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61,
+	0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x13, 0x64, 0x79, 0x6e, 0x61,
+	0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x22,
+	0xb3, 0x01, 0x0a, 0x18, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65,
+	0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x53, 0x6f, 0x72, 0x74, 0x12, 0x58, 0x0a, 0x05,
+	0x66, 0x69, 0x65, 0x6c, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x38, 0x2e, 0x70, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x64, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x2e, 0x53, 0x6f, 0x72, 0x74, 0x44, 0x79, 0x6e,
+	0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67,
+	0x73, 0x54, 0x79, 0x70, 0x65, 0x42, 0x08, 0xba, 0x48, 0x05, 0x82, 0x01, 0x02, 0x10, 0x01, 0x52,
+	0x05, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x12, 0x3d, 0x0a, 0x09, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x15, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x2e, 0x53, 0x6f, 0x72, 0x74, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x42, 0x08, 0xba, 0x48, 0x05, 0x82, 0x01, 0x02, 0x10, 0x01, 0x52, 0x09, 0x64, 0x69, 0x72, 0x65,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x9d, 0x04, 0x0a, 0x1f, 0x4c, 0x69, 0x73, 0x74, 0x44, 0x79,
+	0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e,
+	0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2b, 0x0a, 0x0c, 0x6e, 0x61, 0x6d,
+	0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42,
+	0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x52, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x73,
+	0x70, 0x61, 0x63, 0x65, 0x49, 0x64, 0x12, 0x2f, 0x0a, 0x0d, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70,
+	0x61, 0x63, 0x65, 0x5f, 0x66, 0x71, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xba,
+	0x48, 0x07, 0x72, 0x05, 0x10, 0x01, 0x88, 0x01, 0x01, 0x52, 0x0c, 0x6e, 0x61, 0x6d, 0x65, 0x73,
+	0x70, 0x61, 0x63, 0x65, 0x46, 0x71, 0x6e, 0x12, 0xec, 0x01, 0x0a, 0x17, 0x61, 0x74, 0x74, 0x72,
+	0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x64, 0x65, 0x66, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x6f, 0x6e,
+	0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x42, 0xb3, 0x01, 0xba, 0x48, 0xaf, 0x01,
+	0xba, 0x01, 0xab, 0x01, 0x0a, 0x14, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x5f, 0x75,
+	0x75, 0x69, 0x64, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0x23, 0x4f, 0x70, 0x74, 0x69,
+	0x6f, 0x6e, 0x61, 0x6c, 0x20, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20,
+	0x62, 0x65, 0x20, 0x61, 0x20, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x20, 0x55, 0x55, 0x49, 0x44, 0x1a,
+	0x6e, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3d, 0x3d, 0x20, 0x30,
+	0x20, 0x7c, 0x7c, 0x20, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73,
+	0x28, 0x27, 0x5b, 0x30, 0x2d, 0x39, 0x61, 0x2d, 0x66, 0x41, 0x2d, 0x46, 0x5d, 0x7b, 0x38, 0x7d,
+	0x2d, 0x5b, 0x30, 0x2d, 0x39, 0x61, 0x2d, 0x66, 0x41, 0x2d, 0x46, 0x5d, 0x7b, 0x34, 0x7d, 0x2d,
+	0x5b, 0x30, 0x2d, 0x39, 0x61, 0x2d, 0x66, 0x41, 0x2d, 0x46, 0x5d, 0x7b, 0x34, 0x7d, 0x2d, 0x5b,
+	0x30, 0x2d, 0x39, 0x61, 0x2d, 0x66, 0x41, 0x2d, 0x46, 0x5d, 0x7b, 0x34, 0x7d, 0x2d, 0x5b, 0x30,
+	0x2d, 0x39, 0x61, 0x2d, 0x66, 0x41, 0x2d, 0x46, 0x5d, 0x7b, 0x31, 0x32, 0x7d, 0x27, 0x29, 0x52,
+	0x15, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x44, 0x65, 0x66, 0x69, 0x6e, 0x69,
+	0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x33, 0x0a, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x70, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x2e, 0x50, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x52,
+	0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x52, 0x0a, 0x04, 0x73,
+	0x6f, 0x72, 0x74, 0x18, 0x0b, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x34, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x2e, 0x64, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x6d,
+	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61,
+	0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x53, 0x6f, 0x72, 0x74, 0x42,
+	0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x10, 0x01, 0x52, 0x04, 0x73, 0x6f, 0x72, 0x74, 0x3a,
+	0x24, 0xba, 0x48, 0x21, 0x22, 0x1f, 0x0a, 0x0c, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63,
+	0x65, 0x5f, 0x69, 0x64, 0x0a, 0x0d, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f,
+	0x66, 0x71, 0x6e, 0x10, 0x00, 0x22, 0xab, 0x01, 0x0a, 0x20, 0x4c, 0x69, 0x73, 0x74, 0x44, 0x79,
+	0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e,
+	0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x51, 0x0a, 0x16, 0x64, 0x79,
+	0x6e, 0x61, 0x6d, 0x69, 0x63, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x5f, 0x6d, 0x61, 0x70, 0x70,
+	0x69, 0x6e, 0x67, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x70, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65,
+	0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x14, 0x64, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63,
+	0x56, 0x61, 0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x34, 0x0a,
+	0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x0a, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x14, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x61, 0x67, 0x65, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x52, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x22, 0x90, 0x08, 0x0a, 0x20, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x79,
+	0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e,
+	0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x40, 0x0a, 0x17, 0x61, 0x74, 0x74, 0x72,
+	0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x64, 0x65, 0x66, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x6f, 0x6e,
+	0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03,
+	0xb0, 0x01, 0x01, 0x52, 0x15, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x44, 0x65,
+	0x66, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x44, 0x0a, 0x18, 0x61, 0x74,
+	0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x64, 0x65, 0x66, 0x69, 0x6e, 0x69, 0x74, 0x69,
+	0x6f, 0x6e, 0x5f, 0x66, 0x71, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xba, 0x48,
+	0x07, 0x72, 0x05, 0x10, 0x01, 0x88, 0x01, 0x01, 0x52, 0x16, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62,
+	0x75, 0x74, 0x65, 0x44, 0x65, 0x66, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x71, 0x6e,
+	0x12, 0x4b, 0x0a, 0x0e, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x6c, 0x76,
+	0x65, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63,
+	0x79, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x65,
+	0x73, 0x6f, 0x6c, 0x76, 0x65, 0x72, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x0d,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x72, 0x12, 0xb8, 0x01,
+	0x0a, 0x07, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x42,
+	0x8d, 0x01, 0xba, 0x48, 0x89, 0x01, 0xba, 0x01, 0x80, 0x01, 0x0a, 0x1b, 0x61, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x6f, 0x72, 0x5f, 0x69, 0x64, 0x5f, 0x6e, 0x6f,
+	0x74, 0x5f, 0x65, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x2f, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20,
+	0x6e, 0x61, 0x6d, 0x65, 0x20, 0x6f, 0x72, 0x20, 0x49, 0x44, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20,
+	0x6e, 0x6f, 0x74, 0x20, 0x62, 0x65, 0x20, 0x65, 0x6d, 0x70, 0x74, 0x79, 0x20, 0x69, 0x66, 0x20,
+	0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x64, 0x1a, 0x30, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x61,
+	0x6c, 0x6c, 0x28, 0x69, 0x74, 0x65, 0x6d, 0x2c, 0x20, 0x69, 0x74, 0x65, 0x6d, 0x2e, 0x6e, 0x61,
+	0x6d, 0x65, 0x20, 0x21, 0x3d, 0x20, 0x27, 0x27, 0x20, 0x7c, 0x7c, 0x20, 0x69, 0x74, 0x65, 0x6d,
+	0x2e, 0x69, 0x64, 0x20, 0x21, 0x3d, 0x20, 0x27, 0x27, 0x29, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52,
+	0x07, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0xfe, 0x01, 0x0a, 0x21, 0x65, 0x78, 0x69,
+	0x73, 0x74, 0x69, 0x6e, 0x67, 0x5f, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x63, 0x6f,
+	0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x73, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x05,
+	0x20, 0x01, 0x28, 0x09, 0x42, 0xb3, 0x01, 0xba, 0x48, 0xaf, 0x01, 0xba, 0x01, 0xab, 0x01, 0x0a,
+	0x14, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x5f, 0x75, 0x75, 0x69, 0x64, 0x5f, 0x66,
+	0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0x23, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x20,
+	0x66, 0x69, 0x65, 0x6c, 0x64, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x61, 0x20,
+	0x76, 0x61, 0x6c, 0x69, 0x64, 0x20, 0x55, 0x55, 0x49, 0x44, 0x1a, 0x6e, 0x73, 0x69, 0x7a, 0x65,
+	0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3d, 0x3d, 0x20, 0x30, 0x20, 0x7c, 0x7c, 0x20, 0x74,
+	0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5b, 0x30, 0x2d,
+	0x39, 0x61, 0x2d, 0x66, 0x41, 0x2d, 0x46, 0x5d, 0x7b, 0x38, 0x7d, 0x2d, 0x5b, 0x30, 0x2d, 0x39,
+	0x61, 0x2d, 0x66, 0x41, 0x2d, 0x46, 0x5d, 0x7b, 0x34, 0x7d, 0x2d, 0x5b, 0x30, 0x2d, 0x39, 0x61,
+	0x2d, 0x66, 0x41, 0x2d, 0x46, 0x5d, 0x7b, 0x34, 0x7d, 0x2d, 0x5b, 0x30, 0x2d, 0x39, 0x61, 0x2d,
+	0x66, 0x41, 0x2d, 0x46, 0x5d, 0x7b, 0x34, 0x7d, 0x2d, 0x5b, 0x30, 0x2d, 0x39, 0x61, 0x2d, 0x66,
+	0x41, 0x2d, 0x46, 0x5d, 0x7b, 0x31, 0x32, 0x7d, 0x27, 0x29, 0x52, 0x1d, 0x65, 0x78, 0x69, 0x73,
+	0x74, 0x69, 0x6e, 0x67, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64, 0x69,
+	0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x74, 0x49, 0x64, 0x12, 0x6b, 0x0a, 0x19, 0x6e, 0x65, 0x77,
+	0x5f, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69,
+	0x6f, 0x6e, 0x5f, 0x73, 0x65, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x70,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x6d, 0x61, 0x70,
+	0x70, 0x69, 0x6e, 0x67, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64,
+	0x69, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x74, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x52, 0x16,
+	0x6e, 0x65, 0x77, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74,
+	0x69, 0x6f, 0x6e, 0x53, 0x65, 0x74, 0x12, 0x2b, 0x0a, 0x0c, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70,
+	0x61, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48,
+	0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x52, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63,
+	0x65, 0x49, 0x64, 0x12, 0x2f, 0x0a, 0x0d, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65,
+	0x5f, 0x66, 0x71, 0x6e, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xba, 0x48, 0x07, 0x72,
+	0x05, 0x10, 0x01, 0x88, 0x01, 0x01, 0x52, 0x0c, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63,
+	0x65, 0x46, 0x71, 0x6e, 0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e,
+	0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4d, 0x75, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x52,
+	0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x3a, 0x5b, 0xba, 0x48, 0x58, 0x22, 0x35,
+	0x0a, 0x17, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x64, 0x65, 0x66, 0x69,
+	0x6e, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x0a, 0x18, 0x61, 0x74, 0x74, 0x72, 0x69,
+	0x62, 0x75, 0x74, 0x65, 0x5f, 0x64, 0x65, 0x66, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x5f,
+	0x66, 0x71, 0x6e, 0x10, 0x01, 0x22, 0x1f, 0x0a, 0x0c, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61,
+	0x63, 0x65, 0x5f, 0x69, 0x64, 0x0a, 0x0d, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65,
+	0x5f, 0x66, 0x71, 0x6e, 0x10, 0x00, 0x22, 0x74, 0x0a, 0x21, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70, 0x70,
+	0x69, 0x6e, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4f, 0x0a, 0x15, 0x64,
+	0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x5f, 0x6d, 0x61, 0x70,
+	0x70, 0x69, 0x6e, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x70, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65,
+	0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x13, 0x64, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63,
+	0x56, 0x61, 0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x22, 0xc6, 0x05, 0x0a,
+	0x20, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61,
+	0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba,
+	0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x52, 0x02, 0x69, 0x64, 0x12, 0x43, 0x0a, 0x0e, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x72, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x44, 0x79, 0x6e,
+	0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65,
+	0x72, 0x52, 0x0d, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x72,
+	0x12, 0xed, 0x01, 0x0a, 0x18, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x63, 0x6f, 0x6e,
+	0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x73, 0x65, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x09, 0x42, 0xb3, 0x01, 0xba, 0x48, 0xaf, 0x01, 0xba, 0x01, 0xab, 0x01, 0x0a, 0x14,
+	0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x5f, 0x75, 0x75, 0x69, 0x64, 0x5f, 0x66, 0x6f,
+	0x72, 0x6d, 0x61, 0x74, 0x12, 0x23, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x20, 0x66,
+	0x69, 0x65, 0x6c, 0x64, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x61, 0x20, 0x76,
+	0x61, 0x6c, 0x69, 0x64, 0x20, 0x55, 0x55, 0x49, 0x44, 0x1a, 0x6e, 0x73, 0x69, 0x7a, 0x65, 0x28,
+	0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3d, 0x3d, 0x20, 0x30, 0x20, 0x7c, 0x7c, 0x20, 0x74, 0x68,
+	0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5b, 0x30, 0x2d, 0x39,
+	0x61, 0x2d, 0x66, 0x41, 0x2d, 0x46, 0x5d, 0x7b, 0x38, 0x7d, 0x2d, 0x5b, 0x30, 0x2d, 0x39, 0x61,
+	0x2d, 0x66, 0x41, 0x2d, 0x46, 0x5d, 0x7b, 0x34, 0x7d, 0x2d, 0x5b, 0x30, 0x2d, 0x39, 0x61, 0x2d,
+	0x66, 0x41, 0x2d, 0x46, 0x5d, 0x7b, 0x34, 0x7d, 0x2d, 0x5b, 0x30, 0x2d, 0x39, 0x61, 0x2d, 0x66,
+	0x41, 0x2d, 0x46, 0x5d, 0x7b, 0x34, 0x7d, 0x2d, 0x5b, 0x30, 0x2d, 0x39, 0x61, 0x2d, 0x66, 0x41,
+	0x2d, 0x46, 0x5d, 0x7b, 0x31, 0x32, 0x7d, 0x27, 0x29, 0x52, 0x15, 0x73, 0x75, 0x62, 0x6a, 0x65,
+	0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x74, 0x49, 0x64,
+	0x12, 0xc7, 0x01, 0x0a, 0x07, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x04, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x42, 0x9c, 0x01, 0xba, 0x48, 0x98, 0x01, 0xba, 0x01, 0x94, 0x01, 0x0a, 0x1b, 0x61,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x6f, 0x72, 0x5f, 0x69, 0x64,
+	0x5f, 0x6e, 0x6f, 0x74, 0x5f, 0x65, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x2f, 0x41, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x6f, 0x72, 0x20, 0x49, 0x44, 0x20, 0x6d, 0x75,
+	0x73, 0x74, 0x20, 0x6e, 0x6f, 0x74, 0x20, 0x62, 0x65, 0x20, 0x65, 0x6d, 0x70, 0x74, 0x79, 0x20,
+	0x69, 0x66, 0x20, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x64, 0x1a, 0x44, 0x74, 0x68, 0x69,
+	0x73, 0x2e, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x29, 0x20, 0x3d, 0x3d, 0x20, 0x30, 0x20, 0x7c, 0x7c,
+	0x20, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x61, 0x6c, 0x6c, 0x28, 0x69, 0x74, 0x65, 0x6d, 0x2c, 0x20,
+	0x69, 0x74, 0x65, 0x6d, 0x2e, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x21, 0x3d, 0x20, 0x27, 0x27, 0x20,
+	0x7c, 0x7c, 0x20, 0x69, 0x74, 0x65, 0x6d, 0x2e, 0x69, 0x64, 0x20, 0x21, 0x3d, 0x20, 0x27, 0x27,
+	0x29, 0x52, 0x07, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63,
+	0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4d, 0x75,
+	0x74, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12,
+	0x54, 0x0a, 0x18, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x75, 0x70, 0x64, 0x61,
+	0x74, 0x65, 0x5f, 0x62, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x18, 0x65, 0x20, 0x01, 0x28,
+	0x0e, 0x32, 0x1a, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x52, 0x16, 0x6d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x42, 0x65, 0x68,
+	0x61, 0x76, 0x69, 0x6f, 0x72, 0x22, 0x74, 0x0a, 0x21, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x44,
+	0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69,
+	0x6e, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4f, 0x0a, 0x15, 0x64, 0x79,
+	0x6e, 0x61, 0x6d, 0x69, 0x63, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x5f, 0x6d, 0x61, 0x70, 0x70,
+	0x69, 0x6e, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4d,
+	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x13, 0x64, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56,
+	0x61, 0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x22, 0x3c, 0x0a, 0x20, 0x44,
+	0x65, 0x6c, 0x65, 0x74, 0x65, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75,
+	0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x18, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05,
+	0x72, 0x03, 0xb0, 0x01, 0x01, 0x52, 0x02, 0x69, 0x64, 0x22, 0x74, 0x0a, 0x21, 0x44, 0x65, 0x6c,
+	0x65, 0x74, 0x65, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4d,
+	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4f,
+	0x0a, 0x15, 0x64, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x5f,
+	0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e,
+	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61,
+	0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x13, 0x64, 0x79, 0x6e, 0x61,
+	0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x2a,
+	0xb2, 0x01, 0x0a, 0x1c, 0x53, 0x6f, 0x72, 0x74, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56,
+	0x61, 0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x54, 0x79, 0x70, 0x65,
+	0x12, 0x30, 0x0a, 0x2c, 0x53, 0x4f, 0x52, 0x54, 0x5f, 0x44, 0x59, 0x4e, 0x41, 0x4d, 0x49, 0x43,
+	0x5f, 0x56, 0x41, 0x4c, 0x55, 0x45, 0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x53, 0x5f,
+	0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44,
+	0x10, 0x00, 0x12, 0x2f, 0x0a, 0x2b, 0x53, 0x4f, 0x52, 0x54, 0x5f, 0x44, 0x59, 0x4e, 0x41, 0x4d,
+	0x49, 0x43, 0x5f, 0x56, 0x41, 0x4c, 0x55, 0x45, 0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47,
+	0x53, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x43, 0x52, 0x45, 0x41, 0x54, 0x45, 0x44, 0x5f, 0x41,
+	0x54, 0x10, 0x01, 0x12, 0x2f, 0x0a, 0x2b, 0x53, 0x4f, 0x52, 0x54, 0x5f, 0x44, 0x59, 0x4e, 0x41,
+	0x4d, 0x49, 0x43, 0x5f, 0x56, 0x41, 0x4c, 0x55, 0x45, 0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e,
+	0x47, 0x53, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x50, 0x44, 0x41, 0x54, 0x45, 0x44, 0x5f,
+	0x41, 0x54, 0x10, 0x02, 0x32, 0xa7, 0x06, 0x0a, 0x1a, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63,
+	0x56, 0x61, 0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x53, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x12, 0x9a, 0x01, 0x0a, 0x18, 0x4c, 0x69, 0x73, 0x74, 0x44, 0x79, 0x6e, 0x61,
+	0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73,
+	0x12, 0x3b, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x64, 0x79, 0x6e, 0x61, 0x6d, 0x69,
+	0x63, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x2e, 0x4c, 0x69,
+	0x73, 0x74, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4d, 0x61,
+	0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x3c, 0x2e,
+	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x64, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x76, 0x61,
+	0x6c, 0x75, 0x65, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x44,
+	0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69,
+	0x6e, 0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x03, 0x90, 0x02, 0x01,
+	0x12, 0x94, 0x01, 0x0a, 0x16, 0x47, 0x65, 0x74, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56,
+	0x61, 0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x39, 0x2e, 0x70, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x64, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x79, 0x6e, 0x61,
+	0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x3a, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
+	0x64, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x6d, 0x61, 0x70, 0x70,
+	0x69, 0x6e, 0x67, 0x2e, 0x47, 0x65, 0x74, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61,
+	0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x22, 0x03, 0x90, 0x02, 0x01, 0x12, 0x9a, 0x01, 0x0a, 0x19, 0x43, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4d, 0x61,
+	0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x3c, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x64,
+	0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x6d, 0x61, 0x70, 0x70, 0x69,
+	0x6e, 0x67, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63,
+	0x56, 0x61, 0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x3d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x64, 0x79, 0x6e,
+	0x61, 0x6d, 0x69, 0x63, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67,
+	0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61,
+	0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x22, 0x00, 0x12, 0x9a, 0x01, 0x0a, 0x19, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x44,
+	0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69,
+	0x6e, 0x67, 0x12, 0x3c, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x64, 0x79, 0x6e, 0x61,
+	0x6d, 0x69, 0x63, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x2e,
+	0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c,
+	0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x3d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x64, 0x79, 0x6e, 0x61, 0x6d, 0x69,
+	0x63, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x2e, 0x55, 0x70,
+	0x64, 0x61, 0x74, 0x65, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65,
+	0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0x00, 0x12, 0x9a, 0x01, 0x0a, 0x19, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x44, 0x79, 0x6e, 0x61,
+	0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12,
+	0x3c, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x64, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x2e, 0x44, 0x65, 0x6c,
+	0x65, 0x74, 0x65, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4d,
+	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x3d, 0x2e,
+	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x64, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x76, 0x61,
+	0x6c, 0x75, 0x65, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74,
+	0x65, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4d, 0x61, 0x70,
+	0x70, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0x87,
+	0x02, 0x0a, 0x1e, 0x63, 0x6f, 0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x64, 0x79,
+	0x6e, 0x61, 0x6d, 0x69, 0x63, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e,
+	0x67, 0x42, 0x18, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x4d,
+	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x42, 0x67,
+	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x64,
+	0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x64, 0x79,
+	0x6e, 0x61, 0x6d, 0x69, 0x63, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e,
+	0x67, 0xa2, 0x02, 0x03, 0x50, 0x44, 0x58, 0xaa, 0x02, 0x1a, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x6d, 0x61, 0x70,
+	0x70, 0x69, 0x6e, 0x67, 0xca, 0x02, 0x1a, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x44, 0x79,
+	0x6e, 0x61, 0x6d, 0x69, 0x63, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e,
+	0x67, 0xe2, 0x02, 0x26, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x44, 0x79, 0x6e, 0x61, 0x6d,
+	0x69, 0x63, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x5c, 0x47,
+	0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x1b, 0x50, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x3a, 0x3a, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_rawDescOnce sync.Once
+	file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_rawDescData = file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_rawDesc
+)
+
+func file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_rawDescGZIP() []byte {
+	file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_rawDescOnce.Do(func() {
+		file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_rawDescData = protoimpl.X.CompressGZIP(file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_rawDescData)
+	})
+	return file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_rawDescData
+}
+
+var file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes = make([]protoimpl.MessageInfo, 11)
+var file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_goTypes = []interface{}{
+	(SortDynamicValueMappingsType)(0),                // 0: policy.dynamicvaluemapping.SortDynamicValueMappingsType
+	(*GetDynamicValueMappingRequest)(nil),            // 1: policy.dynamicvaluemapping.GetDynamicValueMappingRequest
+	(*GetDynamicValueMappingResponse)(nil),           // 2: policy.dynamicvaluemapping.GetDynamicValueMappingResponse
+	(*DynamicValueMappingsSort)(nil),                 // 3: policy.dynamicvaluemapping.DynamicValueMappingsSort
+	(*ListDynamicValueMappingsRequest)(nil),          // 4: policy.dynamicvaluemapping.ListDynamicValueMappingsRequest
+	(*ListDynamicValueMappingsResponse)(nil),         // 5: policy.dynamicvaluemapping.ListDynamicValueMappingsResponse
+	(*CreateDynamicValueMappingRequest)(nil),         // 6: policy.dynamicvaluemapping.CreateDynamicValueMappingRequest
+	(*CreateDynamicValueMappingResponse)(nil),        // 7: policy.dynamicvaluemapping.CreateDynamicValueMappingResponse
+	(*UpdateDynamicValueMappingRequest)(nil),         // 8: policy.dynamicvaluemapping.UpdateDynamicValueMappingRequest
+	(*UpdateDynamicValueMappingResponse)(nil),        // 9: policy.dynamicvaluemapping.UpdateDynamicValueMappingResponse
+	(*DeleteDynamicValueMappingRequest)(nil),         // 10: policy.dynamicvaluemapping.DeleteDynamicValueMappingRequest
+	(*DeleteDynamicValueMappingResponse)(nil),        // 11: policy.dynamicvaluemapping.DeleteDynamicValueMappingResponse
+	(*policy.DynamicValueMapping)(nil),               // 12: policy.DynamicValueMapping
+	(policy.SortDirection)(0),                        // 13: policy.SortDirection
+	(*policy.PageRequest)(nil),                       // 14: policy.PageRequest
+	(*policy.PageResponse)(nil),                      // 15: policy.PageResponse
+	(*policy.DynamicValueResolver)(nil),              // 16: policy.DynamicValueResolver
+	(*policy.Action)(nil),                            // 17: policy.Action
+	(*subjectmapping.SubjectConditionSetCreate)(nil), // 18: policy.subjectmapping.SubjectConditionSetCreate
+	(*common.MetadataMutable)(nil),                   // 19: common.MetadataMutable
+	(common.MetadataUpdateEnum)(0),                   // 20: common.MetadataUpdateEnum
+}
+var file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_depIdxs = []int32{
+	12, // 0: policy.dynamicvaluemapping.GetDynamicValueMappingResponse.dynamic_value_mapping:type_name -> policy.DynamicValueMapping
+	0,  // 1: policy.dynamicvaluemapping.DynamicValueMappingsSort.field:type_name -> policy.dynamicvaluemapping.SortDynamicValueMappingsType
+	13, // 2: policy.dynamicvaluemapping.DynamicValueMappingsSort.direction:type_name -> policy.SortDirection
+	14, // 3: policy.dynamicvaluemapping.ListDynamicValueMappingsRequest.pagination:type_name -> policy.PageRequest
+	3,  // 4: policy.dynamicvaluemapping.ListDynamicValueMappingsRequest.sort:type_name -> policy.dynamicvaluemapping.DynamicValueMappingsSort
+	12, // 5: policy.dynamicvaluemapping.ListDynamicValueMappingsResponse.dynamic_value_mappings:type_name -> policy.DynamicValueMapping
+	15, // 6: policy.dynamicvaluemapping.ListDynamicValueMappingsResponse.pagination:type_name -> policy.PageResponse
+	16, // 7: policy.dynamicvaluemapping.CreateDynamicValueMappingRequest.value_resolver:type_name -> policy.DynamicValueResolver
+	17, // 8: policy.dynamicvaluemapping.CreateDynamicValueMappingRequest.actions:type_name -> policy.Action
+	18, // 9: policy.dynamicvaluemapping.CreateDynamicValueMappingRequest.new_subject_condition_set:type_name -> policy.subjectmapping.SubjectConditionSetCreate
+	19, // 10: policy.dynamicvaluemapping.CreateDynamicValueMappingRequest.metadata:type_name -> common.MetadataMutable
+	12, // 11: policy.dynamicvaluemapping.CreateDynamicValueMappingResponse.dynamic_value_mapping:type_name -> policy.DynamicValueMapping
+	16, // 12: policy.dynamicvaluemapping.UpdateDynamicValueMappingRequest.value_resolver:type_name -> policy.DynamicValueResolver
+	17, // 13: policy.dynamicvaluemapping.UpdateDynamicValueMappingRequest.actions:type_name -> policy.Action
+	19, // 14: policy.dynamicvaluemapping.UpdateDynamicValueMappingRequest.metadata:type_name -> common.MetadataMutable
+	20, // 15: policy.dynamicvaluemapping.UpdateDynamicValueMappingRequest.metadata_update_behavior:type_name -> common.MetadataUpdateEnum
+	12, // 16: policy.dynamicvaluemapping.UpdateDynamicValueMappingResponse.dynamic_value_mapping:type_name -> policy.DynamicValueMapping
+	12, // 17: policy.dynamicvaluemapping.DeleteDynamicValueMappingResponse.dynamic_value_mapping:type_name -> policy.DynamicValueMapping
+	4,  // 18: policy.dynamicvaluemapping.DynamicValueMappingService.ListDynamicValueMappings:input_type -> policy.dynamicvaluemapping.ListDynamicValueMappingsRequest
+	1,  // 19: policy.dynamicvaluemapping.DynamicValueMappingService.GetDynamicValueMapping:input_type -> policy.dynamicvaluemapping.GetDynamicValueMappingRequest
+	6,  // 20: policy.dynamicvaluemapping.DynamicValueMappingService.CreateDynamicValueMapping:input_type -> policy.dynamicvaluemapping.CreateDynamicValueMappingRequest
+	8,  // 21: policy.dynamicvaluemapping.DynamicValueMappingService.UpdateDynamicValueMapping:input_type -> policy.dynamicvaluemapping.UpdateDynamicValueMappingRequest
+	10, // 22: policy.dynamicvaluemapping.DynamicValueMappingService.DeleteDynamicValueMapping:input_type -> policy.dynamicvaluemapping.DeleteDynamicValueMappingRequest
+	5,  // 23: policy.dynamicvaluemapping.DynamicValueMappingService.ListDynamicValueMappings:output_type -> policy.dynamicvaluemapping.ListDynamicValueMappingsResponse
+	2,  // 24: policy.dynamicvaluemapping.DynamicValueMappingService.GetDynamicValueMapping:output_type -> policy.dynamicvaluemapping.GetDynamicValueMappingResponse
+	7,  // 25: policy.dynamicvaluemapping.DynamicValueMappingService.CreateDynamicValueMapping:output_type -> policy.dynamicvaluemapping.CreateDynamicValueMappingResponse
+	9,  // 26: policy.dynamicvaluemapping.DynamicValueMappingService.UpdateDynamicValueMapping:output_type -> policy.dynamicvaluemapping.UpdateDynamicValueMappingResponse
+	11, // 27: policy.dynamicvaluemapping.DynamicValueMappingService.DeleteDynamicValueMapping:output_type -> policy.dynamicvaluemapping.DeleteDynamicValueMappingResponse
+	23, // [23:28] is the sub-list for method output_type
+	18, // [18:23] is the sub-list for method input_type
+	18, // [18:18] is the sub-list for extension type_name
+	18, // [18:18] is the sub-list for extension extendee
+	0,  // [0:18] is the sub-list for field type_name
+}
+
+func init() { file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_init() }
+func file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_init() {
+	if File_policy_dynamicvaluemapping_dynamic_value_mapping_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetDynamicValueMappingRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetDynamicValueMappingResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DynamicValueMappingsSort); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ListDynamicValueMappingsRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ListDynamicValueMappingsResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CreateDynamicValueMappingRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CreateDynamicValueMappingResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UpdateDynamicValueMappingRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UpdateDynamicValueMappingResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DeleteDynamicValueMappingRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DeleteDynamicValueMappingResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   11,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_goTypes,
+		DependencyIndexes: file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_depIdxs,
+		EnumInfos:         file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_enumTypes,
+		MessageInfos:      file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_msgTypes,
+	}.Build()
+	File_policy_dynamicvaluemapping_dynamic_value_mapping_proto = out.File
+	file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_rawDesc = nil
+	file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_goTypes = nil
+	file_policy_dynamicvaluemapping_dynamic_value_mapping_proto_depIdxs = nil
+}
diff --git a/protocol/go/policy/dynamicvaluemapping/dynamic_value_mapping_grpc.pb.go b/protocol/go/policy/dynamicvaluemapping/dynamic_value_mapping_grpc.pb.go
new file mode 100644
index 0000000000..513595f0ef
--- /dev/null
+++ b/protocol/go/policy/dynamicvaluemapping/dynamic_value_mapping_grpc.pb.go
@@ -0,0 +1,258 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             (unknown)
+// source: policy/dynamicvaluemapping/dynamic_value_mapping.proto
+
+package dynamicvaluemapping
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
+
+const (
+	DynamicValueMappingService_ListDynamicValueMappings_FullMethodName  = "/policy.dynamicvaluemapping.DynamicValueMappingService/ListDynamicValueMappings"
+	DynamicValueMappingService_GetDynamicValueMapping_FullMethodName    = "/policy.dynamicvaluemapping.DynamicValueMappingService/GetDynamicValueMapping"
+	DynamicValueMappingService_CreateDynamicValueMapping_FullMethodName = "/policy.dynamicvaluemapping.DynamicValueMappingService/CreateDynamicValueMapping"
+	DynamicValueMappingService_UpdateDynamicValueMapping_FullMethodName = "/policy.dynamicvaluemapping.DynamicValueMappingService/UpdateDynamicValueMapping"
+	DynamicValueMappingService_DeleteDynamicValueMapping_FullMethodName = "/policy.dynamicvaluemapping.DynamicValueMappingService/DeleteDynamicValueMapping"
+)
+
+// DynamicValueMappingServiceClient is the client API for DynamicValueMappingService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type DynamicValueMappingServiceClient interface {
+	ListDynamicValueMappings(ctx context.Context, in *ListDynamicValueMappingsRequest, opts ...grpc.CallOption) (*ListDynamicValueMappingsResponse, error)
+	GetDynamicValueMapping(ctx context.Context, in *GetDynamicValueMappingRequest, opts ...grpc.CallOption) (*GetDynamicValueMappingResponse, error)
+	CreateDynamicValueMapping(ctx context.Context, in *CreateDynamicValueMappingRequest, opts ...grpc.CallOption) (*CreateDynamicValueMappingResponse, error)
+	UpdateDynamicValueMapping(ctx context.Context, in *UpdateDynamicValueMappingRequest, opts ...grpc.CallOption) (*UpdateDynamicValueMappingResponse, error)
+	DeleteDynamicValueMapping(ctx context.Context, in *DeleteDynamicValueMappingRequest, opts ...grpc.CallOption) (*DeleteDynamicValueMappingResponse, error)
+}
+
+type dynamicValueMappingServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewDynamicValueMappingServiceClient(cc grpc.ClientConnInterface) DynamicValueMappingServiceClient {
+	return &dynamicValueMappingServiceClient{cc}
+}
+
+func (c *dynamicValueMappingServiceClient) ListDynamicValueMappings(ctx context.Context, in *ListDynamicValueMappingsRequest, opts ...grpc.CallOption) (*ListDynamicValueMappingsResponse, error) {
+	out := new(ListDynamicValueMappingsResponse)
+	err := c.cc.Invoke(ctx, DynamicValueMappingService_ListDynamicValueMappings_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dynamicValueMappingServiceClient) GetDynamicValueMapping(ctx context.Context, in *GetDynamicValueMappingRequest, opts ...grpc.CallOption) (*GetDynamicValueMappingResponse, error) {
+	out := new(GetDynamicValueMappingResponse)
+	err := c.cc.Invoke(ctx, DynamicValueMappingService_GetDynamicValueMapping_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dynamicValueMappingServiceClient) CreateDynamicValueMapping(ctx context.Context, in *CreateDynamicValueMappingRequest, opts ...grpc.CallOption) (*CreateDynamicValueMappingResponse, error) {
+	out := new(CreateDynamicValueMappingResponse)
+	err := c.cc.Invoke(ctx, DynamicValueMappingService_CreateDynamicValueMapping_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dynamicValueMappingServiceClient) UpdateDynamicValueMapping(ctx context.Context, in *UpdateDynamicValueMappingRequest, opts ...grpc.CallOption) (*UpdateDynamicValueMappingResponse, error) {
+	out := new(UpdateDynamicValueMappingResponse)
+	err := c.cc.Invoke(ctx, DynamicValueMappingService_UpdateDynamicValueMapping_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dynamicValueMappingServiceClient) DeleteDynamicValueMapping(ctx context.Context, in *DeleteDynamicValueMappingRequest, opts ...grpc.CallOption) (*DeleteDynamicValueMappingResponse, error) {
+	out := new(DeleteDynamicValueMappingResponse)
+	err := c.cc.Invoke(ctx, DynamicValueMappingService_DeleteDynamicValueMapping_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// DynamicValueMappingServiceServer is the server API for DynamicValueMappingService service.
+// All implementations must embed UnimplementedDynamicValueMappingServiceServer
+// for forward compatibility
+type DynamicValueMappingServiceServer interface {
+	ListDynamicValueMappings(context.Context, *ListDynamicValueMappingsRequest) (*ListDynamicValueMappingsResponse, error)
+	GetDynamicValueMapping(context.Context, *GetDynamicValueMappingRequest) (*GetDynamicValueMappingResponse, error)
+	CreateDynamicValueMapping(context.Context, *CreateDynamicValueMappingRequest) (*CreateDynamicValueMappingResponse, error)
+	UpdateDynamicValueMapping(context.Context, *UpdateDynamicValueMappingRequest) (*UpdateDynamicValueMappingResponse, error)
+	DeleteDynamicValueMapping(context.Context, *DeleteDynamicValueMappingRequest) (*DeleteDynamicValueMappingResponse, error)
+	mustEmbedUnimplementedDynamicValueMappingServiceServer()
+}
+
+// UnimplementedDynamicValueMappingServiceServer must be embedded to have forward compatible implementations.
+type UnimplementedDynamicValueMappingServiceServer struct {
+}
+
+func (UnimplementedDynamicValueMappingServiceServer) ListDynamicValueMappings(context.Context, *ListDynamicValueMappingsRequest) (*ListDynamicValueMappingsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListDynamicValueMappings not implemented")
+}
+func (UnimplementedDynamicValueMappingServiceServer) GetDynamicValueMapping(context.Context, *GetDynamicValueMappingRequest) (*GetDynamicValueMappingResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetDynamicValueMapping not implemented")
+}
+func (UnimplementedDynamicValueMappingServiceServer) CreateDynamicValueMapping(context.Context, *CreateDynamicValueMappingRequest) (*CreateDynamicValueMappingResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateDynamicValueMapping not implemented")
+}
+func (UnimplementedDynamicValueMappingServiceServer) UpdateDynamicValueMapping(context.Context, *UpdateDynamicValueMappingRequest) (*UpdateDynamicValueMappingResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UpdateDynamicValueMapping not implemented")
+}
+func (UnimplementedDynamicValueMappingServiceServer) DeleteDynamicValueMapping(context.Context, *DeleteDynamicValueMappingRequest) (*DeleteDynamicValueMappingResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DeleteDynamicValueMapping not implemented")
+}
+func (UnimplementedDynamicValueMappingServiceServer) mustEmbedUnimplementedDynamicValueMappingServiceServer() {
+}
+
+// UnsafeDynamicValueMappingServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to DynamicValueMappingServiceServer will
+// result in compilation errors.
+type UnsafeDynamicValueMappingServiceServer interface {
+	mustEmbedUnimplementedDynamicValueMappingServiceServer()
+}
+
+func RegisterDynamicValueMappingServiceServer(s grpc.ServiceRegistrar, srv DynamicValueMappingServiceServer) {
+	s.RegisterService(&DynamicValueMappingService_ServiceDesc, srv)
+}
+
+func _DynamicValueMappingService_ListDynamicValueMappings_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListDynamicValueMappingsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DynamicValueMappingServiceServer).ListDynamicValueMappings(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: DynamicValueMappingService_ListDynamicValueMappings_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DynamicValueMappingServiceServer).ListDynamicValueMappings(ctx, req.(*ListDynamicValueMappingsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _DynamicValueMappingService_GetDynamicValueMapping_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetDynamicValueMappingRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DynamicValueMappingServiceServer).GetDynamicValueMapping(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: DynamicValueMappingService_GetDynamicValueMapping_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DynamicValueMappingServiceServer).GetDynamicValueMapping(ctx, req.(*GetDynamicValueMappingRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _DynamicValueMappingService_CreateDynamicValueMapping_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateDynamicValueMappingRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DynamicValueMappingServiceServer).CreateDynamicValueMapping(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: DynamicValueMappingService_CreateDynamicValueMapping_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DynamicValueMappingServiceServer).CreateDynamicValueMapping(ctx, req.(*CreateDynamicValueMappingRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _DynamicValueMappingService_UpdateDynamicValueMapping_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdateDynamicValueMappingRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DynamicValueMappingServiceServer).UpdateDynamicValueMapping(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: DynamicValueMappingService_UpdateDynamicValueMapping_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DynamicValueMappingServiceServer).UpdateDynamicValueMapping(ctx, req.(*UpdateDynamicValueMappingRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _DynamicValueMappingService_DeleteDynamicValueMapping_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteDynamicValueMappingRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DynamicValueMappingServiceServer).DeleteDynamicValueMapping(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: DynamicValueMappingService_DeleteDynamicValueMapping_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DynamicValueMappingServiceServer).DeleteDynamicValueMapping(ctx, req.(*DeleteDynamicValueMappingRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// DynamicValueMappingService_ServiceDesc is the grpc.ServiceDesc for DynamicValueMappingService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var DynamicValueMappingService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "policy.dynamicvaluemapping.DynamicValueMappingService",
+	HandlerType: (*DynamicValueMappingServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "ListDynamicValueMappings",
+			Handler:    _DynamicValueMappingService_ListDynamicValueMappings_Handler,
+		},
+		{
+			MethodName: "GetDynamicValueMapping",
+			Handler:    _DynamicValueMappingService_GetDynamicValueMapping_Handler,
+		},
+		{
+			MethodName: "CreateDynamicValueMapping",
+			Handler:    _DynamicValueMappingService_CreateDynamicValueMapping_Handler,
+		},
+		{
+			MethodName: "UpdateDynamicValueMapping",
+			Handler:    _DynamicValueMappingService_UpdateDynamicValueMapping_Handler,
+		},
+		{
+			MethodName: "DeleteDynamicValueMapping",
+			Handler:    _DynamicValueMappingService_DeleteDynamicValueMapping_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "policy/dynamicvaluemapping/dynamic_value_mapping.proto",
+}
diff --git a/protocol/go/policy/dynamicvaluemapping/dynamicvaluemappingconnect/dynamic_value_mapping.connect.go b/protocol/go/policy/dynamicvaluemapping/dynamicvaluemappingconnect/dynamic_value_mapping.connect.go
new file mode 100644
index 0000000000..dfe90334f5
--- /dev/null
+++ b/protocol/go/policy/dynamicvaluemapping/dynamicvaluemappingconnect/dynamic_value_mapping.connect.go
@@ -0,0 +1,238 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: policy/dynamicvaluemapping/dynamic_value_mapping.proto
+
+package dynamicvaluemappingconnect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	dynamicvaluemapping "github.com/opentdf/platform/protocol/go/policy/dynamicvaluemapping"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// DynamicValueMappingServiceName is the fully-qualified name of the DynamicValueMappingService
+	// service.
+	DynamicValueMappingServiceName = "policy.dynamicvaluemapping.DynamicValueMappingService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// DynamicValueMappingServiceListDynamicValueMappingsProcedure is the fully-qualified name of the
+	// DynamicValueMappingService's ListDynamicValueMappings RPC.
+	DynamicValueMappingServiceListDynamicValueMappingsProcedure = "/policy.dynamicvaluemapping.DynamicValueMappingService/ListDynamicValueMappings"
+	// DynamicValueMappingServiceGetDynamicValueMappingProcedure is the fully-qualified name of the
+	// DynamicValueMappingService's GetDynamicValueMapping RPC.
+	DynamicValueMappingServiceGetDynamicValueMappingProcedure = "/policy.dynamicvaluemapping.DynamicValueMappingService/GetDynamicValueMapping"
+	// DynamicValueMappingServiceCreateDynamicValueMappingProcedure is the fully-qualified name of the
+	// DynamicValueMappingService's CreateDynamicValueMapping RPC.
+	DynamicValueMappingServiceCreateDynamicValueMappingProcedure = "/policy.dynamicvaluemapping.DynamicValueMappingService/CreateDynamicValueMapping"
+	// DynamicValueMappingServiceUpdateDynamicValueMappingProcedure is the fully-qualified name of the
+	// DynamicValueMappingService's UpdateDynamicValueMapping RPC.
+	DynamicValueMappingServiceUpdateDynamicValueMappingProcedure = "/policy.dynamicvaluemapping.DynamicValueMappingService/UpdateDynamicValueMapping"
+	// DynamicValueMappingServiceDeleteDynamicValueMappingProcedure is the fully-qualified name of the
+	// DynamicValueMappingService's DeleteDynamicValueMapping RPC.
+	DynamicValueMappingServiceDeleteDynamicValueMappingProcedure = "/policy.dynamicvaluemapping.DynamicValueMappingService/DeleteDynamicValueMapping"
+)
+
+// DynamicValueMappingServiceClient is a client for the
+// policy.dynamicvaluemapping.DynamicValueMappingService service.
+type DynamicValueMappingServiceClient interface {
+	ListDynamicValueMappings(context.Context, *connect.Request[dynamicvaluemapping.ListDynamicValueMappingsRequest]) (*connect.Response[dynamicvaluemapping.ListDynamicValueMappingsResponse], error)
+	GetDynamicValueMapping(context.Context, *connect.Request[dynamicvaluemapping.GetDynamicValueMappingRequest]) (*connect.Response[dynamicvaluemapping.GetDynamicValueMappingResponse], error)
+	CreateDynamicValueMapping(context.Context, *connect.Request[dynamicvaluemapping.CreateDynamicValueMappingRequest]) (*connect.Response[dynamicvaluemapping.CreateDynamicValueMappingResponse], error)
+	UpdateDynamicValueMapping(context.Context, *connect.Request[dynamicvaluemapping.UpdateDynamicValueMappingRequest]) (*connect.Response[dynamicvaluemapping.UpdateDynamicValueMappingResponse], error)
+	DeleteDynamicValueMapping(context.Context, *connect.Request[dynamicvaluemapping.DeleteDynamicValueMappingRequest]) (*connect.Response[dynamicvaluemapping.DeleteDynamicValueMappingResponse], error)
+}
+
+// NewDynamicValueMappingServiceClient constructs a client for the
+// policy.dynamicvaluemapping.DynamicValueMappingService service. By default, it uses the Connect
+// protocol with the binary Protobuf Codec, asks for gzipped responses, and sends uncompressed
+// requests. To use the gRPC or gRPC-Web protocols, supply the connect.WithGRPC() or
+// connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewDynamicValueMappingServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) DynamicValueMappingServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	dynamicValueMappingServiceMethods := dynamicvaluemapping.File_policy_dynamicvaluemapping_dynamic_value_mapping_proto.Services().ByName("DynamicValueMappingService").Methods()
+	return &dynamicValueMappingServiceClient{
+		listDynamicValueMappings: connect.NewClient[dynamicvaluemapping.ListDynamicValueMappingsRequest, dynamicvaluemapping.ListDynamicValueMappingsResponse](
+			httpClient,
+			baseURL+DynamicValueMappingServiceListDynamicValueMappingsProcedure,
+			connect.WithSchema(dynamicValueMappingServiceMethods.ByName("ListDynamicValueMappings")),
+			connect.WithIdempotency(connect.IdempotencyNoSideEffects),
+			connect.WithClientOptions(opts...),
+		),
+		getDynamicValueMapping: connect.NewClient[dynamicvaluemapping.GetDynamicValueMappingRequest, dynamicvaluemapping.GetDynamicValueMappingResponse](
+			httpClient,
+			baseURL+DynamicValueMappingServiceGetDynamicValueMappingProcedure,
+			connect.WithSchema(dynamicValueMappingServiceMethods.ByName("GetDynamicValueMapping")),
+			connect.WithIdempotency(connect.IdempotencyNoSideEffects),
+			connect.WithClientOptions(opts...),
+		),
+		createDynamicValueMapping: connect.NewClient[dynamicvaluemapping.CreateDynamicValueMappingRequest, dynamicvaluemapping.CreateDynamicValueMappingResponse](
+			httpClient,
+			baseURL+DynamicValueMappingServiceCreateDynamicValueMappingProcedure,
+			connect.WithSchema(dynamicValueMappingServiceMethods.ByName("CreateDynamicValueMapping")),
+			connect.WithClientOptions(opts...),
+		),
+		updateDynamicValueMapping: connect.NewClient[dynamicvaluemapping.UpdateDynamicValueMappingRequest, dynamicvaluemapping.UpdateDynamicValueMappingResponse](
+			httpClient,
+			baseURL+DynamicValueMappingServiceUpdateDynamicValueMappingProcedure,
+			connect.WithSchema(dynamicValueMappingServiceMethods.ByName("UpdateDynamicValueMapping")),
+			connect.WithClientOptions(opts...),
+		),
+		deleteDynamicValueMapping: connect.NewClient[dynamicvaluemapping.DeleteDynamicValueMappingRequest, dynamicvaluemapping.DeleteDynamicValueMappingResponse](
+			httpClient,
+			baseURL+DynamicValueMappingServiceDeleteDynamicValueMappingProcedure,
+			connect.WithSchema(dynamicValueMappingServiceMethods.ByName("DeleteDynamicValueMapping")),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// dynamicValueMappingServiceClient implements DynamicValueMappingServiceClient.
+type dynamicValueMappingServiceClient struct {
+	listDynamicValueMappings  *connect.Client[dynamicvaluemapping.ListDynamicValueMappingsRequest, dynamicvaluemapping.ListDynamicValueMappingsResponse]
+	getDynamicValueMapping    *connect.Client[dynamicvaluemapping.GetDynamicValueMappingRequest, dynamicvaluemapping.GetDynamicValueMappingResponse]
+	createDynamicValueMapping *connect.Client[dynamicvaluemapping.CreateDynamicValueMappingRequest, dynamicvaluemapping.CreateDynamicValueMappingResponse]
+	updateDynamicValueMapping *connect.Client[dynamicvaluemapping.UpdateDynamicValueMappingRequest, dynamicvaluemapping.UpdateDynamicValueMappingResponse]
+	deleteDynamicValueMapping *connect.Client[dynamicvaluemapping.DeleteDynamicValueMappingRequest, dynamicvaluemapping.DeleteDynamicValueMappingResponse]
+}
+
+// ListDynamicValueMappings calls
+// policy.dynamicvaluemapping.DynamicValueMappingService.ListDynamicValueMappings.
+func (c *dynamicValueMappingServiceClient) ListDynamicValueMappings(ctx context.Context, req *connect.Request[dynamicvaluemapping.ListDynamicValueMappingsRequest]) (*connect.Response[dynamicvaluemapping.ListDynamicValueMappingsResponse], error) {
+	return c.listDynamicValueMappings.CallUnary(ctx, req)
+}
+
+// GetDynamicValueMapping calls
+// policy.dynamicvaluemapping.DynamicValueMappingService.GetDynamicValueMapping.
+func (c *dynamicValueMappingServiceClient) GetDynamicValueMapping(ctx context.Context, req *connect.Request[dynamicvaluemapping.GetDynamicValueMappingRequest]) (*connect.Response[dynamicvaluemapping.GetDynamicValueMappingResponse], error) {
+	return c.getDynamicValueMapping.CallUnary(ctx, req)
+}
+
+// CreateDynamicValueMapping calls
+// policy.dynamicvaluemapping.DynamicValueMappingService.CreateDynamicValueMapping.
+func (c *dynamicValueMappingServiceClient) CreateDynamicValueMapping(ctx context.Context, req *connect.Request[dynamicvaluemapping.CreateDynamicValueMappingRequest]) (*connect.Response[dynamicvaluemapping.CreateDynamicValueMappingResponse], error) {
+	return c.createDynamicValueMapping.CallUnary(ctx, req)
+}
+
+// UpdateDynamicValueMapping calls
+// policy.dynamicvaluemapping.DynamicValueMappingService.UpdateDynamicValueMapping.
+func (c *dynamicValueMappingServiceClient) UpdateDynamicValueMapping(ctx context.Context, req *connect.Request[dynamicvaluemapping.UpdateDynamicValueMappingRequest]) (*connect.Response[dynamicvaluemapping.UpdateDynamicValueMappingResponse], error) {
+	return c.updateDynamicValueMapping.CallUnary(ctx, req)
+}
+
+// DeleteDynamicValueMapping calls
+// policy.dynamicvaluemapping.DynamicValueMappingService.DeleteDynamicValueMapping.
+func (c *dynamicValueMappingServiceClient) DeleteDynamicValueMapping(ctx context.Context, req *connect.Request[dynamicvaluemapping.DeleteDynamicValueMappingRequest]) (*connect.Response[dynamicvaluemapping.DeleteDynamicValueMappingResponse], error) {
+	return c.deleteDynamicValueMapping.CallUnary(ctx, req)
+}
+
+// DynamicValueMappingServiceHandler is an implementation of the
+// policy.dynamicvaluemapping.DynamicValueMappingService service.
+type DynamicValueMappingServiceHandler interface {
+	ListDynamicValueMappings(context.Context, *connect.Request[dynamicvaluemapping.ListDynamicValueMappingsRequest]) (*connect.Response[dynamicvaluemapping.ListDynamicValueMappingsResponse], error)
+	GetDynamicValueMapping(context.Context, *connect.Request[dynamicvaluemapping.GetDynamicValueMappingRequest]) (*connect.Response[dynamicvaluemapping.GetDynamicValueMappingResponse], error)
+	CreateDynamicValueMapping(context.Context, *connect.Request[dynamicvaluemapping.CreateDynamicValueMappingRequest]) (*connect.Response[dynamicvaluemapping.CreateDynamicValueMappingResponse], error)
+	UpdateDynamicValueMapping(context.Context, *connect.Request[dynamicvaluemapping.UpdateDynamicValueMappingRequest]) (*connect.Response[dynamicvaluemapping.UpdateDynamicValueMappingResponse], error)
+	DeleteDynamicValueMapping(context.Context, *connect.Request[dynamicvaluemapping.DeleteDynamicValueMappingRequest]) (*connect.Response[dynamicvaluemapping.DeleteDynamicValueMappingResponse], error)
+}
+
+// NewDynamicValueMappingServiceHandler builds an HTTP handler from the service implementation. It
+// returns the path on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewDynamicValueMappingServiceHandler(svc DynamicValueMappingServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	dynamicValueMappingServiceMethods := dynamicvaluemapping.File_policy_dynamicvaluemapping_dynamic_value_mapping_proto.Services().ByName("DynamicValueMappingService").Methods()
+	dynamicValueMappingServiceListDynamicValueMappingsHandler := connect.NewUnaryHandler(
+		DynamicValueMappingServiceListDynamicValueMappingsProcedure,
+		svc.ListDynamicValueMappings,
+		connect.WithSchema(dynamicValueMappingServiceMethods.ByName("ListDynamicValueMappings")),
+		connect.WithIdempotency(connect.IdempotencyNoSideEffects),
+		connect.WithHandlerOptions(opts...),
+	)
+	dynamicValueMappingServiceGetDynamicValueMappingHandler := connect.NewUnaryHandler(
+		DynamicValueMappingServiceGetDynamicValueMappingProcedure,
+		svc.GetDynamicValueMapping,
+		connect.WithSchema(dynamicValueMappingServiceMethods.ByName("GetDynamicValueMapping")),
+		connect.WithIdempotency(connect.IdempotencyNoSideEffects),
+		connect.WithHandlerOptions(opts...),
+	)
+	dynamicValueMappingServiceCreateDynamicValueMappingHandler := connect.NewUnaryHandler(
+		DynamicValueMappingServiceCreateDynamicValueMappingProcedure,
+		svc.CreateDynamicValueMapping,
+		connect.WithSchema(dynamicValueMappingServiceMethods.ByName("CreateDynamicValueMapping")),
+		connect.WithHandlerOptions(opts...),
+	)
+	dynamicValueMappingServiceUpdateDynamicValueMappingHandler := connect.NewUnaryHandler(
+		DynamicValueMappingServiceUpdateDynamicValueMappingProcedure,
+		svc.UpdateDynamicValueMapping,
+		connect.WithSchema(dynamicValueMappingServiceMethods.ByName("UpdateDynamicValueMapping")),
+		connect.WithHandlerOptions(opts...),
+	)
+	dynamicValueMappingServiceDeleteDynamicValueMappingHandler := connect.NewUnaryHandler(
+		DynamicValueMappingServiceDeleteDynamicValueMappingProcedure,
+		svc.DeleteDynamicValueMapping,
+		connect.WithSchema(dynamicValueMappingServiceMethods.ByName("DeleteDynamicValueMapping")),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/policy.dynamicvaluemapping.DynamicValueMappingService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case DynamicValueMappingServiceListDynamicValueMappingsProcedure:
+			dynamicValueMappingServiceListDynamicValueMappingsHandler.ServeHTTP(w, r)
+		case DynamicValueMappingServiceGetDynamicValueMappingProcedure:
+			dynamicValueMappingServiceGetDynamicValueMappingHandler.ServeHTTP(w, r)
+		case DynamicValueMappingServiceCreateDynamicValueMappingProcedure:
+			dynamicValueMappingServiceCreateDynamicValueMappingHandler.ServeHTTP(w, r)
+		case DynamicValueMappingServiceUpdateDynamicValueMappingProcedure:
+			dynamicValueMappingServiceUpdateDynamicValueMappingHandler.ServeHTTP(w, r)
+		case DynamicValueMappingServiceDeleteDynamicValueMappingProcedure:
+			dynamicValueMappingServiceDeleteDynamicValueMappingHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedDynamicValueMappingServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedDynamicValueMappingServiceHandler struct{}
+
+func (UnimplementedDynamicValueMappingServiceHandler) ListDynamicValueMappings(context.Context, *connect.Request[dynamicvaluemapping.ListDynamicValueMappingsRequest]) (*connect.Response[dynamicvaluemapping.ListDynamicValueMappingsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("policy.dynamicvaluemapping.DynamicValueMappingService.ListDynamicValueMappings is not implemented"))
+}
+
+func (UnimplementedDynamicValueMappingServiceHandler) GetDynamicValueMapping(context.Context, *connect.Request[dynamicvaluemapping.GetDynamicValueMappingRequest]) (*connect.Response[dynamicvaluemapping.GetDynamicValueMappingResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("policy.dynamicvaluemapping.DynamicValueMappingService.GetDynamicValueMapping is not implemented"))
+}
+
+func (UnimplementedDynamicValueMappingServiceHandler) CreateDynamicValueMapping(context.Context, *connect.Request[dynamicvaluemapping.CreateDynamicValueMappingRequest]) (*connect.Response[dynamicvaluemapping.CreateDynamicValueMappingResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("policy.dynamicvaluemapping.DynamicValueMappingService.CreateDynamicValueMapping is not implemented"))
+}
+
+func (UnimplementedDynamicValueMappingServiceHandler) UpdateDynamicValueMapping(context.Context, *connect.Request[dynamicvaluemapping.UpdateDynamicValueMappingRequest]) (*connect.Response[dynamicvaluemapping.UpdateDynamicValueMappingResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("policy.dynamicvaluemapping.DynamicValueMappingService.UpdateDynamicValueMapping is not implemented"))
+}
+
+func (UnimplementedDynamicValueMappingServiceHandler) DeleteDynamicValueMapping(context.Context, *connect.Request[dynamicvaluemapping.DeleteDynamicValueMappingRequest]) (*connect.Response[dynamicvaluemapping.DeleteDynamicValueMappingResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("policy.dynamicvaluemapping.DynamicValueMappingService.DeleteDynamicValueMapping is not implemented"))
+}
diff --git a/protocol/go/policy/enums.gen.go b/protocol/go/policy/enums.gen.go
index 87bc32e7c8..795be75cc0 100644
--- a/protocol/go/policy/enums.gen.go
+++ b/protocol/go/policy/enums.gen.go
@@ -21,6 +21,30 @@ const (
 	OperatorInContains = SubjectMappingOperatorEnum_SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS
 )
 
+// Shorthand constants for ConditionComparisonOperatorEnum.
+//
+// Example:
+//
+//	condition := &Condition{
+//	    SubjectExternalSelectorValue: ".email",
+//	    Comparison:                   ComparisonEndsWith,
+//	    Quantifier:                   QuantifierAny,
+//	    SubjectExternalValues:        []string{"@example.com"},
+//	}
+const (
+	ComparisonEquals     = ConditionComparisonOperatorEnum_CONDITION_COMPARISON_OPERATOR_ENUM_EQUALS
+	ComparisonContains   = ConditionComparisonOperatorEnum_CONDITION_COMPARISON_OPERATOR_ENUM_CONTAINS
+	ComparisonStartsWith = ConditionComparisonOperatorEnum_CONDITION_COMPARISON_OPERATOR_ENUM_STARTS_WITH
+	ComparisonEndsWith   = ConditionComparisonOperatorEnum_CONDITION_COMPARISON_OPERATOR_ENUM_ENDS_WITH
+)
+
+// Shorthand constants for ConditionQuantifierEnum.
+const (
+	QuantifierAny  = ConditionQuantifierEnum_CONDITION_QUANTIFIER_ENUM_ANY
+	QuantifierAll  = ConditionQuantifierEnum_CONDITION_QUANTIFIER_ENUM_ALL
+	QuantifierNone = ConditionQuantifierEnum_CONDITION_QUANTIFIER_ENUM_NONE
+)
+
 // Shorthand constants for ConditionBooleanTypeEnum.
 //
 // Example:
diff --git a/protocol/go/policy/objects.pb.go b/protocol/go/policy/objects.pb.go
index 1e386a7531..e7f4f3eaed 100644
--- a/protocol/go/policy/objects.pb.go
+++ b/protocol/go/policy/objects.pb.go
@@ -180,6 +180,124 @@ func (ConditionBooleanTypeEnum) EnumDescriptor() ([]byte, []int) {
 	return file_policy_objects_proto_rawDescGZIP(), []int{2}
 }
 
+// How a selector result is compared against a comparison value. Replaces the all-in-one
+// SubjectMappingOperatorEnum by separating the comparison from the quantifier (see
+// ConditionQuantifierEnum) and case sensitivity.
+type ConditionComparisonOperatorEnum int32
+
+const (
+	ConditionComparisonOperatorEnum_CONDITION_COMPARISON_OPERATOR_ENUM_UNSPECIFIED ConditionComparisonOperatorEnum = 0
+	// exact string equality
+	ConditionComparisonOperatorEnum_CONDITION_COMPARISON_OPERATOR_ENUM_EQUALS ConditionComparisonOperatorEnum = 1
+	// substring containment
+	ConditionComparisonOperatorEnum_CONDITION_COMPARISON_OPERATOR_ENUM_CONTAINS ConditionComparisonOperatorEnum = 2
+	// prefix match
+	ConditionComparisonOperatorEnum_CONDITION_COMPARISON_OPERATOR_ENUM_STARTS_WITH ConditionComparisonOperatorEnum = 3
+	// suffix match; the safe operator for domain matching (e.g. email domains)
+	ConditionComparisonOperatorEnum_CONDITION_COMPARISON_OPERATOR_ENUM_ENDS_WITH ConditionComparisonOperatorEnum = 4
+)
+
+// Enum value maps for ConditionComparisonOperatorEnum.
+var (
+	ConditionComparisonOperatorEnum_name = map[int32]string{
+		0: "CONDITION_COMPARISON_OPERATOR_ENUM_UNSPECIFIED",
+		1: "CONDITION_COMPARISON_OPERATOR_ENUM_EQUALS",
+		2: "CONDITION_COMPARISON_OPERATOR_ENUM_CONTAINS",
+		3: "CONDITION_COMPARISON_OPERATOR_ENUM_STARTS_WITH",
+		4: "CONDITION_COMPARISON_OPERATOR_ENUM_ENDS_WITH",
+	}
+	ConditionComparisonOperatorEnum_value = map[string]int32{
+		"CONDITION_COMPARISON_OPERATOR_ENUM_UNSPECIFIED": 0,
+		"CONDITION_COMPARISON_OPERATOR_ENUM_EQUALS":      1,
+		"CONDITION_COMPARISON_OPERATOR_ENUM_CONTAINS":    2,
+		"CONDITION_COMPARISON_OPERATOR_ENUM_STARTS_WITH": 3,
+		"CONDITION_COMPARISON_OPERATOR_ENUM_ENDS_WITH":   4,
+	}
+)
+
+func (x ConditionComparisonOperatorEnum) Enum() *ConditionComparisonOperatorEnum {
+	p := new(ConditionComparisonOperatorEnum)
+	*p = x
+	return p
+}
+
+func (x ConditionComparisonOperatorEnum) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (ConditionComparisonOperatorEnum) Descriptor() protoreflect.EnumDescriptor {
+	return file_policy_objects_proto_enumTypes[3].Descriptor()
+}
+
+func (ConditionComparisonOperatorEnum) Type() protoreflect.EnumType {
+	return &file_policy_objects_proto_enumTypes[3]
+}
+
+func (x ConditionComparisonOperatorEnum) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use ConditionComparisonOperatorEnum.Descriptor instead.
+func (ConditionComparisonOperatorEnum) EnumDescriptor() ([]byte, []int) {
+	return file_policy_objects_proto_rawDescGZIP(), []int{3}
+}
+
+// How matches are aggregated across the comparison set (subject_external_values).
+type ConditionQuantifierEnum int32
+
+const (
+	ConditionQuantifierEnum_CONDITION_QUANTIFIER_ENUM_UNSPECIFIED ConditionQuantifierEnum = 0
+	// at least one match (legacy IN behavior)
+	ConditionQuantifierEnum_CONDITION_QUANTIFIER_ENUM_ANY ConditionQuantifierEnum = 1
+	// every expected value matches
+	ConditionQuantifierEnum_CONDITION_QUANTIFIER_ENUM_ALL ConditionQuantifierEnum = 2
+	// no matches (legacy NOT_IN behavior)
+	ConditionQuantifierEnum_CONDITION_QUANTIFIER_ENUM_NONE ConditionQuantifierEnum = 3
+)
+
+// Enum value maps for ConditionQuantifierEnum.
+var (
+	ConditionQuantifierEnum_name = map[int32]string{
+		0: "CONDITION_QUANTIFIER_ENUM_UNSPECIFIED",
+		1: "CONDITION_QUANTIFIER_ENUM_ANY",
+		2: "CONDITION_QUANTIFIER_ENUM_ALL",
+		3: "CONDITION_QUANTIFIER_ENUM_NONE",
+	}
+	ConditionQuantifierEnum_value = map[string]int32{
+		"CONDITION_QUANTIFIER_ENUM_UNSPECIFIED": 0,
+		"CONDITION_QUANTIFIER_ENUM_ANY":         1,
+		"CONDITION_QUANTIFIER_ENUM_ALL":         2,
+		"CONDITION_QUANTIFIER_ENUM_NONE":        3,
+	}
+)
+
+func (x ConditionQuantifierEnum) Enum() *ConditionQuantifierEnum {
+	p := new(ConditionQuantifierEnum)
+	*p = x
+	return p
+}
+
+func (x ConditionQuantifierEnum) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (ConditionQuantifierEnum) Descriptor() protoreflect.EnumDescriptor {
+	return file_policy_objects_proto_enumTypes[4].Descriptor()
+}
+
+func (ConditionQuantifierEnum) Type() protoreflect.EnumType {
+	return &file_policy_objects_proto_enumTypes[4]
+}
+
+func (x ConditionQuantifierEnum) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use ConditionQuantifierEnum.Descriptor instead.
+func (ConditionQuantifierEnum) EnumDescriptor() ([]byte, []int) {
+	return file_policy_objects_proto_rawDescGZIP(), []int{4}
+}
+
 // Describes whether this kas is managed by the organization or if they imported
 // the kas information from an external party. These two modes are necessary in order
 // to encrypt a tdf dek with an external parties kas public key.
@@ -218,11 +336,11 @@ func (x SourceType) String() string {
 }
 
 func (SourceType) Descriptor() protoreflect.EnumDescriptor {
-	return file_policy_objects_proto_enumTypes[3].Descriptor()
+	return file_policy_objects_proto_enumTypes[5].Descriptor()
 }
 
 func (SourceType) Type() protoreflect.EnumType {
-	return &file_policy_objects_proto_enumTypes[3]
+	return &file_policy_objects_proto_enumTypes[5]
 }
 
 func (x SourceType) Number() protoreflect.EnumNumber {
@@ -231,7 +349,7 @@ func (x SourceType) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use SourceType.Descriptor instead.
 func (SourceType) EnumDescriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{3}
+	return file_policy_objects_proto_rawDescGZIP(), []int{5}
 }
 
 type KasPublicKeyAlgEnum int32
@@ -285,11 +403,11 @@ func (x KasPublicKeyAlgEnum) String() string {
 }
 
 func (KasPublicKeyAlgEnum) Descriptor() protoreflect.EnumDescriptor {
-	return file_policy_objects_proto_enumTypes[4].Descriptor()
+	return file_policy_objects_proto_enumTypes[6].Descriptor()
 }
 
 func (KasPublicKeyAlgEnum) Type() protoreflect.EnumType {
-	return &file_policy_objects_proto_enumTypes[4]
+	return &file_policy_objects_proto_enumTypes[6]
 }
 
 func (x KasPublicKeyAlgEnum) Number() protoreflect.EnumNumber {
@@ -298,7 +416,7 @@ func (x KasPublicKeyAlgEnum) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use KasPublicKeyAlgEnum.Descriptor instead.
 func (KasPublicKeyAlgEnum) EnumDescriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{4}
+	return file_policy_objects_proto_rawDescGZIP(), []int{6}
 }
 
 // Supported key algorithms.
@@ -353,11 +471,11 @@ func (x Algorithm) String() string {
 }
 
 func (Algorithm) Descriptor() protoreflect.EnumDescriptor {
-	return file_policy_objects_proto_enumTypes[5].Descriptor()
+	return file_policy_objects_proto_enumTypes[7].Descriptor()
 }
 
 func (Algorithm) Type() protoreflect.EnumType {
-	return &file_policy_objects_proto_enumTypes[5]
+	return &file_policy_objects_proto_enumTypes[7]
 }
 
 func (x Algorithm) Number() protoreflect.EnumNumber {
@@ -366,7 +484,7 @@ func (x Algorithm) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use Algorithm.Descriptor instead.
 func (Algorithm) EnumDescriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{5}
+	return file_policy_objects_proto_rawDescGZIP(), []int{7}
 }
 
 // The status of the key
@@ -403,11 +521,11 @@ func (x KeyStatus) String() string {
 }
 
 func (KeyStatus) Descriptor() protoreflect.EnumDescriptor {
-	return file_policy_objects_proto_enumTypes[6].Descriptor()
+	return file_policy_objects_proto_enumTypes[8].Descriptor()
 }
 
 func (KeyStatus) Type() protoreflect.EnumType {
-	return &file_policy_objects_proto_enumTypes[6]
+	return &file_policy_objects_proto_enumTypes[8]
 }
 
 func (x KeyStatus) Number() protoreflect.EnumNumber {
@@ -416,7 +534,7 @@ func (x KeyStatus) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use KeyStatus.Descriptor instead.
 func (KeyStatus) EnumDescriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{6}
+	return file_policy_objects_proto_rawDescGZIP(), []int{8}
 }
 
 // Describes the management and operational mode of a cryptographic key.
@@ -472,11 +590,11 @@ func (x KeyMode) String() string {
 }
 
 func (KeyMode) Descriptor() protoreflect.EnumDescriptor {
-	return file_policy_objects_proto_enumTypes[7].Descriptor()
+	return file_policy_objects_proto_enumTypes[9].Descriptor()
 }
 
 func (KeyMode) Type() protoreflect.EnumType {
-	return &file_policy_objects_proto_enumTypes[7]
+	return &file_policy_objects_proto_enumTypes[9]
 }
 
 func (x KeyMode) Number() protoreflect.EnumNumber {
@@ -485,7 +603,7 @@ func (x KeyMode) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use KeyMode.Descriptor instead.
 func (KeyMode) EnumDescriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{7}
+	return file_policy_objects_proto_rawDescGZIP(), []int{9}
 }
 
 type Action_StandardAction int32
@@ -525,11 +643,11 @@ func (x Action_StandardAction) String() string {
 }
 
 func (Action_StandardAction) Descriptor() protoreflect.EnumDescriptor {
-	return file_policy_objects_proto_enumTypes[8].Descriptor()
+	return file_policy_objects_proto_enumTypes[10].Descriptor()
 }
 
 func (Action_StandardAction) Type() protoreflect.EnumType {
-	return &file_policy_objects_proto_enumTypes[8]
+	return &file_policy_objects_proto_enumTypes[10]
 }
 
 func (x Action_StandardAction) Number() protoreflect.EnumNumber {
@@ -1331,6 +1449,186 @@ func (x *SubjectMapping) GetMetadata() *common.Metadata {
 	return nil
 }
 
+// Dynamic Value Resolver: the dynamic half of a DynamicValueMapping. It resolves a selector
+// against the entity representation, then tests whether any resolved entity value matches the
+// requested resource value segment under comparison. The match is inherently existential over
+// the resolved entity values, so no quantifier is carried here.
+type DynamicValueResolver struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// a selector for a field value on a flattened Entity Representation (such as from
+	// idP/LDAP), e.g. ".patientAssignments[]"
+	SubjectExternalSelectorValue string `protobuf:"bytes,1,opt,name=subject_external_selector_value,json=subjectExternalSelectorValue,proto3" json:"subject_external_selector_value,omitempty"`
+	// how the requested resource value segment is compared against each value the selector
+	// resolves from the entity representation
+	Comparison ConditionComparisonOperatorEnum `protobuf:"varint,2,opt,name=comparison,proto3,enum=policy.ConditionComparisonOperatorEnum" json:"comparison,omitempty"`
+	// when set true, comparison is case-insensitive; unset is treated as case-sensitive. Modeled as
+	// BoolValue so an explicit false is distinguishable from unset, leaving room to change the default.
+	CaseInsensitive *wrapperspb.BoolValue `protobuf:"bytes,3,opt,name=case_insensitive,json=caseInsensitive,proto3" json:"case_insensitive,omitempty"`
+}
+
+func (x *DynamicValueResolver) Reset() {
+	*x = DynamicValueResolver{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_policy_objects_proto_msgTypes[8]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DynamicValueResolver) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DynamicValueResolver) ProtoMessage() {}
+
+func (x *DynamicValueResolver) ProtoReflect() protoreflect.Message {
+	mi := &file_policy_objects_proto_msgTypes[8]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DynamicValueResolver.ProtoReflect.Descriptor instead.
+func (*DynamicValueResolver) Descriptor() ([]byte, []int) {
+	return file_policy_objects_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *DynamicValueResolver) GetSubjectExternalSelectorValue() string {
+	if x != nil {
+		return x.SubjectExternalSelectorValue
+	}
+	return ""
+}
+
+func (x *DynamicValueResolver) GetComparison() ConditionComparisonOperatorEnum {
+	if x != nil {
+		return x.Comparison
+	}
+	return ConditionComparisonOperatorEnum_CONDITION_COMPARISON_OPERATOR_ENUM_UNSPECIFIED
+}
+
+func (x *DynamicValueResolver) GetCaseInsensitive() *wrapperspb.BoolValue {
+	if x != nil {
+		return x.CaseInsensitive
+	}
+	return nil
+}
+
+// Dynamic Value Mapping: a Policy assigning permitted action(s) to
+// dynamically-requested values under an Attribute Definition. It raises entitlement
+// authority from a concrete Attribute Value to the Attribute Definition: at decision time
+// the value_resolver compares the requested resource value segment against the entity
+// representation, avoiding pre-provisioning a value + subject mapping per discrete value.
+type DynamicValueMapping struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	// the Attribute Definition whose values are entitled dynamically
+	AttributeDefinition *Attribute `protobuf:"bytes,2,opt,name=attribute_definition,json=attributeDefinition,proto3" json:"attribute_definition,omitempty"`
+	// the dynamic resolver matched against the requested resource value segment
+	ValueResolver *DynamicValueResolver `protobuf:"bytes,3,opt,name=value_resolver,json=valueResolver,proto3" json:"value_resolver,omitempty"`
+	// optional static pre-gate on the entity, evaluated with normal SubjectConditionSet
+	// semantics (no dynamic overload). When present, both the gate and the resolver must
+	// pass for entitlement.
+	SubjectConditionSet *SubjectConditionSet `protobuf:"bytes,4,opt,name=subject_condition_set,json=subjectConditionSet,proto3" json:"subject_condition_set,omitempty"`
+	// the actions permitted by subjects in this mapping
+	Actions []*Action `protobuf:"bytes,5,rep,name=actions,proto3" json:"actions,omitempty"`
+	// the namespace containing this mapping
+	Namespace *Namespace       `protobuf:"bytes,6,opt,name=namespace,proto3" json:"namespace,omitempty"`
+	Metadata  *common.Metadata `protobuf:"bytes,100,opt,name=metadata,proto3" json:"metadata,omitempty"`
+}
+
+func (x *DynamicValueMapping) Reset() {
+	*x = DynamicValueMapping{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_policy_objects_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DynamicValueMapping) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DynamicValueMapping) ProtoMessage() {}
+
+func (x *DynamicValueMapping) ProtoReflect() protoreflect.Message {
+	mi := &file_policy_objects_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DynamicValueMapping.ProtoReflect.Descriptor instead.
+func (*DynamicValueMapping) Descriptor() ([]byte, []int) {
+	return file_policy_objects_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *DynamicValueMapping) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *DynamicValueMapping) GetAttributeDefinition() *Attribute {
+	if x != nil {
+		return x.AttributeDefinition
+	}
+	return nil
+}
+
+func (x *DynamicValueMapping) GetValueResolver() *DynamicValueResolver {
+	if x != nil {
+		return x.ValueResolver
+	}
+	return nil
+}
+
+func (x *DynamicValueMapping) GetSubjectConditionSet() *SubjectConditionSet {
+	if x != nil {
+		return x.SubjectConditionSet
+	}
+	return nil
+}
+
+func (x *DynamicValueMapping) GetActions() []*Action {
+	if x != nil {
+		return x.Actions
+	}
+	return nil
+}
+
+func (x *DynamicValueMapping) GetNamespace() *Namespace {
+	if x != nil {
+		return x.Namespace
+	}
+	return nil
+}
+
+func (x *DynamicValueMapping) GetMetadata() *common.Metadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
 // *
 // A Condition defines a rule of <the value at the flattened 'selector value'
 // location> <operator> <subject external values>
@@ -1342,18 +1640,28 @@ type Condition struct {
 	// a selector for a field value on a flattened Entity Representation (such as
 	// from idP/LDAP)
 	SubjectExternalSelectorValue string `protobuf:"bytes,1,opt,name=subject_external_selector_value,json=subjectExternalSelectorValue,proto3" json:"subject_external_selector_value,omitempty"`
-	// the evaluation operator of relation
+	// Deprecated: use comparison + quantifier (+ case_insensitive) instead. Normalized to the
+	// decomposed fields in the service layer for backward compatibility.
+	//
+	// Deprecated: Marked as deprecated in policy/objects.proto.
 	Operator SubjectMappingOperatorEnum `protobuf:"varint,2,opt,name=operator,proto3,enum=policy.SubjectMappingOperatorEnum" json:"operator,omitempty"`
 	// list of comparison values for the result of applying the
 	// subject_external_selector_value on a flattened Entity Representation
 	// (Subject), evaluated by the operator
 	SubjectExternalValues []string `protobuf:"bytes,3,rep,name=subject_external_values,json=subjectExternalValues,proto3" json:"subject_external_values,omitempty"`
+	// how each selector result is compared to subject_external_values entries
+	Comparison ConditionComparisonOperatorEnum `protobuf:"varint,4,opt,name=comparison,proto3,enum=policy.ConditionComparisonOperatorEnum" json:"comparison,omitempty"`
+	// how matches are aggregated across subject_external_values
+	Quantifier ConditionQuantifierEnum `protobuf:"varint,5,opt,name=quantifier,proto3,enum=policy.ConditionQuantifierEnum" json:"quantifier,omitempty"`
+	// when set true, comparison is case-insensitive; unset is treated as case-sensitive. Modeled as
+	// BoolValue so an explicit false is distinguishable from unset, leaving room to change the default.
+	CaseInsensitive *wrapperspb.BoolValue `protobuf:"bytes,6,opt,name=case_insensitive,json=caseInsensitive,proto3" json:"case_insensitive,omitempty"`
 }
 
 func (x *Condition) Reset() {
 	*x = Condition{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_policy_objects_proto_msgTypes[8]
+		mi := &file_policy_objects_proto_msgTypes[10]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1366,7 +1674,7 @@ func (x *Condition) String() string {
 func (*Condition) ProtoMessage() {}
 
 func (x *Condition) ProtoReflect() protoreflect.Message {
-	mi := &file_policy_objects_proto_msgTypes[8]
+	mi := &file_policy_objects_proto_msgTypes[10]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1379,7 +1687,7 @@ func (x *Condition) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Condition.ProtoReflect.Descriptor instead.
 func (*Condition) Descriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{8}
+	return file_policy_objects_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *Condition) GetSubjectExternalSelectorValue() string {
@@ -1389,6 +1697,7 @@ func (x *Condition) GetSubjectExternalSelectorValue() string {
 	return ""
 }
 
+// Deprecated: Marked as deprecated in policy/objects.proto.
 func (x *Condition) GetOperator() SubjectMappingOperatorEnum {
 	if x != nil {
 		return x.Operator
@@ -1403,6 +1712,27 @@ func (x *Condition) GetSubjectExternalValues() []string {
 	return nil
 }
 
+func (x *Condition) GetComparison() ConditionComparisonOperatorEnum {
+	if x != nil {
+		return x.Comparison
+	}
+	return ConditionComparisonOperatorEnum_CONDITION_COMPARISON_OPERATOR_ENUM_UNSPECIFIED
+}
+
+func (x *Condition) GetQuantifier() ConditionQuantifierEnum {
+	if x != nil {
+		return x.Quantifier
+	}
+	return ConditionQuantifierEnum_CONDITION_QUANTIFIER_ENUM_UNSPECIFIED
+}
+
+func (x *Condition) GetCaseInsensitive() *wrapperspb.BoolValue {
+	if x != nil {
+		return x.CaseInsensitive
+	}
+	return nil
+}
+
 // A collection of Conditions evaluated by the boolean_operator provided
 type ConditionGroup struct {
 	state         protoimpl.MessageState
@@ -1417,7 +1747,7 @@ type ConditionGroup struct {
 func (x *ConditionGroup) Reset() {
 	*x = ConditionGroup{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_policy_objects_proto_msgTypes[9]
+		mi := &file_policy_objects_proto_msgTypes[11]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1430,7 +1760,7 @@ func (x *ConditionGroup) String() string {
 func (*ConditionGroup) ProtoMessage() {}
 
 func (x *ConditionGroup) ProtoReflect() protoreflect.Message {
-	mi := &file_policy_objects_proto_msgTypes[9]
+	mi := &file_policy_objects_proto_msgTypes[11]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1443,7 +1773,7 @@ func (x *ConditionGroup) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ConditionGroup.ProtoReflect.Descriptor instead.
 func (*ConditionGroup) Descriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{9}
+	return file_policy_objects_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *ConditionGroup) GetConditions() []*Condition {
@@ -1473,7 +1803,7 @@ type SubjectSet struct {
 func (x *SubjectSet) Reset() {
 	*x = SubjectSet{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_policy_objects_proto_msgTypes[10]
+		mi := &file_policy_objects_proto_msgTypes[12]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1486,7 +1816,7 @@ func (x *SubjectSet) String() string {
 func (*SubjectSet) ProtoMessage() {}
 
 func (x *SubjectSet) ProtoReflect() protoreflect.Message {
-	mi := &file_policy_objects_proto_msgTypes[10]
+	mi := &file_policy_objects_proto_msgTypes[12]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1499,7 +1829,7 @@ func (x *SubjectSet) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SubjectSet.ProtoReflect.Descriptor instead.
 func (*SubjectSet) Descriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{10}
+	return file_policy_objects_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *SubjectSet) GetConditionGroups() []*ConditionGroup {
@@ -1531,7 +1861,7 @@ type SubjectConditionSet struct {
 func (x *SubjectConditionSet) Reset() {
 	*x = SubjectConditionSet{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_policy_objects_proto_msgTypes[11]
+		mi := &file_policy_objects_proto_msgTypes[13]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1544,7 +1874,7 @@ func (x *SubjectConditionSet) String() string {
 func (*SubjectConditionSet) ProtoMessage() {}
 
 func (x *SubjectConditionSet) ProtoReflect() protoreflect.Message {
-	mi := &file_policy_objects_proto_msgTypes[11]
+	mi := &file_policy_objects_proto_msgTypes[13]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1557,7 +1887,7 @@ func (x *SubjectConditionSet) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SubjectConditionSet.ProtoReflect.Descriptor instead.
 func (*SubjectConditionSet) Descriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{11}
+	return file_policy_objects_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *SubjectConditionSet) GetId() string {
@@ -1610,7 +1940,7 @@ type SubjectProperty struct {
 func (x *SubjectProperty) Reset() {
 	*x = SubjectProperty{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_policy_objects_proto_msgTypes[12]
+		mi := &file_policy_objects_proto_msgTypes[14]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1623,7 +1953,7 @@ func (x *SubjectProperty) String() string {
 func (*SubjectProperty) ProtoMessage() {}
 
 func (x *SubjectProperty) ProtoReflect() protoreflect.Message {
-	mi := &file_policy_objects_proto_msgTypes[12]
+	mi := &file_policy_objects_proto_msgTypes[14]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1636,7 +1966,7 @@ func (x *SubjectProperty) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SubjectProperty.ProtoReflect.Descriptor instead.
 func (*SubjectProperty) Descriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{12}
+	return file_policy_objects_proto_rawDescGZIP(), []int{14}
 }
 
 func (x *SubjectProperty) GetExternalSelectorValue() string {
@@ -1675,7 +2005,7 @@ type ResourceMappingGroup struct {
 func (x *ResourceMappingGroup) Reset() {
 	*x = ResourceMappingGroup{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_policy_objects_proto_msgTypes[13]
+		mi := &file_policy_objects_proto_msgTypes[15]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1688,7 +2018,7 @@ func (x *ResourceMappingGroup) String() string {
 func (*ResourceMappingGroup) ProtoMessage() {}
 
 func (x *ResourceMappingGroup) ProtoReflect() protoreflect.Message {
-	mi := &file_policy_objects_proto_msgTypes[13]
+	mi := &file_policy_objects_proto_msgTypes[15]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1701,7 +2031,7 @@ func (x *ResourceMappingGroup) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ResourceMappingGroup.ProtoReflect.Descriptor instead.
 func (*ResourceMappingGroup) Descriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{13}
+	return file_policy_objects_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *ResourceMappingGroup) GetId() string {
@@ -1760,7 +2090,7 @@ type ResourceMapping struct {
 func (x *ResourceMapping) Reset() {
 	*x = ResourceMapping{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_policy_objects_proto_msgTypes[14]
+		mi := &file_policy_objects_proto_msgTypes[16]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1773,7 +2103,7 @@ func (x *ResourceMapping) String() string {
 func (*ResourceMapping) ProtoMessage() {}
 
 func (x *ResourceMapping) ProtoReflect() protoreflect.Message {
-	mi := &file_policy_objects_proto_msgTypes[14]
+	mi := &file_policy_objects_proto_msgTypes[16]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1786,7 +2116,7 @@ func (x *ResourceMapping) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ResourceMapping.ProtoReflect.Descriptor instead.
 func (*ResourceMapping) Descriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{14}
+	return file_policy_objects_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *ResourceMapping) GetId() string {
@@ -1856,7 +2186,7 @@ type KeyAccessServer struct {
 func (x *KeyAccessServer) Reset() {
 	*x = KeyAccessServer{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_policy_objects_proto_msgTypes[15]
+		mi := &file_policy_objects_proto_msgTypes[17]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1869,7 +2199,7 @@ func (x *KeyAccessServer) String() string {
 func (*KeyAccessServer) ProtoMessage() {}
 
 func (x *KeyAccessServer) ProtoReflect() protoreflect.Message {
-	mi := &file_policy_objects_proto_msgTypes[15]
+	mi := &file_policy_objects_proto_msgTypes[17]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1882,7 +2212,7 @@ func (x *KeyAccessServer) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use KeyAccessServer.ProtoReflect.Descriptor instead.
 func (*KeyAccessServer) Descriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{15}
+	return file_policy_objects_proto_rawDescGZIP(), []int{17}
 }
 
 func (x *KeyAccessServer) GetId() string {
@@ -1952,7 +2282,7 @@ type Key struct {
 func (x *Key) Reset() {
 	*x = Key{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_policy_objects_proto_msgTypes[16]
+		mi := &file_policy_objects_proto_msgTypes[18]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1965,7 +2295,7 @@ func (x *Key) String() string {
 func (*Key) ProtoMessage() {}
 
 func (x *Key) ProtoReflect() protoreflect.Message {
-	mi := &file_policy_objects_proto_msgTypes[16]
+	mi := &file_policy_objects_proto_msgTypes[18]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1978,7 +2308,7 @@ func (x *Key) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Key.ProtoReflect.Descriptor instead.
 func (*Key) Descriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{16}
+	return file_policy_objects_proto_rawDescGZIP(), []int{18}
 }
 
 func (x *Key) GetId() string {
@@ -2043,7 +2373,7 @@ type KasPublicKey struct {
 func (x *KasPublicKey) Reset() {
 	*x = KasPublicKey{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_policy_objects_proto_msgTypes[17]
+		mi := &file_policy_objects_proto_msgTypes[19]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2056,7 +2386,7 @@ func (x *KasPublicKey) String() string {
 func (*KasPublicKey) ProtoMessage() {}
 
 func (x *KasPublicKey) ProtoReflect() protoreflect.Message {
-	mi := &file_policy_objects_proto_msgTypes[17]
+	mi := &file_policy_objects_proto_msgTypes[19]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2069,7 +2399,7 @@ func (x *KasPublicKey) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use KasPublicKey.ProtoReflect.Descriptor instead.
 func (*KasPublicKey) Descriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{17}
+	return file_policy_objects_proto_rawDescGZIP(), []int{19}
 }
 
 func (x *KasPublicKey) GetPem() string {
@@ -2106,7 +2436,7 @@ type KasPublicKeySet struct {
 func (x *KasPublicKeySet) Reset() {
 	*x = KasPublicKeySet{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_policy_objects_proto_msgTypes[18]
+		mi := &file_policy_objects_proto_msgTypes[20]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2119,7 +2449,7 @@ func (x *KasPublicKeySet) String() string {
 func (*KasPublicKeySet) ProtoMessage() {}
 
 func (x *KasPublicKeySet) ProtoReflect() protoreflect.Message {
-	mi := &file_policy_objects_proto_msgTypes[18]
+	mi := &file_policy_objects_proto_msgTypes[20]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2132,7 +2462,7 @@ func (x *KasPublicKeySet) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use KasPublicKeySet.ProtoReflect.Descriptor instead.
 func (*KasPublicKeySet) Descriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{18}
+	return file_policy_objects_proto_rawDescGZIP(), []int{20}
 }
 
 func (x *KasPublicKeySet) GetKeys() []*KasPublicKey {
@@ -2158,7 +2488,7 @@ type PublicKey struct {
 func (x *PublicKey) Reset() {
 	*x = PublicKey{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_policy_objects_proto_msgTypes[19]
+		mi := &file_policy_objects_proto_msgTypes[21]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2171,7 +2501,7 @@ func (x *PublicKey) String() string {
 func (*PublicKey) ProtoMessage() {}
 
 func (x *PublicKey) ProtoReflect() protoreflect.Message {
-	mi := &file_policy_objects_proto_msgTypes[19]
+	mi := &file_policy_objects_proto_msgTypes[21]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2184,7 +2514,7 @@ func (x *PublicKey) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PublicKey.ProtoReflect.Descriptor instead.
 func (*PublicKey) Descriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{19}
+	return file_policy_objects_proto_rawDescGZIP(), []int{21}
 }
 
 func (m *PublicKey) GetPublicKey() isPublicKey_PublicKey {
@@ -2242,7 +2572,7 @@ type RegisteredResource struct {
 func (x *RegisteredResource) Reset() {
 	*x = RegisteredResource{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_policy_objects_proto_msgTypes[20]
+		mi := &file_policy_objects_proto_msgTypes[22]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2255,7 +2585,7 @@ func (x *RegisteredResource) String() string {
 func (*RegisteredResource) ProtoMessage() {}
 
 func (x *RegisteredResource) ProtoReflect() protoreflect.Message {
-	mi := &file_policy_objects_proto_msgTypes[20]
+	mi := &file_policy_objects_proto_msgTypes[22]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2268,7 +2598,7 @@ func (x *RegisteredResource) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RegisteredResource.ProtoReflect.Descriptor instead.
 func (*RegisteredResource) Descriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{20}
+	return file_policy_objects_proto_rawDescGZIP(), []int{22}
 }
 
 func (x *RegisteredResource) GetId() string {
@@ -2323,7 +2653,7 @@ type RegisteredResourceValue struct {
 func (x *RegisteredResourceValue) Reset() {
 	*x = RegisteredResourceValue{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_policy_objects_proto_msgTypes[21]
+		mi := &file_policy_objects_proto_msgTypes[23]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2336,7 +2666,7 @@ func (x *RegisteredResourceValue) String() string {
 func (*RegisteredResourceValue) ProtoMessage() {}
 
 func (x *RegisteredResourceValue) ProtoReflect() protoreflect.Message {
-	mi := &file_policy_objects_proto_msgTypes[21]
+	mi := &file_policy_objects_proto_msgTypes[23]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2349,7 +2679,7 @@ func (x *RegisteredResourceValue) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RegisteredResourceValue.ProtoReflect.Descriptor instead.
 func (*RegisteredResourceValue) Descriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{21}
+	return file_policy_objects_proto_rawDescGZIP(), []int{23}
 }
 
 func (x *RegisteredResourceValue) GetId() string {
@@ -2405,7 +2735,7 @@ type PolicyEnforcementPoint struct {
 func (x *PolicyEnforcementPoint) Reset() {
 	*x = PolicyEnforcementPoint{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_policy_objects_proto_msgTypes[22]
+		mi := &file_policy_objects_proto_msgTypes[24]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2418,7 +2748,7 @@ func (x *PolicyEnforcementPoint) String() string {
 func (*PolicyEnforcementPoint) ProtoMessage() {}
 
 func (x *PolicyEnforcementPoint) ProtoReflect() protoreflect.Message {
-	mi := &file_policy_objects_proto_msgTypes[22]
+	mi := &file_policy_objects_proto_msgTypes[24]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2431,7 +2761,7 @@ func (x *PolicyEnforcementPoint) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PolicyEnforcementPoint.ProtoReflect.Descriptor instead.
 func (*PolicyEnforcementPoint) Descriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{22}
+	return file_policy_objects_proto_rawDescGZIP(), []int{24}
 }
 
 func (x *PolicyEnforcementPoint) GetClientId() string {
@@ -2453,7 +2783,7 @@ type RequestContext struct {
 func (x *RequestContext) Reset() {
 	*x = RequestContext{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_policy_objects_proto_msgTypes[23]
+		mi := &file_policy_objects_proto_msgTypes[25]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2466,7 +2796,7 @@ func (x *RequestContext) String() string {
 func (*RequestContext) ProtoMessage() {}
 
 func (x *RequestContext) ProtoReflect() protoreflect.Message {
-	mi := &file_policy_objects_proto_msgTypes[23]
+	mi := &file_policy_objects_proto_msgTypes[25]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2479,7 +2809,7 @@ func (x *RequestContext) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RequestContext.ProtoReflect.Descriptor instead.
 func (*RequestContext) Descriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{23}
+	return file_policy_objects_proto_rawDescGZIP(), []int{25}
 }
 
 func (x *RequestContext) GetPep() *PolicyEnforcementPoint {
@@ -2505,7 +2835,7 @@ type Obligation struct {
 func (x *Obligation) Reset() {
 	*x = Obligation{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_policy_objects_proto_msgTypes[24]
+		mi := &file_policy_objects_proto_msgTypes[26]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2518,7 +2848,7 @@ func (x *Obligation) String() string {
 func (*Obligation) ProtoMessage() {}
 
 func (x *Obligation) ProtoReflect() protoreflect.Message {
-	mi := &file_policy_objects_proto_msgTypes[24]
+	mi := &file_policy_objects_proto_msgTypes[26]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2531,7 +2861,7 @@ func (x *Obligation) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Obligation.ProtoReflect.Descriptor instead.
 func (*Obligation) Descriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{24}
+	return file_policy_objects_proto_rawDescGZIP(), []int{26}
 }
 
 func (x *Obligation) GetId() string {
@@ -2592,7 +2922,7 @@ type ObligationValue struct {
 func (x *ObligationValue) Reset() {
 	*x = ObligationValue{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_policy_objects_proto_msgTypes[25]
+		mi := &file_policy_objects_proto_msgTypes[27]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2605,7 +2935,7 @@ func (x *ObligationValue) String() string {
 func (*ObligationValue) ProtoMessage() {}
 
 func (x *ObligationValue) ProtoReflect() protoreflect.Message {
-	mi := &file_policy_objects_proto_msgTypes[25]
+	mi := &file_policy_objects_proto_msgTypes[27]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2618,7 +2948,7 @@ func (x *ObligationValue) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ObligationValue.ProtoReflect.Descriptor instead.
 func (*ObligationValue) Descriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{25}
+	return file_policy_objects_proto_rawDescGZIP(), []int{27}
 }
 
 func (x *ObligationValue) GetId() string {
@@ -2681,7 +3011,7 @@ type ObligationTrigger struct {
 func (x *ObligationTrigger) Reset() {
 	*x = ObligationTrigger{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_policy_objects_proto_msgTypes[26]
+		mi := &file_policy_objects_proto_msgTypes[28]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2694,7 +3024,7 @@ func (x *ObligationTrigger) String() string {
 func (*ObligationTrigger) ProtoMessage() {}
 
 func (x *ObligationTrigger) ProtoReflect() protoreflect.Message {
-	mi := &file_policy_objects_proto_msgTypes[26]
+	mi := &file_policy_objects_proto_msgTypes[28]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2707,7 +3037,7 @@ func (x *ObligationTrigger) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ObligationTrigger.ProtoReflect.Descriptor instead.
 func (*ObligationTrigger) Descriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{26}
+	return file_policy_objects_proto_rawDescGZIP(), []int{28}
 }
 
 func (x *ObligationTrigger) GetId() string {
@@ -2772,7 +3102,7 @@ type KasKey struct {
 func (x *KasKey) Reset() {
 	*x = KasKey{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_policy_objects_proto_msgTypes[27]
+		mi := &file_policy_objects_proto_msgTypes[29]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2785,7 +3115,7 @@ func (x *KasKey) String() string {
 func (*KasKey) ProtoMessage() {}
 
 func (x *KasKey) ProtoReflect() protoreflect.Message {
-	mi := &file_policy_objects_proto_msgTypes[27]
+	mi := &file_policy_objects_proto_msgTypes[29]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2798,7 +3128,7 @@ func (x *KasKey) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use KasKey.ProtoReflect.Descriptor instead.
 func (*KasKey) Descriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{27}
+	return file_policy_objects_proto_rawDescGZIP(), []int{29}
 }
 
 func (x *KasKey) GetKasId() string {
@@ -2834,7 +3164,7 @@ type PublicKeyCtx struct {
 func (x *PublicKeyCtx) Reset() {
 	*x = PublicKeyCtx{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_policy_objects_proto_msgTypes[28]
+		mi := &file_policy_objects_proto_msgTypes[30]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2847,7 +3177,7 @@ func (x *PublicKeyCtx) String() string {
 func (*PublicKeyCtx) ProtoMessage() {}
 
 func (x *PublicKeyCtx) ProtoReflect() protoreflect.Message {
-	mi := &file_policy_objects_proto_msgTypes[28]
+	mi := &file_policy_objects_proto_msgTypes[30]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2860,7 +3190,7 @@ func (x *PublicKeyCtx) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PublicKeyCtx.ProtoReflect.Descriptor instead.
 func (*PublicKeyCtx) Descriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{28}
+	return file_policy_objects_proto_rawDescGZIP(), []int{30}
 }
 
 func (x *PublicKeyCtx) GetPem() string {
@@ -2884,7 +3214,7 @@ type PrivateKeyCtx struct {
 func (x *PrivateKeyCtx) Reset() {
 	*x = PrivateKeyCtx{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_policy_objects_proto_msgTypes[29]
+		mi := &file_policy_objects_proto_msgTypes[31]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2897,7 +3227,7 @@ func (x *PrivateKeyCtx) String() string {
 func (*PrivateKeyCtx) ProtoMessage() {}
 
 func (x *PrivateKeyCtx) ProtoReflect() protoreflect.Message {
-	mi := &file_policy_objects_proto_msgTypes[29]
+	mi := &file_policy_objects_proto_msgTypes[31]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2910,7 +3240,7 @@ func (x *PrivateKeyCtx) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PrivateKeyCtx.ProtoReflect.Descriptor instead.
 func (*PrivateKeyCtx) Descriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{29}
+	return file_policy_objects_proto_rawDescGZIP(), []int{31}
 }
 
 func (x *PrivateKeyCtx) GetKeyId() string {
@@ -2957,7 +3287,7 @@ type AsymmetricKey struct {
 func (x *AsymmetricKey) Reset() {
 	*x = AsymmetricKey{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_policy_objects_proto_msgTypes[30]
+		mi := &file_policy_objects_proto_msgTypes[32]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2970,7 +3300,7 @@ func (x *AsymmetricKey) String() string {
 func (*AsymmetricKey) ProtoMessage() {}
 
 func (x *AsymmetricKey) ProtoReflect() protoreflect.Message {
-	mi := &file_policy_objects_proto_msgTypes[30]
+	mi := &file_policy_objects_proto_msgTypes[32]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2983,7 +3313,7 @@ func (x *AsymmetricKey) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AsymmetricKey.ProtoReflect.Descriptor instead.
 func (*AsymmetricKey) Descriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{30}
+	return file_policy_objects_proto_rawDescGZIP(), []int{32}
 }
 
 func (x *AsymmetricKey) GetId() string {
@@ -3074,7 +3404,7 @@ type SymmetricKey struct {
 func (x *SymmetricKey) Reset() {
 	*x = SymmetricKey{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_policy_objects_proto_msgTypes[31]
+		mi := &file_policy_objects_proto_msgTypes[33]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3087,7 +3417,7 @@ func (x *SymmetricKey) String() string {
 func (*SymmetricKey) ProtoMessage() {}
 
 func (x *SymmetricKey) ProtoReflect() protoreflect.Message {
-	mi := &file_policy_objects_proto_msgTypes[31]
+	mi := &file_policy_objects_proto_msgTypes[33]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3100,7 +3430,7 @@ func (x *SymmetricKey) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SymmetricKey.ProtoReflect.Descriptor instead.
 func (*SymmetricKey) Descriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{31}
+	return file_policy_objects_proto_rawDescGZIP(), []int{33}
 }
 
 func (x *SymmetricKey) GetId() string {
@@ -3167,7 +3497,7 @@ type RegisteredResourceValue_ActionAttributeValue struct {
 func (x *RegisteredResourceValue_ActionAttributeValue) Reset() {
 	*x = RegisteredResourceValue_ActionAttributeValue{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_policy_objects_proto_msgTypes[32]
+		mi := &file_policy_objects_proto_msgTypes[34]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3180,7 +3510,7 @@ func (x *RegisteredResourceValue_ActionAttributeValue) String() string {
 func (*RegisteredResourceValue_ActionAttributeValue) ProtoMessage() {}
 
 func (x *RegisteredResourceValue_ActionAttributeValue) ProtoReflect() protoreflect.Message {
-	mi := &file_policy_objects_proto_msgTypes[32]
+	mi := &file_policy_objects_proto_msgTypes[34]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3193,7 +3523,7 @@ func (x *RegisteredResourceValue_ActionAttributeValue) ProtoReflect() protorefle
 
 // Deprecated: Use RegisteredResourceValue_ActionAttributeValue.ProtoReflect.Descriptor instead.
 func (*RegisteredResourceValue_ActionAttributeValue) Descriptor() ([]byte, []int) {
-	return file_policy_objects_proto_rawDescGZIP(), []int{21, 0}
+	return file_policy_objects_proto_rawDescGZIP(), []int{23, 0}
 }
 
 func (x *RegisteredResourceValue_ActionAttributeValue) GetId() string {
@@ -3378,455 +3708,539 @@ var file_policy_objects_proto_rawDesc = []byte{
 	0x61, 0x63, 0x65, 0x52, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x2c,
 	0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b,
 	0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0xe9, 0x01, 0x0a,
-	0x09, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x4d, 0x0a, 0x1f, 0x73, 0x75,
-	0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x73,
-	0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x1c, 0x73, 0x75, 0x62,
-	0x6a, 0x65, 0x63, 0x74, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x53, 0x65, 0x6c, 0x65,
-	0x63, 0x74, 0x6f, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x4b, 0x0a, 0x08, 0x6f, 0x70, 0x65,
-	0x72, 0x61, 0x74, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x22, 0x2e, 0x70, 0x6f,
-	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4d, 0x61, 0x70, 0x70,
-	0x69, 0x6e, 0x67, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x45, 0x6e, 0x75, 0x6d, 0x42,
-	0x0b, 0xba, 0x48, 0x08, 0xc8, 0x01, 0x01, 0x82, 0x01, 0x02, 0x10, 0x01, 0x52, 0x08, 0x6f, 0x70,
-	0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x12, 0x40, 0x0a, 0x17, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63,
-	0x74, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08,
-	0x01, 0x52, 0x15, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e,
-	0x61, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x22, 0xa7, 0x01, 0x0a, 0x0e, 0x43, 0x6f, 0x6e,
-	0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x3b, 0x0a, 0x0a, 0x63,
-	0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x11, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69,
-	0x6f, 0x6e, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x0a, 0x63, 0x6f,
-	0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x58, 0x0a, 0x10, 0x62, 0x6f, 0x6f, 0x6c,
-	0x65, 0x61, 0x6e, 0x5f, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x0e, 0x32, 0x20, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x43, 0x6f, 0x6e, 0x64,
-	0x69, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x54, 0x79, 0x70, 0x65,
-	0x45, 0x6e, 0x75, 0x6d, 0x42, 0x0b, 0xba, 0x48, 0x08, 0xc8, 0x01, 0x01, 0x82, 0x01, 0x02, 0x10,
-	0x01, 0x52, 0x0f, 0x62, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74,
-	0x6f, 0x72, 0x22, 0x59, 0x0a, 0x0a, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x53, 0x65, 0x74,
-	0x12, 0x4b, 0x0a, 0x10, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x67, 0x72,
-	0x6f, 0x75, 0x70, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x70, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f,
-	0x75, 0x70, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x0f, 0x63, 0x6f,
-	0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x22, 0xc5, 0x01,
-	0x0a, 0x13, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69,
-	0x6f, 0x6e, 0x53, 0x65, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x2f, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61,
-	0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63,
-	0x79, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x52, 0x09, 0x6e, 0x61, 0x6d,
-	0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x3f, 0x0a, 0x0c, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63,
-	0x74, 0x5f, 0x73, 0x65, 0x74, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x70,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x53, 0x65, 0x74,
-	0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x0b, 0x73, 0x75, 0x62, 0x6a,
-	0x65, 0x63, 0x74, 0x53, 0x65, 0x74, 0x73, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64,
-	0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d,
-	0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74,
-	0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x7c, 0x0a, 0x0f, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74,
-	0x50, 0x72, 0x6f, 0x70, 0x65, 0x72, 0x74, 0x79, 0x12, 0x42, 0x0a, 0x17, 0x65, 0x78, 0x74, 0x65,
-	0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x76, 0x61,
-	0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xba, 0x48, 0x07, 0xc8, 0x01,
-	0x01, 0x72, 0x02, 0x10, 0x01, 0x52, 0x15, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x53,
-	0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x25, 0x0a, 0x0e,
-	0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x56, 0x61,
-	0x6c, 0x75, 0x65, 0x22, 0xad, 0x01, 0x0a, 0x14, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x0e, 0x0a, 0x02,
-	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x29, 0x0a, 0x0c,
-	0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x0b, 0x6e, 0x61, 0x6d, 0x65,
-	0x73, 0x70, 0x61, 0x63, 0x65, 0x49, 0x64, 0x12, 0x1a, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x09, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x04, 0x6e,
-	0x61, 0x6d, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x66, 0x71, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x03, 0x66, 0x71, 0x6e, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e,
-	0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64,
-	0x61, 0x74, 0x61, 0x22, 0x8a, 0x02, 0x0a, 0x0f, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64,
-	0x61, 0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d,
-	0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74,
-	0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x3e, 0x0a, 0x0f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75,
-	0x74, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d,
-	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x06, 0xba,
-	0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x0e, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65,
-	0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x65, 0x72, 0x6d, 0x73, 0x18, 0x04,
-	0x20, 0x03, 0x28, 0x09, 0x52, 0x05, 0x74, 0x65, 0x72, 0x6d, 0x73, 0x12, 0x32, 0x0a, 0x05, 0x67,
-	0x72, 0x6f, 0x75, 0x70, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x70, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x61, 0x70, 0x70,
-	0x69, 0x6e, 0x67, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x05, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x12,
+	0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x82, 0x02, 0x0a,
+	0x14, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x65, 0x73,
+	0x6f, 0x6c, 0x76, 0x65, 0x72, 0x12, 0x4d, 0x0a, 0x1f, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74,
+	0x5f, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74,
+	0x6f, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x06,
+	0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x1c, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x45,
+	0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x56,
+	0x61, 0x6c, 0x75, 0x65, 0x12, 0x54, 0x0a, 0x0a, 0x63, 0x6f, 0x6d, 0x70, 0x61, 0x72, 0x69, 0x73,
+	0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x27, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63,
+	0x79, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x6d, 0x70, 0x61,
+	0x72, 0x69, 0x73, 0x6f, 0x6e, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x45, 0x6e, 0x75,
+	0x6d, 0x42, 0x0b, 0xba, 0x48, 0x08, 0xc8, 0x01, 0x01, 0x82, 0x01, 0x02, 0x10, 0x01, 0x52, 0x0a,
+	0x63, 0x6f, 0x6d, 0x70, 0x61, 0x72, 0x69, 0x73, 0x6f, 0x6e, 0x12, 0x45, 0x0a, 0x10, 0x63, 0x61,
+	0x73, 0x65, 0x5f, 0x69, 0x6e, 0x73, 0x65, 0x6e, 0x73, 0x69, 0x74, 0x69, 0x76, 0x65, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42, 0x6f, 0x6f, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65,
+	0x52, 0x0f, 0x63, 0x61, 0x73, 0x65, 0x49, 0x6e, 0x73, 0x65, 0x6e, 0x73, 0x69, 0x74, 0x69, 0x76,
+	0x65, 0x22, 0x8a, 0x03, 0x0a, 0x13, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c,
+	0x75, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x44, 0x0a, 0x14, 0x61, 0x74, 0x74,
+	0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x64, 0x65, 0x66, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x6f,
+	0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x2e, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x52, 0x13, 0x61, 0x74, 0x74, 0x72,
+	0x69, 0x62, 0x75, 0x74, 0x65, 0x44, 0x65, 0x66, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x12,
+	0x43, 0x0a, 0x0e, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65,
+	0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x2e, 0x44, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x65, 0x73,
+	0x6f, 0x6c, 0x76, 0x65, 0x72, 0x52, 0x0d, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x65, 0x73, 0x6f,
+	0x6c, 0x76, 0x65, 0x72, 0x12, 0x4f, 0x0a, 0x15, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f,
+	0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x73, 0x65, 0x74, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62,
+	0x6a, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x74,
+	0x52, 0x13, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69,
+	0x6f, 0x6e, 0x53, 0x65, 0x74, 0x12, 0x28, 0x0a, 0x07, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
+	0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x07, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12,
 	0x2f, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x06, 0x20, 0x01,
 	0x28, 0x0b, 0x32, 0x11, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4e, 0x61, 0x6d, 0x65,
 	0x73, 0x70, 0x61, 0x63, 0x65, 0x52, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65,
-	0x22, 0x85, 0x05, 0x0a, 0x0f, 0x4b, 0x65, 0x79, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x53, 0x65,
-	0x72, 0x76, 0x65, 0x72, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x02, 0x69, 0x64, 0x12, 0x87, 0x03, 0x0a, 0x03, 0x75, 0x72, 0x69, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x42, 0xf4, 0x02, 0xba, 0x48, 0xf0, 0x02, 0xba, 0x01, 0xec, 0x02, 0x0a, 0x0a, 0x75,
-	0x72, 0x69, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0xcf, 0x01, 0x55, 0x52, 0x49, 0x20,
-	0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x61, 0x20, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x20,
-	0x55, 0x52, 0x4c, 0x20, 0x28, 0x65, 0x2e, 0x67, 0x2e, 0x2c, 0x20, 0x27, 0x68, 0x74, 0x74, 0x70,
-	0x73, 0x3a, 0x2f, 0x2f, 0x64, 0x65, 0x6d, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x27, 0x29, 0x20,
-	0x66, 0x6f, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x20, 0x62, 0x79, 0x20, 0x61, 0x64, 0x64, 0x69,
-	0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x20, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x2e,
-	0x20, 0x45, 0x61, 0x63, 0x68, 0x20, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x20, 0x6d, 0x75,
-	0x73, 0x74, 0x20, 0x73, 0x74, 0x61, 0x72, 0x74, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x65, 0x6e, 0x64,
-	0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75,
-	0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2c,
-	0x20, 0x63, 0x61, 0x6e, 0x20, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20, 0x68, 0x79, 0x70,
-	0x68, 0x65, 0x6e, 0x73, 0x2c, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72,
-	0x69, 0x63, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x73, 0x2c, 0x20, 0x61,
-	0x6e, 0x64, 0x20, 0x73, 0x6c, 0x61, 0x73, 0x68, 0x65, 0x73, 0x2e, 0x1a, 0x8b, 0x01, 0x74, 0x68,
-	0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x68, 0x74, 0x74,
-	0x70, 0x73, 0x3f, 0x3a, 0x2f, 0x2f, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39,
-	0x5d, 0x28, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d,
-	0x7b, 0x30, 0x2c, 0x36, 0x31, 0x7d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39,
-	0x5d, 0x29, 0x3f, 0x28, 0x5c, 0x5c, 0x2e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d,
-	0x39, 0x5d, 0x28, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d,
-	0x5d, 0x7b, 0x30, 0x2c, 0x36, 0x31, 0x7d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d,
-	0x39, 0x5d, 0x29, 0x3f, 0x29, 0x2a, 0x28, 0x3a, 0x5b, 0x30, 0x2d, 0x39, 0x5d, 0x2b, 0x29, 0x3f,
-	0x28, 0x2f, 0x2e, 0x2a, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x52, 0x03, 0x75, 0x72, 0x69, 0x12, 0x30,
-	0x0a, 0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x03, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x11, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x75, 0x62, 0x6c,
-	0x69, 0x63, 0x4b, 0x65, 0x79, 0x52, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79,
-	0x12, 0x33, 0x0a, 0x0b, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18,
-	0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x12, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x54, 0x79, 0x70, 0x65, 0x52, 0x0a, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x2f, 0x0a, 0x08, 0x6b, 0x61, 0x73, 0x5f, 0x6b, 0x65, 0x79,
-	0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x2e, 0x53, 0x69, 0x6d, 0x70, 0x6c, 0x65, 0x4b, 0x61, 0x73, 0x4b, 0x65, 0x79, 0x52, 0x07, 0x6b,
-	0x61, 0x73, 0x4b, 0x65, 0x79, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x14,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65,
-	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63,
-	0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08,
-	0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x97, 0x02, 0x0a, 0x03, 0x4b, 0x65, 0x79,
-	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64,
-	0x12, 0x37, 0x0a, 0x09, 0x69, 0x73, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42, 0x6f, 0x6f, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52,
-	0x08, 0x69, 0x73, 0x41, 0x63, 0x74, 0x69, 0x76, 0x65, 0x12, 0x39, 0x0a, 0x0a, 0x77, 0x61, 0x73,
-	0x5f, 0x6d, 0x61, 0x70, 0x70, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
-	0x42, 0x6f, 0x6f, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x09, 0x77, 0x61, 0x73, 0x4d, 0x61,
-	0x70, 0x70, 0x65, 0x64, 0x12, 0x33, 0x0a, 0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b,
-	0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63,
-	0x79, 0x2e, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x52, 0x09,
-	0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x29, 0x0a, 0x03, 0x6b, 0x61, 0x73,
-	0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
-	0x4b, 0x65, 0x79, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52,
-	0x03, 0x6b, 0x61, 0x73, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
-	0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e,
-	0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x22, 0x84, 0x01, 0x0a, 0x0c, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63,
-	0x4b, 0x65, 0x79, 0x12, 0x1c, 0x0a, 0x03, 0x70, 0x65, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x42, 0x0a, 0xba, 0x48, 0x07, 0x72, 0x05, 0x10, 0x01, 0x18, 0x80, 0x40, 0x52, 0x03, 0x70, 0x65,
-	0x6d, 0x12, 0x1b, 0x0a, 0x03, 0x6b, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x09,
-	0xba, 0x48, 0x06, 0x72, 0x04, 0x10, 0x01, 0x18, 0x20, 0x52, 0x03, 0x6b, 0x69, 0x64, 0x12, 0x39,
-	0x0a, 0x03, 0x61, 0x6c, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1b, 0x2e, 0x70, 0x6f,
-	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65,
-	0x79, 0x41, 0x6c, 0x67, 0x45, 0x6e, 0x75, 0x6d, 0x42, 0x0a, 0xba, 0x48, 0x07, 0x82, 0x01, 0x04,
-	0x10, 0x01, 0x20, 0x00, 0x52, 0x03, 0x61, 0x6c, 0x67, 0x22, 0x3b, 0x0a, 0x0f, 0x4b, 0x61, 0x73,
-	0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x53, 0x65, 0x74, 0x12, 0x28, 0x0a, 0x04,
-	0x6b, 0x65, 0x79, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x70, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79,
-	0x52, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x22, 0xe0, 0x03, 0x0a, 0x09, 0x50, 0x75, 0x62, 0x6c, 0x69,
-	0x63, 0x4b, 0x65, 0x79, 0x12, 0x84, 0x03, 0x0a, 0x06, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0xe9, 0x02, 0xba, 0x48, 0xe5, 0x02, 0xba, 0x01, 0xe1, 0x02,
-	0x0a, 0x0a, 0x75, 0x72, 0x69, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0xcf, 0x01, 0x55,
-	0x52, 0x49, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x61, 0x20, 0x76, 0x61, 0x6c,
-	0x69, 0x64, 0x20, 0x55, 0x52, 0x4c, 0x20, 0x28, 0x65, 0x2e, 0x67, 0x2e, 0x2c, 0x20, 0x27, 0x68,
-	0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x64, 0x65, 0x6d, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x2f,
-	0x27, 0x29, 0x20, 0x66, 0x6f, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x20, 0x62, 0x79, 0x20, 0x61,
-	0x64, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x20, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e,
-	0x74, 0x73, 0x2e, 0x20, 0x45, 0x61, 0x63, 0x68, 0x20, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74,
-	0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x73, 0x74, 0x61, 0x72, 0x74, 0x20, 0x61, 0x6e, 0x64, 0x20,
-	0x65, 0x6e, 0x64, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68,
-	0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74,
-	0x65, 0x72, 0x2c, 0x20, 0x63, 0x61, 0x6e, 0x20, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20,
-	0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x2c, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75,
-	0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x73,
-	0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x73, 0x6c, 0x61, 0x73, 0x68, 0x65, 0x73, 0x2e, 0x1a, 0x80,
-	0x01, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e,
-	0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30,
-	0x2d, 0x39, 0x5d, 0x28, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c,
-	0x2d, 0x5d, 0x7b, 0x30, 0x2c, 0x36, 0x31, 0x7d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30,
-	0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x28, 0x5c, 0x5c, 0x2e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a,
-	0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c,
-	0x5c, 0x2d, 0x5d, 0x7b, 0x30, 0x2c, 0x36, 0x31, 0x7d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a,
-	0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x29, 0x2a, 0x28, 0x2f, 0x2e, 0x2a, 0x29, 0x3f, 0x24, 0x27,
-	0x29, 0x48, 0x00, 0x52, 0x06, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x12, 0x31, 0x0a, 0x06, 0x63,
-	0x61, 0x63, 0x68, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x70, 0x6f,
-	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65,
-	0x79, 0x53, 0x65, 0x74, 0x48, 0x00, 0x52, 0x06, 0x63, 0x61, 0x63, 0x68, 0x65, 0x64, 0x42, 0x0c,
-	0x0a, 0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x4a, 0x04, 0x08, 0x02,
-	0x10, 0x03, 0x52, 0x05, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x22, 0xd0, 0x01, 0x0a, 0x12, 0x52, 0x65,
-	0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64,
-	0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
-	0x6e, 0x61, 0x6d, 0x65, 0x12, 0x37, 0x0a, 0x06, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x03,
-	0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x52, 0x65,
-	0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x06, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x12, 0x2f, 0x0a,
-	0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x11, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70,
-	0x61, 0x63, 0x65, 0x52, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x2c,
+	0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0xd0,
+	0x03, 0x0a, 0x09, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x4d, 0x0a, 0x1f,
+	0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c,
+	0x5f, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x1c, 0x73,
+	0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x53, 0x65,
+	0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x4d, 0x0a, 0x08, 0x6f,
+	0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x22, 0x2e,
+	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4d, 0x61,
+	0x70, 0x70, 0x69, 0x6e, 0x67, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x45, 0x6e, 0x75,
+	0x6d, 0x42, 0x0d, 0xba, 0x48, 0x08, 0xd8, 0x01, 0x01, 0x82, 0x01, 0x02, 0x10, 0x01, 0x18, 0x01,
+	0x52, 0x08, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x12, 0x40, 0x0a, 0x17, 0x73, 0x75,
+	0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05,
+	0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x15, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x45, 0x78,
+	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x12, 0x51, 0x0a, 0x0a,
+	0x63, 0x6f, 0x6d, 0x70, 0x61, 0x72, 0x69, 0x73, 0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e,
+	0x32, 0x27, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74,
+	0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x72, 0x69, 0x73, 0x6f, 0x6e, 0x4f, 0x70, 0x65,
+	0x72, 0x61, 0x74, 0x6f, 0x72, 0x45, 0x6e, 0x75, 0x6d, 0x42, 0x08, 0xba, 0x48, 0x05, 0x82, 0x01,
+	0x02, 0x10, 0x01, 0x52, 0x0a, 0x63, 0x6f, 0x6d, 0x70, 0x61, 0x72, 0x69, 0x73, 0x6f, 0x6e, 0x12,
+	0x49, 0x0a, 0x0a, 0x71, 0x75, 0x61, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x0e, 0x32, 0x1f, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x43, 0x6f, 0x6e,
+	0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x51, 0x75, 0x61, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72,
+	0x45, 0x6e, 0x75, 0x6d, 0x42, 0x08, 0xba, 0x48, 0x05, 0x82, 0x01, 0x02, 0x10, 0x01, 0x52, 0x0a,
+	0x71, 0x75, 0x61, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x12, 0x45, 0x0a, 0x10, 0x63, 0x61,
+	0x73, 0x65, 0x5f, 0x69, 0x6e, 0x73, 0x65, 0x6e, 0x73, 0x69, 0x74, 0x69, 0x76, 0x65, 0x18, 0x06,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42, 0x6f, 0x6f, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65,
+	0x52, 0x0f, 0x63, 0x61, 0x73, 0x65, 0x49, 0x6e, 0x73, 0x65, 0x6e, 0x73, 0x69, 0x74, 0x69, 0x76,
+	0x65, 0x22, 0xa7, 0x01, 0x0a, 0x0e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x47,
+	0x72, 0x6f, 0x75, 0x70, 0x12, 0x3b, 0x0a, 0x0a, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63,
+	0x79, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x08, 0xba, 0x48, 0x05,
+	0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x0a, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x12, 0x58, 0x0a, 0x10, 0x62, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x5f, 0x6f, 0x70, 0x65,
+	0x72, 0x61, 0x74, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x20, 0x2e, 0x70, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x6f,
+	0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x42, 0x0b, 0xba,
+	0x48, 0x08, 0xc8, 0x01, 0x01, 0x82, 0x01, 0x02, 0x10, 0x01, 0x52, 0x0f, 0x62, 0x6f, 0x6f, 0x6c,
+	0x65, 0x61, 0x6e, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x22, 0x59, 0x0a, 0x0a, 0x53,
+	0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x53, 0x65, 0x74, 0x12, 0x4b, 0x0a, 0x10, 0x63, 0x6f, 0x6e,
+	0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x01, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x43, 0x6f, 0x6e,
+	0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x42, 0x08, 0xba, 0x48, 0x05,
+	0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x0f, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e,
+	0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x22, 0xc5, 0x01, 0x0a, 0x13, 0x53, 0x75, 0x62, 0x6a, 0x65,
+	0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x74, 0x12, 0x0e,
+	0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x2f,
+	0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x11, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x73,
+	0x70, 0x61, 0x63, 0x65, 0x52, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12,
+	0x3f, 0x0a, 0x0c, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x73, 0x18,
+	0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53,
+	0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x53, 0x65, 0x74, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01,
+	0x02, 0x08, 0x01, 0x52, 0x0b, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x53, 0x65, 0x74, 0x73,
+	0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x7c,
+	0x0a, 0x0f, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x50, 0x72, 0x6f, 0x70, 0x65, 0x72, 0x74,
+	0x79, 0x12, 0x42, 0x0a, 0x17, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x73, 0x65,
+	0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x42, 0x0a, 0xba, 0x48, 0x07, 0xc8, 0x01, 0x01, 0x72, 0x02, 0x10, 0x01, 0x52, 0x15,
+	0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72,
+	0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x25, 0x0a, 0x0e, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61,
+	0x6c, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x65,
+	0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x22, 0xad, 0x01, 0x0a,
+	0x14, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67,
+	0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x29, 0x0a, 0x0c, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61,
+	0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x06, 0xba, 0x48, 0x03,
+	0xc8, 0x01, 0x01, 0x52, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x49, 0x64,
+	0x12, 0x1a, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x42, 0x06,
+	0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x10, 0x0a, 0x03,
+	0x66, 0x71, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x66, 0x71, 0x6e, 0x12, 0x2c,
 	0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b,
 	0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0xdc, 0x03, 0x0a,
-	0x17, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75,
-	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x36,
-	0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x1a, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74,
-	0x65, 0x72, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x6c, 0x0a, 0x17, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x5f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x34, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x41,
-	0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x15, 0x61,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x56, 0x61,
-	0x6c, 0x75, 0x65, 0x73, 0x12, 0x10, 0x0a, 0x03, 0x66, 0x71, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x03, 0x66, 0x71, 0x6e, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f,
-	0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61,
-	0x64, 0x61, 0x74, 0x61, 0x1a, 0xb4, 0x01, 0x0a, 0x14, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x41,
-	0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x0e, 0x0a,
-	0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x26, 0x0a,
-	0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e,
-	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x36, 0x0a, 0x0f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75,
-	0x74, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d,
-	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0e, 0x61,
-	0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x2c, 0x0a,
+	0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x8a, 0x02, 0x0a,
+	0x0f, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67,
+	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64,
+	0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x3e,
+	0x0a, 0x0f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x2e, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x0e,
+	0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x14,
+	0x0a, 0x05, 0x74, 0x65, 0x72, 0x6d, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x05, 0x74,
+	0x65, 0x72, 0x6d, 0x73, 0x12, 0x32, 0x0a, 0x05, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x52, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x47, 0x72, 0x6f, 0x75,
+	0x70, 0x52, 0x05, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x2f, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65,
+	0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x70, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x52, 0x09,
+	0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x22, 0x85, 0x05, 0x0a, 0x0f, 0x4b, 0x65,
+	0x79, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x12, 0x0e, 0x0a,
+	0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x87, 0x03,
+	0x0a, 0x03, 0x75, 0x72, 0x69, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0xf4, 0x02, 0xba, 0x48,
+	0xf0, 0x02, 0xba, 0x01, 0xec, 0x02, 0x0a, 0x0a, 0x75, 0x72, 0x69, 0x5f, 0x66, 0x6f, 0x72, 0x6d,
+	0x61, 0x74, 0x12, 0xcf, 0x01, 0x55, 0x52, 0x49, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65,
+	0x20, 0x61, 0x20, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x20, 0x55, 0x52, 0x4c, 0x20, 0x28, 0x65, 0x2e,
+	0x67, 0x2e, 0x2c, 0x20, 0x27, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x64, 0x65, 0x6d,
+	0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x27, 0x29, 0x20, 0x66, 0x6f, 0x6c, 0x6c, 0x6f, 0x77, 0x65,
+	0x64, 0x20, 0x62, 0x79, 0x20, 0x61, 0x64, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x20,
+	0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x20, 0x45, 0x61, 0x63, 0x68, 0x20, 0x73,
+	0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x73, 0x74, 0x61, 0x72,
+	0x74, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x65, 0x6e, 0x64, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x61,
+	0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x63,
+	0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2c, 0x20, 0x63, 0x61, 0x6e, 0x20, 0x63, 0x6f,
+	0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x2c, 0x20, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x63, 0x68, 0x61, 0x72,
+	0x61, 0x63, 0x74, 0x65, 0x72, 0x73, 0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x73, 0x6c, 0x61, 0x73,
+	0x68, 0x65, 0x73, 0x2e, 0x1a, 0x8b, 0x01, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63,
+	0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3f, 0x3a, 0x2f, 0x2f, 0x5b,
+	0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b, 0x61, 0x2d, 0x7a, 0x41,
+	0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b, 0x30, 0x2c, 0x36, 0x31, 0x7d, 0x5b,
+	0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x28, 0x5c, 0x5c, 0x2e,
+	0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b, 0x61, 0x2d, 0x7a,
+	0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b, 0x30, 0x2c, 0x36, 0x31, 0x7d,
+	0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x29, 0x2a, 0x28,
+	0x3a, 0x5b, 0x30, 0x2d, 0x39, 0x5d, 0x2b, 0x29, 0x3f, 0x28, 0x2f, 0x2e, 0x2a, 0x29, 0x3f, 0x24,
+	0x27, 0x29, 0x52, 0x03, 0x75, 0x72, 0x69, 0x12, 0x30, 0x0a, 0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69,
+	0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x70, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x52, 0x09,
+	0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x33, 0x0a, 0x0b, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x12,
+	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x54, 0x79,
+	0x70, 0x65, 0x52, 0x0a, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x2f,
+	0x0a, 0x08, 0x6b, 0x61, 0x73, 0x5f, 0x6b, 0x65, 0x79, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x14, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x69, 0x6d, 0x70, 0x6c, 0x65,
+	0x4b, 0x61, 0x73, 0x4b, 0x65, 0x79, 0x52, 0x07, 0x6b, 0x61, 0x73, 0x4b, 0x65, 0x79, 0x73, 0x12,
+	0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e,
+	0x61, 0x6d, 0x65, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18,
+	0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0x22, 0x97, 0x02, 0x0a, 0x03, 0x4b, 0x65, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x37, 0x0a, 0x09, 0x69, 0x73, 0x5f,
+	0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42,
+	0x6f, 0x6f, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x08, 0x69, 0x73, 0x41, 0x63, 0x74, 0x69,
+	0x76, 0x65, 0x12, 0x39, 0x0a, 0x0a, 0x77, 0x61, 0x73, 0x5f, 0x6d, 0x61, 0x70, 0x70, 0x65, 0x64,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42, 0x6f, 0x6f, 0x6c, 0x56, 0x61, 0x6c,
+	0x75, 0x65, 0x52, 0x09, 0x77, 0x61, 0x73, 0x4d, 0x61, 0x70, 0x70, 0x65, 0x64, 0x12, 0x33, 0x0a,
+	0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x14, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73, 0x50, 0x75,
+	0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x52, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b,
+	0x65, 0x79, 0x12, 0x29, 0x0a, 0x03, 0x6b, 0x61, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x17, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x65, 0x79, 0x41, 0x63, 0x63, 0x65,
+	0x73, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x03, 0x6b, 0x61, 0x73, 0x12, 0x2c, 0x0a,
 	0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32,
 	0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x3e, 0x0a, 0x16, 0x50,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x45, 0x6e, 0x66, 0x6f, 0x72, 0x63, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x50, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x24, 0x0a, 0x09, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f,
-	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x07, 0xba, 0x48, 0x04, 0x72, 0x02, 0x10,
-	0x01, 0x52, 0x08, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x64, 0x22, 0x4a, 0x0a, 0x0e, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x12, 0x38, 0x0a,
-	0x03, 0x70, 0x65, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x70, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x45, 0x6e, 0x66, 0x6f, 0x72, 0x63,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x50, 0x6f, 0x69, 0x6e, 0x74, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8,
-	0x01, 0x01, 0x52, 0x03, 0x70, 0x65, 0x70, 0x22, 0xd2, 0x01, 0x0a, 0x0a, 0x4f, 0x62, 0x6c, 0x69,
-	0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x2f, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70,
-	0x61, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
+	0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x84, 0x01, 0x0a, 0x0c,
+	0x4b, 0x61, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x1c, 0x0a, 0x03,
+	0x70, 0x65, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xba, 0x48, 0x07, 0x72, 0x05,
+	0x10, 0x01, 0x18, 0x80, 0x40, 0x52, 0x03, 0x70, 0x65, 0x6d, 0x12, 0x1b, 0x0a, 0x03, 0x6b, 0x69,
+	0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x09, 0xba, 0x48, 0x06, 0x72, 0x04, 0x10, 0x01,
+	0x18, 0x20, 0x52, 0x03, 0x6b, 0x69, 0x64, 0x12, 0x39, 0x0a, 0x03, 0x61, 0x6c, 0x67, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0e, 0x32, 0x1b, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61,
+	0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x41, 0x6c, 0x67, 0x45, 0x6e, 0x75,
+	0x6d, 0x42, 0x0a, 0xba, 0x48, 0x07, 0x82, 0x01, 0x04, 0x10, 0x01, 0x20, 0x00, 0x52, 0x03, 0x61,
+	0x6c, 0x67, 0x22, 0x3b, 0x0a, 0x0f, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b,
+	0x65, 0x79, 0x53, 0x65, 0x74, 0x12, 0x28, 0x0a, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x18, 0x01, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73,
+	0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x52, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x22,
+	0xe0, 0x03, 0x0a, 0x09, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x84, 0x03,
+	0x0a, 0x06, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0xe9,
+	0x02, 0xba, 0x48, 0xe5, 0x02, 0xba, 0x01, 0xe1, 0x02, 0x0a, 0x0a, 0x75, 0x72, 0x69, 0x5f, 0x66,
+	0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0xcf, 0x01, 0x55, 0x52, 0x49, 0x20, 0x6d, 0x75, 0x73, 0x74,
+	0x20, 0x62, 0x65, 0x20, 0x61, 0x20, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x20, 0x55, 0x52, 0x4c, 0x20,
+	0x28, 0x65, 0x2e, 0x67, 0x2e, 0x2c, 0x20, 0x27, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f,
+	0x64, 0x65, 0x6d, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x27, 0x29, 0x20, 0x66, 0x6f, 0x6c, 0x6c,
+	0x6f, 0x77, 0x65, 0x64, 0x20, 0x62, 0x79, 0x20, 0x61, 0x64, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e,
+	0x61, 0x6c, 0x20, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x20, 0x45, 0x61, 0x63,
+	0x68, 0x20, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x73,
+	0x74, 0x61, 0x72, 0x74, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x65, 0x6e, 0x64, 0x20, 0x77, 0x69, 0x74,
+	0x68, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69,
+	0x63, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2c, 0x20, 0x63, 0x61, 0x6e,
+	0x20, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73,
+	0x2c, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x63,
+	0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x73, 0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x73,
+	0x6c, 0x61, 0x73, 0x68, 0x65, 0x73, 0x2e, 0x1a, 0x80, 0x01, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d,
+	0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f,
+	0x2f, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b, 0x61, 0x2d,
+	0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b, 0x30, 0x2c, 0x36, 0x31,
+	0x7d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x28, 0x5c,
+	0x5c, 0x2e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b, 0x61,
+	0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b, 0x30, 0x2c, 0x36,
+	0x31, 0x7d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x29,
+	0x2a, 0x28, 0x2f, 0x2e, 0x2a, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x48, 0x00, 0x52, 0x06, 0x72, 0x65,
+	0x6d, 0x6f, 0x74, 0x65, 0x12, 0x31, 0x0a, 0x06, 0x63, 0x61, 0x63, 0x68, 0x65, 0x64, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61,
+	0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x53, 0x65, 0x74, 0x48, 0x00, 0x52,
+	0x06, 0x63, 0x61, 0x63, 0x68, 0x65, 0x64, 0x42, 0x0c, 0x0a, 0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69,
+	0x63, 0x5f, 0x6b, 0x65, 0x79, 0x4a, 0x04, 0x08, 0x02, 0x10, 0x03, 0x52, 0x05, 0x6c, 0x6f, 0x63,
+	0x61, 0x6c, 0x22, 0xd0, 0x01, 0x0a, 0x12, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x65,
+	0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x37, 0x0a,
+	0x06, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e,
+	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x65,
+	0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x06,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x12, 0x2f, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70,
+	0x61, 0x63, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
 	0x63, 0x79, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x52, 0x09, 0x6e, 0x61,
-	0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x2f, 0x0a, 0x06, 0x76,
-	0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x70, 0x6f,
-	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4f, 0x62, 0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x56,
-	0x61, 0x6c, 0x75, 0x65, 0x52, 0x06, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x12, 0x10, 0x0a, 0x03,
-	0x66, 0x71, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x66, 0x71, 0x6e, 0x12, 0x2c,
-	0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0xe2, 0x01, 0x0a,
-	0x0f, 0x4f, 0x62, 0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x56, 0x61, 0x6c, 0x75, 0x65,
+	0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d,
+	0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0xdc, 0x03, 0x0a, 0x17, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74,
+	0x65, 0x72, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x56, 0x61, 0x6c, 0x75,
+	0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69,
+	0x64, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x36, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x65, 0x64, 0x52, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12,
+	0x6c, 0x0a, 0x17, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62,
+	0x75, 0x74, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x34, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74,
+	0x65, 0x72, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x56, 0x61, 0x6c, 0x75,
+	0x65, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74,
+	0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x15, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x41, 0x74,
+	0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x12, 0x10, 0x0a,
+	0x03, 0x66, 0x71, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x66, 0x71, 0x6e, 0x12,
+	0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x1a, 0xb4, 0x01,
+	0x0a, 0x14, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74,
+	0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x36,
+	0x0a, 0x0f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x2e, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0e, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74,
+	0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f,
+	0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x22, 0x3e, 0x0a, 0x16, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x45, 0x6e,
+	0x66, 0x6f, 0x72, 0x63, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x50, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x24,
+	0x0a, 0x09, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x42, 0x07, 0xba, 0x48, 0x04, 0x72, 0x02, 0x10, 0x01, 0x52, 0x08, 0x63, 0x6c, 0x69, 0x65,
+	0x6e, 0x74, 0x49, 0x64, 0x22, 0x4a, 0x0a, 0x0e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x43,
+	0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x12, 0x38, 0x0a, 0x03, 0x70, 0x65, 0x70, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x45, 0x6e, 0x66, 0x6f, 0x72, 0x63, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x50, 0x6f,
+	0x69, 0x6e, 0x74, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x03, 0x70, 0x65, 0x70,
+	0x22, 0xd2, 0x01, 0x0a, 0x0a, 0x4f, 0x62, 0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12,
+	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12,
+	0x2f, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x11, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4e, 0x61, 0x6d, 0x65,
+	0x73, 0x70, 0x61, 0x63, 0x65, 0x52, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65,
+	0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
+	0x6e, 0x61, 0x6d, 0x65, 0x12, 0x2f, 0x0a, 0x06, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x04,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4f, 0x62,
+	0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x06, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x73, 0x12, 0x10, 0x0a, 0x03, 0x66, 0x71, 0x6e, 0x18, 0x05, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x03, 0x66, 0x71, 0x6e, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d,
+	0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0xe2, 0x01, 0x0a, 0x0f, 0x4f, 0x62, 0x6c, 0x69, 0x67, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x32, 0x0a, 0x0a, 0x6f, 0x62, 0x6c,
+	0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e,
+	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4f, 0x62, 0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x52, 0x0a, 0x6f, 0x62, 0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x14, 0x0a,
+	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61,
+	0x6c, 0x75, 0x65, 0x12, 0x35, 0x0a, 0x08, 0x74, 0x72, 0x69, 0x67, 0x67, 0x65, 0x72, 0x73, 0x18,
+	0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4f,
+	0x62, 0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x72, 0x69, 0x67, 0x67, 0x65, 0x72,
+	0x52, 0x08, 0x74, 0x72, 0x69, 0x67, 0x67, 0x65, 0x72, 0x73, 0x12, 0x10, 0x0a, 0x03, 0x66, 0x71,
+	0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x66, 0x71, 0x6e, 0x12, 0x2c, 0x0a, 0x08,
+	0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10,
+	0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0xd8, 0x02, 0x0a, 0x11, 0x4f,
+	0x62, 0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x72, 0x69, 0x67, 0x67, 0x65, 0x72,
 	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64,
-	0x12, 0x32, 0x0a, 0x0a, 0x6f, 0x62, 0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4f, 0x62,
-	0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0a, 0x6f, 0x62, 0x6c, 0x69, 0x67, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x35, 0x0a, 0x08, 0x74, 0x72,
-	0x69, 0x67, 0x67, 0x65, 0x72, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x70,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4f, 0x62, 0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x54, 0x72, 0x69, 0x67, 0x67, 0x65, 0x72, 0x52, 0x08, 0x74, 0x72, 0x69, 0x67, 0x67, 0x65, 0x72,
-	0x73, 0x12, 0x10, 0x0a, 0x03, 0x66, 0x71, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03,
-	0x66, 0x71, 0x6e, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18,
-	0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d,
-	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x22, 0xd8, 0x02, 0x0a, 0x11, 0x4f, 0x62, 0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x54, 0x72, 0x69, 0x67, 0x67, 0x65, 0x72, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x42, 0x0a, 0x10, 0x6f, 0x62, 0x6c, 0x69, 0x67,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x17, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4f, 0x62, 0x6c, 0x69, 0x67,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0f, 0x6f, 0x62, 0x6c, 0x69,
-	0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f,
-	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x12, 0x36, 0x0a, 0x0f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65,
-	0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x70,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0e, 0x61, 0x74, 0x74,
-	0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x30, 0x0a, 0x07, 0x63,
-	0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x70,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x43, 0x6f, 0x6e,
-	0x74, 0x65, 0x78, 0x74, 0x52, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x12, 0x2f, 0x0a,
-	0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x11, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70,
-	0x61, 0x63, 0x65, 0x52, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x2c,
-	0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x61, 0x0a, 0x06,
-	0x4b, 0x61, 0x73, 0x4b, 0x65, 0x79, 0x12, 0x15, 0x0a, 0x06, 0x6b, 0x61, 0x73, 0x5f, 0x69, 0x64,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6b, 0x61, 0x73, 0x49, 0x64, 0x12, 0x27, 0x0a,
-	0x03, 0x6b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x70, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x2e, 0x41, 0x73, 0x79, 0x6d, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x4b, 0x65,
-	0x79, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x17, 0x0a, 0x07, 0x6b, 0x61, 0x73, 0x5f, 0x75, 0x72,
-	0x69, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6b, 0x61, 0x73, 0x55, 0x72, 0x69, 0x22,
-	0x29, 0x0a, 0x0c, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x43, 0x74, 0x78, 0x12,
-	0x19, 0x0a, 0x03, 0x70, 0x65, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x07, 0xba, 0x48,
-	0x04, 0x72, 0x02, 0x10, 0x01, 0x52, 0x03, 0x70, 0x65, 0x6d, 0x22, 0x50, 0x0a, 0x0d, 0x50, 0x72,
-	0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x43, 0x74, 0x78, 0x12, 0x1e, 0x0a, 0x06, 0x6b,
-	0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x07, 0xba, 0x48, 0x04,
-	0x72, 0x02, 0x10, 0x01, 0x52, 0x05, 0x6b, 0x65, 0x79, 0x49, 0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x77,
-	0x72, 0x61, 0x70, 0x70, 0x65, 0x64, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x0a, 0x77, 0x72, 0x61, 0x70, 0x70, 0x65, 0x64, 0x4b, 0x65, 0x79, 0x22, 0xd1, 0x03, 0x0a,
-	0x0d, 0x41, 0x73, 0x79, 0x6d, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x0e,
-	0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x15,
-	0x0a, 0x06, 0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
-	0x6b, 0x65, 0x79, 0x49, 0x64, 0x12, 0x36, 0x0a, 0x0d, 0x6b, 0x65, 0x79, 0x5f, 0x61, 0x6c, 0x67,
-	0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x11, 0x2e, 0x70,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x52,
-	0x0c, 0x6b, 0x65, 0x79, 0x41, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x12, 0x30, 0x0a,
-	0x0a, 0x6b, 0x65, 0x79, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28,
-	0x0e, 0x32, 0x11, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x65, 0x79, 0x53, 0x74,
-	0x61, 0x74, 0x75, 0x73, 0x52, 0x09, 0x6b, 0x65, 0x79, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12,
-	0x2a, 0x0a, 0x08, 0x6b, 0x65, 0x79, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28,
-	0x0e, 0x32, 0x0f, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x65, 0x79, 0x4d, 0x6f,
-	0x64, 0x65, 0x52, 0x07, 0x6b, 0x65, 0x79, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x3a, 0x0a, 0x0e, 0x70,
-	0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x63, 0x74, 0x78, 0x18, 0x06, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x75, 0x62,
-	0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x43, 0x74, 0x78, 0x52, 0x0c, 0x70, 0x75, 0x62, 0x6c, 0x69,
-	0x63, 0x4b, 0x65, 0x79, 0x43, 0x74, 0x78, 0x12, 0x3d, 0x0a, 0x0f, 0x70, 0x72, 0x69, 0x76, 0x61,
-	0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x63, 0x74, 0x78, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x15, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74,
-	0x65, 0x4b, 0x65, 0x79, 0x43, 0x74, 0x78, 0x52, 0x0d, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65,
-	0x4b, 0x65, 0x79, 0x43, 0x74, 0x78, 0x12, 0x42, 0x0a, 0x0f, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64,
-	0x65, 0x72, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x19, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x65, 0x79, 0x50, 0x72, 0x6f, 0x76,
-	0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0e, 0x70, 0x72, 0x6f, 0x76,
-	0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x16, 0x0a, 0x06, 0x6c, 0x65,
-	0x67, 0x61, 0x63, 0x79, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x6c, 0x65, 0x67, 0x61,
-	0x63, 0x79, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65,
-	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
-	0x22, 0x9e, 0x02, 0x0a, 0x0c, 0x53, 0x79, 0x6d, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x4b, 0x65,
-	0x79, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69,
-	0x64, 0x12, 0x15, 0x0a, 0x06, 0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x05, 0x6b, 0x65, 0x79, 0x49, 0x64, 0x12, 0x30, 0x0a, 0x0a, 0x6b, 0x65, 0x79, 0x5f,
-	0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x11, 0x2e, 0x70,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x65, 0x79, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52,
-	0x09, 0x6b, 0x65, 0x79, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x2a, 0x0a, 0x08, 0x6b, 0x65,
-	0x79, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x0f, 0x2e, 0x70,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x65, 0x79, 0x4d, 0x6f, 0x64, 0x65, 0x52, 0x07, 0x6b,
-	0x65, 0x79, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x17, 0x0a, 0x07, 0x6b, 0x65, 0x79, 0x5f, 0x63, 0x74,
-	0x78, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x6b, 0x65, 0x79, 0x43, 0x74, 0x78, 0x12,
+	0x12, 0x42, 0x0a, 0x10, 0x6f, 0x62, 0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x70, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x2e, 0x4f, 0x62, 0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x56, 0x61,
+	0x6c, 0x75, 0x65, 0x52, 0x0f, 0x6f, 0x62, 0x6c, 0x69, 0x67, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x56,
+	0x61, 0x6c, 0x75, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x36, 0x0a, 0x0f,
+	0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x56,
+	0x61, 0x6c, 0x75, 0x65, 0x52, 0x0e, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x56,
+	0x61, 0x6c, 0x75, 0x65, 0x12, 0x30, 0x0a, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x18,
+	0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x52, 0x07, 0x63,
+	0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x12, 0x2f, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70,
+	0x61, 0x63, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x52, 0x09, 0x6e, 0x61,
+	0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d,
+	0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x61, 0x0a, 0x06, 0x4b, 0x61, 0x73, 0x4b, 0x65, 0x79, 0x12,
+	0x15, 0x0a, 0x06, 0x6b, 0x61, 0x73, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x05, 0x6b, 0x61, 0x73, 0x49, 0x64, 0x12, 0x27, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x73, 0x79,
+	0x6d, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12,
+	0x17, 0x0a, 0x07, 0x6b, 0x61, 0x73, 0x5f, 0x75, 0x72, 0x69, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x06, 0x6b, 0x61, 0x73, 0x55, 0x72, 0x69, 0x22, 0x29, 0x0a, 0x0c, 0x50, 0x75, 0x62, 0x6c,
+	0x69, 0x63, 0x4b, 0x65, 0x79, 0x43, 0x74, 0x78, 0x12, 0x19, 0x0a, 0x03, 0x70, 0x65, 0x6d, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x07, 0xba, 0x48, 0x04, 0x72, 0x02, 0x10, 0x01, 0x52, 0x03,
+	0x70, 0x65, 0x6d, 0x22, 0x50, 0x0a, 0x0d, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65,
+	0x79, 0x43, 0x74, 0x78, 0x12, 0x1e, 0x0a, 0x06, 0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x42, 0x07, 0xba, 0x48, 0x04, 0x72, 0x02, 0x10, 0x01, 0x52, 0x05, 0x6b,
+	0x65, 0x79, 0x49, 0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x77, 0x72, 0x61, 0x70, 0x70, 0x65, 0x64, 0x5f,
+	0x6b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x77, 0x72, 0x61, 0x70, 0x70,
+	0x65, 0x64, 0x4b, 0x65, 0x79, 0x22, 0xd1, 0x03, 0x0a, 0x0d, 0x41, 0x73, 0x79, 0x6d, 0x6d, 0x65,
+	0x74, 0x72, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x15, 0x0a, 0x06, 0x6b, 0x65, 0x79, 0x5f, 0x69,
+	0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6b, 0x65, 0x79, 0x49, 0x64, 0x12, 0x36,
+	0x0a, 0x0d, 0x6b, 0x65, 0x79, 0x5f, 0x61, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x11, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41,
+	0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x52, 0x0c, 0x6b, 0x65, 0x79, 0x41, 0x6c, 0x67,
+	0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x12, 0x30, 0x0a, 0x0a, 0x6b, 0x65, 0x79, 0x5f, 0x73, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x11, 0x2e, 0x70, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x2e, 0x4b, 0x65, 0x79, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x09, 0x6b,
+	0x65, 0x79, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x2a, 0x0a, 0x08, 0x6b, 0x65, 0x79, 0x5f,
+	0x6d, 0x6f, 0x64, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x0f, 0x2e, 0x70, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x2e, 0x4b, 0x65, 0x79, 0x4d, 0x6f, 0x64, 0x65, 0x52, 0x07, 0x6b, 0x65, 0x79,
+	0x4d, 0x6f, 0x64, 0x65, 0x12, 0x3a, 0x0a, 0x0e, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b,
+	0x65, 0x79, 0x5f, 0x63, 0x74, 0x78, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x70,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x43,
+	0x74, 0x78, 0x52, 0x0c, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x43, 0x74, 0x78,
+	0x12, 0x3d, 0x0a, 0x0f, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x5f,
+	0x63, 0x74, 0x78, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x2e, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x43, 0x74, 0x78,
+	0x52, 0x0d, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x43, 0x74, 0x78, 0x12,
 	0x42, 0x0a, 0x0f, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x5f, 0x63, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63,
+	0x69, 0x67, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63,
 	0x79, 0x2e, 0x4b, 0x65, 0x79, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e,
 	0x66, 0x69, 0x67, 0x52, 0x0e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18,
-	0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d,
-	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x2a, 0xb3, 0x01, 0x0a, 0x15, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x52,
-	0x75, 0x6c, 0x65, 0x54, 0x79, 0x70, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x12, 0x28, 0x0a, 0x24, 0x41,
-	0x54, 0x54, 0x52, 0x49, 0x42, 0x55, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54, 0x59,
-	0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46,
-	0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x23, 0x0a, 0x1f, 0x41, 0x54, 0x54, 0x52, 0x49, 0x42, 0x55,
-	0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55,
-	0x4d, 0x5f, 0x41, 0x4c, 0x4c, 0x5f, 0x4f, 0x46, 0x10, 0x01, 0x12, 0x23, 0x0a, 0x1f, 0x41, 0x54,
-	0x54, 0x52, 0x49, 0x42, 0x55, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54, 0x59, 0x50,
-	0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x41, 0x4e, 0x59, 0x5f, 0x4f, 0x46, 0x10, 0x02, 0x12,
-	0x26, 0x0a, 0x22, 0x41, 0x54, 0x54, 0x52, 0x49, 0x42, 0x55, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c,
-	0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x48, 0x49, 0x45, 0x52,
-	0x41, 0x52, 0x43, 0x48, 0x59, 0x10, 0x03, 0x2a, 0xca, 0x01, 0x0a, 0x1a, 0x53, 0x75, 0x62, 0x6a,
-	0x65, 0x63, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74,
-	0x6f, 0x72, 0x45, 0x6e, 0x75, 0x6d, 0x12, 0x2d, 0x0a, 0x29, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43,
-	0x54, 0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54,
-	0x4f, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46,
-	0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x24, 0x0a, 0x20, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43, 0x54,
-	0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x4f,
-	0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x49, 0x4e, 0x10, 0x01, 0x12, 0x28, 0x0a, 0x24, 0x53,
-	0x55, 0x42, 0x4a, 0x45, 0x43, 0x54, 0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f,
-	0x50, 0x45, 0x52, 0x41, 0x54, 0x4f, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x4e, 0x4f, 0x54,
-	0x5f, 0x49, 0x4e, 0x10, 0x02, 0x12, 0x2d, 0x0a, 0x29, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43, 0x54,
-	0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x4f,
-	0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x49, 0x4e, 0x5f, 0x43, 0x4f, 0x4e, 0x54, 0x41, 0x49,
-	0x4e, 0x53, 0x10, 0x03, 0x2a, 0x90, 0x01, 0x0a, 0x18, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69,
-	0x6f, 0x6e, 0x42, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x45, 0x6e, 0x75,
-	0x6d, 0x12, 0x2b, 0x0a, 0x27, 0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x42,
-	0x4f, 0x4f, 0x4c, 0x45, 0x41, 0x4e, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d,
+	0x66, 0x69, 0x67, 0x12, 0x16, 0x0a, 0x06, 0x6c, 0x65, 0x67, 0x61, 0x63, 0x79, 0x18, 0x09, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x06, 0x6c, 0x65, 0x67, 0x61, 0x63, 0x79, 0x12, 0x2c, 0x0a, 0x08, 0x6d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e,
+	0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52,
+	0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x9e, 0x02, 0x0a, 0x0c, 0x53, 0x79,
+	0x6d, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x15, 0x0a, 0x06, 0x6b, 0x65,
+	0x79, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6b, 0x65, 0x79, 0x49,
+	0x64, 0x12, 0x30, 0x0a, 0x0a, 0x6b, 0x65, 0x79, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x11, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b,
+	0x65, 0x79, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x09, 0x6b, 0x65, 0x79, 0x53, 0x74, 0x61,
+	0x74, 0x75, 0x73, 0x12, 0x2a, 0x0a, 0x08, 0x6b, 0x65, 0x79, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x0f, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b,
+	0x65, 0x79, 0x4d, 0x6f, 0x64, 0x65, 0x52, 0x07, 0x6b, 0x65, 0x79, 0x4d, 0x6f, 0x64, 0x65, 0x12,
+	0x17, 0x0a, 0x07, 0x6b, 0x65, 0x79, 0x5f, 0x63, 0x74, 0x78, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0c,
+	0x52, 0x06, 0x6b, 0x65, 0x79, 0x43, 0x74, 0x78, 0x12, 0x42, 0x0a, 0x0f, 0x70, 0x72, 0x6f, 0x76,
+	0x69, 0x64, 0x65, 0x72, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x06, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x19, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x65, 0x79, 0x50, 0x72,
+	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0e, 0x70, 0x72,
+	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x2c, 0x0a, 0x08,
+	0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10,
+	0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x2a, 0xb3, 0x01, 0x0a, 0x15, 0x41,
+	0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x52, 0x75, 0x6c, 0x65, 0x54, 0x79, 0x70, 0x65,
+	0x45, 0x6e, 0x75, 0x6d, 0x12, 0x28, 0x0a, 0x24, 0x41, 0x54, 0x54, 0x52, 0x49, 0x42, 0x55, 0x54,
+	0x45, 0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d,
 	0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x23,
-	0x0a, 0x1f, 0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x42, 0x4f, 0x4f, 0x4c,
-	0x45, 0x41, 0x4e, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x41, 0x4e,
-	0x44, 0x10, 0x01, 0x12, 0x22, 0x0a, 0x1e, 0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e,
-	0x5f, 0x42, 0x4f, 0x4f, 0x4c, 0x45, 0x41, 0x4e, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e,
-	0x55, 0x4d, 0x5f, 0x4f, 0x52, 0x10, 0x02, 0x2a, 0x5d, 0x0a, 0x0a, 0x53, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x1b, 0x0a, 0x17, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f,
-	0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44,
-	0x10, 0x00, 0x12, 0x18, 0x0a, 0x14, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x54, 0x59, 0x50,
-	0x45, 0x5f, 0x49, 0x4e, 0x54, 0x45, 0x52, 0x4e, 0x41, 0x4c, 0x10, 0x01, 0x12, 0x18, 0x0a, 0x14,
-	0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x58, 0x54, 0x45,
-	0x52, 0x4e, 0x41, 0x4c, 0x10, 0x02, 0x2a, 0x9b, 0x03, 0x0a, 0x13, 0x4b, 0x61, 0x73, 0x50, 0x75,
-	0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x41, 0x6c, 0x67, 0x45, 0x6e, 0x75, 0x6d, 0x12, 0x27,
-	0x0a, 0x23, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59,
-	0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43,
-	0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x24, 0x0a, 0x20, 0x4b, 0x41, 0x53, 0x5f, 0x50,
-	0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e,
-	0x55, 0x4d, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x32, 0x30, 0x34, 0x38, 0x10, 0x01, 0x12, 0x24, 0x0a,
-	0x20, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f,
-	0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x34, 0x30, 0x39,
-	0x36, 0x10, 0x02, 0x12, 0x28, 0x0a, 0x24, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49,
-	0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x45,
-	0x43, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x32, 0x35, 0x36, 0x52, 0x31, 0x10, 0x05, 0x12, 0x28, 0x0a,
-	0x24, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f,
-	0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x45, 0x43, 0x5f, 0x53, 0x45, 0x43, 0x50,
-	0x33, 0x38, 0x34, 0x52, 0x31, 0x10, 0x06, 0x12, 0x28, 0x0a, 0x24, 0x4b, 0x41, 0x53, 0x5f, 0x50,
-	0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e,
-	0x55, 0x4d, 0x5f, 0x45, 0x43, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x35, 0x32, 0x31, 0x52, 0x31, 0x10,
-	0x07, 0x12, 0x26, 0x0a, 0x22, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f,
-	0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x48, 0x50, 0x51,
-	0x54, 0x5f, 0x58, 0x57, 0x49, 0x4e, 0x47, 0x10, 0x0a, 0x12, 0x33, 0x0a, 0x2f, 0x4b, 0x41, 0x53,
+	0x0a, 0x1f, 0x41, 0x54, 0x54, 0x52, 0x49, 0x42, 0x55, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c, 0x45,
+	0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x41, 0x4c, 0x4c, 0x5f, 0x4f,
+	0x46, 0x10, 0x01, 0x12, 0x23, 0x0a, 0x1f, 0x41, 0x54, 0x54, 0x52, 0x49, 0x42, 0x55, 0x54, 0x45,
+	0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f,
+	0x41, 0x4e, 0x59, 0x5f, 0x4f, 0x46, 0x10, 0x02, 0x12, 0x26, 0x0a, 0x22, 0x41, 0x54, 0x54, 0x52,
+	0x49, 0x42, 0x55, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f,
+	0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x48, 0x49, 0x45, 0x52, 0x41, 0x52, 0x43, 0x48, 0x59, 0x10, 0x03,
+	0x2a, 0xca, 0x01, 0x0a, 0x1a, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4d, 0x61, 0x70, 0x70,
+	0x69, 0x6e, 0x67, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x45, 0x6e, 0x75, 0x6d, 0x12,
+	0x2d, 0x0a, 0x29, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43, 0x54, 0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49,
+	0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x4f, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d,
+	0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x24,
+	0x0a, 0x20, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43, 0x54, 0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e,
+	0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x4f, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f,
+	0x49, 0x4e, 0x10, 0x01, 0x12, 0x28, 0x0a, 0x24, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43, 0x54, 0x5f,
+	0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x4f, 0x52,
+	0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x4e, 0x4f, 0x54, 0x5f, 0x49, 0x4e, 0x10, 0x02, 0x12, 0x2d,
+	0x0a, 0x29, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43, 0x54, 0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e,
+	0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x4f, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f,
+	0x49, 0x4e, 0x5f, 0x43, 0x4f, 0x4e, 0x54, 0x41, 0x49, 0x4e, 0x53, 0x10, 0x03, 0x2a, 0x90, 0x01,
+	0x0a, 0x18, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x6f, 0x6f, 0x6c, 0x65,
+	0x61, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x12, 0x2b, 0x0a, 0x27, 0x43, 0x4f,
+	0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x42, 0x4f, 0x4f, 0x4c, 0x45, 0x41, 0x4e, 0x5f,
+	0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43,
+	0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x23, 0x0a, 0x1f, 0x43, 0x4f, 0x4e, 0x44, 0x49,
+	0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x42, 0x4f, 0x4f, 0x4c, 0x45, 0x41, 0x4e, 0x5f, 0x54, 0x59, 0x50,
+	0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x41, 0x4e, 0x44, 0x10, 0x01, 0x12, 0x22, 0x0a, 0x1e,
+	0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x42, 0x4f, 0x4f, 0x4c, 0x45, 0x41,
+	0x4e, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x4f, 0x52, 0x10, 0x02,
+	0x2a, 0x9b, 0x02, 0x0a, 0x1f, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x43, 0x6f,
+	0x6d, 0x70, 0x61, 0x72, 0x69, 0x73, 0x6f, 0x6e, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72,
+	0x45, 0x6e, 0x75, 0x6d, 0x12, 0x32, 0x0a, 0x2e, 0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f,
+	0x4e, 0x5f, 0x43, 0x4f, 0x4d, 0x50, 0x41, 0x52, 0x49, 0x53, 0x4f, 0x4e, 0x5f, 0x4f, 0x50, 0x45,
+	0x52, 0x41, 0x54, 0x4f, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45,
+	0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x2d, 0x0a, 0x29, 0x43, 0x4f, 0x4e, 0x44,
+	0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x43, 0x4f, 0x4d, 0x50, 0x41, 0x52, 0x49, 0x53, 0x4f, 0x4e,
+	0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x4f, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x45,
+	0x51, 0x55, 0x41, 0x4c, 0x53, 0x10, 0x01, 0x12, 0x2f, 0x0a, 0x2b, 0x43, 0x4f, 0x4e, 0x44, 0x49,
+	0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x43, 0x4f, 0x4d, 0x50, 0x41, 0x52, 0x49, 0x53, 0x4f, 0x4e, 0x5f,
+	0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x4f, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x43, 0x4f,
+	0x4e, 0x54, 0x41, 0x49, 0x4e, 0x53, 0x10, 0x02, 0x12, 0x32, 0x0a, 0x2e, 0x43, 0x4f, 0x4e, 0x44,
+	0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x43, 0x4f, 0x4d, 0x50, 0x41, 0x52, 0x49, 0x53, 0x4f, 0x4e,
+	0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x4f, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x53,
+	0x54, 0x41, 0x52, 0x54, 0x53, 0x5f, 0x57, 0x49, 0x54, 0x48, 0x10, 0x03, 0x12, 0x30, 0x0a, 0x2c,
+	0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x43, 0x4f, 0x4d, 0x50, 0x41, 0x52,
+	0x49, 0x53, 0x4f, 0x4e, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x4f, 0x52, 0x5f, 0x45, 0x4e,
+	0x55, 0x4d, 0x5f, 0x45, 0x4e, 0x44, 0x53, 0x5f, 0x57, 0x49, 0x54, 0x48, 0x10, 0x04, 0x2a, 0xae,
+	0x01, 0x0a, 0x17, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x51, 0x75, 0x61, 0x6e,
+	0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x45, 0x6e, 0x75, 0x6d, 0x12, 0x29, 0x0a, 0x25, 0x43, 0x4f,
+	0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x51, 0x55, 0x41, 0x4e, 0x54, 0x49, 0x46, 0x49,
+	0x45, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46,
+	0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x21, 0x0a, 0x1d, 0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49,
+	0x4f, 0x4e, 0x5f, 0x51, 0x55, 0x41, 0x4e, 0x54, 0x49, 0x46, 0x49, 0x45, 0x52, 0x5f, 0x45, 0x4e,
+	0x55, 0x4d, 0x5f, 0x41, 0x4e, 0x59, 0x10, 0x01, 0x12, 0x21, 0x0a, 0x1d, 0x43, 0x4f, 0x4e, 0x44,
+	0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x51, 0x55, 0x41, 0x4e, 0x54, 0x49, 0x46, 0x49, 0x45, 0x52,
+	0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x41, 0x4c, 0x4c, 0x10, 0x02, 0x12, 0x22, 0x0a, 0x1e, 0x43,
+	0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x51, 0x55, 0x41, 0x4e, 0x54, 0x49, 0x46,
+	0x49, 0x45, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x4e, 0x4f, 0x4e, 0x45, 0x10, 0x03, 0x2a,
+	0x5d, 0x0a, 0x0a, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x1b, 0x0a,
+	0x17, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x4e, 0x53,
+	0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x18, 0x0a, 0x14, 0x53, 0x4f,
+	0x55, 0x52, 0x43, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x49, 0x4e, 0x54, 0x45, 0x52, 0x4e,
+	0x41, 0x4c, 0x10, 0x01, 0x12, 0x18, 0x0a, 0x14, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x54,
+	0x59, 0x50, 0x45, 0x5f, 0x45, 0x58, 0x54, 0x45, 0x52, 0x4e, 0x41, 0x4c, 0x10, 0x02, 0x2a, 0x9b,
+	0x03, 0x0a, 0x13, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x41,
+	0x6c, 0x67, 0x45, 0x6e, 0x75, 0x6d, 0x12, 0x27, 0x0a, 0x23, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55,
+	0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55,
+	0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12,
+	0x24, 0x0a, 0x20, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45,
+	0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x32,
+	0x30, 0x34, 0x38, 0x10, 0x01, 0x12, 0x24, 0x0a, 0x20, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42,
+	0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d,
+	0x5f, 0x52, 0x53, 0x41, 0x5f, 0x34, 0x30, 0x39, 0x36, 0x10, 0x02, 0x12, 0x28, 0x0a, 0x24, 0x4b,
+	0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c,
+	0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x45, 0x43, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x32, 0x35,
+	0x36, 0x52, 0x31, 0x10, 0x05, 0x12, 0x28, 0x0a, 0x24, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42,
+	0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d,
+	0x5f, 0x45, 0x43, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x33, 0x38, 0x34, 0x52, 0x31, 0x10, 0x06, 0x12,
+	0x28, 0x0a, 0x24, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45,
+	0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x45, 0x43, 0x5f, 0x53, 0x45,
+	0x43, 0x50, 0x35, 0x32, 0x31, 0x52, 0x31, 0x10, 0x07, 0x12, 0x26, 0x0a, 0x22, 0x4b, 0x41, 0x53,
 	0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f,
-	0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x48, 0x50, 0x51, 0x54, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x32, 0x35,
-	0x36, 0x52, 0x31, 0x5f, 0x4d, 0x4c, 0x4b, 0x45, 0x4d, 0x37, 0x36, 0x38, 0x10, 0x0b, 0x12, 0x34,
-	0x0a, 0x30, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59,
-	0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x48, 0x50, 0x51, 0x54, 0x5f, 0x53,
-	0x45, 0x43, 0x50, 0x33, 0x38, 0x34, 0x52, 0x31, 0x5f, 0x4d, 0x4c, 0x4b, 0x45, 0x4d, 0x31, 0x30,
-	0x32, 0x34, 0x10, 0x0c, 0x2a, 0x84, 0x02, 0x0a, 0x09, 0x41, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74,
-	0x68, 0x6d, 0x12, 0x19, 0x0a, 0x15, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f,
-	0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x16, 0x0a,
-	0x12, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x32,
-	0x30, 0x34, 0x38, 0x10, 0x01, 0x12, 0x16, 0x0a, 0x12, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54,
-	0x48, 0x4d, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x34, 0x30, 0x39, 0x36, 0x10, 0x02, 0x12, 0x15, 0x0a,
-	0x11, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x45, 0x43, 0x5f, 0x50, 0x32,
-	0x35, 0x36, 0x10, 0x03, 0x12, 0x15, 0x0a, 0x11, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48,
-	0x4d, 0x5f, 0x45, 0x43, 0x5f, 0x50, 0x33, 0x38, 0x34, 0x10, 0x04, 0x12, 0x15, 0x0a, 0x11, 0x41,
-	0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x45, 0x43, 0x5f, 0x50, 0x35, 0x32, 0x31,
-	0x10, 0x05, 0x12, 0x18, 0x0a, 0x14, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f,
-	0x48, 0x50, 0x51, 0x54, 0x5f, 0x58, 0x57, 0x49, 0x4e, 0x47, 0x10, 0x06, 0x12, 0x25, 0x0a, 0x21,
-	0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x48, 0x50, 0x51, 0x54, 0x5f, 0x53,
-	0x45, 0x43, 0x50, 0x32, 0x35, 0x36, 0x52, 0x31, 0x5f, 0x4d, 0x4c, 0x4b, 0x45, 0x4d, 0x37, 0x36,
-	0x38, 0x10, 0x07, 0x12, 0x26, 0x0a, 0x22, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d,
-	0x5f, 0x48, 0x50, 0x51, 0x54, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x33, 0x38, 0x34, 0x52, 0x31, 0x5f,
-	0x4d, 0x4c, 0x4b, 0x45, 0x4d, 0x31, 0x30, 0x32, 0x34, 0x10, 0x08, 0x2a, 0x56, 0x0a, 0x09, 0x4b,
-	0x65, 0x79, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x1a, 0x0a, 0x16, 0x4b, 0x45, 0x59, 0x5f,
-	0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49,
-	0x45, 0x44, 0x10, 0x00, 0x12, 0x15, 0x0a, 0x11, 0x4b, 0x45, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54,
-	0x55, 0x53, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x56, 0x45, 0x10, 0x01, 0x12, 0x16, 0x0a, 0x12, 0x4b,
-	0x45, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x52, 0x4f, 0x54, 0x41, 0x54, 0x45,
-	0x44, 0x10, 0x02, 0x2a, 0x94, 0x01, 0x0a, 0x07, 0x4b, 0x65, 0x79, 0x4d, 0x6f, 0x64, 0x65, 0x12,
-	0x18, 0x0a, 0x14, 0x4b, 0x45, 0x59, 0x5f, 0x4d, 0x4f, 0x44, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50,
-	0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x1c, 0x0a, 0x18, 0x4b, 0x45, 0x59,
-	0x5f, 0x4d, 0x4f, 0x44, 0x45, 0x5f, 0x43, 0x4f, 0x4e, 0x46, 0x49, 0x47, 0x5f, 0x52, 0x4f, 0x4f,
-	0x54, 0x5f, 0x4b, 0x45, 0x59, 0x10, 0x01, 0x12, 0x1e, 0x0a, 0x1a, 0x4b, 0x45, 0x59, 0x5f, 0x4d,
-	0x4f, 0x44, 0x45, 0x5f, 0x50, 0x52, 0x4f, 0x56, 0x49, 0x44, 0x45, 0x52, 0x5f, 0x52, 0x4f, 0x4f,
-	0x54, 0x5f, 0x4b, 0x45, 0x59, 0x10, 0x02, 0x12, 0x13, 0x0a, 0x0f, 0x4b, 0x45, 0x59, 0x5f, 0x4d,
-	0x4f, 0x44, 0x45, 0x5f, 0x52, 0x45, 0x4d, 0x4f, 0x54, 0x45, 0x10, 0x03, 0x12, 0x1c, 0x0a, 0x18,
-	0x4b, 0x45, 0x59, 0x5f, 0x4d, 0x4f, 0x44, 0x45, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f,
-	0x4b, 0x45, 0x59, 0x5f, 0x4f, 0x4e, 0x4c, 0x59, 0x10, 0x04, 0x42, 0x82, 0x01, 0x0a, 0x0a, 0x63,
-	0x6f, 0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x42, 0x0c, 0x4f, 0x62, 0x6a, 0x65, 0x63,
-	0x74, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x2e, 0x67, 0x69, 0x74, 0x68, 0x75,
-	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c,
-	0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f,
-	0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xa2, 0x02, 0x03, 0x50, 0x58, 0x58, 0xaa,
-	0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xca, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63,
-	0x79, 0xe2, 0x02, 0x12, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65,
-	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x62,
-	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x48, 0x50, 0x51, 0x54, 0x5f, 0x58, 0x57, 0x49, 0x4e, 0x47, 0x10,
+	0x0a, 0x12, 0x33, 0x0a, 0x2f, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f,
+	0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x48, 0x50, 0x51,
+	0x54, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x32, 0x35, 0x36, 0x52, 0x31, 0x5f, 0x4d, 0x4c, 0x4b, 0x45,
+	0x4d, 0x37, 0x36, 0x38, 0x10, 0x0b, 0x12, 0x34, 0x0a, 0x30, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55,
+	0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55,
+	0x4d, 0x5f, 0x48, 0x50, 0x51, 0x54, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x33, 0x38, 0x34, 0x52, 0x31,
+	0x5f, 0x4d, 0x4c, 0x4b, 0x45, 0x4d, 0x31, 0x30, 0x32, 0x34, 0x10, 0x0c, 0x2a, 0x84, 0x02, 0x0a,
+	0x09, 0x41, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x12, 0x19, 0x0a, 0x15, 0x41, 0x4c,
+	0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46,
+	0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x16, 0x0a, 0x12, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54,
+	0x48, 0x4d, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x32, 0x30, 0x34, 0x38, 0x10, 0x01, 0x12, 0x16, 0x0a,
+	0x12, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x34,
+	0x30, 0x39, 0x36, 0x10, 0x02, 0x12, 0x15, 0x0a, 0x11, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54,
+	0x48, 0x4d, 0x5f, 0x45, 0x43, 0x5f, 0x50, 0x32, 0x35, 0x36, 0x10, 0x03, 0x12, 0x15, 0x0a, 0x11,
+	0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x45, 0x43, 0x5f, 0x50, 0x33, 0x38,
+	0x34, 0x10, 0x04, 0x12, 0x15, 0x0a, 0x11, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d,
+	0x5f, 0x45, 0x43, 0x5f, 0x50, 0x35, 0x32, 0x31, 0x10, 0x05, 0x12, 0x18, 0x0a, 0x14, 0x41, 0x4c,
+	0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x48, 0x50, 0x51, 0x54, 0x5f, 0x58, 0x57, 0x49,
+	0x4e, 0x47, 0x10, 0x06, 0x12, 0x25, 0x0a, 0x21, 0x41, 0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48,
+	0x4d, 0x5f, 0x48, 0x50, 0x51, 0x54, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x32, 0x35, 0x36, 0x52, 0x31,
+	0x5f, 0x4d, 0x4c, 0x4b, 0x45, 0x4d, 0x37, 0x36, 0x38, 0x10, 0x07, 0x12, 0x26, 0x0a, 0x22, 0x41,
+	0x4c, 0x47, 0x4f, 0x52, 0x49, 0x54, 0x48, 0x4d, 0x5f, 0x48, 0x50, 0x51, 0x54, 0x5f, 0x53, 0x45,
+	0x43, 0x50, 0x33, 0x38, 0x34, 0x52, 0x31, 0x5f, 0x4d, 0x4c, 0x4b, 0x45, 0x4d, 0x31, 0x30, 0x32,
+	0x34, 0x10, 0x08, 0x2a, 0x56, 0x0a, 0x09, 0x4b, 0x65, 0x79, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
+	0x12, 0x1a, 0x0a, 0x16, 0x4b, 0x45, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x55,
+	0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x15, 0x0a, 0x11,
+	0x4b, 0x45, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x56,
+	0x45, 0x10, 0x01, 0x12, 0x16, 0x0a, 0x12, 0x4b, 0x45, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55,
+	0x53, 0x5f, 0x52, 0x4f, 0x54, 0x41, 0x54, 0x45, 0x44, 0x10, 0x02, 0x2a, 0x94, 0x01, 0x0a, 0x07,
+	0x4b, 0x65, 0x79, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x18, 0x0a, 0x14, 0x4b, 0x45, 0x59, 0x5f, 0x4d,
+	0x4f, 0x44, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10,
+	0x00, 0x12, 0x1c, 0x0a, 0x18, 0x4b, 0x45, 0x59, 0x5f, 0x4d, 0x4f, 0x44, 0x45, 0x5f, 0x43, 0x4f,
+	0x4e, 0x46, 0x49, 0x47, 0x5f, 0x52, 0x4f, 0x4f, 0x54, 0x5f, 0x4b, 0x45, 0x59, 0x10, 0x01, 0x12,
+	0x1e, 0x0a, 0x1a, 0x4b, 0x45, 0x59, 0x5f, 0x4d, 0x4f, 0x44, 0x45, 0x5f, 0x50, 0x52, 0x4f, 0x56,
+	0x49, 0x44, 0x45, 0x52, 0x5f, 0x52, 0x4f, 0x4f, 0x54, 0x5f, 0x4b, 0x45, 0x59, 0x10, 0x02, 0x12,
+	0x13, 0x0a, 0x0f, 0x4b, 0x45, 0x59, 0x5f, 0x4d, 0x4f, 0x44, 0x45, 0x5f, 0x52, 0x45, 0x4d, 0x4f,
+	0x54, 0x45, 0x10, 0x03, 0x12, 0x1c, 0x0a, 0x18, 0x4b, 0x45, 0x59, 0x5f, 0x4d, 0x4f, 0x44, 0x45,
+	0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x4f, 0x4e, 0x4c, 0x59,
+	0x10, 0x04, 0x42, 0x82, 0x01, 0x0a, 0x0a, 0x63, 0x6f, 0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63,
+	0x79, 0x42, 0x0c, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50,
+	0x01, 0x5a, 0x2e, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70,
+	0x65, 0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63,
+	0x79, 0xa2, 0x02, 0x03, 0x50, 0x58, 0x58, 0xaa, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0xca, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xe2, 0x02, 0x12, 0x50, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02,
+	0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -3841,149 +4255,164 @@ func file_policy_objects_proto_rawDescGZIP() []byte {
 	return file_policy_objects_proto_rawDescData
 }
 
-var file_policy_objects_proto_enumTypes = make([]protoimpl.EnumInfo, 9)
-var file_policy_objects_proto_msgTypes = make([]protoimpl.MessageInfo, 33)
+var file_policy_objects_proto_enumTypes = make([]protoimpl.EnumInfo, 11)
+var file_policy_objects_proto_msgTypes = make([]protoimpl.MessageInfo, 35)
 var file_policy_objects_proto_goTypes = []interface{}{
-	(AttributeRuleTypeEnum)(0),      // 0: policy.AttributeRuleTypeEnum
-	(SubjectMappingOperatorEnum)(0), // 1: policy.SubjectMappingOperatorEnum
-	(ConditionBooleanTypeEnum)(0),   // 2: policy.ConditionBooleanTypeEnum
-	(SourceType)(0),                 // 3: policy.SourceType
-	(KasPublicKeyAlgEnum)(0),        // 4: policy.KasPublicKeyAlgEnum
-	(Algorithm)(0),                  // 5: policy.Algorithm
-	(KeyStatus)(0),                  // 6: policy.KeyStatus
-	(KeyMode)(0),                    // 7: policy.KeyMode
-	(Action_StandardAction)(0),      // 8: policy.Action.StandardAction
-	(*SimpleKasPublicKey)(nil),      // 9: policy.SimpleKasPublicKey
-	(*SimpleKasKey)(nil),            // 10: policy.SimpleKasKey
-	(*KeyProviderConfig)(nil),       // 11: policy.KeyProviderConfig
-	(*Namespace)(nil),               // 12: policy.Namespace
-	(*Attribute)(nil),               // 13: policy.Attribute
-	(*Value)(nil),                   // 14: policy.Value
-	(*Action)(nil),                  // 15: policy.Action
-	(*SubjectMapping)(nil),          // 16: policy.SubjectMapping
-	(*Condition)(nil),               // 17: policy.Condition
-	(*ConditionGroup)(nil),          // 18: policy.ConditionGroup
-	(*SubjectSet)(nil),              // 19: policy.SubjectSet
-	(*SubjectConditionSet)(nil),     // 20: policy.SubjectConditionSet
-	(*SubjectProperty)(nil),         // 21: policy.SubjectProperty
-	(*ResourceMappingGroup)(nil),    // 22: policy.ResourceMappingGroup
-	(*ResourceMapping)(nil),         // 23: policy.ResourceMapping
-	(*KeyAccessServer)(nil),         // 24: policy.KeyAccessServer
-	(*Key)(nil),                     // 25: policy.Key
-	(*KasPublicKey)(nil),            // 26: policy.KasPublicKey
-	(*KasPublicKeySet)(nil),         // 27: policy.KasPublicKeySet
-	(*PublicKey)(nil),               // 28: policy.PublicKey
-	(*RegisteredResource)(nil),      // 29: policy.RegisteredResource
-	(*RegisteredResourceValue)(nil), // 30: policy.RegisteredResourceValue
-	(*PolicyEnforcementPoint)(nil),  // 31: policy.PolicyEnforcementPoint
-	(*RequestContext)(nil),          // 32: policy.RequestContext
-	(*Obligation)(nil),              // 33: policy.Obligation
-	(*ObligationValue)(nil),         // 34: policy.ObligationValue
-	(*ObligationTrigger)(nil),       // 35: policy.ObligationTrigger
-	(*KasKey)(nil),                  // 36: policy.KasKey
-	(*PublicKeyCtx)(nil),            // 37: policy.PublicKeyCtx
-	(*PrivateKeyCtx)(nil),           // 38: policy.PrivateKeyCtx
-	(*AsymmetricKey)(nil),           // 39: policy.AsymmetricKey
-	(*SymmetricKey)(nil),            // 40: policy.SymmetricKey
-	(*RegisteredResourceValue_ActionAttributeValue)(nil), // 41: policy.RegisteredResourceValue.ActionAttributeValue
-	(*common.Metadata)(nil),                              // 42: common.Metadata
-	(*wrapperspb.BoolValue)(nil),                         // 43: google.protobuf.BoolValue
+	(AttributeRuleTypeEnum)(0),                           // 0: policy.AttributeRuleTypeEnum
+	(SubjectMappingOperatorEnum)(0),                      // 1: policy.SubjectMappingOperatorEnum
+	(ConditionBooleanTypeEnum)(0),                        // 2: policy.ConditionBooleanTypeEnum
+	(ConditionComparisonOperatorEnum)(0),                 // 3: policy.ConditionComparisonOperatorEnum
+	(ConditionQuantifierEnum)(0),                         // 4: policy.ConditionQuantifierEnum
+	(SourceType)(0),                                      // 5: policy.SourceType
+	(KasPublicKeyAlgEnum)(0),                             // 6: policy.KasPublicKeyAlgEnum
+	(Algorithm)(0),                                       // 7: policy.Algorithm
+	(KeyStatus)(0),                                       // 8: policy.KeyStatus
+	(KeyMode)(0),                                         // 9: policy.KeyMode
+	(Action_StandardAction)(0),                           // 10: policy.Action.StandardAction
+	(*SimpleKasPublicKey)(nil),                           // 11: policy.SimpleKasPublicKey
+	(*SimpleKasKey)(nil),                                 // 12: policy.SimpleKasKey
+	(*KeyProviderConfig)(nil),                            // 13: policy.KeyProviderConfig
+	(*Namespace)(nil),                                    // 14: policy.Namespace
+	(*Attribute)(nil),                                    // 15: policy.Attribute
+	(*Value)(nil),                                        // 16: policy.Value
+	(*Action)(nil),                                       // 17: policy.Action
+	(*SubjectMapping)(nil),                               // 18: policy.SubjectMapping
+	(*DynamicValueResolver)(nil),                         // 19: policy.DynamicValueResolver
+	(*DynamicValueMapping)(nil),                          // 20: policy.DynamicValueMapping
+	(*Condition)(nil),                                    // 21: policy.Condition
+	(*ConditionGroup)(nil),                               // 22: policy.ConditionGroup
+	(*SubjectSet)(nil),                                   // 23: policy.SubjectSet
+	(*SubjectConditionSet)(nil),                          // 24: policy.SubjectConditionSet
+	(*SubjectProperty)(nil),                              // 25: policy.SubjectProperty
+	(*ResourceMappingGroup)(nil),                         // 26: policy.ResourceMappingGroup
+	(*ResourceMapping)(nil),                              // 27: policy.ResourceMapping
+	(*KeyAccessServer)(nil),                              // 28: policy.KeyAccessServer
+	(*Key)(nil),                                          // 29: policy.Key
+	(*KasPublicKey)(nil),                                 // 30: policy.KasPublicKey
+	(*KasPublicKeySet)(nil),                              // 31: policy.KasPublicKeySet
+	(*PublicKey)(nil),                                    // 32: policy.PublicKey
+	(*RegisteredResource)(nil),                           // 33: policy.RegisteredResource
+	(*RegisteredResourceValue)(nil),                      // 34: policy.RegisteredResourceValue
+	(*PolicyEnforcementPoint)(nil),                       // 35: policy.PolicyEnforcementPoint
+	(*RequestContext)(nil),                               // 36: policy.RequestContext
+	(*Obligation)(nil),                                   // 37: policy.Obligation
+	(*ObligationValue)(nil),                              // 38: policy.ObligationValue
+	(*ObligationTrigger)(nil),                            // 39: policy.ObligationTrigger
+	(*KasKey)(nil),                                       // 40: policy.KasKey
+	(*PublicKeyCtx)(nil),                                 // 41: policy.PublicKeyCtx
+	(*PrivateKeyCtx)(nil),                                // 42: policy.PrivateKeyCtx
+	(*AsymmetricKey)(nil),                                // 43: policy.AsymmetricKey
+	(*SymmetricKey)(nil),                                 // 44: policy.SymmetricKey
+	(*RegisteredResourceValue_ActionAttributeValue)(nil), // 45: policy.RegisteredResourceValue.ActionAttributeValue
+	(*common.Metadata)(nil),                              // 46: common.Metadata
+	(*wrapperspb.BoolValue)(nil),                         // 47: google.protobuf.BoolValue
 }
 var file_policy_objects_proto_depIdxs = []int32{
-	5,  // 0: policy.SimpleKasPublicKey.algorithm:type_name -> policy.Algorithm
-	9,  // 1: policy.SimpleKasKey.public_key:type_name -> policy.SimpleKasPublicKey
-	42, // 2: policy.KeyProviderConfig.metadata:type_name -> common.Metadata
-	43, // 3: policy.Namespace.active:type_name -> google.protobuf.BoolValue
-	42, // 4: policy.Namespace.metadata:type_name -> common.Metadata
-	24, // 5: policy.Namespace.grants:type_name -> policy.KeyAccessServer
-	10, // 6: policy.Namespace.kas_keys:type_name -> policy.SimpleKasKey
-	12, // 7: policy.Attribute.namespace:type_name -> policy.Namespace
-	0,  // 8: policy.Attribute.rule:type_name -> policy.AttributeRuleTypeEnum
-	14, // 9: policy.Attribute.values:type_name -> policy.Value
-	24, // 10: policy.Attribute.grants:type_name -> policy.KeyAccessServer
-	43, // 11: policy.Attribute.active:type_name -> google.protobuf.BoolValue
-	10, // 12: policy.Attribute.kas_keys:type_name -> policy.SimpleKasKey
-	43, // 13: policy.Attribute.allow_traversal:type_name -> google.protobuf.BoolValue
-	42, // 14: policy.Attribute.metadata:type_name -> common.Metadata
-	13, // 15: policy.Value.attribute:type_name -> policy.Attribute
-	24, // 16: policy.Value.grants:type_name -> policy.KeyAccessServer
-	43, // 17: policy.Value.active:type_name -> google.protobuf.BoolValue
-	16, // 18: policy.Value.subject_mappings:type_name -> policy.SubjectMapping
-	10, // 19: policy.Value.kas_keys:type_name -> policy.SimpleKasKey
-	23, // 20: policy.Value.resource_mappings:type_name -> policy.ResourceMapping
-	33, // 21: policy.Value.obligations:type_name -> policy.Obligation
-	42, // 22: policy.Value.metadata:type_name -> common.Metadata
-	8,  // 23: policy.Action.standard:type_name -> policy.Action.StandardAction
-	12, // 24: policy.Action.namespace:type_name -> policy.Namespace
-	42, // 25: policy.Action.metadata:type_name -> common.Metadata
-	14, // 26: policy.SubjectMapping.attribute_value:type_name -> policy.Value
-	20, // 27: policy.SubjectMapping.subject_condition_set:type_name -> policy.SubjectConditionSet
-	15, // 28: policy.SubjectMapping.actions:type_name -> policy.Action
-	12, // 29: policy.SubjectMapping.namespace:type_name -> policy.Namespace
-	42, // 30: policy.SubjectMapping.metadata:type_name -> common.Metadata
-	1,  // 31: policy.Condition.operator:type_name -> policy.SubjectMappingOperatorEnum
-	17, // 32: policy.ConditionGroup.conditions:type_name -> policy.Condition
-	2,  // 33: policy.ConditionGroup.boolean_operator:type_name -> policy.ConditionBooleanTypeEnum
-	18, // 34: policy.SubjectSet.condition_groups:type_name -> policy.ConditionGroup
-	12, // 35: policy.SubjectConditionSet.namespace:type_name -> policy.Namespace
-	19, // 36: policy.SubjectConditionSet.subject_sets:type_name -> policy.SubjectSet
-	42, // 37: policy.SubjectConditionSet.metadata:type_name -> common.Metadata
-	42, // 38: policy.ResourceMappingGroup.metadata:type_name -> common.Metadata
-	42, // 39: policy.ResourceMapping.metadata:type_name -> common.Metadata
-	14, // 40: policy.ResourceMapping.attribute_value:type_name -> policy.Value
-	22, // 41: policy.ResourceMapping.group:type_name -> policy.ResourceMappingGroup
-	12, // 42: policy.ResourceMapping.namespace:type_name -> policy.Namespace
-	28, // 43: policy.KeyAccessServer.public_key:type_name -> policy.PublicKey
-	3,  // 44: policy.KeyAccessServer.source_type:type_name -> policy.SourceType
-	10, // 45: policy.KeyAccessServer.kas_keys:type_name -> policy.SimpleKasKey
-	42, // 46: policy.KeyAccessServer.metadata:type_name -> common.Metadata
-	43, // 47: policy.Key.is_active:type_name -> google.protobuf.BoolValue
-	43, // 48: policy.Key.was_mapped:type_name -> google.protobuf.BoolValue
-	26, // 49: policy.Key.public_key:type_name -> policy.KasPublicKey
-	24, // 50: policy.Key.kas:type_name -> policy.KeyAccessServer
-	42, // 51: policy.Key.metadata:type_name -> common.Metadata
-	4,  // 52: policy.KasPublicKey.alg:type_name -> policy.KasPublicKeyAlgEnum
-	26, // 53: policy.KasPublicKeySet.keys:type_name -> policy.KasPublicKey
-	27, // 54: policy.PublicKey.cached:type_name -> policy.KasPublicKeySet
-	30, // 55: policy.RegisteredResource.values:type_name -> policy.RegisteredResourceValue
-	12, // 56: policy.RegisteredResource.namespace:type_name -> policy.Namespace
-	42, // 57: policy.RegisteredResource.metadata:type_name -> common.Metadata
-	29, // 58: policy.RegisteredResourceValue.resource:type_name -> policy.RegisteredResource
-	41, // 59: policy.RegisteredResourceValue.action_attribute_values:type_name -> policy.RegisteredResourceValue.ActionAttributeValue
-	42, // 60: policy.RegisteredResourceValue.metadata:type_name -> common.Metadata
-	31, // 61: policy.RequestContext.pep:type_name -> policy.PolicyEnforcementPoint
-	12, // 62: policy.Obligation.namespace:type_name -> policy.Namespace
-	34, // 63: policy.Obligation.values:type_name -> policy.ObligationValue
-	42, // 64: policy.Obligation.metadata:type_name -> common.Metadata
-	33, // 65: policy.ObligationValue.obligation:type_name -> policy.Obligation
-	35, // 66: policy.ObligationValue.triggers:type_name -> policy.ObligationTrigger
-	42, // 67: policy.ObligationValue.metadata:type_name -> common.Metadata
-	34, // 68: policy.ObligationTrigger.obligation_value:type_name -> policy.ObligationValue
-	15, // 69: policy.ObligationTrigger.action:type_name -> policy.Action
-	14, // 70: policy.ObligationTrigger.attribute_value:type_name -> policy.Value
-	32, // 71: policy.ObligationTrigger.context:type_name -> policy.RequestContext
-	12, // 72: policy.ObligationTrigger.namespace:type_name -> policy.Namespace
-	42, // 73: policy.ObligationTrigger.metadata:type_name -> common.Metadata
-	39, // 74: policy.KasKey.key:type_name -> policy.AsymmetricKey
-	5,  // 75: policy.AsymmetricKey.key_algorithm:type_name -> policy.Algorithm
-	6,  // 76: policy.AsymmetricKey.key_status:type_name -> policy.KeyStatus
-	7,  // 77: policy.AsymmetricKey.key_mode:type_name -> policy.KeyMode
-	37, // 78: policy.AsymmetricKey.public_key_ctx:type_name -> policy.PublicKeyCtx
-	38, // 79: policy.AsymmetricKey.private_key_ctx:type_name -> policy.PrivateKeyCtx
-	11, // 80: policy.AsymmetricKey.provider_config:type_name -> policy.KeyProviderConfig
-	42, // 81: policy.AsymmetricKey.metadata:type_name -> common.Metadata
-	6,  // 82: policy.SymmetricKey.key_status:type_name -> policy.KeyStatus
-	7,  // 83: policy.SymmetricKey.key_mode:type_name -> policy.KeyMode
-	11, // 84: policy.SymmetricKey.provider_config:type_name -> policy.KeyProviderConfig
-	42, // 85: policy.SymmetricKey.metadata:type_name -> common.Metadata
-	15, // 86: policy.RegisteredResourceValue.ActionAttributeValue.action:type_name -> policy.Action
-	14, // 87: policy.RegisteredResourceValue.ActionAttributeValue.attribute_value:type_name -> policy.Value
-	42, // 88: policy.RegisteredResourceValue.ActionAttributeValue.metadata:type_name -> common.Metadata
-	89, // [89:89] is the sub-list for method output_type
-	89, // [89:89] is the sub-list for method input_type
-	89, // [89:89] is the sub-list for extension type_name
-	89, // [89:89] is the sub-list for extension extendee
-	0,  // [0:89] is the sub-list for field type_name
+	7,   // 0: policy.SimpleKasPublicKey.algorithm:type_name -> policy.Algorithm
+	11,  // 1: policy.SimpleKasKey.public_key:type_name -> policy.SimpleKasPublicKey
+	46,  // 2: policy.KeyProviderConfig.metadata:type_name -> common.Metadata
+	47,  // 3: policy.Namespace.active:type_name -> google.protobuf.BoolValue
+	46,  // 4: policy.Namespace.metadata:type_name -> common.Metadata
+	28,  // 5: policy.Namespace.grants:type_name -> policy.KeyAccessServer
+	12,  // 6: policy.Namespace.kas_keys:type_name -> policy.SimpleKasKey
+	14,  // 7: policy.Attribute.namespace:type_name -> policy.Namespace
+	0,   // 8: policy.Attribute.rule:type_name -> policy.AttributeRuleTypeEnum
+	16,  // 9: policy.Attribute.values:type_name -> policy.Value
+	28,  // 10: policy.Attribute.grants:type_name -> policy.KeyAccessServer
+	47,  // 11: policy.Attribute.active:type_name -> google.protobuf.BoolValue
+	12,  // 12: policy.Attribute.kas_keys:type_name -> policy.SimpleKasKey
+	47,  // 13: policy.Attribute.allow_traversal:type_name -> google.protobuf.BoolValue
+	46,  // 14: policy.Attribute.metadata:type_name -> common.Metadata
+	15,  // 15: policy.Value.attribute:type_name -> policy.Attribute
+	28,  // 16: policy.Value.grants:type_name -> policy.KeyAccessServer
+	47,  // 17: policy.Value.active:type_name -> google.protobuf.BoolValue
+	18,  // 18: policy.Value.subject_mappings:type_name -> policy.SubjectMapping
+	12,  // 19: policy.Value.kas_keys:type_name -> policy.SimpleKasKey
+	27,  // 20: policy.Value.resource_mappings:type_name -> policy.ResourceMapping
+	37,  // 21: policy.Value.obligations:type_name -> policy.Obligation
+	46,  // 22: policy.Value.metadata:type_name -> common.Metadata
+	10,  // 23: policy.Action.standard:type_name -> policy.Action.StandardAction
+	14,  // 24: policy.Action.namespace:type_name -> policy.Namespace
+	46,  // 25: policy.Action.metadata:type_name -> common.Metadata
+	16,  // 26: policy.SubjectMapping.attribute_value:type_name -> policy.Value
+	24,  // 27: policy.SubjectMapping.subject_condition_set:type_name -> policy.SubjectConditionSet
+	17,  // 28: policy.SubjectMapping.actions:type_name -> policy.Action
+	14,  // 29: policy.SubjectMapping.namespace:type_name -> policy.Namespace
+	46,  // 30: policy.SubjectMapping.metadata:type_name -> common.Metadata
+	3,   // 31: policy.DynamicValueResolver.comparison:type_name -> policy.ConditionComparisonOperatorEnum
+	47,  // 32: policy.DynamicValueResolver.case_insensitive:type_name -> google.protobuf.BoolValue
+	15,  // 33: policy.DynamicValueMapping.attribute_definition:type_name -> policy.Attribute
+	19,  // 34: policy.DynamicValueMapping.value_resolver:type_name -> policy.DynamicValueResolver
+	24,  // 35: policy.DynamicValueMapping.subject_condition_set:type_name -> policy.SubjectConditionSet
+	17,  // 36: policy.DynamicValueMapping.actions:type_name -> policy.Action
+	14,  // 37: policy.DynamicValueMapping.namespace:type_name -> policy.Namespace
+	46,  // 38: policy.DynamicValueMapping.metadata:type_name -> common.Metadata
+	1,   // 39: policy.Condition.operator:type_name -> policy.SubjectMappingOperatorEnum
+	3,   // 40: policy.Condition.comparison:type_name -> policy.ConditionComparisonOperatorEnum
+	4,   // 41: policy.Condition.quantifier:type_name -> policy.ConditionQuantifierEnum
+	47,  // 42: policy.Condition.case_insensitive:type_name -> google.protobuf.BoolValue
+	21,  // 43: policy.ConditionGroup.conditions:type_name -> policy.Condition
+	2,   // 44: policy.ConditionGroup.boolean_operator:type_name -> policy.ConditionBooleanTypeEnum
+	22,  // 45: policy.SubjectSet.condition_groups:type_name -> policy.ConditionGroup
+	14,  // 46: policy.SubjectConditionSet.namespace:type_name -> policy.Namespace
+	23,  // 47: policy.SubjectConditionSet.subject_sets:type_name -> policy.SubjectSet
+	46,  // 48: policy.SubjectConditionSet.metadata:type_name -> common.Metadata
+	46,  // 49: policy.ResourceMappingGroup.metadata:type_name -> common.Metadata
+	46,  // 50: policy.ResourceMapping.metadata:type_name -> common.Metadata
+	16,  // 51: policy.ResourceMapping.attribute_value:type_name -> policy.Value
+	26,  // 52: policy.ResourceMapping.group:type_name -> policy.ResourceMappingGroup
+	14,  // 53: policy.ResourceMapping.namespace:type_name -> policy.Namespace
+	32,  // 54: policy.KeyAccessServer.public_key:type_name -> policy.PublicKey
+	5,   // 55: policy.KeyAccessServer.source_type:type_name -> policy.SourceType
+	12,  // 56: policy.KeyAccessServer.kas_keys:type_name -> policy.SimpleKasKey
+	46,  // 57: policy.KeyAccessServer.metadata:type_name -> common.Metadata
+	47,  // 58: policy.Key.is_active:type_name -> google.protobuf.BoolValue
+	47,  // 59: policy.Key.was_mapped:type_name -> google.protobuf.BoolValue
+	30,  // 60: policy.Key.public_key:type_name -> policy.KasPublicKey
+	28,  // 61: policy.Key.kas:type_name -> policy.KeyAccessServer
+	46,  // 62: policy.Key.metadata:type_name -> common.Metadata
+	6,   // 63: policy.KasPublicKey.alg:type_name -> policy.KasPublicKeyAlgEnum
+	30,  // 64: policy.KasPublicKeySet.keys:type_name -> policy.KasPublicKey
+	31,  // 65: policy.PublicKey.cached:type_name -> policy.KasPublicKeySet
+	34,  // 66: policy.RegisteredResource.values:type_name -> policy.RegisteredResourceValue
+	14,  // 67: policy.RegisteredResource.namespace:type_name -> policy.Namespace
+	46,  // 68: policy.RegisteredResource.metadata:type_name -> common.Metadata
+	33,  // 69: policy.RegisteredResourceValue.resource:type_name -> policy.RegisteredResource
+	45,  // 70: policy.RegisteredResourceValue.action_attribute_values:type_name -> policy.RegisteredResourceValue.ActionAttributeValue
+	46,  // 71: policy.RegisteredResourceValue.metadata:type_name -> common.Metadata
+	35,  // 72: policy.RequestContext.pep:type_name -> policy.PolicyEnforcementPoint
+	14,  // 73: policy.Obligation.namespace:type_name -> policy.Namespace
+	38,  // 74: policy.Obligation.values:type_name -> policy.ObligationValue
+	46,  // 75: policy.Obligation.metadata:type_name -> common.Metadata
+	37,  // 76: policy.ObligationValue.obligation:type_name -> policy.Obligation
+	39,  // 77: policy.ObligationValue.triggers:type_name -> policy.ObligationTrigger
+	46,  // 78: policy.ObligationValue.metadata:type_name -> common.Metadata
+	38,  // 79: policy.ObligationTrigger.obligation_value:type_name -> policy.ObligationValue
+	17,  // 80: policy.ObligationTrigger.action:type_name -> policy.Action
+	16,  // 81: policy.ObligationTrigger.attribute_value:type_name -> policy.Value
+	36,  // 82: policy.ObligationTrigger.context:type_name -> policy.RequestContext
+	14,  // 83: policy.ObligationTrigger.namespace:type_name -> policy.Namespace
+	46,  // 84: policy.ObligationTrigger.metadata:type_name -> common.Metadata
+	43,  // 85: policy.KasKey.key:type_name -> policy.AsymmetricKey
+	7,   // 86: policy.AsymmetricKey.key_algorithm:type_name -> policy.Algorithm
+	8,   // 87: policy.AsymmetricKey.key_status:type_name -> policy.KeyStatus
+	9,   // 88: policy.AsymmetricKey.key_mode:type_name -> policy.KeyMode
+	41,  // 89: policy.AsymmetricKey.public_key_ctx:type_name -> policy.PublicKeyCtx
+	42,  // 90: policy.AsymmetricKey.private_key_ctx:type_name -> policy.PrivateKeyCtx
+	13,  // 91: policy.AsymmetricKey.provider_config:type_name -> policy.KeyProviderConfig
+	46,  // 92: policy.AsymmetricKey.metadata:type_name -> common.Metadata
+	8,   // 93: policy.SymmetricKey.key_status:type_name -> policy.KeyStatus
+	9,   // 94: policy.SymmetricKey.key_mode:type_name -> policy.KeyMode
+	13,  // 95: policy.SymmetricKey.provider_config:type_name -> policy.KeyProviderConfig
+	46,  // 96: policy.SymmetricKey.metadata:type_name -> common.Metadata
+	17,  // 97: policy.RegisteredResourceValue.ActionAttributeValue.action:type_name -> policy.Action
+	16,  // 98: policy.RegisteredResourceValue.ActionAttributeValue.attribute_value:type_name -> policy.Value
+	46,  // 99: policy.RegisteredResourceValue.ActionAttributeValue.metadata:type_name -> common.Metadata
+	100, // [100:100] is the sub-list for method output_type
+	100, // [100:100] is the sub-list for method input_type
+	100, // [100:100] is the sub-list for extension type_name
+	100, // [100:100] is the sub-list for extension extendee
+	0,   // [0:100] is the sub-list for field type_name
 }
 
 func init() { file_policy_objects_proto_init() }
@@ -4089,7 +4518,7 @@ func file_policy_objects_proto_init() {
 			}
 		}
 		file_policy_objects_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Condition); i {
+			switch v := v.(*DynamicValueResolver); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4101,7 +4530,7 @@ func file_policy_objects_proto_init() {
 			}
 		}
 		file_policy_objects_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ConditionGroup); i {
+			switch v := v.(*DynamicValueMapping); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4113,7 +4542,7 @@ func file_policy_objects_proto_init() {
 			}
 		}
 		file_policy_objects_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SubjectSet); i {
+			switch v := v.(*Condition); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4125,7 +4554,7 @@ func file_policy_objects_proto_init() {
 			}
 		}
 		file_policy_objects_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SubjectConditionSet); i {
+			switch v := v.(*ConditionGroup); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4137,7 +4566,7 @@ func file_policy_objects_proto_init() {
 			}
 		}
 		file_policy_objects_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SubjectProperty); i {
+			switch v := v.(*SubjectSet); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4149,7 +4578,7 @@ func file_policy_objects_proto_init() {
 			}
 		}
 		file_policy_objects_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ResourceMappingGroup); i {
+			switch v := v.(*SubjectConditionSet); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4161,7 +4590,7 @@ func file_policy_objects_proto_init() {
 			}
 		}
 		file_policy_objects_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ResourceMapping); i {
+			switch v := v.(*SubjectProperty); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4173,7 +4602,7 @@ func file_policy_objects_proto_init() {
 			}
 		}
 		file_policy_objects_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*KeyAccessServer); i {
+			switch v := v.(*ResourceMappingGroup); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4185,7 +4614,7 @@ func file_policy_objects_proto_init() {
 			}
 		}
 		file_policy_objects_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Key); i {
+			switch v := v.(*ResourceMapping); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4197,7 +4626,7 @@ func file_policy_objects_proto_init() {
 			}
 		}
 		file_policy_objects_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*KasPublicKey); i {
+			switch v := v.(*KeyAccessServer); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4209,7 +4638,7 @@ func file_policy_objects_proto_init() {
 			}
 		}
 		file_policy_objects_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*KasPublicKeySet); i {
+			switch v := v.(*Key); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4221,7 +4650,7 @@ func file_policy_objects_proto_init() {
 			}
 		}
 		file_policy_objects_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PublicKey); i {
+			switch v := v.(*KasPublicKey); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4233,7 +4662,7 @@ func file_policy_objects_proto_init() {
 			}
 		}
 		file_policy_objects_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RegisteredResource); i {
+			switch v := v.(*KasPublicKeySet); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4245,7 +4674,7 @@ func file_policy_objects_proto_init() {
 			}
 		}
 		file_policy_objects_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RegisteredResourceValue); i {
+			switch v := v.(*PublicKey); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4257,7 +4686,7 @@ func file_policy_objects_proto_init() {
 			}
 		}
 		file_policy_objects_proto_msgTypes[22].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PolicyEnforcementPoint); i {
+			switch v := v.(*RegisteredResource); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4269,7 +4698,7 @@ func file_policy_objects_proto_init() {
 			}
 		}
 		file_policy_objects_proto_msgTypes[23].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RequestContext); i {
+			switch v := v.(*RegisteredResourceValue); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4281,7 +4710,7 @@ func file_policy_objects_proto_init() {
 			}
 		}
 		file_policy_objects_proto_msgTypes[24].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Obligation); i {
+			switch v := v.(*PolicyEnforcementPoint); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4293,7 +4722,7 @@ func file_policy_objects_proto_init() {
 			}
 		}
 		file_policy_objects_proto_msgTypes[25].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ObligationValue); i {
+			switch v := v.(*RequestContext); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4305,7 +4734,7 @@ func file_policy_objects_proto_init() {
 			}
 		}
 		file_policy_objects_proto_msgTypes[26].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ObligationTrigger); i {
+			switch v := v.(*Obligation); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4317,7 +4746,7 @@ func file_policy_objects_proto_init() {
 			}
 		}
 		file_policy_objects_proto_msgTypes[27].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*KasKey); i {
+			switch v := v.(*ObligationValue); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4329,7 +4758,7 @@ func file_policy_objects_proto_init() {
 			}
 		}
 		file_policy_objects_proto_msgTypes[28].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PublicKeyCtx); i {
+			switch v := v.(*ObligationTrigger); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4341,7 +4770,7 @@ func file_policy_objects_proto_init() {
 			}
 		}
 		file_policy_objects_proto_msgTypes[29].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PrivateKeyCtx); i {
+			switch v := v.(*KasKey); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4353,7 +4782,7 @@ func file_policy_objects_proto_init() {
 			}
 		}
 		file_policy_objects_proto_msgTypes[30].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AsymmetricKey); i {
+			switch v := v.(*PublicKeyCtx); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4365,7 +4794,7 @@ func file_policy_objects_proto_init() {
 			}
 		}
 		file_policy_objects_proto_msgTypes[31].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SymmetricKey); i {
+			switch v := v.(*PrivateKeyCtx); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -4377,6 +4806,30 @@ func file_policy_objects_proto_init() {
 			}
 		}
 		file_policy_objects_proto_msgTypes[32].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AsymmetricKey); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_policy_objects_proto_msgTypes[33].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SymmetricKey); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_policy_objects_proto_msgTypes[34].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*RegisteredResourceValue_ActionAttributeValue); i {
 			case 0:
 				return &v.state
@@ -4393,7 +4846,7 @@ func file_policy_objects_proto_init() {
 		(*Action_Standard)(nil),
 		(*Action_Custom)(nil),
 	}
-	file_policy_objects_proto_msgTypes[19].OneofWrappers = []interface{}{
+	file_policy_objects_proto_msgTypes[21].OneofWrappers = []interface{}{
 		(*PublicKey_Remote)(nil),
 		(*PublicKey_Cached)(nil),
 	}
@@ -4402,8 +4855,8 @@ func file_policy_objects_proto_init() {
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_policy_objects_proto_rawDesc,
-			NumEnums:      9,
-			NumMessages:   33,
+			NumEnums:      11,
+			NumMessages:   35,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/service/policy/dynamicvaluemapping/dynamic_value_mapping.proto b/service/policy/dynamicvaluemapping/dynamic_value_mapping.proto
new file mode 100644
index 0000000000..5a2242bdb4
--- /dev/null
+++ b/service/policy/dynamicvaluemapping/dynamic_value_mapping.proto
@@ -0,0 +1,178 @@
+syntax = "proto3";
+
+package policy.dynamicvaluemapping;
+
+import "buf/validate/validate.proto";
+import "common/common.proto";
+import "policy/objects.proto";
+import "policy/selectors.proto";
+import "policy/subjectmapping/subject_mapping.proto";
+
+/*
+   Dynamic Value Mapping CRUD operations
+
+   A DynamicValueMapping raises entitlement authority from a concrete AttributeValue to the
+   AttributeDefinition: at decision time the value_resolver compares the requested resource
+   value segment against the entity representation, avoiding pre-provisioning a value +
+   subject mapping per discrete value.
+*/
+
+message GetDynamicValueMappingRequest {
+  // Required
+  string id = 1 [(buf.validate.field).string.uuid = true];
+}
+message GetDynamicValueMappingResponse {
+  policy.DynamicValueMapping dynamic_value_mapping = 1;
+}
+
+enum SortDynamicValueMappingsType {
+  SORT_DYNAMIC_VALUE_MAPPINGS_TYPE_UNSPECIFIED = 0;
+  SORT_DYNAMIC_VALUE_MAPPINGS_TYPE_CREATED_AT = 1;
+  SORT_DYNAMIC_VALUE_MAPPINGS_TYPE_UPDATED_AT = 2;
+}
+
+message DynamicValueMappingsSort {
+  SortDynamicValueMappingsType field = 1 [(buf.validate.field).enum.defined_only = true];
+  policy.SortDirection direction = 2 [(buf.validate.field).enum.defined_only = true];
+}
+
+message ListDynamicValueMappingsRequest {
+  // Optional: Namespace ID or FQN to filter by
+  option (buf.validate.message).oneof = {
+    fields: ["namespace_id", "namespace_fqn"]
+    required: false
+  };
+  string namespace_id = 1 [(buf.validate.field).string.uuid = true];
+  string namespace_fqn = 2 [
+    (buf.validate.field).string = {
+      min_len: 1
+      uri: true
+    }
+  ];
+
+  // Optional: Attribute Definition ID to filter by
+  string attribute_definition_id = 3 [(buf.validate.field).cel = {
+    id: "optional_uuid_format"
+    message: "Optional field must be a valid UUID"
+    expression: "size(this) == 0 || this.matches('[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}')"
+  }];
+
+  // Optional
+  policy.PageRequest pagination = 10;
+
+  // Optional - CONSTRAINT: max 1 item
+  repeated DynamicValueMappingsSort sort = 11 [(buf.validate.field).repeated.max_items = 1];
+}
+message ListDynamicValueMappingsResponse {
+  repeated policy.DynamicValueMapping dynamic_value_mappings = 1;
+
+  policy.PageResponse pagination = 10;
+}
+
+message CreateDynamicValueMappingRequest {
+  // Required: Attribute Definition ID or FQN to scope the mapping to
+  option (buf.validate.message).oneof = {
+    fields: ["attribute_definition_id", "attribute_definition_fqn"]
+    required: true
+  };
+  // Optional: Namespace ID or FQN to scope the mapping to
+  option (buf.validate.message).oneof = {
+    fields: ["namespace_id", "namespace_fqn"]
+    required: false
+  };
+
+  string attribute_definition_id = 1 [(buf.validate.field).string.uuid = true];
+  string attribute_definition_fqn = 2 [
+    (buf.validate.field).string = {
+      min_len: 1
+      uri: true
+    }
+  ];
+
+  // Required: the dynamic resolver comparing entity selector result to the resource value segment
+  policy.DynamicValueResolver value_resolver = 3 [(buf.validate.field).required = true];
+
+  // Required: actions permitted on a matched value
+  repeated policy.Action actions = 4 [
+    (buf.validate.field).repeated.min_items = 1,
+    (buf.validate.field).cel = {
+      id: "action_name_or_id_not_empty"
+      message: "Action name or ID must not be empty if provided"
+      expression: "this.all(item, item.name != '' || item.id != '')"
+    }
+  ];
+
+  // Optional static pre-gate. Reuse an existing SubjectConditionSet (prioritized) ...
+  string existing_subject_condition_set_id = 5 [(buf.validate.field).cel = {
+    id: "optional_uuid_format"
+    message: "Optional field must be a valid UUID"
+    expression: "size(this) == 0 || this.matches('[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}')"
+  }];
+  // ... or create a new one (ignored if existing_subject_condition_set_id is provided)
+  policy.subjectmapping.SubjectConditionSetCreate new_subject_condition_set = 6;
+
+  // Optional: namespace ID or FQN for the mapping
+  string namespace_id = 7 [(buf.validate.field).string.uuid = true];
+  string namespace_fqn = 8 [
+    (buf.validate.field).string = {
+      min_len: 1
+      uri: true
+    }
+  ];
+
+  // Optional
+  common.MetadataMutable metadata = 100;
+}
+message CreateDynamicValueMappingResponse {
+  policy.DynamicValueMapping dynamic_value_mapping = 1;
+}
+
+message UpdateDynamicValueMappingRequest {
+  // Required
+  string id = 1 [(buf.validate.field).string.uuid = true];
+
+  // Optional: replace the dynamic resolver
+  policy.DynamicValueResolver value_resolver = 2;
+
+  // Optional: replace the static pre-gate SubjectConditionSet by id
+  string subject_condition_set_id = 3 [(buf.validate.field).cel = {
+    id: "optional_uuid_format"
+    message: "Optional field must be a valid UUID"
+    expression: "size(this) == 0 || this.matches('[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}')"
+  }];
+
+  // Optional: replace the entire list of actions
+  repeated policy.Action actions = 4 [(buf.validate.field).cel = {
+    id: "action_name_or_id_not_empty"
+    message: "Action name or ID must not be empty if provided"
+    expression: "this.size() == 0 || this.all(item, item.name != '' || item.id != '')"
+  }];
+
+  // Common metadata
+  common.MetadataMutable metadata = 100;
+  common.MetadataUpdateEnum metadata_update_behavior = 101;
+}
+message UpdateDynamicValueMappingResponse {
+  policy.DynamicValueMapping dynamic_value_mapping = 1;
+}
+
+message DeleteDynamicValueMappingRequest {
+  // Required
+  string id = 1 [(buf.validate.field).string.uuid = true];
+}
+message DeleteDynamicValueMappingResponse {
+  // Only ID of the deleted mapping provided
+  policy.DynamicValueMapping dynamic_value_mapping = 1;
+}
+
+service DynamicValueMappingService {
+  rpc ListDynamicValueMappings(ListDynamicValueMappingsRequest) returns (ListDynamicValueMappingsResponse) {
+    option idempotency_level = NO_SIDE_EFFECTS;
+  }
+  rpc GetDynamicValueMapping(GetDynamicValueMappingRequest) returns (GetDynamicValueMappingResponse) {
+    option idempotency_level = NO_SIDE_EFFECTS;
+  }
+  rpc CreateDynamicValueMapping(CreateDynamicValueMappingRequest) returns (CreateDynamicValueMappingResponse) {}
+  rpc UpdateDynamicValueMapping(UpdateDynamicValueMappingRequest) returns (UpdateDynamicValueMappingResponse) {}
+  rpc DeleteDynamicValueMapping(DeleteDynamicValueMappingRequest) returns (DeleteDynamicValueMappingResponse) {}
+}
diff --git a/service/policy/objects.proto b/service/policy/objects.proto
index 2bf66902ae..5a241e72ea 100644
--- a/service/policy/objects.proto
+++ b/service/policy/objects.proto
@@ -180,6 +180,32 @@ enum ConditionBooleanTypeEnum {
   CONDITION_BOOLEAN_TYPE_ENUM_OR = 2;
 }
 
+// How a selector result is compared against a comparison value. Replaces the all-in-one
+// SubjectMappingOperatorEnum by separating the comparison from the quantifier (see
+// ConditionQuantifierEnum) and case sensitivity.
+enum ConditionComparisonOperatorEnum {
+  CONDITION_COMPARISON_OPERATOR_ENUM_UNSPECIFIED = 0;
+  // exact string equality
+  CONDITION_COMPARISON_OPERATOR_ENUM_EQUALS = 1;
+  // substring containment
+  CONDITION_COMPARISON_OPERATOR_ENUM_CONTAINS = 2;
+  // prefix match
+  CONDITION_COMPARISON_OPERATOR_ENUM_STARTS_WITH = 3;
+  // suffix match; the safe operator for domain matching (e.g. email domains)
+  CONDITION_COMPARISON_OPERATOR_ENUM_ENDS_WITH = 4;
+}
+
+// How matches are aggregated across the comparison set (subject_external_values).
+enum ConditionQuantifierEnum {
+  CONDITION_QUANTIFIER_ENUM_UNSPECIFIED = 0;
+  // at least one match (legacy IN behavior)
+  CONDITION_QUANTIFIER_ENUM_ANY = 1;
+  // every expected value matches
+  CONDITION_QUANTIFIER_ENUM_ALL = 2;
+  // no matches (legacy NOT_IN behavior)
+  CONDITION_QUANTIFIER_ENUM_NONE = 3;
+}
+
 /*
    Subject Mapping: A Policy assigning Subject Set(s) to a permitted attribute
    value + action(s) combination
@@ -204,6 +230,59 @@ message SubjectMapping {
   common.Metadata metadata = 100;
 }
 
+/*
+   Dynamic Value Resolver: the dynamic half of a DynamicValueMapping. It resolves a selector
+   against the entity representation, then tests whether any resolved entity value matches the
+   requested resource value segment under comparison. The match is inherently existential over
+   the resolved entity values, so no quantifier is carried here.
+*/
+message DynamicValueResolver {
+  // a selector for a field value on a flattened Entity Representation (such as from
+  // idP/LDAP), e.g. ".patientAssignments[]"
+  string subject_external_selector_value = 1 [(buf.validate.field).required = true];
+
+  // how the requested resource value segment is compared against each value the selector
+  // resolves from the entity representation
+  ConditionComparisonOperatorEnum comparison = 2 [
+    (buf.validate.field).enum.defined_only = true,
+    (buf.validate.field).required = true
+  ];
+
+  // when set true, comparison is case-insensitive; unset is treated as case-sensitive. Modeled as
+  // BoolValue so an explicit false is distinguishable from unset, leaving room to change the default.
+  google.protobuf.BoolValue case_insensitive = 3;
+}
+
+/*
+   Dynamic Value Mapping: a Policy assigning permitted action(s) to
+   dynamically-requested values under an Attribute Definition. It raises entitlement
+   authority from a concrete Attribute Value to the Attribute Definition: at decision time
+   the value_resolver compares the requested resource value segment against the entity
+   representation, avoiding pre-provisioning a value + subject mapping per discrete value.
+*/
+message DynamicValueMapping {
+  string id = 1;
+
+  // the Attribute Definition whose values are entitled dynamically
+  Attribute attribute_definition = 2;
+
+  // the dynamic resolver matched against the requested resource value segment
+  DynamicValueResolver value_resolver = 3;
+
+  // optional static pre-gate on the entity, evaluated with normal SubjectConditionSet
+  // semantics (no dynamic overload). When present, both the gate and the resolver must
+  // pass for entitlement.
+  SubjectConditionSet subject_condition_set = 4;
+
+  // the actions permitted by subjects in this mapping
+  repeated Action actions = 5;
+
+  // the namespace containing this mapping
+  Namespace namespace = 6;
+
+  common.Metadata metadata = 100;
+}
+
 /**
    A Condition defines a rule of <the value at the flattened 'selector value'
    location> <operator> <subject external values>
@@ -213,16 +292,28 @@ message Condition {
   // from idP/LDAP)
   string subject_external_selector_value = 1 [(buf.validate.field).required = true];
 
-  // the evaluation operator of relation
+  // Deprecated: use comparison + quantifier (+ case_insensitive) instead. Normalized to the
+  // decomposed fields in the service layer for backward compatibility.
   SubjectMappingOperatorEnum operator = 2 [
+    deprecated = true,
     (buf.validate.field).enum.defined_only = true,
-    (buf.validate.field).required = true
+    (buf.validate.field).ignore = IGNORE_IF_ZERO_VALUE
   ];
 
   // list of comparison values for the result of applying the
   // subject_external_selector_value on a flattened Entity Representation
   // (Subject), evaluated by the operator
   repeated string subject_external_values = 3 [(buf.validate.field).repeated.min_items = 1];
+
+  // how each selector result is compared to subject_external_values entries
+  ConditionComparisonOperatorEnum comparison = 4 [(buf.validate.field).enum.defined_only = true];
+
+  // how matches are aggregated across subject_external_values
+  ConditionQuantifierEnum quantifier = 5 [(buf.validate.field).enum.defined_only = true];
+
+  // when set true, comparison is case-insensitive; unset is treated as case-sensitive. Modeled as
+  // BoolValue so an explicit false is distinguishable from unset, leaving room to change the default.
+  google.protobuf.BoolValue case_insensitive = 6;
 }
 
 // A collection of Conditions evaluated by the boolean_operator provided