diff --git a/sysdig/internal/client/v2/cloudauth/go/cloud_account.pb.go b/sysdig/internal/client/v2/cloudauth/go/cloud_account.pb.go
index 0c5a874f..ba543220 100644
--- a/sysdig/internal/client/v2/cloudauth/go/cloud_account.pb.go
+++ b/sysdig/internal/client/v2/cloudauth/go/cloud_account.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.6
-// 	protoc        v4.24.2
+// 	protoc-gen-go v1.36.11
+// 	protoc        v6.33.5
 // source: cloudauth_cloud_account.proto
 
 package cloudauthproto
@@ -531,6 +531,7 @@ type CloudAccount struct {
 	//
 	//	*CloudAccount_Ibm
 	ProviderDetails isCloudAccount_ProviderDetails `protobuf_oneof:"provider_details"`
+	ParentUuid      string                         `protobuf:"bytes,22,opt,name=parent_uuid,json=parentUuid,proto3" json:"parent_uuid,omitempty"` // UUID/CRN of the direct parent organizational group; empty if directly under the root
 	unknownFields   protoimpl.UnknownFields
 	sizeCache       protoimpl.SizeCache
 }
@@ -721,6 +722,13 @@ func (x *CloudAccount) GetIbm() *IBMCloudAccount {
 	return nil
 }
 
+func (x *CloudAccount) GetParentUuid() string {
+	if x != nil {
+		return x.ParentUuid
+	}
+	return ""
+}
+
 type isCloudAccount_ProviderDetails interface {
 	isCloudAccount_ProviderDetails()
 }
@@ -1445,6 +1453,124 @@ func (x *CloudOrganization) GetAutomaticOnboarding() bool {
 	return false
 }
 
+// OrganizationalGroup captures metadata for cloud organizational structures
+// Supports AWS Organizations OUs, Azure Management Groups, GCP Folders, IBM Account Groups
+type OrganizationalGroup struct {
+	state            protoimpl.MessageState `protogen:"open.v1"`
+	Uuid             string                 `protobuf:"bytes,1,opt,name=uuid,proto3" json:"uuid,omitempty"`                                                 // Primary key (IBM CRN, AWS ARN, Azure Resource ID, GCP Resource Name)
+	Name             string                 `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`                                                 // Human-readable name (e.g., "Production OU", "account-AA")
+	OrganizationUuid string                 `protobuf:"bytes,3,opt,name=organization_uuid,json=organizationUuid,proto3" json:"organization_uuid,omitempty"` // Organization UUID (parent organization)
+	ParentUuid       string                 `protobuf:"bytes,4,opt,name=parent_uuid,json=parentUuid,proto3" json:"parent_uuid,omitempty"`                   // Parent group UUID (empty/null for root-level groups)
+	Provider         Provider               `protobuf:"varint,5,opt,name=provider,proto3,enum=cloudauthproto.Provider" json:"provider,omitempty"`           // Cloud provider enum (PROVIDER_AWS, PROVIDER_AZURE, etc.)
+	Metadata         *structpb.Struct       `protobuf:"bytes,6,opt,name=metadata,proto3" json:"metadata,omitempty"`                                         // Provider-specific metadata (JSONB storage)
+	CustomerId       uint64                 `protobuf:"varint,7,opt,name=customer_id,json=customerId,proto3" json:"customer_id,omitempty"`                  // Customer ID for multi-tenancy isolation
+	CreatedAt        *timestamppb.Timestamp `protobuf:"bytes,8,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`                      // Creation timestamp
+	UpdatedAt        *timestamppb.Timestamp `protobuf:"bytes,9,opt,name=updated_at,json=updatedAt,proto3" json:"updated_at,omitempty"`                      // Last update timestamp
+	Verbosity        Verbosity              `protobuf:"varint,10,opt,name=verbosity,proto3,enum=cloudauthproto.Verbosity" json:"verbosity,omitempty"`       // Verbosity level for nested loading control
+	unknownFields    protoimpl.UnknownFields
+	sizeCache        protoimpl.SizeCache
+}
+
+func (x *OrganizationalGroup) Reset() {
+	*x = OrganizationalGroup{}
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *OrganizationalGroup) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*OrganizationalGroup) ProtoMessage() {}
+
+func (x *OrganizationalGroup) ProtoReflect() protoreflect.Message {
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[9]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use OrganizationalGroup.ProtoReflect.Descriptor instead.
+func (*OrganizationalGroup) Descriptor() ([]byte, []int) {
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *OrganizationalGroup) GetUuid() string {
+	if x != nil {
+		return x.Uuid
+	}
+	return ""
+}
+
+func (x *OrganizationalGroup) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *OrganizationalGroup) GetOrganizationUuid() string {
+	if x != nil {
+		return x.OrganizationUuid
+	}
+	return ""
+}
+
+func (x *OrganizationalGroup) GetParentUuid() string {
+	if x != nil {
+		return x.ParentUuid
+	}
+	return ""
+}
+
+func (x *OrganizationalGroup) GetProvider() Provider {
+	if x != nil {
+		return x.Provider
+	}
+	return Provider_PROVIDER_UNSPECIFIED
+}
+
+func (x *OrganizationalGroup) GetMetadata() *structpb.Struct {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *OrganizationalGroup) GetCustomerId() uint64 {
+	if x != nil {
+		return x.CustomerId
+	}
+	return 0
+}
+
+func (x *OrganizationalGroup) GetCreatedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.CreatedAt
+	}
+	return nil
+}
+
+func (x *OrganizationalGroup) GetUpdatedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.UpdatedAt
+	}
+	return nil
+}
+
+func (x *OrganizationalGroup) GetVerbosity() Verbosity {
+	if x != nil {
+		return x.Verbosity
+	}
+	return Verbosity_VERBOSITY_UNSPECIFIED
+}
+
 // FeatureComponents enumerates all components available to a feature
 type FeatureComponents struct {
 	state               protoimpl.MessageState `protogen:"open.v1"`
@@ -1463,7 +1589,7 @@ type FeatureComponents struct {
 
 func (x *FeatureComponents) Reset() {
 	*x = FeatureComponents{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[9]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[10]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1475,7 +1601,7 @@ func (x *FeatureComponents) String() string {
 func (*FeatureComponents) ProtoMessage() {}
 
 func (x *FeatureComponents) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[9]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[10]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1488,7 +1614,7 @@ func (x *FeatureComponents) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FeatureComponents.ProtoReflect.Descriptor instead.
 func (*FeatureComponents) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{9}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *FeatureComponents) GetCloudConnector() *AccountComponent {
@@ -1581,7 +1707,7 @@ type AccountComponent struct {
 
 func (x *AccountComponent) Reset() {
 	*x = AccountComponent{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[10]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[11]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1593,7 +1719,7 @@ func (x *AccountComponent) String() string {
 func (*AccountComponent) ProtoMessage() {}
 
 func (x *AccountComponent) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[10]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[11]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1606,7 +1732,7 @@ func (x *AccountComponent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AccountComponent.ProtoReflect.Descriptor instead.
 func (*AccountComponent) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{10}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *AccountComponent) GetType() Component {
@@ -1812,7 +1938,7 @@ type CloudConnectorMetadata struct {
 
 func (x *CloudConnectorMetadata) Reset() {
 	*x = CloudConnectorMetadata{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[11]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[12]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1824,7 +1950,7 @@ func (x *CloudConnectorMetadata) String() string {
 func (*CloudConnectorMetadata) ProtoMessage() {}
 
 func (x *CloudConnectorMetadata) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[11]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[12]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1837,7 +1963,7 @@ func (x *CloudConnectorMetadata) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CloudConnectorMetadata.ProtoReflect.Descriptor instead.
 func (*CloudConnectorMetadata) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{11}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *CloudConnectorMetadata) GetProvider() isCloudConnectorMetadata_Provider {
@@ -1912,7 +2038,7 @@ type TrustedRoleMetadata struct {
 
 func (x *TrustedRoleMetadata) Reset() {
 	*x = TrustedRoleMetadata{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[12]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[13]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1924,7 +2050,7 @@ func (x *TrustedRoleMetadata) String() string {
 func (*TrustedRoleMetadata) ProtoMessage() {}
 
 func (x *TrustedRoleMetadata) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[12]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[13]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1937,7 +2063,7 @@ func (x *TrustedRoleMetadata) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TrustedRoleMetadata.ProtoReflect.Descriptor instead.
 func (*TrustedRoleMetadata) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{12}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *TrustedRoleMetadata) GetProvider() isTrustedRoleMetadata_Provider {
@@ -2025,7 +2151,7 @@ type EventBridgeMetadata struct {
 
 func (x *EventBridgeMetadata) Reset() {
 	*x = EventBridgeMetadata{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[13]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[14]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2037,7 +2163,7 @@ func (x *EventBridgeMetadata) String() string {
 func (*EventBridgeMetadata) ProtoMessage() {}
 
 func (x *EventBridgeMetadata) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[13]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[14]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2050,7 +2176,7 @@ func (x *EventBridgeMetadata) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use EventBridgeMetadata.ProtoReflect.Descriptor instead.
 func (*EventBridgeMetadata) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{13}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{14}
 }
 
 func (x *EventBridgeMetadata) GetProvider() isEventBridgeMetadata_Provider {
@@ -2110,7 +2236,7 @@ type ServicePrincipalMetadata struct {
 
 func (x *ServicePrincipalMetadata) Reset() {
 	*x = ServicePrincipalMetadata{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[14]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[15]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2122,7 +2248,7 @@ func (x *ServicePrincipalMetadata) String() string {
 func (*ServicePrincipalMetadata) ProtoMessage() {}
 
 func (x *ServicePrincipalMetadata) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[14]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[15]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2135,7 +2261,7 @@ func (x *ServicePrincipalMetadata) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ServicePrincipalMetadata.ProtoReflect.Descriptor instead.
 func (*ServicePrincipalMetadata) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{14}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *ServicePrincipalMetadata) GetProvider() isServicePrincipalMetadata_Provider {
@@ -2226,7 +2352,7 @@ type WebhookDatasourceMetadata struct {
 
 func (x *WebhookDatasourceMetadata) Reset() {
 	*x = WebhookDatasourceMetadata{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[15]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[16]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2238,7 +2364,7 @@ func (x *WebhookDatasourceMetadata) String() string {
 func (*WebhookDatasourceMetadata) ProtoMessage() {}
 
 func (x *WebhookDatasourceMetadata) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[15]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[16]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2251,7 +2377,7 @@ func (x *WebhookDatasourceMetadata) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WebhookDatasourceMetadata.ProtoReflect.Descriptor instead.
 func (*WebhookDatasourceMetadata) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{15}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *WebhookDatasourceMetadata) GetProvider() isWebhookDatasourceMetadata_Provider {
@@ -2338,7 +2464,7 @@ type CryptoKeyMetadata struct {
 
 func (x *CryptoKeyMetadata) Reset() {
 	*x = CryptoKeyMetadata{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[16]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[17]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2350,7 +2476,7 @@ func (x *CryptoKeyMetadata) String() string {
 func (*CryptoKeyMetadata) ProtoMessage() {}
 
 func (x *CryptoKeyMetadata) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[16]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[17]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2363,7 +2489,7 @@ func (x *CryptoKeyMetadata) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CryptoKeyMetadata.ProtoReflect.Descriptor instead.
 func (*CryptoKeyMetadata) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{16}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{17}
 }
 
 func (x *CryptoKeyMetadata) GetProvider() isCryptoKeyMetadata_Provider {
@@ -2406,7 +2532,7 @@ type CloudLogsMetadata struct {
 
 func (x *CloudLogsMetadata) Reset() {
 	*x = CloudLogsMetadata{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[17]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[18]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2418,7 +2544,7 @@ func (x *CloudLogsMetadata) String() string {
 func (*CloudLogsMetadata) ProtoMessage() {}
 
 func (x *CloudLogsMetadata) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[17]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[18]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2431,7 +2557,7 @@ func (x *CloudLogsMetadata) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CloudLogsMetadata.ProtoReflect.Descriptor instead.
 func (*CloudLogsMetadata) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{17}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{18}
 }
 
 func (x *CloudLogsMetadata) GetProvider() isCloudLogsMetadata_Provider {
@@ -2487,7 +2613,7 @@ type CloudResponderMetadata struct {
 
 func (x *CloudResponderMetadata) Reset() {
 	*x = CloudResponderMetadata{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[18]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2499,7 +2625,7 @@ func (x *CloudResponderMetadata) String() string {
 func (*CloudResponderMetadata) ProtoMessage() {}
 
 func (x *CloudResponderMetadata) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[18]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2512,7 +2638,7 @@ func (x *CloudResponderMetadata) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CloudResponderMetadata.ProtoReflect.Descriptor instead.
 func (*CloudResponderMetadata) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{18}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{19}
 }
 
 func (x *CloudResponderMetadata) GetProvider() isCloudResponderMetadata_Provider {
@@ -2542,15 +2668,16 @@ type CloudResponderMetadata_Aws struct {
 func (*CloudResponderMetadata_Aws) isCloudResponderMetadata_Provider() {}
 
 type CloudResponderRolesMetadata struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	Roles         []*TrustedRoleMetadata `protobuf:"bytes,1,rep,name=roles,proto3" json:"roles,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+	state          protoimpl.MessageState `protogen:"open.v1"`
+	Roles          []*TrustedRoleMetadata `protobuf:"bytes,1,rep,name=roles,proto3" json:"roles,omitempty"`
+	ValidationRole *TrustedRoleMetadata   `protobuf:"bytes,2,opt,name=validation_role,json=validationRole,proto3" json:"validation_role,omitempty"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
 }
 
 func (x *CloudResponderRolesMetadata) Reset() {
 	*x = CloudResponderRolesMetadata{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[19]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2562,7 +2689,7 @@ func (x *CloudResponderRolesMetadata) String() string {
 func (*CloudResponderRolesMetadata) ProtoMessage() {}
 
 func (x *CloudResponderRolesMetadata) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[19]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2575,7 +2702,7 @@ func (x *CloudResponderRolesMetadata) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CloudResponderRolesMetadata.ProtoReflect.Descriptor instead.
 func (*CloudResponderRolesMetadata) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{19}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{20}
 }
 
 func (x *CloudResponderRolesMetadata) GetRoles() []*TrustedRoleMetadata {
@@ -2585,6 +2712,13 @@ func (x *CloudResponderRolesMetadata) GetRoles() []*TrustedRoleMetadata {
 	return nil
 }
 
+func (x *CloudResponderRolesMetadata) GetValidationRole() *TrustedRoleMetadata {
+	if x != nil {
+		return x.ValidationRole
+	}
+	return nil
+}
+
 type CloudConnectorMetadata_AWS struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
@@ -2593,7 +2727,7 @@ type CloudConnectorMetadata_AWS struct {
 
 func (x *CloudConnectorMetadata_AWS) Reset() {
 	*x = CloudConnectorMetadata_AWS{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[21]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[22]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2605,7 +2739,7 @@ func (x *CloudConnectorMetadata_AWS) String() string {
 func (*CloudConnectorMetadata_AWS) ProtoMessage() {}
 
 func (x *CloudConnectorMetadata_AWS) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[21]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[22]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2618,7 +2752,7 @@ func (x *CloudConnectorMetadata_AWS) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CloudConnectorMetadata_AWS.ProtoReflect.Descriptor instead.
 func (*CloudConnectorMetadata_AWS) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{11, 0}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{12, 0}
 }
 
 type CloudConnectorMetadata_Azure struct {
@@ -2629,7 +2763,7 @@ type CloudConnectorMetadata_Azure struct {
 
 func (x *CloudConnectorMetadata_Azure) Reset() {
 	*x = CloudConnectorMetadata_Azure{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[22]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[23]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2641,7 +2775,7 @@ func (x *CloudConnectorMetadata_Azure) String() string {
 func (*CloudConnectorMetadata_Azure) ProtoMessage() {}
 
 func (x *CloudConnectorMetadata_Azure) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[22]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[23]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2654,7 +2788,7 @@ func (x *CloudConnectorMetadata_Azure) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CloudConnectorMetadata_Azure.ProtoReflect.Descriptor instead.
 func (*CloudConnectorMetadata_Azure) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{11, 1}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{12, 1}
 }
 
 type CloudConnectorMetadata_GCP struct {
@@ -2665,7 +2799,7 @@ type CloudConnectorMetadata_GCP struct {
 
 func (x *CloudConnectorMetadata_GCP) Reset() {
 	*x = CloudConnectorMetadata_GCP{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[23]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[24]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2677,7 +2811,7 @@ func (x *CloudConnectorMetadata_GCP) String() string {
 func (*CloudConnectorMetadata_GCP) ProtoMessage() {}
 
 func (x *CloudConnectorMetadata_GCP) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[23]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[24]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2690,7 +2824,7 @@ func (x *CloudConnectorMetadata_GCP) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CloudConnectorMetadata_GCP.ProtoReflect.Descriptor instead.
 func (*CloudConnectorMetadata_GCP) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{11, 2}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{12, 2}
 }
 
 type TrustedRoleMetadata_AWS struct {
@@ -2702,7 +2836,7 @@ type TrustedRoleMetadata_AWS struct {
 
 func (x *TrustedRoleMetadata_AWS) Reset() {
 	*x = TrustedRoleMetadata_AWS{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[24]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[25]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2714,7 +2848,7 @@ func (x *TrustedRoleMetadata_AWS) String() string {
 func (*TrustedRoleMetadata_AWS) ProtoMessage() {}
 
 func (x *TrustedRoleMetadata_AWS) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[24]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[25]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2727,7 +2861,7 @@ func (x *TrustedRoleMetadata_AWS) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TrustedRoleMetadata_AWS.ProtoReflect.Descriptor instead.
 func (*TrustedRoleMetadata_AWS) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{12, 0}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{13, 0}
 }
 
 func (x *TrustedRoleMetadata_AWS) GetRoleName() string {
@@ -2746,7 +2880,7 @@ type TrustedRoleMetadata_GCP struct {
 
 func (x *TrustedRoleMetadata_GCP) Reset() {
 	*x = TrustedRoleMetadata_GCP{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[25]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[26]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2758,7 +2892,7 @@ func (x *TrustedRoleMetadata_GCP) String() string {
 func (*TrustedRoleMetadata_GCP) ProtoMessage() {}
 
 func (x *TrustedRoleMetadata_GCP) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[25]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[26]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2771,7 +2905,7 @@ func (x *TrustedRoleMetadata_GCP) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TrustedRoleMetadata_GCP.ProtoReflect.Descriptor instead.
 func (*TrustedRoleMetadata_GCP) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{12, 1}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{13, 1}
 }
 
 func (x *TrustedRoleMetadata_GCP) GetRoleName() string {
@@ -2790,7 +2924,7 @@ type TrustedRoleMetadata_Azure struct {
 
 func (x *TrustedRoleMetadata_Azure) Reset() {
 	*x = TrustedRoleMetadata_Azure{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[26]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[27]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2802,7 +2936,7 @@ func (x *TrustedRoleMetadata_Azure) String() string {
 func (*TrustedRoleMetadata_Azure) ProtoMessage() {}
 
 func (x *TrustedRoleMetadata_Azure) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[26]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[27]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2815,7 +2949,7 @@ func (x *TrustedRoleMetadata_Azure) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TrustedRoleMetadata_Azure.ProtoReflect.Descriptor instead.
 func (*TrustedRoleMetadata_Azure) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{12, 2}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{13, 2}
 }
 
 func (x *TrustedRoleMetadata_Azure) GetRoleName() string {
@@ -2834,7 +2968,7 @@ type TrustedRoleMetadata_IBMCloud struct {
 
 func (x *TrustedRoleMetadata_IBMCloud) Reset() {
 	*x = TrustedRoleMetadata_IBMCloud{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[27]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[28]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2846,7 +2980,7 @@ func (x *TrustedRoleMetadata_IBMCloud) String() string {
 func (*TrustedRoleMetadata_IBMCloud) ProtoMessage() {}
 
 func (x *TrustedRoleMetadata_IBMCloud) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[27]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[28]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2859,7 +2993,7 @@ func (x *TrustedRoleMetadata_IBMCloud) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TrustedRoleMetadata_IBMCloud.ProtoReflect.Descriptor instead.
 func (*TrustedRoleMetadata_IBMCloud) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{12, 3}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{13, 3}
 }
 
 func (x *TrustedRoleMetadata_IBMCloud) GetRoleName() string {
@@ -2880,7 +3014,7 @@ type EventBridgeMetadata_AWS struct {
 
 func (x *EventBridgeMetadata_AWS) Reset() {
 	*x = EventBridgeMetadata_AWS{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[28]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[29]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2892,7 +3026,7 @@ func (x *EventBridgeMetadata_AWS) String() string {
 func (*EventBridgeMetadata_AWS) ProtoMessage() {}
 
 func (x *EventBridgeMetadata_AWS) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[28]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[29]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2905,7 +3039,7 @@ func (x *EventBridgeMetadata_AWS) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use EventBridgeMetadata_AWS.ProtoReflect.Descriptor instead.
 func (*EventBridgeMetadata_AWS) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{13, 0}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{14, 0}
 }
 
 func (x *EventBridgeMetadata_AWS) GetRoleName() string {
@@ -2939,7 +3073,7 @@ type EventBridgeMetadata_Azure struct {
 
 func (x *EventBridgeMetadata_Azure) Reset() {
 	*x = EventBridgeMetadata_Azure{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[29]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[30]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2951,7 +3085,7 @@ func (x *EventBridgeMetadata_Azure) String() string {
 func (*EventBridgeMetadata_Azure) ProtoMessage() {}
 
 func (x *EventBridgeMetadata_Azure) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[29]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[30]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2964,7 +3098,7 @@ func (x *EventBridgeMetadata_Azure) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use EventBridgeMetadata_Azure.ProtoReflect.Descriptor instead.
 func (*EventBridgeMetadata_Azure) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{13, 1}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{14, 1}
 }
 
 func (x *EventBridgeMetadata_Azure) GetEventHubMetadata() *EventBridgeMetadata_Azure_EventHubMetadata {
@@ -2992,7 +3126,7 @@ type EventBridgeMetadata_Azure_EventHubMetadata struct {
 
 func (x *EventBridgeMetadata_Azure_EventHubMetadata) Reset() {
 	*x = EventBridgeMetadata_Azure_EventHubMetadata{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[30]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[31]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3004,7 +3138,7 @@ func (x *EventBridgeMetadata_Azure_EventHubMetadata) String() string {
 func (*EventBridgeMetadata_Azure_EventHubMetadata) ProtoMessage() {}
 
 func (x *EventBridgeMetadata_Azure_EventHubMetadata) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[30]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[31]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3017,7 +3151,7 @@ func (x *EventBridgeMetadata_Azure_EventHubMetadata) ProtoReflect() protoreflect
 
 // Deprecated: Use EventBridgeMetadata_Azure_EventHubMetadata.ProtoReflect.Descriptor instead.
 func (*EventBridgeMetadata_Azure_EventHubMetadata) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{13, 1, 0}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{14, 1, 0}
 }
 
 func (x *EventBridgeMetadata_Azure_EventHubMetadata) GetEventHubName() string {
@@ -3053,7 +3187,7 @@ type ServicePrincipalMetadata_GCP struct {
 
 func (x *ServicePrincipalMetadata_GCP) Reset() {
 	*x = ServicePrincipalMetadata_GCP{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[31]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[32]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3065,7 +3199,7 @@ func (x *ServicePrincipalMetadata_GCP) String() string {
 func (*ServicePrincipalMetadata_GCP) ProtoMessage() {}
 
 func (x *ServicePrincipalMetadata_GCP) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[31]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[32]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3078,7 +3212,7 @@ func (x *ServicePrincipalMetadata_GCP) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ServicePrincipalMetadata_GCP.ProtoReflect.Descriptor instead.
 func (*ServicePrincipalMetadata_GCP) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{14, 0}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{15, 0}
 }
 
 func (x *ServicePrincipalMetadata_GCP) GetKey() *ServicePrincipalMetadata_GCP_Key {
@@ -3118,7 +3252,7 @@ type ServicePrincipalMetadata_Okta struct {
 
 func (x *ServicePrincipalMetadata_Okta) Reset() {
 	*x = ServicePrincipalMetadata_Okta{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[32]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[33]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3130,7 +3264,7 @@ func (x *ServicePrincipalMetadata_Okta) String() string {
 func (*ServicePrincipalMetadata_Okta) ProtoMessage() {}
 
 func (x *ServicePrincipalMetadata_Okta) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[32]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[33]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3143,7 +3277,7 @@ func (x *ServicePrincipalMetadata_Okta) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ServicePrincipalMetadata_Okta.ProtoReflect.Descriptor instead.
 func (*ServicePrincipalMetadata_Okta) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{14, 1}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{15, 1}
 }
 
 func (x *ServicePrincipalMetadata_Okta) GetOauthApp() *ServicePrincipalMetadata_Okta_OAuthApp {
@@ -3163,7 +3297,7 @@ type ServicePrincipalMetadata_Azure struct {
 
 func (x *ServicePrincipalMetadata_Azure) Reset() {
 	*x = ServicePrincipalMetadata_Azure{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[33]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[34]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3175,7 +3309,7 @@ func (x *ServicePrincipalMetadata_Azure) String() string {
 func (*ServicePrincipalMetadata_Azure) ProtoMessage() {}
 
 func (x *ServicePrincipalMetadata_Azure) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[33]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[34]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3188,7 +3322,7 @@ func (x *ServicePrincipalMetadata_Azure) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ServicePrincipalMetadata_Azure.ProtoReflect.Descriptor instead.
 func (*ServicePrincipalMetadata_Azure) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{14, 2}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{15, 2}
 }
 
 func (x *ServicePrincipalMetadata_Azure) GetActiveDirectoryServicePrincipal() *ServicePrincipalMetadata_Azure_ActiveDirectoryServicePrincipal {
@@ -3215,7 +3349,7 @@ type ServicePrincipalMetadata_OracleCloud struct {
 
 func (x *ServicePrincipalMetadata_OracleCloud) Reset() {
 	*x = ServicePrincipalMetadata_OracleCloud{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[34]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[35]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3227,7 +3361,7 @@ func (x *ServicePrincipalMetadata_OracleCloud) String() string {
 func (*ServicePrincipalMetadata_OracleCloud) ProtoMessage() {}
 
 func (x *ServicePrincipalMetadata_OracleCloud) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[34]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[35]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3240,7 +3374,7 @@ func (x *ServicePrincipalMetadata_OracleCloud) ProtoReflect() protoreflect.Messa
 
 // Deprecated: Use ServicePrincipalMetadata_OracleCloud.ProtoReflect.Descriptor instead.
 func (*ServicePrincipalMetadata_OracleCloud) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{14, 3}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{15, 3}
 }
 
 func (x *ServicePrincipalMetadata_OracleCloud) GetApiKey() *ServicePrincipalMetadata_OracleCloud_ApiKey {
@@ -3276,7 +3410,7 @@ type ServicePrincipalMetadata_GCP_Key struct {
 
 func (x *ServicePrincipalMetadata_GCP_Key) Reset() {
 	*x = ServicePrincipalMetadata_GCP_Key{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[35]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[36]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3288,7 +3422,7 @@ func (x *ServicePrincipalMetadata_GCP_Key) String() string {
 func (*ServicePrincipalMetadata_GCP_Key) ProtoMessage() {}
 
 func (x *ServicePrincipalMetadata_GCP_Key) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[35]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[36]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3301,7 +3435,7 @@ func (x *ServicePrincipalMetadata_GCP_Key) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ServicePrincipalMetadata_GCP_Key.ProtoReflect.Descriptor instead.
 func (*ServicePrincipalMetadata_GCP_Key) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{14, 0, 0}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{15, 0, 0}
 }
 
 func (x *ServicePrincipalMetadata_GCP_Key) GetType() string {
@@ -3392,7 +3526,7 @@ type ServicePrincipalMetadata_GCP_WorkloadIdentityFederation struct {
 
 func (x *ServicePrincipalMetadata_GCP_WorkloadIdentityFederation) Reset() {
 	*x = ServicePrincipalMetadata_GCP_WorkloadIdentityFederation{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[36]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[37]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3404,7 +3538,7 @@ func (x *ServicePrincipalMetadata_GCP_WorkloadIdentityFederation) String() strin
 func (*ServicePrincipalMetadata_GCP_WorkloadIdentityFederation) ProtoMessage() {}
 
 func (x *ServicePrincipalMetadata_GCP_WorkloadIdentityFederation) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[36]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[37]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3417,7 +3551,7 @@ func (x *ServicePrincipalMetadata_GCP_WorkloadIdentityFederation) ProtoReflect()
 
 // Deprecated: Use ServicePrincipalMetadata_GCP_WorkloadIdentityFederation.ProtoReflect.Descriptor instead.
 func (*ServicePrincipalMetadata_GCP_WorkloadIdentityFederation) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{14, 0, 1}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{15, 0, 1}
 }
 
 func (x *ServicePrincipalMetadata_GCP_WorkloadIdentityFederation) GetPoolId() string {
@@ -3452,7 +3586,7 @@ type ServicePrincipalMetadata_Okta_OAuthApp struct {
 
 func (x *ServicePrincipalMetadata_Okta_OAuthApp) Reset() {
 	*x = ServicePrincipalMetadata_Okta_OAuthApp{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[37]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[38]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3464,7 +3598,7 @@ func (x *ServicePrincipalMetadata_Okta_OAuthApp) String() string {
 func (*ServicePrincipalMetadata_Okta_OAuthApp) ProtoMessage() {}
 
 func (x *ServicePrincipalMetadata_Okta_OAuthApp) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[37]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[38]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3477,7 +3611,7 @@ func (x *ServicePrincipalMetadata_Okta_OAuthApp) ProtoReflect() protoreflect.Mes
 
 // Deprecated: Use ServicePrincipalMetadata_Okta_OAuthApp.ProtoReflect.Descriptor instead.
 func (*ServicePrincipalMetadata_Okta_OAuthApp) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{14, 1, 0}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{15, 1, 0}
 }
 
 func (x *ServicePrincipalMetadata_Okta_OAuthApp) GetOktaUrl() string {
@@ -3519,7 +3653,7 @@ type ServicePrincipalMetadata_Azure_ActiveDirectoryServicePrincipal struct {
 
 func (x *ServicePrincipalMetadata_Azure_ActiveDirectoryServicePrincipal) Reset() {
 	*x = ServicePrincipalMetadata_Azure_ActiveDirectoryServicePrincipal{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[38]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[39]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3531,7 +3665,7 @@ func (x *ServicePrincipalMetadata_Azure_ActiveDirectoryServicePrincipal) String(
 func (*ServicePrincipalMetadata_Azure_ActiveDirectoryServicePrincipal) ProtoMessage() {}
 
 func (x *ServicePrincipalMetadata_Azure_ActiveDirectoryServicePrincipal) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[38]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[39]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3544,7 +3678,7 @@ func (x *ServicePrincipalMetadata_Azure_ActiveDirectoryServicePrincipal) ProtoRe
 
 // Deprecated: Use ServicePrincipalMetadata_Azure_ActiveDirectoryServicePrincipal.ProtoReflect.Descriptor instead.
 func (*ServicePrincipalMetadata_Azure_ActiveDirectoryServicePrincipal) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{14, 2, 0}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{15, 2, 0}
 }
 
 func (x *ServicePrincipalMetadata_Azure_ActiveDirectoryServicePrincipal) GetAccountEnabled() bool {
@@ -3617,7 +3751,7 @@ type ServicePrincipalMetadata_Azure_Oauth2PermissionGrant struct {
 
 func (x *ServicePrincipalMetadata_Azure_Oauth2PermissionGrant) Reset() {
 	*x = ServicePrincipalMetadata_Azure_Oauth2PermissionGrant{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[39]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[40]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3629,7 +3763,7 @@ func (x *ServicePrincipalMetadata_Azure_Oauth2PermissionGrant) String() string {
 func (*ServicePrincipalMetadata_Azure_Oauth2PermissionGrant) ProtoMessage() {}
 
 func (x *ServicePrincipalMetadata_Azure_Oauth2PermissionGrant) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[39]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[40]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3642,7 +3776,7 @@ func (x *ServicePrincipalMetadata_Azure_Oauth2PermissionGrant) ProtoReflect() pr
 
 // Deprecated: Use ServicePrincipalMetadata_Azure_Oauth2PermissionGrant.ProtoReflect.Descriptor instead.
 func (*ServicePrincipalMetadata_Azure_Oauth2PermissionGrant) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{14, 2, 1}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{15, 2, 1}
 }
 
 func (x *ServicePrincipalMetadata_Azure_Oauth2PermissionGrant) GetClientId() string {
@@ -3703,7 +3837,7 @@ type ServicePrincipalMetadata_OracleCloud_ApiKey struct {
 
 func (x *ServicePrincipalMetadata_OracleCloud_ApiKey) Reset() {
 	*x = ServicePrincipalMetadata_OracleCloud_ApiKey{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[40]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[41]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3715,7 +3849,7 @@ func (x *ServicePrincipalMetadata_OracleCloud_ApiKey) String() string {
 func (*ServicePrincipalMetadata_OracleCloud_ApiKey) ProtoMessage() {}
 
 func (x *ServicePrincipalMetadata_OracleCloud_ApiKey) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[40]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[41]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3728,7 +3862,7 @@ func (x *ServicePrincipalMetadata_OracleCloud_ApiKey) ProtoReflect() protoreflec
 
 // Deprecated: Use ServicePrincipalMetadata_OracleCloud_ApiKey.ProtoReflect.Descriptor instead.
 func (*ServicePrincipalMetadata_OracleCloud_ApiKey) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{14, 3, 0}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{15, 3, 0}
 }
 
 func (x *ServicePrincipalMetadata_OracleCloud_ApiKey) GetFingerprint() string {
@@ -3796,7 +3930,7 @@ type ServicePrincipalMetadata_OracleCloud_Policy struct {
 
 func (x *ServicePrincipalMetadata_OracleCloud_Policy) Reset() {
 	*x = ServicePrincipalMetadata_OracleCloud_Policy{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[41]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[42]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3808,7 +3942,7 @@ func (x *ServicePrincipalMetadata_OracleCloud_Policy) String() string {
 func (*ServicePrincipalMetadata_OracleCloud_Policy) ProtoMessage() {}
 
 func (x *ServicePrincipalMetadata_OracleCloud_Policy) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[41]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[42]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3821,7 +3955,7 @@ func (x *ServicePrincipalMetadata_OracleCloud_Policy) ProtoReflect() protoreflec
 
 // Deprecated: Use ServicePrincipalMetadata_OracleCloud_Policy.ProtoReflect.Descriptor instead.
 func (*ServicePrincipalMetadata_OracleCloud_Policy) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{14, 3, 1}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{15, 3, 1}
 }
 
 func (x *ServicePrincipalMetadata_OracleCloud_Policy) GetPolicyId() string {
@@ -3840,7 +3974,7 @@ type WebhookDatasourceMetadata_Okta struct {
 
 func (x *WebhookDatasourceMetadata_Okta) Reset() {
 	*x = WebhookDatasourceMetadata_Okta{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[42]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[43]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3852,7 +3986,7 @@ func (x *WebhookDatasourceMetadata_Okta) String() string {
 func (*WebhookDatasourceMetadata_Okta) ProtoMessage() {}
 
 func (x *WebhookDatasourceMetadata_Okta) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[42]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[43]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3865,7 +3999,7 @@ func (x *WebhookDatasourceMetadata_Okta) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WebhookDatasourceMetadata_Okta.ProtoReflect.Descriptor instead.
 func (*WebhookDatasourceMetadata_Okta) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{15, 0}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{16, 0}
 }
 
 func (x *WebhookDatasourceMetadata_Okta) GetWebhookDatasource() *WebhookDatasourceMetadata_Okta_WebhookDatasource {
@@ -3884,7 +4018,7 @@ type WebhookDatasourceMetadata_Github struct {
 
 func (x *WebhookDatasourceMetadata_Github) Reset() {
 	*x = WebhookDatasourceMetadata_Github{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[43]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[44]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3896,7 +4030,7 @@ func (x *WebhookDatasourceMetadata_Github) String() string {
 func (*WebhookDatasourceMetadata_Github) ProtoMessage() {}
 
 func (x *WebhookDatasourceMetadata_Github) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[43]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[44]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3909,7 +4043,7 @@ func (x *WebhookDatasourceMetadata_Github) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WebhookDatasourceMetadata_Github.ProtoReflect.Descriptor instead.
 func (*WebhookDatasourceMetadata_Github) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{15, 1}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{16, 1}
 }
 
 func (x *WebhookDatasourceMetadata_Github) GetWebhookDatasource() *WebhookDatasourceMetadata_Github_WebhookDatasource {
@@ -3929,7 +4063,7 @@ type WebhookDatasourceMetadata_Gcp struct {
 
 func (x *WebhookDatasourceMetadata_Gcp) Reset() {
 	*x = WebhookDatasourceMetadata_Gcp{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[44]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[45]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3941,7 +4075,7 @@ func (x *WebhookDatasourceMetadata_Gcp) String() string {
 func (*WebhookDatasourceMetadata_Gcp) ProtoMessage() {}
 
 func (x *WebhookDatasourceMetadata_Gcp) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[44]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[45]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3954,7 +4088,7 @@ func (x *WebhookDatasourceMetadata_Gcp) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WebhookDatasourceMetadata_Gcp.ProtoReflect.Descriptor instead.
 func (*WebhookDatasourceMetadata_Gcp) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{15, 2}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{16, 2}
 }
 
 func (x *WebhookDatasourceMetadata_Gcp) GetWebhookDatasource() *WebhookDatasourceMetadata_Gcp_WebhookDatasource {
@@ -3980,7 +4114,7 @@ type WebhookDatasourceMetadata_AWS struct {
 
 func (x *WebhookDatasourceMetadata_AWS) Reset() {
 	*x = WebhookDatasourceMetadata_AWS{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[45]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[46]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3992,7 +4126,7 @@ func (x *WebhookDatasourceMetadata_AWS) String() string {
 func (*WebhookDatasourceMetadata_AWS) ProtoMessage() {}
 
 func (x *WebhookDatasourceMetadata_AWS) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[45]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[46]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4005,7 +4139,7 @@ func (x *WebhookDatasourceMetadata_AWS) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WebhookDatasourceMetadata_AWS.ProtoReflect.Descriptor instead.
 func (*WebhookDatasourceMetadata_AWS) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{15, 3}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{16, 3}
 }
 
 func (x *WebhookDatasourceMetadata_AWS) GetWebhookDatasource() *WebhookDatasourceMetadata_AWS_WebhookDatasource {
@@ -4027,7 +4161,7 @@ type WebhookDatasourceMetadata_Okta_WebhookDatasource struct {
 
 func (x *WebhookDatasourceMetadata_Okta_WebhookDatasource) Reset() {
 	*x = WebhookDatasourceMetadata_Okta_WebhookDatasource{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[46]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[47]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4039,7 +4173,7 @@ func (x *WebhookDatasourceMetadata_Okta_WebhookDatasource) String() string {
 func (*WebhookDatasourceMetadata_Okta_WebhookDatasource) ProtoMessage() {}
 
 func (x *WebhookDatasourceMetadata_Okta_WebhookDatasource) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[46]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[47]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4052,7 +4186,7 @@ func (x *WebhookDatasourceMetadata_Okta_WebhookDatasource) ProtoReflect() protor
 
 // Deprecated: Use WebhookDatasourceMetadata_Okta_WebhookDatasource.ProtoReflect.Descriptor instead.
 func (*WebhookDatasourceMetadata_Okta_WebhookDatasource) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{15, 0, 0}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{16, 0, 0}
 }
 
 func (x *WebhookDatasourceMetadata_Okta_WebhookDatasource) GetHookId() string {
@@ -4095,7 +4229,7 @@ type WebhookDatasourceMetadata_Github_WebhookDatasource struct {
 
 func (x *WebhookDatasourceMetadata_Github_WebhookDatasource) Reset() {
 	*x = WebhookDatasourceMetadata_Github_WebhookDatasource{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[47]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[48]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4107,7 +4241,7 @@ func (x *WebhookDatasourceMetadata_Github_WebhookDatasource) String() string {
 func (*WebhookDatasourceMetadata_Github_WebhookDatasource) ProtoMessage() {}
 
 func (x *WebhookDatasourceMetadata_Github_WebhookDatasource) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[47]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[48]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4120,7 +4254,7 @@ func (x *WebhookDatasourceMetadata_Github_WebhookDatasource) ProtoReflect() prot
 
 // Deprecated: Use WebhookDatasourceMetadata_Github_WebhookDatasource.ProtoReflect.Descriptor instead.
 func (*WebhookDatasourceMetadata_Github_WebhookDatasource) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{15, 1, 0}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{16, 1, 0}
 }
 
 func (x *WebhookDatasourceMetadata_Github_WebhookDatasource) GetHookId() int64 {
@@ -4164,7 +4298,7 @@ type WebhookDatasourceMetadata_Gcp_WebhookDatasource struct {
 
 func (x *WebhookDatasourceMetadata_Gcp_WebhookDatasource) Reset() {
 	*x = WebhookDatasourceMetadata_Gcp_WebhookDatasource{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[48]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[49]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4176,7 +4310,7 @@ func (x *WebhookDatasourceMetadata_Gcp_WebhookDatasource) String() string {
 func (*WebhookDatasourceMetadata_Gcp_WebhookDatasource) ProtoMessage() {}
 
 func (x *WebhookDatasourceMetadata_Gcp_WebhookDatasource) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[48]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[49]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4189,7 +4323,7 @@ func (x *WebhookDatasourceMetadata_Gcp_WebhookDatasource) ProtoReflect() protore
 
 // Deprecated: Use WebhookDatasourceMetadata_Gcp_WebhookDatasource.ProtoReflect.Descriptor instead.
 func (*WebhookDatasourceMetadata_Gcp_WebhookDatasource) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{15, 2, 0}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{16, 2, 0}
 }
 
 func (x *WebhookDatasourceMetadata_Gcp_WebhookDatasource) GetPubsubTopicName() string {
@@ -4243,7 +4377,7 @@ type WebhookDatasourceMetadata_AWS_WebhookDatasource struct {
 
 func (x *WebhookDatasourceMetadata_AWS_WebhookDatasource) Reset() {
 	*x = WebhookDatasourceMetadata_AWS_WebhookDatasource{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[49]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[50]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4255,7 +4389,7 @@ func (x *WebhookDatasourceMetadata_AWS_WebhookDatasource) String() string {
 func (*WebhookDatasourceMetadata_AWS_WebhookDatasource) ProtoMessage() {}
 
 func (x *WebhookDatasourceMetadata_AWS_WebhookDatasource) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[49]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[50]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4268,7 +4402,7 @@ func (x *WebhookDatasourceMetadata_AWS_WebhookDatasource) ProtoReflect() protore
 
 // Deprecated: Use WebhookDatasourceMetadata_AWS_WebhookDatasource.ProtoReflect.Descriptor instead.
 func (*WebhookDatasourceMetadata_AWS_WebhookDatasource) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{15, 3, 0}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{16, 3, 0}
 }
 
 func (x *WebhookDatasourceMetadata_AWS_WebhookDatasource) GetRoutingKey() string {
@@ -4336,7 +4470,7 @@ type CryptoKeyMetadata_AWS struct {
 
 func (x *CryptoKeyMetadata_AWS) Reset() {
 	*x = CryptoKeyMetadata_AWS{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[50]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[51]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4348,7 +4482,7 @@ func (x *CryptoKeyMetadata_AWS) String() string {
 func (*CryptoKeyMetadata_AWS) ProtoMessage() {}
 
 func (x *CryptoKeyMetadata_AWS) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[50]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[51]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4361,7 +4495,7 @@ func (x *CryptoKeyMetadata_AWS) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CryptoKeyMetadata_AWS.ProtoReflect.Descriptor instead.
 func (*CryptoKeyMetadata_AWS) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{16, 0}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{17, 0}
 }
 
 func (x *CryptoKeyMetadata_AWS) GetKms() *CryptoKeyMetadata_AWS_KMS {
@@ -4381,7 +4515,7 @@ type CryptoKeyMetadata_AWS_KMS struct {
 
 func (x *CryptoKeyMetadata_AWS_KMS) Reset() {
 	*x = CryptoKeyMetadata_AWS_KMS{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[51]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[52]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4393,7 +4527,7 @@ func (x *CryptoKeyMetadata_AWS_KMS) String() string {
 func (*CryptoKeyMetadata_AWS_KMS) ProtoMessage() {}
 
 func (x *CryptoKeyMetadata_AWS_KMS) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[51]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[52]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4406,7 +4540,7 @@ func (x *CryptoKeyMetadata_AWS_KMS) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CryptoKeyMetadata_AWS_KMS.ProtoReflect.Descriptor instead.
 func (*CryptoKeyMetadata_AWS_KMS) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{16, 0, 0}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{17, 0, 0}
 }
 
 func (x *CryptoKeyMetadata_AWS_KMS) GetAlias() string {
@@ -4433,7 +4567,7 @@ type CloudLogsMetadata_AWS struct {
 
 func (x *CloudLogsMetadata_AWS) Reset() {
 	*x = CloudLogsMetadata_AWS{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[52]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[53]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4445,7 +4579,7 @@ func (x *CloudLogsMetadata_AWS) String() string {
 func (*CloudLogsMetadata_AWS) ProtoMessage() {}
 
 func (x *CloudLogsMetadata_AWS) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[52]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[53]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4458,7 +4592,7 @@ func (x *CloudLogsMetadata_AWS) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CloudLogsMetadata_AWS.ProtoReflect.Descriptor instead.
 func (*CloudLogsMetadata_AWS) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{17, 0}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{18, 0}
 }
 
 func (x *CloudLogsMetadata_AWS) GetCloudtrailS3Bucket() *CloudLogsMetadata_AWS_CloudTrailS3Bucket {
@@ -4484,7 +4618,7 @@ type CloudLogsMetadata_IBMCloud struct {
 
 func (x *CloudLogsMetadata_IBMCloud) Reset() {
 	*x = CloudLogsMetadata_IBMCloud{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[53]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[54]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4496,7 +4630,7 @@ func (x *CloudLogsMetadata_IBMCloud) String() string {
 func (*CloudLogsMetadata_IBMCloud) ProtoMessage() {}
 
 func (x *CloudLogsMetadata_IBMCloud) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[53]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[54]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4509,7 +4643,7 @@ func (x *CloudLogsMetadata_IBMCloud) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CloudLogsMetadata_IBMCloud.ProtoReflect.Descriptor instead.
 func (*CloudLogsMetadata_IBMCloud) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{17, 1}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{18, 1}
 }
 
 func (x *CloudLogsMetadata_IBMCloud) GetIbmActivityTracker() *CloudLogsMetadata_IBMCloud_IBMActivityTracker {
@@ -4533,7 +4667,7 @@ type CloudLogsMetadata_AWS_CloudTrailS3Bucket struct {
 
 func (x *CloudLogsMetadata_AWS_CloudTrailS3Bucket) Reset() {
 	*x = CloudLogsMetadata_AWS_CloudTrailS3Bucket{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[54]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[55]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4545,7 +4679,7 @@ func (x *CloudLogsMetadata_AWS_CloudTrailS3Bucket) String() string {
 func (*CloudLogsMetadata_AWS_CloudTrailS3Bucket) ProtoMessage() {}
 
 func (x *CloudLogsMetadata_AWS_CloudTrailS3Bucket) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[54]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[55]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4558,7 +4692,7 @@ func (x *CloudLogsMetadata_AWS_CloudTrailS3Bucket) ProtoReflect() protoreflect.M
 
 // Deprecated: Use CloudLogsMetadata_AWS_CloudTrailS3Bucket.ProtoReflect.Descriptor instead.
 func (*CloudLogsMetadata_AWS_CloudTrailS3Bucket) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{17, 0, 0}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{18, 0, 0}
 }
 
 func (x *CloudLogsMetadata_AWS_CloudTrailS3Bucket) GetBucketArn() string {
@@ -4619,7 +4753,7 @@ type CloudLogsMetadata_AWS_CloudTrailSNS struct {
 
 func (x *CloudLogsMetadata_AWS_CloudTrailSNS) Reset() {
 	*x = CloudLogsMetadata_AWS_CloudTrailSNS{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[55]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[56]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4631,7 +4765,7 @@ func (x *CloudLogsMetadata_AWS_CloudTrailSNS) String() string {
 func (*CloudLogsMetadata_AWS_CloudTrailSNS) ProtoMessage() {}
 
 func (x *CloudLogsMetadata_AWS_CloudTrailSNS) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[55]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[56]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4644,7 +4778,7 @@ func (x *CloudLogsMetadata_AWS_CloudTrailSNS) ProtoReflect() protoreflect.Messag
 
 // Deprecated: Use CloudLogsMetadata_AWS_CloudTrailSNS.ProtoReflect.Descriptor instead.
 func (*CloudLogsMetadata_AWS_CloudTrailSNS) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{17, 0, 1}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{18, 0, 1}
 }
 
 func (x *CloudLogsMetadata_AWS_CloudTrailSNS) GetRoleName() string {
@@ -4716,7 +4850,7 @@ type CloudLogsMetadata_IBMCloud_IBMActivityTracker struct {
 
 func (x *CloudLogsMetadata_IBMCloud_IBMActivityTracker) Reset() {
 	*x = CloudLogsMetadata_IBMCloud_IBMActivityTracker{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[56]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[57]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4728,7 +4862,7 @@ func (x *CloudLogsMetadata_IBMCloud_IBMActivityTracker) String() string {
 func (*CloudLogsMetadata_IBMCloud_IBMActivityTracker) ProtoMessage() {}
 
 func (x *CloudLogsMetadata_IBMCloud_IBMActivityTracker) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[56]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[57]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4741,7 +4875,7 @@ func (x *CloudLogsMetadata_IBMCloud_IBMActivityTracker) ProtoReflect() protorefl
 
 // Deprecated: Use CloudLogsMetadata_IBMCloud_IBMActivityTracker.ProtoReflect.Descriptor instead.
 func (*CloudLogsMetadata_IBMCloud_IBMActivityTracker) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{17, 1, 0}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{18, 1, 0}
 }
 
 func (x *CloudLogsMetadata_IBMCloud_IBMActivityTracker) GetServiceId() string {
@@ -4788,7 +4922,7 @@ type CloudResponderMetadata_AWS struct {
 
 func (x *CloudResponderMetadata_AWS) Reset() {
 	*x = CloudResponderMetadata_AWS{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[57]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[58]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4800,7 +4934,7 @@ func (x *CloudResponderMetadata_AWS) String() string {
 func (*CloudResponderMetadata_AWS) ProtoMessage() {}
 
 func (x *CloudResponderMetadata_AWS) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[57]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[58]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4813,7 +4947,7 @@ func (x *CloudResponderMetadata_AWS) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CloudResponderMetadata_AWS.ProtoReflect.Descriptor instead.
 func (*CloudResponderMetadata_AWS) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{18, 0}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{19, 0}
 }
 
 func (x *CloudResponderMetadata_AWS) GetResponderLambdas() *CloudResponderMetadata_AWS_ResponderLambdas {
@@ -4824,17 +4958,18 @@ func (x *CloudResponderMetadata_AWS) GetResponderLambdas() *CloudResponderMetada
 }
 
 type CloudResponderMetadata_AWS_ResponderLambdas struct {
-	state            protoimpl.MessageState `protogen:"open.v1"`
-	LambdaNames      []string               `protobuf:"bytes,1,rep,name=lambda_names,json=lambdaNames,proto3" json:"lambda_names,omitempty"`
-	Regions          []string               `protobuf:"bytes,2,rep,name=regions,proto3" json:"regions,omitempty"`
-	DelegateRoleName string                 `protobuf:"bytes,3,opt,name=delegate_role_name,json=delegateRoleName,proto3" json:"delegate_role_name,omitempty"`
-	unknownFields    protoimpl.UnknownFields
-	sizeCache        protoimpl.SizeCache
+	state              protoimpl.MessageState `protogen:"open.v1"`
+	LambdaNames        []string               `protobuf:"bytes,1,rep,name=lambda_names,json=lambdaNames,proto3" json:"lambda_names,omitempty"`
+	Regions            []string               `protobuf:"bytes,2,rep,name=regions,proto3" json:"regions,omitempty"`
+	DelegateRoleName   string                 `protobuf:"bytes,3,opt,name=delegate_role_name,json=delegateRoleName,proto3" json:"delegate_role_name,omitempty"`
+	ValidationRoleName string                 `protobuf:"bytes,4,opt,name=validation_role_name,json=validationRoleName,proto3" json:"validation_role_name,omitempty"`
+	unknownFields      protoimpl.UnknownFields
+	sizeCache          protoimpl.SizeCache
 }
 
 func (x *CloudResponderMetadata_AWS_ResponderLambdas) Reset() {
 	*x = CloudResponderMetadata_AWS_ResponderLambdas{}
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[58]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[59]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4846,7 +4981,7 @@ func (x *CloudResponderMetadata_AWS_ResponderLambdas) String() string {
 func (*CloudResponderMetadata_AWS_ResponderLambdas) ProtoMessage() {}
 
 func (x *CloudResponderMetadata_AWS_ResponderLambdas) ProtoReflect() protoreflect.Message {
-	mi := &file_cloudauth_cloud_account_proto_msgTypes[58]
+	mi := &file_cloudauth_cloud_account_proto_msgTypes[59]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4859,7 +4994,7 @@ func (x *CloudResponderMetadata_AWS_ResponderLambdas) ProtoReflect() protoreflec
 
 // Deprecated: Use CloudResponderMetadata_AWS_ResponderLambdas.ProtoReflect.Descriptor instead.
 func (*CloudResponderMetadata_AWS_ResponderLambdas) Descriptor() ([]byte, []int) {
-	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{18, 0, 0}
+	return file_cloudauth_cloud_account_proto_rawDescGZIP(), []int{19, 0, 0}
 }
 
 func (x *CloudResponderMetadata_AWS_ResponderLambdas) GetLambdaNames() []string {
@@ -4883,6 +5018,13 @@ func (x *CloudResponderMetadata_AWS_ResponderLambdas) GetDelegateRoleName() stri
 	return ""
 }
 
+func (x *CloudResponderMetadata_AWS_ResponderLambdas) GetValidationRoleName() string {
+	if x != nil {
+		return x.ValidationRoleName
+	}
+	return ""
+}
+
 var file_cloudauth_cloud_account_proto_extTypes = []protoimpl.ExtensionInfo{
 	{
 		ExtendedType:  (*descriptorpb.FieldOptions)(nil),
@@ -4904,7 +5046,7 @@ var File_cloudauth_cloud_account_proto protoreflect.FileDescriptor
 
 const file_cloudauth_cloud_account_proto_rawDesc = "" +
 	"\n" +
-	"\x1dcloudauth_cloud_account.proto\x12\x0ecloudauthproto\x1a google/protobuf/descriptor.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"\xaa\b\n" +
+	"\x1dcloudauth_cloud_account.proto\x12\x0ecloudauthproto\x1a google/protobuf/descriptor.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"\xcb\b\n" +
 	"\fCloudAccount\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x12\x1f\n" +
 	"\vcustomer_id\x18\x02 \x01(\x04R\n" +
@@ -4935,7 +5077,9 @@ const file_cloudauth_cloud_account_proto_rawDesc = "" +
 	"\x14regulatory_framework\x18\x12 \x01(\x0e2#.cloudauthproto.RegulatoryFrameworkR\x13regulatoryFramework\x12P\n" +
 	"\x12provider_partition\x18\x13 \x01(\x0e2!.cloudauthproto.ProviderPartitionR\x11providerPartition\x128\n" +
 	"\x18organizational_unit_path\x18\x14 \x01(\tR\x16organizationalUnitPath\x123\n" +
-	"\x03ibm\x18\x15 \x01(\v2\x1f.cloudauthproto.IBMCloudAccountH\x00R\x03ibmB\x12\n" +
+	"\x03ibm\x18\x15 \x01(\v2\x1f.cloudauthproto.IBMCloudAccountH\x00R\x03ibm\x12\x1f\n" +
+	"\vparent_uuid\x18\x16 \x01(\tR\n" +
+	"parentUuidB\x12\n" +
 	"\x10provider_details\"#\n" +
 	"\x0fIBMCloudAccount\x12\x10\n" +
 	"\x03crn\x18\x01 \x01(\tR\x03crn\"\xd9\a\n" +
@@ -5019,7 +5163,23 @@ const file_cloudauth_cloud_account_proto_rawDesc = "" +
 	"\x17included_cloud_accounts\x18\x11 \x03(\tR\x15includedCloudAccounts\x126\n" +
 	"\x17excluded_cloud_accounts\x18\x12 \x03(\tR\x15excludedCloudAccounts\x120\n" +
 	"\x14organization_root_id\x18\x13 \x01(\tR\x12organizationRootId\x121\n" +
-	"\x14automatic_onboarding\x18\x14 \x01(\bR\x13automaticOnboarding\"\x87\a\n" +
+	"\x14automatic_onboarding\x18\x14 \x01(\bR\x13automaticOnboarding\"\xc6\x03\n" +
+	"\x13OrganizationalGroup\x12\x12\n" +
+	"\x04uuid\x18\x01 \x01(\tR\x04uuid\x12\x12\n" +
+	"\x04name\x18\x02 \x01(\tR\x04name\x12+\n" +
+	"\x11organization_uuid\x18\x03 \x01(\tR\x10organizationUuid\x12\x1f\n" +
+	"\vparent_uuid\x18\x04 \x01(\tR\n" +
+	"parentUuid\x124\n" +
+	"\bprovider\x18\x05 \x01(\x0e2\x18.cloudauthproto.ProviderR\bprovider\x123\n" +
+	"\bmetadata\x18\x06 \x01(\v2\x17.google.protobuf.StructR\bmetadata\x12\x1f\n" +
+	"\vcustomer_id\x18\a \x01(\x04R\n" +
+	"customerId\x129\n" +
+	"\n" +
+	"created_at\x18\b \x01(\v2\x1a.google.protobuf.TimestampR\tcreatedAt\x129\n" +
+	"\n" +
+	"updated_at\x18\t \x01(\v2\x1a.google.protobuf.TimestampR\tupdatedAt\x127\n" +
+	"\tverbosity\x18\n" +
+	" \x01(\x0e2\x19.cloudauthproto.VerbosityR\tverbosity\"\x87\a\n" +
 	"\x11FeatureComponents\x12N\n" +
 	"\x0fcloud_connector\x18\x01 \x01(\v2 .cloudauthproto.AccountComponentH\x00R\x0ecloudConnector\x88\x01\x01\x12H\n" +
 	"\fevent_bridge\x18\x02 \x01(\v2 .cloudauthproto.AccountComponentH\x01R\veventBridge\x88\x01\x01\x12H\n" +
@@ -5271,19 +5431,21 @@ const file_cloudauth_cloud_account_proto_rawDesc = "" +
 	"bucket_crn\x18\x04 \x01(\tR\tbucketCrn\x12#\n" +
 	"\ringestion_url\x18\x05 \x01(\tR\fingestionUrlB\n" +
 	"\n" +
-	"\bprovider\"\xd5\x02\n" +
+	"\bprovider\"\x88\x03\n" +
 	"\x16CloudResponderMetadata\x12>\n" +
-	"\x03aws\x18\x01 \x01(\v2*.cloudauthproto.CloudResponderMetadata.AWSH\x00R\x03aws\x1a\xee\x01\n" +
+	"\x03aws\x18\x01 \x01(\v2*.cloudauthproto.CloudResponderMetadata.AWSH\x00R\x03aws\x1a\xa1\x02\n" +
 	"\x03AWS\x12h\n" +
-	"\x11responder_lambdas\x18\x01 \x01(\v2;.cloudauthproto.CloudResponderMetadata.AWS.ResponderLambdasR\x10responderLambdas\x1a}\n" +
+	"\x11responder_lambdas\x18\x01 \x01(\v2;.cloudauthproto.CloudResponderMetadata.AWS.ResponderLambdasR\x10responderLambdas\x1a\xaf\x01\n" +
 	"\x10ResponderLambdas\x12!\n" +
 	"\flambda_names\x18\x01 \x03(\tR\vlambdaNames\x12\x18\n" +
 	"\aregions\x18\x02 \x03(\tR\aregions\x12,\n" +
-	"\x12delegate_role_name\x18\x03 \x01(\tR\x10delegateRoleNameB\n" +
+	"\x12delegate_role_name\x18\x03 \x01(\tR\x10delegateRoleName\x120\n" +
+	"\x14validation_role_name\x18\x04 \x01(\tR\x12validationRoleNameB\n" +
 	"\n" +
-	"\bprovider\"X\n" +
+	"\bprovider\"\xa6\x01\n" +
 	"\x1bCloudResponderRolesMetadata\x129\n" +
-	"\x05roles\x18\x01 \x03(\v2#.cloudauthproto.TrustedRoleMetadataR\x05roles*\xb5\x01\n" +
+	"\x05roles\x18\x01 \x03(\v2#.cloudauthproto.TrustedRoleMetadataR\x05roles\x12L\n" +
+	"\x0fvalidation_role\x18\x02 \x01(\v2#.cloudauthproto.TrustedRoleMetadataR\x0evalidationRole*\xb5\x01\n" +
 	"\bProvider\x12\x18\n" +
 	"\x14PROVIDER_UNSPECIFIED\x10\x00\x12\x10\n" +
 	"\fPROVIDER_AWS\x10\x01\x12\x12\n" +
@@ -5363,7 +5525,7 @@ func file_cloudauth_cloud_account_proto_rawDescGZIP() []byte {
 }
 
 var file_cloudauth_cloud_account_proto_enumTypes = make([]protoimpl.EnumInfo, 8)
-var file_cloudauth_cloud_account_proto_msgTypes = make([]protoimpl.MessageInfo, 59)
+var file_cloudauth_cloud_account_proto_msgTypes = make([]protoimpl.MessageInfo, 60)
 var file_cloudauth_cloud_account_proto_goTypes = []any{
 	(Provider)(0),                                                   // 0: cloudauthproto.Provider
 	(Feature)(0),                                                    // 1: cloudauthproto.Feature
@@ -5382,67 +5544,69 @@ var file_cloudauth_cloud_account_proto_goTypes = []any{
 	(*ValidationWarning)(nil),                                       // 14: cloudauthproto.ValidationWarning
 	(*Validation)(nil),                                              // 15: cloudauthproto.Validation
 	(*CloudOrganization)(nil),                                       // 16: cloudauthproto.CloudOrganization
-	(*FeatureComponents)(nil),                                       // 17: cloudauthproto.FeatureComponents
-	(*AccountComponent)(nil),                                        // 18: cloudauthproto.AccountComponent
-	(*CloudConnectorMetadata)(nil),                                  // 19: cloudauthproto.CloudConnectorMetadata
-	(*TrustedRoleMetadata)(nil),                                     // 20: cloudauthproto.TrustedRoleMetadata
-	(*EventBridgeMetadata)(nil),                                     // 21: cloudauthproto.EventBridgeMetadata
-	(*ServicePrincipalMetadata)(nil),                                // 22: cloudauthproto.ServicePrincipalMetadata
-	(*WebhookDatasourceMetadata)(nil),                               // 23: cloudauthproto.WebhookDatasourceMetadata
-	(*CryptoKeyMetadata)(nil),                                       // 24: cloudauthproto.CryptoKeyMetadata
-	(*CloudLogsMetadata)(nil),                                       // 25: cloudauthproto.CloudLogsMetadata
-	(*CloudResponderMetadata)(nil),                                  // 26: cloudauthproto.CloudResponderMetadata
-	(*CloudResponderRolesMetadata)(nil),                             // 27: cloudauthproto.CloudResponderRolesMetadata
-	nil,                                                             // 28: cloudauthproto.AccountFeature.FlagsEntry
-	(*CloudConnectorMetadata_AWS)(nil),                              // 29: cloudauthproto.CloudConnectorMetadata.AWS
-	(*CloudConnectorMetadata_Azure)(nil),                            // 30: cloudauthproto.CloudConnectorMetadata.Azure
-	(*CloudConnectorMetadata_GCP)(nil),                              // 31: cloudauthproto.CloudConnectorMetadata.GCP
-	(*TrustedRoleMetadata_AWS)(nil),                                 // 32: cloudauthproto.TrustedRoleMetadata.AWS
-	(*TrustedRoleMetadata_GCP)(nil),                                 // 33: cloudauthproto.TrustedRoleMetadata.GCP
-	(*TrustedRoleMetadata_Azure)(nil),                               // 34: cloudauthproto.TrustedRoleMetadata.Azure
-	(*TrustedRoleMetadata_IBMCloud)(nil),                            // 35: cloudauthproto.TrustedRoleMetadata.IBMCloud
-	(*EventBridgeMetadata_AWS)(nil),                                 // 36: cloudauthproto.EventBridgeMetadata.AWS
-	(*EventBridgeMetadata_Azure)(nil),                               // 37: cloudauthproto.EventBridgeMetadata.Azure
-	(*EventBridgeMetadata_Azure_EventHubMetadata)(nil),              // 38: cloudauthproto.EventBridgeMetadata.Azure.EventHubMetadata
-	(*ServicePrincipalMetadata_GCP)(nil),                            // 39: cloudauthproto.ServicePrincipalMetadata.GCP
-	(*ServicePrincipalMetadata_Okta)(nil),                           // 40: cloudauthproto.ServicePrincipalMetadata.Okta
-	(*ServicePrincipalMetadata_Azure)(nil),                          // 41: cloudauthproto.ServicePrincipalMetadata.Azure
-	(*ServicePrincipalMetadata_OracleCloud)(nil),                    // 42: cloudauthproto.ServicePrincipalMetadata.OracleCloud
-	(*ServicePrincipalMetadata_GCP_Key)(nil),                        // 43: cloudauthproto.ServicePrincipalMetadata.GCP.Key
-	(*ServicePrincipalMetadata_GCP_WorkloadIdentityFederation)(nil), // 44: cloudauthproto.ServicePrincipalMetadata.GCP.WorkloadIdentityFederation
-	(*ServicePrincipalMetadata_Okta_OAuthApp)(nil),                  // 45: cloudauthproto.ServicePrincipalMetadata.Okta.OAuthApp
-	(*ServicePrincipalMetadata_Azure_ActiveDirectoryServicePrincipal)(nil), // 46: cloudauthproto.ServicePrincipalMetadata.Azure.ActiveDirectoryServicePrincipal
-	(*ServicePrincipalMetadata_Azure_Oauth2PermissionGrant)(nil),           // 47: cloudauthproto.ServicePrincipalMetadata.Azure.Oauth2PermissionGrant
-	(*ServicePrincipalMetadata_OracleCloud_ApiKey)(nil),                    // 48: cloudauthproto.ServicePrincipalMetadata.OracleCloud.ApiKey
-	(*ServicePrincipalMetadata_OracleCloud_Policy)(nil),                    // 49: cloudauthproto.ServicePrincipalMetadata.OracleCloud.Policy
-	(*WebhookDatasourceMetadata_Okta)(nil),                                 // 50: cloudauthproto.WebhookDatasourceMetadata.Okta
-	(*WebhookDatasourceMetadata_Github)(nil),                               // 51: cloudauthproto.WebhookDatasourceMetadata.Github
-	(*WebhookDatasourceMetadata_Gcp)(nil),                                  // 52: cloudauthproto.WebhookDatasourceMetadata.Gcp
-	(*WebhookDatasourceMetadata_AWS)(nil),                                  // 53: cloudauthproto.WebhookDatasourceMetadata.AWS
-	(*WebhookDatasourceMetadata_Okta_WebhookDatasource)(nil),               // 54: cloudauthproto.WebhookDatasourceMetadata.Okta.WebhookDatasource
-	(*WebhookDatasourceMetadata_Github_WebhookDatasource)(nil),             // 55: cloudauthproto.WebhookDatasourceMetadata.Github.WebhookDatasource
-	(*WebhookDatasourceMetadata_Gcp_WebhookDatasource)(nil),                // 56: cloudauthproto.WebhookDatasourceMetadata.Gcp.WebhookDatasource
-	(*WebhookDatasourceMetadata_AWS_WebhookDatasource)(nil),                // 57: cloudauthproto.WebhookDatasourceMetadata.AWS.WebhookDatasource
-	(*CryptoKeyMetadata_AWS)(nil),                                          // 58: cloudauthproto.CryptoKeyMetadata.AWS
-	(*CryptoKeyMetadata_AWS_KMS)(nil),                                      // 59: cloudauthproto.CryptoKeyMetadata.AWS.KMS
-	(*CloudLogsMetadata_AWS)(nil),                                          // 60: cloudauthproto.CloudLogsMetadata.AWS
-	(*CloudLogsMetadata_IBMCloud)(nil),                                     // 61: cloudauthproto.CloudLogsMetadata.IBMCloud
-	(*CloudLogsMetadata_AWS_CloudTrailS3Bucket)(nil),                       // 62: cloudauthproto.CloudLogsMetadata.AWS.CloudTrailS3Bucket
-	(*CloudLogsMetadata_AWS_CloudTrailSNS)(nil),                            // 63: cloudauthproto.CloudLogsMetadata.AWS.CloudTrailSNS
-	(*CloudLogsMetadata_IBMCloud_IBMActivityTracker)(nil),                  // 64: cloudauthproto.CloudLogsMetadata.IBMCloud.IBMActivityTracker
-	(*CloudResponderMetadata_AWS)(nil),                                     // 65: cloudauthproto.CloudResponderMetadata.AWS
-	(*CloudResponderMetadata_AWS_ResponderLambdas)(nil),                    // 66: cloudauthproto.CloudResponderMetadata.AWS.ResponderLambdas
-	(*timestamppb.Timestamp)(nil),                                          // 67: google.protobuf.Timestamp
-	(*durationpb.Duration)(nil),                                            // 68: google.protobuf.Duration
-	(*structpb.Value)(nil),                                                 // 69: google.protobuf.Value
-	(*descriptorpb.FieldOptions)(nil),                                      // 70: google.protobuf.FieldOptions
+	(*OrganizationalGroup)(nil),                                     // 17: cloudauthproto.OrganizationalGroup
+	(*FeatureComponents)(nil),                                       // 18: cloudauthproto.FeatureComponents
+	(*AccountComponent)(nil),                                        // 19: cloudauthproto.AccountComponent
+	(*CloudConnectorMetadata)(nil),                                  // 20: cloudauthproto.CloudConnectorMetadata
+	(*TrustedRoleMetadata)(nil),                                     // 21: cloudauthproto.TrustedRoleMetadata
+	(*EventBridgeMetadata)(nil),                                     // 22: cloudauthproto.EventBridgeMetadata
+	(*ServicePrincipalMetadata)(nil),                                // 23: cloudauthproto.ServicePrincipalMetadata
+	(*WebhookDatasourceMetadata)(nil),                               // 24: cloudauthproto.WebhookDatasourceMetadata
+	(*CryptoKeyMetadata)(nil),                                       // 25: cloudauthproto.CryptoKeyMetadata
+	(*CloudLogsMetadata)(nil),                                       // 26: cloudauthproto.CloudLogsMetadata
+	(*CloudResponderMetadata)(nil),                                  // 27: cloudauthproto.CloudResponderMetadata
+	(*CloudResponderRolesMetadata)(nil),                             // 28: cloudauthproto.CloudResponderRolesMetadata
+	nil,                                                             // 29: cloudauthproto.AccountFeature.FlagsEntry
+	(*CloudConnectorMetadata_AWS)(nil),                              // 30: cloudauthproto.CloudConnectorMetadata.AWS
+	(*CloudConnectorMetadata_Azure)(nil),                            // 31: cloudauthproto.CloudConnectorMetadata.Azure
+	(*CloudConnectorMetadata_GCP)(nil),                              // 32: cloudauthproto.CloudConnectorMetadata.GCP
+	(*TrustedRoleMetadata_AWS)(nil),                                 // 33: cloudauthproto.TrustedRoleMetadata.AWS
+	(*TrustedRoleMetadata_GCP)(nil),                                 // 34: cloudauthproto.TrustedRoleMetadata.GCP
+	(*TrustedRoleMetadata_Azure)(nil),                               // 35: cloudauthproto.TrustedRoleMetadata.Azure
+	(*TrustedRoleMetadata_IBMCloud)(nil),                            // 36: cloudauthproto.TrustedRoleMetadata.IBMCloud
+	(*EventBridgeMetadata_AWS)(nil),                                 // 37: cloudauthproto.EventBridgeMetadata.AWS
+	(*EventBridgeMetadata_Azure)(nil),                               // 38: cloudauthproto.EventBridgeMetadata.Azure
+	(*EventBridgeMetadata_Azure_EventHubMetadata)(nil),              // 39: cloudauthproto.EventBridgeMetadata.Azure.EventHubMetadata
+	(*ServicePrincipalMetadata_GCP)(nil),                            // 40: cloudauthproto.ServicePrincipalMetadata.GCP
+	(*ServicePrincipalMetadata_Okta)(nil),                           // 41: cloudauthproto.ServicePrincipalMetadata.Okta
+	(*ServicePrincipalMetadata_Azure)(nil),                          // 42: cloudauthproto.ServicePrincipalMetadata.Azure
+	(*ServicePrincipalMetadata_OracleCloud)(nil),                    // 43: cloudauthproto.ServicePrincipalMetadata.OracleCloud
+	(*ServicePrincipalMetadata_GCP_Key)(nil),                        // 44: cloudauthproto.ServicePrincipalMetadata.GCP.Key
+	(*ServicePrincipalMetadata_GCP_WorkloadIdentityFederation)(nil), // 45: cloudauthproto.ServicePrincipalMetadata.GCP.WorkloadIdentityFederation
+	(*ServicePrincipalMetadata_Okta_OAuthApp)(nil),                  // 46: cloudauthproto.ServicePrincipalMetadata.Okta.OAuthApp
+	(*ServicePrincipalMetadata_Azure_ActiveDirectoryServicePrincipal)(nil), // 47: cloudauthproto.ServicePrincipalMetadata.Azure.ActiveDirectoryServicePrincipal
+	(*ServicePrincipalMetadata_Azure_Oauth2PermissionGrant)(nil),           // 48: cloudauthproto.ServicePrincipalMetadata.Azure.Oauth2PermissionGrant
+	(*ServicePrincipalMetadata_OracleCloud_ApiKey)(nil),                    // 49: cloudauthproto.ServicePrincipalMetadata.OracleCloud.ApiKey
+	(*ServicePrincipalMetadata_OracleCloud_Policy)(nil),                    // 50: cloudauthproto.ServicePrincipalMetadata.OracleCloud.Policy
+	(*WebhookDatasourceMetadata_Okta)(nil),                                 // 51: cloudauthproto.WebhookDatasourceMetadata.Okta
+	(*WebhookDatasourceMetadata_Github)(nil),                               // 52: cloudauthproto.WebhookDatasourceMetadata.Github
+	(*WebhookDatasourceMetadata_Gcp)(nil),                                  // 53: cloudauthproto.WebhookDatasourceMetadata.Gcp
+	(*WebhookDatasourceMetadata_AWS)(nil),                                  // 54: cloudauthproto.WebhookDatasourceMetadata.AWS
+	(*WebhookDatasourceMetadata_Okta_WebhookDatasource)(nil),               // 55: cloudauthproto.WebhookDatasourceMetadata.Okta.WebhookDatasource
+	(*WebhookDatasourceMetadata_Github_WebhookDatasource)(nil),             // 56: cloudauthproto.WebhookDatasourceMetadata.Github.WebhookDatasource
+	(*WebhookDatasourceMetadata_Gcp_WebhookDatasource)(nil),                // 57: cloudauthproto.WebhookDatasourceMetadata.Gcp.WebhookDatasource
+	(*WebhookDatasourceMetadata_AWS_WebhookDatasource)(nil),                // 58: cloudauthproto.WebhookDatasourceMetadata.AWS.WebhookDatasource
+	(*CryptoKeyMetadata_AWS)(nil),                                          // 59: cloudauthproto.CryptoKeyMetadata.AWS
+	(*CryptoKeyMetadata_AWS_KMS)(nil),                                      // 60: cloudauthproto.CryptoKeyMetadata.AWS.KMS
+	(*CloudLogsMetadata_AWS)(nil),                                          // 61: cloudauthproto.CloudLogsMetadata.AWS
+	(*CloudLogsMetadata_IBMCloud)(nil),                                     // 62: cloudauthproto.CloudLogsMetadata.IBMCloud
+	(*CloudLogsMetadata_AWS_CloudTrailS3Bucket)(nil),                       // 63: cloudauthproto.CloudLogsMetadata.AWS.CloudTrailS3Bucket
+	(*CloudLogsMetadata_AWS_CloudTrailSNS)(nil),                            // 64: cloudauthproto.CloudLogsMetadata.AWS.CloudTrailSNS
+	(*CloudLogsMetadata_IBMCloud_IBMActivityTracker)(nil),                  // 65: cloudauthproto.CloudLogsMetadata.IBMCloud.IBMActivityTracker
+	(*CloudResponderMetadata_AWS)(nil),                                     // 66: cloudauthproto.CloudResponderMetadata.AWS
+	(*CloudResponderMetadata_AWS_ResponderLambdas)(nil),                    // 67: cloudauthproto.CloudResponderMetadata.AWS.ResponderLambdas
+	(*timestamppb.Timestamp)(nil),                                          // 68: google.protobuf.Timestamp
+	(*durationpb.Duration)(nil),                                            // 69: google.protobuf.Duration
+	(*structpb.Value)(nil),                                                 // 70: google.protobuf.Value
+	(*structpb.Struct)(nil),                                                // 71: google.protobuf.Struct
+	(*descriptorpb.FieldOptions)(nil),                                      // 72: google.protobuf.FieldOptions
 }
 var file_cloudauth_cloud_account_proto_depIdxs = []int32{
 	0,   // 0: cloudauthproto.CloudAccount.provider:type_name -> cloudauthproto.Provider
 	10,  // 1: cloudauthproto.CloudAccount.feature:type_name -> cloudauthproto.AccountFeatures
-	67,  // 2: cloudauthproto.CloudAccount.created_at:type_name -> google.protobuf.Timestamp
-	67,  // 3: cloudauthproto.CloudAccount.updated_at:type_name -> google.protobuf.Timestamp
-	18,  // 4: cloudauthproto.CloudAccount.components:type_name -> cloudauthproto.AccountComponent
+	68,  // 2: cloudauthproto.CloudAccount.created_at:type_name -> google.protobuf.Timestamp
+	68,  // 3: cloudauthproto.CloudAccount.updated_at:type_name -> google.protobuf.Timestamp
+	19,  // 4: cloudauthproto.CloudAccount.components:type_name -> cloudauthproto.AccountComponent
 	15,  // 5: cloudauthproto.CloudAccount.validation:type_name -> cloudauthproto.Validation
 	2,   // 6: cloudauthproto.CloudAccount.verbosity:type_name -> cloudauthproto.Verbosity
 	3,   // 7: cloudauthproto.CloudAccount.regulatory_framework:type_name -> cloudauthproto.RegulatoryFramework
@@ -5459,96 +5623,102 @@ var file_cloudauth_cloud_account_proto_depIdxs = []int32{
 	11,  // 18: cloudauthproto.AccountFeatures.secure_sensitive_content_posture:type_name -> cloudauthproto.AccountFeature
 	11,  // 19: cloudauthproto.AccountFeatures.secure_response_actions:type_name -> cloudauthproto.AccountFeature
 	1,   // 20: cloudauthproto.AccountFeature.type:type_name -> cloudauthproto.Feature
-	67,  // 21: cloudauthproto.AccountFeature.created_at:type_name -> google.protobuf.Timestamp
+	68,  // 21: cloudauthproto.AccountFeature.created_at:type_name -> google.protobuf.Timestamp
 	15,  // 22: cloudauthproto.AccountFeature.validation:type_name -> cloudauthproto.Validation
-	28,  // 23: cloudauthproto.AccountFeature.flags:type_name -> cloudauthproto.AccountFeature.FlagsEntry
-	68,  // 24: cloudauthproto.ValidationStep.duration:type_name -> google.protobuf.Duration
+	29,  // 23: cloudauthproto.AccountFeature.flags:type_name -> cloudauthproto.AccountFeature.FlagsEntry
+	69,  // 24: cloudauthproto.ValidationStep.duration:type_name -> google.protobuf.Duration
 	13,  // 25: cloudauthproto.ValidationStep.error:type_name -> cloudauthproto.ValidationError
 	14,  // 26: cloudauthproto.ValidationStep.warning:type_name -> cloudauthproto.ValidationWarning
 	6,   // 27: cloudauthproto.ValidationStep.stage:type_name -> cloudauthproto.ValidationStage
-	67,  // 28: cloudauthproto.ValidationStep.updated_at:type_name -> google.protobuf.Timestamp
-	69,  // 29: cloudauthproto.ValidationError.detail:type_name -> google.protobuf.Value
-	69,  // 30: cloudauthproto.ValidationWarning.detail:type_name -> google.protobuf.Value
+	68,  // 28: cloudauthproto.ValidationStep.updated_at:type_name -> google.protobuf.Timestamp
+	70,  // 29: cloudauthproto.ValidationError.detail:type_name -> google.protobuf.Value
+	70,  // 30: cloudauthproto.ValidationWarning.detail:type_name -> google.protobuf.Value
 	5,   // 31: cloudauthproto.Validation.result:type_name -> cloudauthproto.ValidationResult
-	67,  // 32: cloudauthproto.Validation.timestamp:type_name -> google.protobuf.Timestamp
+	68,  // 32: cloudauthproto.Validation.timestamp:type_name -> google.protobuf.Timestamp
 	12,  // 33: cloudauthproto.Validation.steps:type_name -> cloudauthproto.ValidationStep
 	6,   // 34: cloudauthproto.Validation.disposition:type_name -> cloudauthproto.ValidationStage
 	8,   // 35: cloudauthproto.CloudOrganization.accounts:type_name -> cloudauthproto.CloudAccount
-	67,  // 36: cloudauthproto.CloudOrganization.created_at:type_name -> google.protobuf.Timestamp
-	67,  // 37: cloudauthproto.CloudOrganization.updated_at:type_name -> google.protobuf.Timestamp
+	68,  // 36: cloudauthproto.CloudOrganization.created_at:type_name -> google.protobuf.Timestamp
+	68,  // 37: cloudauthproto.CloudOrganization.updated_at:type_name -> google.protobuf.Timestamp
 	0,   // 38: cloudauthproto.CloudOrganization.provider:type_name -> cloudauthproto.Provider
 	15,  // 39: cloudauthproto.CloudOrganization.validation:type_name -> cloudauthproto.Validation
 	2,   // 40: cloudauthproto.CloudOrganization.verbosity:type_name -> cloudauthproto.Verbosity
 	8,   // 41: cloudauthproto.CloudOrganization.management_account:type_name -> cloudauthproto.CloudAccount
-	18,  // 42: cloudauthproto.FeatureComponents.cloud_connector:type_name -> cloudauthproto.AccountComponent
-	18,  // 43: cloudauthproto.FeatureComponents.event_bridge:type_name -> cloudauthproto.AccountComponent
-	18,  // 44: cloudauthproto.FeatureComponents.trusted_role:type_name -> cloudauthproto.AccountComponent
-	18,  // 45: cloudauthproto.FeatureComponents.service_principal:type_name -> cloudauthproto.AccountComponent
-	18,  // 46: cloudauthproto.FeatureComponents.webhook_datasource:type_name -> cloudauthproto.AccountComponent
-	18,  // 47: cloudauthproto.FeatureComponents.crypto_key:type_name -> cloudauthproto.AccountComponent
-	18,  // 48: cloudauthproto.FeatureComponents.cloud_logs:type_name -> cloudauthproto.AccountComponent
-	18,  // 49: cloudauthproto.FeatureComponents.cloud_responder:type_name -> cloudauthproto.AccountComponent
-	18,  // 50: cloudauthproto.FeatureComponents.cloud_responder_roles:type_name -> cloudauthproto.AccountComponent
-	7,   // 51: cloudauthproto.AccountComponent.type:type_name -> cloudauthproto.Component
-	67,  // 52: cloudauthproto.AccountComponent.created_at:type_name -> google.protobuf.Timestamp
-	67,  // 53: cloudauthproto.AccountComponent.updated_at:type_name -> google.protobuf.Timestamp
-	15,  // 54: cloudauthproto.AccountComponent.validation:type_name -> cloudauthproto.Validation
-	19,  // 55: cloudauthproto.AccountComponent.cloud_connector_metadata:type_name -> cloudauthproto.CloudConnectorMetadata
-	20,  // 56: cloudauthproto.AccountComponent.trusted_role_metadata:type_name -> cloudauthproto.TrustedRoleMetadata
-	21,  // 57: cloudauthproto.AccountComponent.event_bridge_metadata:type_name -> cloudauthproto.EventBridgeMetadata
-	22,  // 58: cloudauthproto.AccountComponent.service_principal_metadata:type_name -> cloudauthproto.ServicePrincipalMetadata
-	23,  // 59: cloudauthproto.AccountComponent.webhook_datasource_metadata:type_name -> cloudauthproto.WebhookDatasourceMetadata
-	24,  // 60: cloudauthproto.AccountComponent.crypto_key_metadata:type_name -> cloudauthproto.CryptoKeyMetadata
-	25,  // 61: cloudauthproto.AccountComponent.cloud_logs_metadata:type_name -> cloudauthproto.CloudLogsMetadata
-	26,  // 62: cloudauthproto.AccountComponent.cloud_responder_metadata:type_name -> cloudauthproto.CloudResponderMetadata
-	27,  // 63: cloudauthproto.AccountComponent.cloud_responder_roles_metadata:type_name -> cloudauthproto.CloudResponderRolesMetadata
-	29,  // 64: cloudauthproto.CloudConnectorMetadata.aws:type_name -> cloudauthproto.CloudConnectorMetadata.AWS
-	30,  // 65: cloudauthproto.CloudConnectorMetadata.azure:type_name -> cloudauthproto.CloudConnectorMetadata.Azure
-	31,  // 66: cloudauthproto.CloudConnectorMetadata.gcp:type_name -> cloudauthproto.CloudConnectorMetadata.GCP
-	32,  // 67: cloudauthproto.TrustedRoleMetadata.aws:type_name -> cloudauthproto.TrustedRoleMetadata.AWS
-	34,  // 68: cloudauthproto.TrustedRoleMetadata.azure:type_name -> cloudauthproto.TrustedRoleMetadata.Azure
-	33,  // 69: cloudauthproto.TrustedRoleMetadata.gcp:type_name -> cloudauthproto.TrustedRoleMetadata.GCP
-	35,  // 70: cloudauthproto.TrustedRoleMetadata.ibmcloud:type_name -> cloudauthproto.TrustedRoleMetadata.IBMCloud
-	36,  // 71: cloudauthproto.EventBridgeMetadata.aws:type_name -> cloudauthproto.EventBridgeMetadata.AWS
-	37,  // 72: cloudauthproto.EventBridgeMetadata.azure:type_name -> cloudauthproto.EventBridgeMetadata.Azure
-	39,  // 73: cloudauthproto.ServicePrincipalMetadata.gcp:type_name -> cloudauthproto.ServicePrincipalMetadata.GCP
-	40,  // 74: cloudauthproto.ServicePrincipalMetadata.okta:type_name -> cloudauthproto.ServicePrincipalMetadata.Okta
-	41,  // 75: cloudauthproto.ServicePrincipalMetadata.azure:type_name -> cloudauthproto.ServicePrincipalMetadata.Azure
-	42,  // 76: cloudauthproto.ServicePrincipalMetadata.oci:type_name -> cloudauthproto.ServicePrincipalMetadata.OracleCloud
-	50,  // 77: cloudauthproto.WebhookDatasourceMetadata.okta:type_name -> cloudauthproto.WebhookDatasourceMetadata.Okta
-	51,  // 78: cloudauthproto.WebhookDatasourceMetadata.github:type_name -> cloudauthproto.WebhookDatasourceMetadata.Github
-	52,  // 79: cloudauthproto.WebhookDatasourceMetadata.gcp:type_name -> cloudauthproto.WebhookDatasourceMetadata.Gcp
-	53,  // 80: cloudauthproto.WebhookDatasourceMetadata.aws:type_name -> cloudauthproto.WebhookDatasourceMetadata.AWS
-	58,  // 81: cloudauthproto.CryptoKeyMetadata.aws:type_name -> cloudauthproto.CryptoKeyMetadata.AWS
-	60,  // 82: cloudauthproto.CloudLogsMetadata.aws:type_name -> cloudauthproto.CloudLogsMetadata.AWS
-	61,  // 83: cloudauthproto.CloudLogsMetadata.ibmcloud:type_name -> cloudauthproto.CloudLogsMetadata.IBMCloud
-	65,  // 84: cloudauthproto.CloudResponderMetadata.aws:type_name -> cloudauthproto.CloudResponderMetadata.AWS
-	20,  // 85: cloudauthproto.CloudResponderRolesMetadata.roles:type_name -> cloudauthproto.TrustedRoleMetadata
-	38,  // 86: cloudauthproto.EventBridgeMetadata.Azure.event_hub_metadata:type_name -> cloudauthproto.EventBridgeMetadata.Azure.EventHubMetadata
-	41,  // 87: cloudauthproto.EventBridgeMetadata.Azure.service_principal:type_name -> cloudauthproto.ServicePrincipalMetadata.Azure
-	43,  // 88: cloudauthproto.ServicePrincipalMetadata.GCP.key:type_name -> cloudauthproto.ServicePrincipalMetadata.GCP.Key
-	44,  // 89: cloudauthproto.ServicePrincipalMetadata.GCP.workload_identity_federation:type_name -> cloudauthproto.ServicePrincipalMetadata.GCP.WorkloadIdentityFederation
-	45,  // 90: cloudauthproto.ServicePrincipalMetadata.Okta.oauth_app:type_name -> cloudauthproto.ServicePrincipalMetadata.Okta.OAuthApp
-	46,  // 91: cloudauthproto.ServicePrincipalMetadata.Azure.active_directory_service_principal:type_name -> cloudauthproto.ServicePrincipalMetadata.Azure.ActiveDirectoryServicePrincipal
-	47,  // 92: cloudauthproto.ServicePrincipalMetadata.Azure.oauth2_permission_grants:type_name -> cloudauthproto.ServicePrincipalMetadata.Azure.Oauth2PermissionGrant
-	48,  // 93: cloudauthproto.ServicePrincipalMetadata.OracleCloud.api_key:type_name -> cloudauthproto.ServicePrincipalMetadata.OracleCloud.ApiKey
-	49,  // 94: cloudauthproto.ServicePrincipalMetadata.OracleCloud.policy:type_name -> cloudauthproto.ServicePrincipalMetadata.OracleCloud.Policy
-	54,  // 95: cloudauthproto.WebhookDatasourceMetadata.Okta.webhook_datasource:type_name -> cloudauthproto.WebhookDatasourceMetadata.Okta.WebhookDatasource
-	55,  // 96: cloudauthproto.WebhookDatasourceMetadata.Github.webhook_datasource:type_name -> cloudauthproto.WebhookDatasourceMetadata.Github.WebhookDatasource
-	56,  // 97: cloudauthproto.WebhookDatasourceMetadata.Gcp.webhook_datasource:type_name -> cloudauthproto.WebhookDatasourceMetadata.Gcp.WebhookDatasource
-	39,  // 98: cloudauthproto.WebhookDatasourceMetadata.Gcp.service_principal:type_name -> cloudauthproto.ServicePrincipalMetadata.GCP
-	57,  // 99: cloudauthproto.WebhookDatasourceMetadata.AWS.webhook_datasource:type_name -> cloudauthproto.WebhookDatasourceMetadata.AWS.WebhookDatasource
-	59,  // 100: cloudauthproto.CryptoKeyMetadata.AWS.kms:type_name -> cloudauthproto.CryptoKeyMetadata.AWS.KMS
-	62,  // 101: cloudauthproto.CloudLogsMetadata.AWS.cloudtrail_s3_bucket:type_name -> cloudauthproto.CloudLogsMetadata.AWS.CloudTrailS3Bucket
-	63,  // 102: cloudauthproto.CloudLogsMetadata.AWS.cloudtrail_sns:type_name -> cloudauthproto.CloudLogsMetadata.AWS.CloudTrailSNS
-	64,  // 103: cloudauthproto.CloudLogsMetadata.IBMCloud.ibm_activity_tracker:type_name -> cloudauthproto.CloudLogsMetadata.IBMCloud.IBMActivityTracker
-	66,  // 104: cloudauthproto.CloudResponderMetadata.AWS.responder_lambdas:type_name -> cloudauthproto.CloudResponderMetadata.AWS.ResponderLambdas
-	70,  // 105: cloudauthproto.encryption:extendee -> google.protobuf.FieldOptions
-	106, // [106:106] is the sub-list for method output_type
-	106, // [106:106] is the sub-list for method input_type
-	106, // [106:106] is the sub-list for extension type_name
-	105, // [105:106] is the sub-list for extension extendee
-	0,   // [0:105] is the sub-list for field type_name
+	0,   // 42: cloudauthproto.OrganizationalGroup.provider:type_name -> cloudauthproto.Provider
+	71,  // 43: cloudauthproto.OrganizationalGroup.metadata:type_name -> google.protobuf.Struct
+	68,  // 44: cloudauthproto.OrganizationalGroup.created_at:type_name -> google.protobuf.Timestamp
+	68,  // 45: cloudauthproto.OrganizationalGroup.updated_at:type_name -> google.protobuf.Timestamp
+	2,   // 46: cloudauthproto.OrganizationalGroup.verbosity:type_name -> cloudauthproto.Verbosity
+	19,  // 47: cloudauthproto.FeatureComponents.cloud_connector:type_name -> cloudauthproto.AccountComponent
+	19,  // 48: cloudauthproto.FeatureComponents.event_bridge:type_name -> cloudauthproto.AccountComponent
+	19,  // 49: cloudauthproto.FeatureComponents.trusted_role:type_name -> cloudauthproto.AccountComponent
+	19,  // 50: cloudauthproto.FeatureComponents.service_principal:type_name -> cloudauthproto.AccountComponent
+	19,  // 51: cloudauthproto.FeatureComponents.webhook_datasource:type_name -> cloudauthproto.AccountComponent
+	19,  // 52: cloudauthproto.FeatureComponents.crypto_key:type_name -> cloudauthproto.AccountComponent
+	19,  // 53: cloudauthproto.FeatureComponents.cloud_logs:type_name -> cloudauthproto.AccountComponent
+	19,  // 54: cloudauthproto.FeatureComponents.cloud_responder:type_name -> cloudauthproto.AccountComponent
+	19,  // 55: cloudauthproto.FeatureComponents.cloud_responder_roles:type_name -> cloudauthproto.AccountComponent
+	7,   // 56: cloudauthproto.AccountComponent.type:type_name -> cloudauthproto.Component
+	68,  // 57: cloudauthproto.AccountComponent.created_at:type_name -> google.protobuf.Timestamp
+	68,  // 58: cloudauthproto.AccountComponent.updated_at:type_name -> google.protobuf.Timestamp
+	15,  // 59: cloudauthproto.AccountComponent.validation:type_name -> cloudauthproto.Validation
+	20,  // 60: cloudauthproto.AccountComponent.cloud_connector_metadata:type_name -> cloudauthproto.CloudConnectorMetadata
+	21,  // 61: cloudauthproto.AccountComponent.trusted_role_metadata:type_name -> cloudauthproto.TrustedRoleMetadata
+	22,  // 62: cloudauthproto.AccountComponent.event_bridge_metadata:type_name -> cloudauthproto.EventBridgeMetadata
+	23,  // 63: cloudauthproto.AccountComponent.service_principal_metadata:type_name -> cloudauthproto.ServicePrincipalMetadata
+	24,  // 64: cloudauthproto.AccountComponent.webhook_datasource_metadata:type_name -> cloudauthproto.WebhookDatasourceMetadata
+	25,  // 65: cloudauthproto.AccountComponent.crypto_key_metadata:type_name -> cloudauthproto.CryptoKeyMetadata
+	26,  // 66: cloudauthproto.AccountComponent.cloud_logs_metadata:type_name -> cloudauthproto.CloudLogsMetadata
+	27,  // 67: cloudauthproto.AccountComponent.cloud_responder_metadata:type_name -> cloudauthproto.CloudResponderMetadata
+	28,  // 68: cloudauthproto.AccountComponent.cloud_responder_roles_metadata:type_name -> cloudauthproto.CloudResponderRolesMetadata
+	30,  // 69: cloudauthproto.CloudConnectorMetadata.aws:type_name -> cloudauthproto.CloudConnectorMetadata.AWS
+	31,  // 70: cloudauthproto.CloudConnectorMetadata.azure:type_name -> cloudauthproto.CloudConnectorMetadata.Azure
+	32,  // 71: cloudauthproto.CloudConnectorMetadata.gcp:type_name -> cloudauthproto.CloudConnectorMetadata.GCP
+	33,  // 72: cloudauthproto.TrustedRoleMetadata.aws:type_name -> cloudauthproto.TrustedRoleMetadata.AWS
+	35,  // 73: cloudauthproto.TrustedRoleMetadata.azure:type_name -> cloudauthproto.TrustedRoleMetadata.Azure
+	34,  // 74: cloudauthproto.TrustedRoleMetadata.gcp:type_name -> cloudauthproto.TrustedRoleMetadata.GCP
+	36,  // 75: cloudauthproto.TrustedRoleMetadata.ibmcloud:type_name -> cloudauthproto.TrustedRoleMetadata.IBMCloud
+	37,  // 76: cloudauthproto.EventBridgeMetadata.aws:type_name -> cloudauthproto.EventBridgeMetadata.AWS
+	38,  // 77: cloudauthproto.EventBridgeMetadata.azure:type_name -> cloudauthproto.EventBridgeMetadata.Azure
+	40,  // 78: cloudauthproto.ServicePrincipalMetadata.gcp:type_name -> cloudauthproto.ServicePrincipalMetadata.GCP
+	41,  // 79: cloudauthproto.ServicePrincipalMetadata.okta:type_name -> cloudauthproto.ServicePrincipalMetadata.Okta
+	42,  // 80: cloudauthproto.ServicePrincipalMetadata.azure:type_name -> cloudauthproto.ServicePrincipalMetadata.Azure
+	43,  // 81: cloudauthproto.ServicePrincipalMetadata.oci:type_name -> cloudauthproto.ServicePrincipalMetadata.OracleCloud
+	51,  // 82: cloudauthproto.WebhookDatasourceMetadata.okta:type_name -> cloudauthproto.WebhookDatasourceMetadata.Okta
+	52,  // 83: cloudauthproto.WebhookDatasourceMetadata.github:type_name -> cloudauthproto.WebhookDatasourceMetadata.Github
+	53,  // 84: cloudauthproto.WebhookDatasourceMetadata.gcp:type_name -> cloudauthproto.WebhookDatasourceMetadata.Gcp
+	54,  // 85: cloudauthproto.WebhookDatasourceMetadata.aws:type_name -> cloudauthproto.WebhookDatasourceMetadata.AWS
+	59,  // 86: cloudauthproto.CryptoKeyMetadata.aws:type_name -> cloudauthproto.CryptoKeyMetadata.AWS
+	61,  // 87: cloudauthproto.CloudLogsMetadata.aws:type_name -> cloudauthproto.CloudLogsMetadata.AWS
+	62,  // 88: cloudauthproto.CloudLogsMetadata.ibmcloud:type_name -> cloudauthproto.CloudLogsMetadata.IBMCloud
+	66,  // 89: cloudauthproto.CloudResponderMetadata.aws:type_name -> cloudauthproto.CloudResponderMetadata.AWS
+	21,  // 90: cloudauthproto.CloudResponderRolesMetadata.roles:type_name -> cloudauthproto.TrustedRoleMetadata
+	21,  // 91: cloudauthproto.CloudResponderRolesMetadata.validation_role:type_name -> cloudauthproto.TrustedRoleMetadata
+	39,  // 92: cloudauthproto.EventBridgeMetadata.Azure.event_hub_metadata:type_name -> cloudauthproto.EventBridgeMetadata.Azure.EventHubMetadata
+	42,  // 93: cloudauthproto.EventBridgeMetadata.Azure.service_principal:type_name -> cloudauthproto.ServicePrincipalMetadata.Azure
+	44,  // 94: cloudauthproto.ServicePrincipalMetadata.GCP.key:type_name -> cloudauthproto.ServicePrincipalMetadata.GCP.Key
+	45,  // 95: cloudauthproto.ServicePrincipalMetadata.GCP.workload_identity_federation:type_name -> cloudauthproto.ServicePrincipalMetadata.GCP.WorkloadIdentityFederation
+	46,  // 96: cloudauthproto.ServicePrincipalMetadata.Okta.oauth_app:type_name -> cloudauthproto.ServicePrincipalMetadata.Okta.OAuthApp
+	47,  // 97: cloudauthproto.ServicePrincipalMetadata.Azure.active_directory_service_principal:type_name -> cloudauthproto.ServicePrincipalMetadata.Azure.ActiveDirectoryServicePrincipal
+	48,  // 98: cloudauthproto.ServicePrincipalMetadata.Azure.oauth2_permission_grants:type_name -> cloudauthproto.ServicePrincipalMetadata.Azure.Oauth2PermissionGrant
+	49,  // 99: cloudauthproto.ServicePrincipalMetadata.OracleCloud.api_key:type_name -> cloudauthproto.ServicePrincipalMetadata.OracleCloud.ApiKey
+	50,  // 100: cloudauthproto.ServicePrincipalMetadata.OracleCloud.policy:type_name -> cloudauthproto.ServicePrincipalMetadata.OracleCloud.Policy
+	55,  // 101: cloudauthproto.WebhookDatasourceMetadata.Okta.webhook_datasource:type_name -> cloudauthproto.WebhookDatasourceMetadata.Okta.WebhookDatasource
+	56,  // 102: cloudauthproto.WebhookDatasourceMetadata.Github.webhook_datasource:type_name -> cloudauthproto.WebhookDatasourceMetadata.Github.WebhookDatasource
+	57,  // 103: cloudauthproto.WebhookDatasourceMetadata.Gcp.webhook_datasource:type_name -> cloudauthproto.WebhookDatasourceMetadata.Gcp.WebhookDatasource
+	40,  // 104: cloudauthproto.WebhookDatasourceMetadata.Gcp.service_principal:type_name -> cloudauthproto.ServicePrincipalMetadata.GCP
+	58,  // 105: cloudauthproto.WebhookDatasourceMetadata.AWS.webhook_datasource:type_name -> cloudauthproto.WebhookDatasourceMetadata.AWS.WebhookDatasource
+	60,  // 106: cloudauthproto.CryptoKeyMetadata.AWS.kms:type_name -> cloudauthproto.CryptoKeyMetadata.AWS.KMS
+	63,  // 107: cloudauthproto.CloudLogsMetadata.AWS.cloudtrail_s3_bucket:type_name -> cloudauthproto.CloudLogsMetadata.AWS.CloudTrailS3Bucket
+	64,  // 108: cloudauthproto.CloudLogsMetadata.AWS.cloudtrail_sns:type_name -> cloudauthproto.CloudLogsMetadata.AWS.CloudTrailSNS
+	65,  // 109: cloudauthproto.CloudLogsMetadata.IBMCloud.ibm_activity_tracker:type_name -> cloudauthproto.CloudLogsMetadata.IBMCloud.IBMActivityTracker
+	67,  // 110: cloudauthproto.CloudResponderMetadata.AWS.responder_lambdas:type_name -> cloudauthproto.CloudResponderMetadata.AWS.ResponderLambdas
+	72,  // 111: cloudauthproto.encryption:extendee -> google.protobuf.FieldOptions
+	112, // [112:112] is the sub-list for method output_type
+	112, // [112:112] is the sub-list for method input_type
+	112, // [112:112] is the sub-list for extension type_name
+	111, // [111:112] is the sub-list for extension extendee
+	0,   // [0:111] is the sub-list for field type_name
 }
 
 func init() { file_cloudauth_cloud_account_proto_init() }
@@ -5560,8 +5730,8 @@ func file_cloudauth_cloud_account_proto_init() {
 		(*CloudAccount_Ibm)(nil),
 	}
 	file_cloudauth_cloud_account_proto_msgTypes[4].OneofWrappers = []any{}
-	file_cloudauth_cloud_account_proto_msgTypes[9].OneofWrappers = []any{}
-	file_cloudauth_cloud_account_proto_msgTypes[10].OneofWrappers = []any{
+	file_cloudauth_cloud_account_proto_msgTypes[10].OneofWrappers = []any{}
+	file_cloudauth_cloud_account_proto_msgTypes[11].OneofWrappers = []any{
 		(*AccountComponent_CloudConnectorMetadata)(nil),
 		(*AccountComponent_TrustedRoleMetadata)(nil),
 		(*AccountComponent_EventBridgeMetadata)(nil),
@@ -5572,41 +5742,41 @@ func file_cloudauth_cloud_account_proto_init() {
 		(*AccountComponent_CloudResponderMetadata)(nil),
 		(*AccountComponent_CloudResponderRolesMetadata)(nil),
 	}
-	file_cloudauth_cloud_account_proto_msgTypes[11].OneofWrappers = []any{
+	file_cloudauth_cloud_account_proto_msgTypes[12].OneofWrappers = []any{
 		(*CloudConnectorMetadata_Aws)(nil),
 		(*CloudConnectorMetadata_Azure_)(nil),
 		(*CloudConnectorMetadata_Gcp)(nil),
 	}
-	file_cloudauth_cloud_account_proto_msgTypes[12].OneofWrappers = []any{
+	file_cloudauth_cloud_account_proto_msgTypes[13].OneofWrappers = []any{
 		(*TrustedRoleMetadata_Aws)(nil),
 		(*TrustedRoleMetadata_Azure_)(nil),
 		(*TrustedRoleMetadata_Gcp)(nil),
 		(*TrustedRoleMetadata_Ibmcloud)(nil),
 	}
-	file_cloudauth_cloud_account_proto_msgTypes[13].OneofWrappers = []any{
+	file_cloudauth_cloud_account_proto_msgTypes[14].OneofWrappers = []any{
 		(*EventBridgeMetadata_Aws)(nil),
 		(*EventBridgeMetadata_Azure_)(nil),
 	}
-	file_cloudauth_cloud_account_proto_msgTypes[14].OneofWrappers = []any{
+	file_cloudauth_cloud_account_proto_msgTypes[15].OneofWrappers = []any{
 		(*ServicePrincipalMetadata_Gcp)(nil),
 		(*ServicePrincipalMetadata_Okta_)(nil),
 		(*ServicePrincipalMetadata_Azure_)(nil),
 		(*ServicePrincipalMetadata_Oci)(nil),
 	}
-	file_cloudauth_cloud_account_proto_msgTypes[15].OneofWrappers = []any{
+	file_cloudauth_cloud_account_proto_msgTypes[16].OneofWrappers = []any{
 		(*WebhookDatasourceMetadata_Okta_)(nil),
 		(*WebhookDatasourceMetadata_Github_)(nil),
 		(*WebhookDatasourceMetadata_Gcp_)(nil),
 		(*WebhookDatasourceMetadata_Aws)(nil),
 	}
-	file_cloudauth_cloud_account_proto_msgTypes[16].OneofWrappers = []any{
+	file_cloudauth_cloud_account_proto_msgTypes[17].OneofWrappers = []any{
 		(*CryptoKeyMetadata_Aws)(nil),
 	}
-	file_cloudauth_cloud_account_proto_msgTypes[17].OneofWrappers = []any{
+	file_cloudauth_cloud_account_proto_msgTypes[18].OneofWrappers = []any{
 		(*CloudLogsMetadata_Aws)(nil),
 		(*CloudLogsMetadata_Ibmcloud)(nil),
 	}
-	file_cloudauth_cloud_account_proto_msgTypes[18].OneofWrappers = []any{
+	file_cloudauth_cloud_account_proto_msgTypes[19].OneofWrappers = []any{
 		(*CloudResponderMetadata_Aws)(nil),
 	}
 	type x struct{}
@@ -5615,7 +5785,7 @@ func file_cloudauth_cloud_account_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_cloudauth_cloud_account_proto_rawDesc), len(file_cloudauth_cloud_account_proto_rawDesc)),
 			NumEnums:      8,
-			NumMessages:   59,
+			NumMessages:   60,
 			NumExtensions: 1,
 			NumServices:   0,
 		},
diff --git a/website/docs/r/secure_cloud_auth_account_component.md b/website/docs/r/secure_cloud_auth_account_component.md
index f9388681..1965802d 100644
--- a/website/docs/r/secure_cloud_auth_account_component.md
+++ b/website/docs/r/secure_cloud_auth_account_component.md
@@ -114,9 +114,11 @@ resource "sysdig_secure_cloud_auth_account_component" "cloud_responder_roles" {
   * `aws.responder_lambdas.lambda_names` - List of Lambda function names to use for response actions
   * `aws.responder_lambdas.regions` - List of AWS regions where the responder is deployed
   * `aws.responder_lambdas.delegate_role_name` - IAM role name that the responder assumes
+  * `aws.responder_lambdas.validation_role_name` - IAM role name used to validate the onboarded lambdas on the customer cloud account
 
 * `cloud_responder_roles_metadata` - (Optional) Metadata for `COMPONENT_CLOUD_RESPONDER_ROLES` type. Defines the IAM roles that can be assumed for response actions. Required fields:
   * `roles` - Array of role objects, each containing provider-specific role name (e.g., `aws.role_name` for AWS roles)
+  * `validation_role` - Role object, used to validate the onboarded roles on the customer cloud account
 
 -> **Note:** Please refer to Sysdig Secure API Documentation for the Cloud Accounts API for metadata types for `component`.