From 48d8987167f9620bfeceeb8e85ae457fa32f8fc7 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 31 Mar 2025 14:46:49 -0700
Subject: [PATCH 001/110] feat(policy): add enhanced standard/custom actions
 protos

---
 docs/grpc/index.html                          | 434 +++++++-
 .../authorization/authorization.swagger.json  |  38 +-
 .../policy/actions/actions.swagger.json       | 207 ++++
 .../policy/attributes/attributes.swagger.json |  24 +-
 .../resource_mapping.swagger.json             |  24 +-
 .../subject_mapping.swagger.json              |  24 +-
 .../openapi/policy/unsafe/unsafe.swagger.json |  24 +-
 protocol/go/policy/actions/actions.pb.go      | 957 ++++++++++++++++++
 protocol/go/policy/actions/actions_grpc.pb.go | 257 +++++
 .../actions/actionsconnect/actions.connect.go | 232 +++++
 protocol/go/policy/objects.pb.go              | 590 +++++------
 service/policy/actions/actions.proto          | 116 +++
 service/policy/objects.proto                  |  25 +-
 13 files changed, 2606 insertions(+), 346 deletions(-)
 create mode 100644 docs/openapi/policy/actions/actions.swagger.json
 create mode 100644 protocol/go/policy/actions/actions.pb.go
 create mode 100644 protocol/go/policy/actions/actions_grpc.pb.go
 create mode 100644 protocol/go/policy/actions/actionsconnect/actions.connect.go
 create mode 100644 service/policy/actions/actions.proto

diff --git a/docs/grpc/index.html b/docs/grpc/index.html
index 89f7852ece..0b6c404966 100644
--- a/docs/grpc/index.html
+++ b/docs/grpc/index.html
@@ -568,6 +568,61 @@ <h2>Table of Contents</h2>
           </li>
         
           
+          <li>
+            <a href="#policy%2factions%2factions.proto">policy/actions/actions.proto</a>
+            <ul>
+              
+                <li>
+                  <a href="#policy.actions.CreateCustomActionRequest"><span class="badge">M</span>CreateCustomActionRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.actions.CreateCustomActionResponse"><span class="badge">M</span>CreateCustomActionResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.actions.DeleteCustomActionRequest"><span class="badge">M</span>DeleteCustomActionRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.actions.DeleteCustomActionResponse"><span class="badge">M</span>DeleteCustomActionResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.actions.GetActionRequest"><span class="badge">M</span>GetActionRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.actions.GetActionResponse"><span class="badge">M</span>GetActionResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.actions.ListActionsRequest"><span class="badge">M</span>ListActionsRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.actions.ListActionsResponse"><span class="badge">M</span>ListActionsResponse</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.actions.UpdateActionRequest"><span class="badge">M</span>UpdateActionRequest</a>
+                </li>
+              
+                <li>
+                  <a href="#policy.actions.UpdateActionResponse"><span class="badge">M</span>UpdateActionResponse</a>
+                </li>
+              
+              
+              
+              
+                <li>
+                  <a href="#policy.actions.ActionService"><span class="badge">S</span>ActionService</a>
+                </li>
+              
+            </ul>
+          </li>
+        
+          
           <li>
             <a href="#policy%2fattributes%2fattributes.proto">policy/attributes/attributes.proto</a>
             <ul>
@@ -1572,13 +1627,20 @@ <h3 id="policy.Action">Action</h3>
                   <td>standard</td>
                   <td><a href="#policy.Action.StandardAction">Action.StandardAction</a></td>
                   <td></td>
-                  <td><p> </p></td>
+                  <td><p>standard CRUD action </p></td>
                 </tr>
               
                 <tr>
                   <td>custom</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
+                  <td><p>distinctly custom action </p></td>
+                </tr>
+              
+                <tr>
+                  <td>metadata</td>
+                  <td><a href="#common.Metadata">common.Metadata</a></td>
+                  <td></td>
                   <td><p> </p></td>
                 </tr>
               
@@ -2363,14 +2425,26 @@ <h3 id="policy.Action.StandardAction">Action.StandardAction</h3>
               </tr>
             
               <tr>
-                <td>STANDARD_ACTION_DECRYPT</td>
-                <td>1</td>
+                <td>STANDARD_ACTION_CREATE</td>
+                <td>3</td>
                 <td><p></p></td>
               </tr>
             
               <tr>
-                <td>STANDARD_ACTION_TRANSMIT</td>
-                <td>2</td>
+                <td>STANDARD_ACTION_READ</td>
+                <td>4</td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>STANDARD_ACTION_UPDATE</td>
+                <td>5</td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>STANDARD_ACTION_DELETE</td>
+                <td>6</td>
                 <td><p></p></td>
               </tr>
             
@@ -2378,7 +2452,7 @@ <h3 id="policy.Action.StandardAction">Action.StandardAction</h3>
         </table>
       
         <h3 id="policy.AttributeRuleTypeEnum">AttributeRuleTypeEnum</h3>
-        <p>buflint ENUM_VALUE_PREFIX: to make sure that C++ scoping rules aren't</p><p>violated when users add new enum values to an enum in a given package</p>
+        <p></p>
         <table class="enum-table">
           <thead>
             <tr><td>Name</td><td>Number</td><td>Description</td></tr>
@@ -2413,7 +2487,7 @@ <h3 id="policy.AttributeRuleTypeEnum">AttributeRuleTypeEnum</h3>
         </table>
       
         <h3 id="policy.ConditionBooleanTypeEnum">ConditionBooleanTypeEnum</h3>
-        <p>buflint ENUM_VALUE_PREFIX: to make sure that C++ scoping rules aren't</p><p>violated when users add new enum values to an enum in a given package</p>
+        <p></p>
         <table class="enum-table">
           <thead>
             <tr><td>Name</td><td>Number</td><td>Description</td></tr>
@@ -2489,7 +2563,7 @@ <h3 id="policy.KasPublicKeyAlgEnum">KasPublicKeyAlgEnum</h3>
         </table>
       
         <h3 id="policy.SubjectMappingOperatorEnum">SubjectMappingOperatorEnum</h3>
-        <p>buflint ENUM_VALUE_PREFIX: to make sure that C++ scoping rules aren't</p><p>violated when users add new enum values to an enum in a given package</p>
+        <p></p>
         <table class="enum-table">
           <thead>
             <tr><td>Name</td><td>Number</td><td>Description</td></tr>
@@ -4592,6 +4666,350 @@ <h3 id="policy.PageResponse">PageResponse</h3>
       
     
       
+      <div class="file-heading">
+        <h2 id="policy/actions/actions.proto">policy/actions/actions.proto</h2><a href="#title">Top</a>
+      </div>
+      <p></p>
+
+      
+        <h3 id="policy.actions.CreateCustomActionRequest">CreateCustomActionRequest</h3>
+        <p>Create a new custom action name with optional metadata.</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>name</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Required </p></td>
+                </tr>
+              
+                <tr>
+                  <td>metadata</td>
+                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
+                  <td></td>
+                  <td><p>Optional </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.actions.CreateCustomActionResponse">CreateCustomActionResponse</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>action</td>
+                  <td><a href="#policy.Action">policy.Action</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.actions.DeleteCustomActionRequest">DeleteCustomActionRequest</h3>
+        <p>Deletion of standard actions is not supported.</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Required </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.actions.DeleteCustomActionResponse">DeleteCustomActionResponse</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>action</td>
+                  <td><a href="#policy.Action">policy.Action</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.actions.GetActionRequest">GetActionRequest</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>name</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.actions.GetActionResponse">GetActionResponse</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>action</td>
+                  <td><a href="#policy.Action">policy.Action</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.actions.ListActionsRequest">ListActionsRequest</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>pagination</td>
+                  <td><a href="#policy.PageRequest">policy.PageRequest</a></td>
+                  <td></td>
+                  <td><p>Optional </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.actions.ListActionsResponse">ListActionsResponse</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>actions</td>
+                  <td><a href="#policy.Action">policy.Action</a></td>
+                  <td>repeated</td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>pagination</td>
+                  <td><a href="#policy.PageResponse">policy.PageResponse</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.actions.UpdateActionRequest">UpdateActionRequest</h3>
+        <p>Names may only be updated for custom actions.</p><p>Metadata may be updated for either custom or standard actions.</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Required </p></td>
+                </tr>
+              
+                <tr>
+                  <td>name</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Optional
+Custom actions only: replaces the existing action name </p></td>
+                </tr>
+              
+                <tr>
+                  <td>metadata</td>
+                  <td><a href="#common.MetadataMutable">common.MetadataMutable</a></td>
+                  <td></td>
+                  <td><p>Common metadata </p></td>
+                </tr>
+              
+                <tr>
+                  <td>metadata_update_behavior</td>
+                  <td><a href="#common.MetadataUpdateEnum">common.MetadataUpdateEnum</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="policy.actions.UpdateActionResponse">UpdateActionResponse</h3>
+        <p></p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>action</td>
+                  <td><a href="#policy.Action">policy.Action</a></td>
+                  <td></td>
+                  <td><p> </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+
+      
+
+      
+
+      
+        <h3 id="policy.actions.ActionService">ActionService</h3>
+        <p></p>
+        <table class="enum-table">
+          <thead>
+            <tr><td>Method Name</td><td>Request Type</td><td>Response Type</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>GetAction</td>
+                <td><a href="#policy.actions.GetActionRequest">GetActionRequest</a></td>
+                <td><a href="#policy.actions.GetActionResponse">GetActionResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>ListActions</td>
+                <td><a href="#policy.actions.ListActionsRequest">ListActionsRequest</a></td>
+                <td><a href="#policy.actions.ListActionsResponse">ListActionsResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>CreateCustomAction</td>
+                <td><a href="#policy.actions.CreateCustomActionRequest">CreateCustomActionRequest</a></td>
+                <td><a href="#policy.actions.CreateCustomActionResponse">CreateCustomActionResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>UpdateAction</td>
+                <td><a href="#policy.actions.UpdateActionRequest">UpdateActionRequest</a></td>
+                <td><a href="#policy.actions.UpdateActionResponse">UpdateActionResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>DeleteCustomAction</td>
+                <td><a href="#policy.actions.DeleteCustomActionRequest">DeleteCustomActionRequest</a></td>
+                <td><a href="#policy.actions.DeleteCustomActionResponse">DeleteCustomActionResponse</a></td>
+                <td><p></p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+
+        
+    
+      
       <div class="file-heading">
         <h2 id="policy/attributes/attributes.proto">policy/attributes/attributes.proto</h2><a href="#title">Top</a>
       </div>
diff --git a/docs/openapi/authorization/authorization.swagger.json b/docs/openapi/authorization/authorization.swagger.json
index cf1fa7dc2e..ad470f259a 100644
--- a/docs/openapi/authorization/authorization.swagger.json
+++ b/docs/openapi/authorization/authorization.swagger.json
@@ -109,8 +109,10 @@
       "type": "string",
       "enum": [
         "STANDARD_ACTION_UNSPECIFIED",
-        "STANDARD_ACTION_DECRYPT",
-        "STANDARD_ACTION_TRANSMIT"
+        "STANDARD_ACTION_CREATE",
+        "STANDARD_ACTION_READ",
+        "STANDARD_ACTION_UPDATE",
+        "STANDARD_ACTION_DELETE"
       ],
       "default": "STANDARD_ACTION_UNSPECIFIED",
       "title": "Standard actions supported by the platform"
@@ -395,14 +397,42 @@
       "description": "{\n\"actions\": [\n{\n\"standard\": \"STANDARD_ACTION_TRANSMIT\"\n}\n],\n\"tokens\": [\n{\n\"id\": \"tok1\",\n\"jwt\": ....\n},\n{\n\"id\": \"tok2\",\n\"jwt\": .....\n}\n],\n\"resourceAttributes\": [\n{\n\"attributeFqns\": [\n\"https://www.example.org/attr/foo/value/value1\"\n]\n},\n{\n\"attributeFqns\": [\n\"https://example.net/attr/attr1/value/value1\",\n\"https://example.net/attr/attr1/value/value2\"\n]\n}\n]\n}",
       "title": "Example Request Get Decisions by Token to answer the question -  Do Bob and client1 (represented by token tok1)\nand Alice and client2 (represented by token tok2) have TRANSMIT authorization for\n2 resources; resource1 (attr-set-1) defined by attributes foo:bar  resource2 (attr-set-2) defined by attribute foo:bar, color:red ?"
     },
+    "commonMetadata": {
+      "type": "object",
+      "properties": {
+        "createdAt": {
+          "type": "string",
+          "format": "date-time",
+          "title": "created_at set by server (entity who created will recorded in an audit event)"
+        },
+        "updatedAt": {
+          "type": "string",
+          "format": "date-time",
+          "title": "updated_at set by server (entity who updated will recorded in an audit event)"
+        },
+        "labels": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          },
+          "title": "optional short description"
+        }
+      },
+      "title": "Struct to uniquely identify a resource with optional additional metadata"
+    },
     "policyAction": {
       "type": "object",
       "properties": {
         "standard": {
-          "$ref": "#/definitions/ActionStandardAction"
+          "$ref": "#/definitions/ActionStandardAction",
+          "title": "standard CRUD action"
         },
         "custom": {
-          "type": "string"
+          "type": "string",
+          "title": "distinctly custom action"
+        },
+        "metadata": {
+          "$ref": "#/definitions/commonMetadata"
         }
       },
       "title": "An action an entity can take"
diff --git a/docs/openapi/policy/actions/actions.swagger.json b/docs/openapi/policy/actions/actions.swagger.json
new file mode 100644
index 0000000000..4e65ac5d6b
--- /dev/null
+++ b/docs/openapi/policy/actions/actions.swagger.json
@@ -0,0 +1,207 @@
+{
+  "swagger": "2.0",
+  "info": {
+    "title": "policy/actions/actions.proto",
+    "version": "version not set"
+  },
+  "tags": [
+    {
+      "name": "ActionService"
+    }
+  ],
+  "consumes": [
+    "application/json"
+  ],
+  "produces": [
+    "application/json"
+  ],
+  "paths": {},
+  "definitions": {
+    "ActionStandardAction": {
+      "type": "string",
+      "enum": [
+        "STANDARD_ACTION_UNSPECIFIED",
+        "STANDARD_ACTION_CREATE",
+        "STANDARD_ACTION_READ",
+        "STANDARD_ACTION_UPDATE",
+        "STANDARD_ACTION_DELETE"
+      ],
+      "default": "STANDARD_ACTION_UNSPECIFIED",
+      "title": "Standard actions supported by the platform"
+    },
+    "actionsCreateCustomActionResponse": {
+      "type": "object",
+      "properties": {
+        "action": {
+          "$ref": "#/definitions/policyAction"
+        }
+      }
+    },
+    "actionsDeleteCustomActionResponse": {
+      "type": "object",
+      "properties": {
+        "action": {
+          "$ref": "#/definitions/policyAction"
+        }
+      }
+    },
+    "actionsGetActionResponse": {
+      "type": "object",
+      "properties": {
+        "action": {
+          "$ref": "#/definitions/policyAction"
+        }
+      }
+    },
+    "actionsListActionsResponse": {
+      "type": "object",
+      "properties": {
+        "actions": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/policyAction"
+          }
+        },
+        "pagination": {
+          "$ref": "#/definitions/policyPageResponse"
+        }
+      }
+    },
+    "actionsUpdateActionResponse": {
+      "type": "object",
+      "properties": {
+        "action": {
+          "$ref": "#/definitions/policyAction"
+        }
+      }
+    },
+    "commonMetadata": {
+      "type": "object",
+      "properties": {
+        "createdAt": {
+          "type": "string",
+          "format": "date-time",
+          "title": "created_at set by server (entity who created will recorded in an audit event)"
+        },
+        "updatedAt": {
+          "type": "string",
+          "format": "date-time",
+          "title": "updated_at set by server (entity who updated will recorded in an audit event)"
+        },
+        "labels": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          },
+          "title": "optional short description"
+        }
+      },
+      "title": "Struct to uniquely identify a resource with optional additional metadata"
+    },
+    "commonMetadataMutable": {
+      "type": "object",
+      "properties": {
+        "labels": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          },
+          "title": "optional labels"
+        }
+      }
+    },
+    "commonMetadataUpdateEnum": {
+      "type": "string",
+      "enum": [
+        "METADATA_UPDATE_ENUM_UNSPECIFIED",
+        "METADATA_UPDATE_ENUM_EXTEND",
+        "METADATA_UPDATE_ENUM_REPLACE"
+      ],
+      "default": "METADATA_UPDATE_ENUM_UNSPECIFIED",
+      "title": "- METADATA_UPDATE_ENUM_UNSPECIFIED: unspecified update type\n - METADATA_UPDATE_ENUM_EXTEND: only update the fields that are provided\n - METADATA_UPDATE_ENUM_REPLACE: replace the entire metadata with the provided metadata"
+    },
+    "policyAction": {
+      "type": "object",
+      "properties": {
+        "standard": {
+          "$ref": "#/definitions/ActionStandardAction",
+          "title": "standard CRUD action"
+        },
+        "custom": {
+          "type": "string",
+          "title": "distinctly custom action"
+        },
+        "metadata": {
+          "$ref": "#/definitions/commonMetadata"
+        }
+      },
+      "title": "An action an entity can take"
+    },
+    "policyPageRequest": {
+      "type": "object",
+      "properties": {
+        "limit": {
+          "type": "integer",
+          "format": "int32",
+          "title": "Optional\nSet to configured default limit if not provided\nMaximum limit set in platform config and enforced by services"
+        },
+        "offset": {
+          "type": "integer",
+          "format": "int32",
+          "title": "Optional\nDefaulted if not provided"
+        }
+      }
+    },
+    "policyPageResponse": {
+      "type": "object",
+      "properties": {
+        "currentOffset": {
+          "type": "integer",
+          "format": "int32",
+          "title": "Requested pagination offset"
+        },
+        "nextOffset": {
+          "type": "integer",
+          "format": "int32",
+          "title": "Calculated with request limit + offset or defaults\nEmpty when none remain after current page"
+        },
+        "total": {
+          "type": "integer",
+          "format": "int32",
+          "title": "Total count of entire list"
+        }
+      }
+    },
+    "protobufAny": {
+      "type": "object",
+      "properties": {
+        "@type": {
+          "type": "string",
+          "description": "A URL/resource name that uniquely identifies the type of the serialized\nprotocol buffer message. This string must contain at least\none \"/\" character. The last segment of the URL's path must represent\nthe fully qualified name of the type (as in\n`path/google.protobuf.Duration`). The name should be in a canonical form\n(e.g., leading \".\" is not accepted).\n\nIn practice, teams usually precompile into the binary all types that they\nexpect it to use in the context of Any. However, for URLs which use the\nscheme `http`, `https`, or no scheme, one can optionally set up a type\nserver that maps type URLs to message definitions as follows:\n\n* If no scheme is provided, `https` is assumed.\n* An HTTP GET on the URL must yield a [google.protobuf.Type][]\n  value in binary format, or produce an error.\n* Applications are allowed to cache lookup results based on the\n  URL, or have them precompiled into a binary to avoid any\n  lookup. Therefore, binary compatibility needs to be preserved\n  on changes to types. (Use versioned type names to manage\n  breaking changes.)\n\nNote: this functionality is not currently available in the official\nprotobuf release, and it is not used for type URLs beginning with\ntype.googleapis.com. As of May 2023, there are no widely used type server\nimplementations and no plans to implement one.\n\nSchemes other than `http`, `https` (or the empty scheme) might be\nused with implementation specific semantics."
+        }
+      },
+      "additionalProperties": {},
+      "description": "`Any` contains an arbitrary serialized protocol buffer message along with a\nURL that describes the type of the serialized message.\n\nProtobuf library provides support to pack/unpack Any values in the form\nof utility functions or additional generated methods of the Any type.\n\nExample 1: Pack and unpack a message in C++.\n\n    Foo foo = ...;\n    Any any;\n    any.PackFrom(foo);\n    ...\n    if (any.UnpackTo(\u0026foo)) {\n      ...\n    }\n\nExample 2: Pack and unpack a message in Java.\n\n    Foo foo = ...;\n    Any any = Any.pack(foo);\n    ...\n    if (any.is(Foo.class)) {\n      foo = any.unpack(Foo.class);\n    }\n    // or ...\n    if (any.isSameTypeAs(Foo.getDefaultInstance())) {\n      foo = any.unpack(Foo.getDefaultInstance());\n    }\n\n Example 3: Pack and unpack a message in Python.\n\n    foo = Foo(...)\n    any = Any()\n    any.Pack(foo)\n    ...\n    if any.Is(Foo.DESCRIPTOR):\n      any.Unpack(foo)\n      ...\n\n Example 4: Pack and unpack a message in Go\n\n     foo := \u0026pb.Foo{...}\n     any, err := anypb.New(foo)\n     if err != nil {\n       ...\n     }\n     ...\n     foo := \u0026pb.Foo{}\n     if err := any.UnmarshalTo(foo); err != nil {\n       ...\n     }\n\nThe pack methods provided by protobuf library will by default use\n'type.googleapis.com/full.type.name' as the type URL and the unpack\nmethods only use the fully qualified type name after the last '/'\nin the type URL, for example \"foo.bar.com/x/y.z\" will yield type\nname \"y.z\".\n\nJSON\n====\nThe JSON representation of an `Any` value uses the regular\nrepresentation of the deserialized, embedded message, with an\nadditional field `@type` which contains the type URL. Example:\n\n    package google.profile;\n    message Person {\n      string first_name = 1;\n      string last_name = 2;\n    }\n\n    {\n      \"@type\": \"type.googleapis.com/google.profile.Person\",\n      \"firstName\": \u003cstring\u003e,\n      \"lastName\": \u003cstring\u003e\n    }\n\nIf the embedded message type is well-known and has a custom JSON\nrepresentation, that representation will be embedded adding a field\n`value` which holds the custom JSON in addition to the `@type`\nfield. Example (for message [google.protobuf.Duration][]):\n\n    {\n      \"@type\": \"type.googleapis.com/google.protobuf.Duration\",\n      \"value\": \"1.212s\"\n    }"
+    },
+    "rpcStatus": {
+      "type": "object",
+      "properties": {
+        "code": {
+          "type": "integer",
+          "format": "int32"
+        },
+        "message": {
+          "type": "string"
+        },
+        "details": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/protobufAny"
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/docs/openapi/policy/attributes/attributes.swagger.json b/docs/openapi/policy/attributes/attributes.swagger.json
index d9c4593a25..ee55aa4752 100644
--- a/docs/openapi/policy/attributes/attributes.swagger.json
+++ b/docs/openapi/policy/attributes/attributes.swagger.json
@@ -661,8 +661,10 @@
       "type": "string",
       "enum": [
         "STANDARD_ACTION_UNSPECIFIED",
-        "STANDARD_ACTION_DECRYPT",
-        "STANDARD_ACTION_TRANSMIT"
+        "STANDARD_ACTION_CREATE",
+        "STANDARD_ACTION_READ",
+        "STANDARD_ACTION_UPDATE",
+        "STANDARD_ACTION_DELETE"
       ],
       "default": "STANDARD_ACTION_UNSPECIFIED",
       "title": "Standard actions supported by the platform"
@@ -995,10 +997,15 @@
       "type": "object",
       "properties": {
         "standard": {
-          "$ref": "#/definitions/ActionStandardAction"
+          "$ref": "#/definitions/ActionStandardAction",
+          "title": "standard CRUD action"
         },
         "custom": {
-          "type": "string"
+          "type": "string",
+          "title": "distinctly custom action"
+        },
+        "metadata": {
+          "$ref": "#/definitions/commonMetadata"
         }
       },
       "title": "An action an entity can take"
@@ -1065,8 +1072,7 @@
         "ATTRIBUTE_RULE_TYPE_ENUM_ANY_OF",
         "ATTRIBUTE_RULE_TYPE_ENUM_HIERARCHY"
       ],
-      "default": "ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED",
-      "title": "buflint ENUM_VALUE_PREFIX: to make sure that C++ scoping rules aren't\nviolated when users add new enum values to an enum in a given package"
+      "default": "ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED"
     },
     "policyAttributeValueSelector": {
       "type": "object",
@@ -1124,8 +1130,7 @@
         "CONDITION_BOOLEAN_TYPE_ENUM_AND",
         "CONDITION_BOOLEAN_TYPE_ENUM_OR"
       ],
-      "default": "CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED",
-      "title": "buflint ENUM_VALUE_PREFIX: to make sure that C++ scoping rules aren't\nviolated when users add new enum values to an enum in a given package"
+      "default": "CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED"
     },
     "policyConditionGroup": {
       "type": "object",
@@ -1381,8 +1386,7 @@
         "SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS"
       ],
       "default": "SUBJECT_MAPPING_OPERATOR_ENUM_UNSPECIFIED",
-      "description": "- SUBJECT_MAPPING_OPERATOR_ENUM_IN: operator that returns true if a value in a list matches the string\n - SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN: operator that returns true if a value is not in a list that is matched by\nstring\n - SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS: operator that returns true if a value in a list contains the substring",
-      "title": "buflint ENUM_VALUE_PREFIX: to make sure that C++ scoping rules aren't\nviolated when users add new enum values to an enum in a given package"
+      "title": "- SUBJECT_MAPPING_OPERATOR_ENUM_IN: operator that returns true if a value in a list matches the string\n - SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN: operator that returns true if a value is not in a list that is matched by\nstring\n - SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS: operator that returns true if a value in a list contains the substring"
     },
     "policySubjectSet": {
       "type": "object",
diff --git a/docs/openapi/policy/resourcemapping/resource_mapping.swagger.json b/docs/openapi/policy/resourcemapping/resource_mapping.swagger.json
index 16e861d375..af9b514616 100644
--- a/docs/openapi/policy/resourcemapping/resource_mapping.swagger.json
+++ b/docs/openapi/policy/resourcemapping/resource_mapping.swagger.json
@@ -446,8 +446,10 @@
       "type": "string",
       "enum": [
         "STANDARD_ACTION_UNSPECIFIED",
-        "STANDARD_ACTION_DECRYPT",
-        "STANDARD_ACTION_TRANSMIT"
+        "STANDARD_ACTION_CREATE",
+        "STANDARD_ACTION_READ",
+        "STANDARD_ACTION_UPDATE",
+        "STANDARD_ACTION_DELETE"
       ],
       "default": "STANDARD_ACTION_UNSPECIFIED",
       "title": "Standard actions supported by the platform"
@@ -501,10 +503,15 @@
       "type": "object",
       "properties": {
         "standard": {
-          "$ref": "#/definitions/ActionStandardAction"
+          "$ref": "#/definitions/ActionStandardAction",
+          "title": "standard CRUD action"
         },
         "custom": {
-          "type": "string"
+          "type": "string",
+          "title": "distinctly custom action"
+        },
+        "metadata": {
+          "$ref": "#/definitions/commonMetadata"
         }
       },
       "title": "An action an entity can take"
@@ -571,8 +578,7 @@
         "ATTRIBUTE_RULE_TYPE_ENUM_ANY_OF",
         "ATTRIBUTE_RULE_TYPE_ENUM_HIERARCHY"
       ],
-      "default": "ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED",
-      "title": "buflint ENUM_VALUE_PREFIX: to make sure that C++ scoping rules aren't\nviolated when users add new enum values to an enum in a given package"
+      "default": "ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED"
     },
     "policyCondition": {
       "type": "object",
@@ -602,8 +608,7 @@
         "CONDITION_BOOLEAN_TYPE_ENUM_AND",
         "CONDITION_BOOLEAN_TYPE_ENUM_OR"
       ],
-      "default": "CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED",
-      "title": "buflint ENUM_VALUE_PREFIX: to make sure that C++ scoping rules aren't\nviolated when users add new enum values to an enum in a given package"
+      "default": "CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED"
     },
     "policyConditionGroup": {
       "type": "object",
@@ -904,8 +909,7 @@
         "SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS"
       ],
       "default": "SUBJECT_MAPPING_OPERATOR_ENUM_UNSPECIFIED",
-      "description": "- SUBJECT_MAPPING_OPERATOR_ENUM_IN: operator that returns true if a value in a list matches the string\n - SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN: operator that returns true if a value is not in a list that is matched by\nstring\n - SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS: operator that returns true if a value in a list contains the substring",
-      "title": "buflint ENUM_VALUE_PREFIX: to make sure that C++ scoping rules aren't\nviolated when users add new enum values to an enum in a given package"
+      "title": "- SUBJECT_MAPPING_OPERATOR_ENUM_IN: operator that returns true if a value in a list matches the string\n - SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN: operator that returns true if a value is not in a list that is matched by\nstring\n - SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS: operator that returns true if a value in a list contains the substring"
     },
     "policySubjectSet": {
       "type": "object",
diff --git a/docs/openapi/policy/subjectmapping/subject_mapping.swagger.json b/docs/openapi/policy/subjectmapping/subject_mapping.swagger.json
index 9836c9b85e..6662a882a3 100644
--- a/docs/openapi/policy/subjectmapping/subject_mapping.swagger.json
+++ b/docs/openapi/policy/subjectmapping/subject_mapping.swagger.json
@@ -453,8 +453,10 @@
       "type": "string",
       "enum": [
         "STANDARD_ACTION_UNSPECIFIED",
-        "STANDARD_ACTION_DECRYPT",
-        "STANDARD_ACTION_TRANSMIT"
+        "STANDARD_ACTION_CREATE",
+        "STANDARD_ACTION_READ",
+        "STANDARD_ACTION_UPDATE",
+        "STANDARD_ACTION_DELETE"
       ],
       "default": "STANDARD_ACTION_UNSPECIFIED",
       "title": "Standard actions supported by the platform"
@@ -508,10 +510,15 @@
       "type": "object",
       "properties": {
         "standard": {
-          "$ref": "#/definitions/ActionStandardAction"
+          "$ref": "#/definitions/ActionStandardAction",
+          "title": "standard CRUD action"
         },
         "custom": {
-          "type": "string"
+          "type": "string",
+          "title": "distinctly custom action"
+        },
+        "metadata": {
+          "$ref": "#/definitions/commonMetadata"
         }
       },
       "title": "An action an entity can take"
@@ -578,8 +585,7 @@
         "ATTRIBUTE_RULE_TYPE_ENUM_ANY_OF",
         "ATTRIBUTE_RULE_TYPE_ENUM_HIERARCHY"
       ],
-      "default": "ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED",
-      "title": "buflint ENUM_VALUE_PREFIX: to make sure that C++ scoping rules aren't\nviolated when users add new enum values to an enum in a given package"
+      "default": "ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED"
     },
     "policyCondition": {
       "type": "object",
@@ -609,8 +615,7 @@
         "CONDITION_BOOLEAN_TYPE_ENUM_AND",
         "CONDITION_BOOLEAN_TYPE_ENUM_OR"
       ],
-      "default": "CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED",
-      "title": "buflint ENUM_VALUE_PREFIX: to make sure that C++ scoping rules aren't\nviolated when users add new enum values to an enum in a given package"
+      "default": "CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED"
     },
     "policyConditionGroup": {
       "type": "object",
@@ -866,8 +871,7 @@
         "SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS"
       ],
       "default": "SUBJECT_MAPPING_OPERATOR_ENUM_UNSPECIFIED",
-      "description": "- SUBJECT_MAPPING_OPERATOR_ENUM_IN: operator that returns true if a value in a list matches the string\n - SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN: operator that returns true if a value is not in a list that is matched by\nstring\n - SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS: operator that returns true if a value in a list contains the substring",
-      "title": "buflint ENUM_VALUE_PREFIX: to make sure that C++ scoping rules aren't\nviolated when users add new enum values to an enum in a given package"
+      "title": "- SUBJECT_MAPPING_OPERATOR_ENUM_IN: operator that returns true if a value in a list matches the string\n - SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN: operator that returns true if a value is not in a list that is matched by\nstring\n - SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS: operator that returns true if a value in a list contains the substring"
     },
     "policySubjectProperty": {
       "type": "object",
diff --git a/docs/openapi/policy/unsafe/unsafe.swagger.json b/docs/openapi/policy/unsafe/unsafe.swagger.json
index 6b71a8547a..f2f559217f 100644
--- a/docs/openapi/policy/unsafe/unsafe.swagger.json
+++ b/docs/openapi/policy/unsafe/unsafe.swagger.json
@@ -365,8 +365,10 @@
       "type": "string",
       "enum": [
         "STANDARD_ACTION_UNSPECIFIED",
-        "STANDARD_ACTION_DECRYPT",
-        "STANDARD_ACTION_TRANSMIT"
+        "STANDARD_ACTION_CREATE",
+        "STANDARD_ACTION_READ",
+        "STANDARD_ACTION_UPDATE",
+        "STANDARD_ACTION_DELETE"
       ],
       "default": "STANDARD_ACTION_UNSPECIFIED",
       "title": "Standard actions supported by the platform"
@@ -398,10 +400,15 @@
       "type": "object",
       "properties": {
         "standard": {
-          "$ref": "#/definitions/ActionStandardAction"
+          "$ref": "#/definitions/ActionStandardAction",
+          "title": "standard CRUD action"
         },
         "custom": {
-          "type": "string"
+          "type": "string",
+          "title": "distinctly custom action"
+        },
+        "metadata": {
+          "$ref": "#/definitions/commonMetadata"
         }
       },
       "title": "An action an entity can take"
@@ -468,8 +475,7 @@
         "ATTRIBUTE_RULE_TYPE_ENUM_ANY_OF",
         "ATTRIBUTE_RULE_TYPE_ENUM_HIERARCHY"
       ],
-      "default": "ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED",
-      "title": "buflint ENUM_VALUE_PREFIX: to make sure that C++ scoping rules aren't\nviolated when users add new enum values to an enum in a given package"
+      "default": "ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED"
     },
     "policyCondition": {
       "type": "object",
@@ -499,8 +505,7 @@
         "CONDITION_BOOLEAN_TYPE_ENUM_AND",
         "CONDITION_BOOLEAN_TYPE_ENUM_OR"
       ],
-      "default": "CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED",
-      "title": "buflint ENUM_VALUE_PREFIX: to make sure that C++ scoping rules aren't\nviolated when users add new enum values to an enum in a given package"
+      "default": "CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED"
     },
     "policyConditionGroup": {
       "type": "object",
@@ -721,8 +726,7 @@
         "SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS"
       ],
       "default": "SUBJECT_MAPPING_OPERATOR_ENUM_UNSPECIFIED",
-      "description": "- SUBJECT_MAPPING_OPERATOR_ENUM_IN: operator that returns true if a value in a list matches the string\n - SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN: operator that returns true if a value is not in a list that is matched by\nstring\n - SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS: operator that returns true if a value in a list contains the substring",
-      "title": "buflint ENUM_VALUE_PREFIX: to make sure that C++ scoping rules aren't\nviolated when users add new enum values to an enum in a given package"
+      "title": "- SUBJECT_MAPPING_OPERATOR_ENUM_IN: operator that returns true if a value in a list matches the string\n - SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN: operator that returns true if a value is not in a list that is matched by\nstring\n - SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS: operator that returns true if a value in a list contains the substring"
     },
     "policySubjectSet": {
       "type": "object",
diff --git a/protocol/go/policy/actions/actions.pb.go b/protocol/go/policy/actions/actions.pb.go
new file mode 100644
index 0000000000..4338990a4c
--- /dev/null
+++ b/protocol/go/policy/actions/actions.pb.go
@@ -0,0 +1,957 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.33.0
+// 	protoc        (unknown)
+// source: policy/actions/actions.proto
+
+package actions
+
+import (
+	_ "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate"
+	common "github.com/opentdf/platform/protocol/go/common"
+	policy "github.com/opentdf/platform/protocol/go/policy"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type GetActionRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Required
+	//
+	// Types that are assignable to Identifier:
+	//
+	//	*GetActionRequest_Id
+	//	*GetActionRequest_Name
+	Identifier isGetActionRequest_Identifier `protobuf_oneof:"identifier"`
+}
+
+func (x *GetActionRequest) Reset() {
+	*x = GetActionRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_policy_actions_actions_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetActionRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetActionRequest) ProtoMessage() {}
+
+func (x *GetActionRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_policy_actions_actions_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetActionRequest.ProtoReflect.Descriptor instead.
+func (*GetActionRequest) Descriptor() ([]byte, []int) {
+	return file_policy_actions_actions_proto_rawDescGZIP(), []int{0}
+}
+
+func (m *GetActionRequest) GetIdentifier() isGetActionRequest_Identifier {
+	if m != nil {
+		return m.Identifier
+	}
+	return nil
+}
+
+func (x *GetActionRequest) GetId() string {
+	if x, ok := x.GetIdentifier().(*GetActionRequest_Id); ok {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *GetActionRequest) GetName() string {
+	if x, ok := x.GetIdentifier().(*GetActionRequest_Name); ok {
+		return x.Name
+	}
+	return ""
+}
+
+type isGetActionRequest_Identifier interface {
+	isGetActionRequest_Identifier()
+}
+
+type GetActionRequest_Id struct {
+	Id string `protobuf:"bytes,1,opt,name=id,proto3,oneof"`
+}
+
+type GetActionRequest_Name struct {
+	Name string `protobuf:"bytes,2,opt,name=name,proto3,oneof"`
+}
+
+func (*GetActionRequest_Id) isGetActionRequest_Identifier() {}
+
+func (*GetActionRequest_Name) isGetActionRequest_Identifier() {}
+
+type GetActionResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Action *policy.Action `protobuf:"bytes,1,opt,name=action,proto3" json:"action,omitempty"`
+}
+
+func (x *GetActionResponse) Reset() {
+	*x = GetActionResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_policy_actions_actions_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetActionResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetActionResponse) ProtoMessage() {}
+
+func (x *GetActionResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_policy_actions_actions_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetActionResponse.ProtoReflect.Descriptor instead.
+func (*GetActionResponse) Descriptor() ([]byte, []int) {
+	return file_policy_actions_actions_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *GetActionResponse) GetAction() *policy.Action {
+	if x != nil {
+		return x.Action
+	}
+	return nil
+}
+
+type ListActionsRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Optional
+	Pagination *policy.PageRequest `protobuf:"bytes,10,opt,name=pagination,proto3" json:"pagination,omitempty"`
+}
+
+func (x *ListActionsRequest) Reset() {
+	*x = ListActionsRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_policy_actions_actions_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListActionsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListActionsRequest) ProtoMessage() {}
+
+func (x *ListActionsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_policy_actions_actions_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListActionsRequest.ProtoReflect.Descriptor instead.
+func (*ListActionsRequest) Descriptor() ([]byte, []int) {
+	return file_policy_actions_actions_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *ListActionsRequest) GetPagination() *policy.PageRequest {
+	if x != nil {
+		return x.Pagination
+	}
+	return nil
+}
+
+type ListActionsResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Actions    []*policy.Action     `protobuf:"bytes,1,rep,name=actions,proto3" json:"actions,omitempty"`
+	Pagination *policy.PageResponse `protobuf:"bytes,10,opt,name=pagination,proto3" json:"pagination,omitempty"`
+}
+
+func (x *ListActionsResponse) Reset() {
+	*x = ListActionsResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_policy_actions_actions_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListActionsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListActionsResponse) ProtoMessage() {}
+
+func (x *ListActionsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_policy_actions_actions_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListActionsResponse.ProtoReflect.Descriptor instead.
+func (*ListActionsResponse) Descriptor() ([]byte, []int) {
+	return file_policy_actions_actions_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *ListActionsResponse) GetActions() []*policy.Action {
+	if x != nil {
+		return x.Actions
+	}
+	return nil
+}
+
+func (x *ListActionsResponse) GetPagination() *policy.PageResponse {
+	if x != nil {
+		return x.Pagination
+	}
+	return nil
+}
+
+// Create a new custom action name with optional metadata.
+type CreateCustomActionRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Required
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// Optional
+	Metadata *common.MetadataMutable `protobuf:"bytes,100,opt,name=metadata,proto3" json:"metadata,omitempty"`
+}
+
+func (x *CreateCustomActionRequest) Reset() {
+	*x = CreateCustomActionRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_policy_actions_actions_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CreateCustomActionRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateCustomActionRequest) ProtoMessage() {}
+
+func (x *CreateCustomActionRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_policy_actions_actions_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateCustomActionRequest.ProtoReflect.Descriptor instead.
+func (*CreateCustomActionRequest) Descriptor() ([]byte, []int) {
+	return file_policy_actions_actions_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *CreateCustomActionRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *CreateCustomActionRequest) GetMetadata() *common.MetadataMutable {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+type CreateCustomActionResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Action *policy.Action `protobuf:"bytes,1,opt,name=action,proto3" json:"action,omitempty"`
+}
+
+func (x *CreateCustomActionResponse) Reset() {
+	*x = CreateCustomActionResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_policy_actions_actions_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CreateCustomActionResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateCustomActionResponse) ProtoMessage() {}
+
+func (x *CreateCustomActionResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_policy_actions_actions_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateCustomActionResponse.ProtoReflect.Descriptor instead.
+func (*CreateCustomActionResponse) Descriptor() ([]byte, []int) {
+	return file_policy_actions_actions_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *CreateCustomActionResponse) GetAction() *policy.Action {
+	if x != nil {
+		return x.Action
+	}
+	return nil
+}
+
+// Names may only be updated for custom actions.
+// Metadata may be updated for either custom or standard actions.
+type UpdateActionRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Required
+	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	// Optional
+	// Custom actions only: replaces the existing action name
+	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+	// Common metadata
+	Metadata               *common.MetadataMutable   `protobuf:"bytes,100,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	MetadataUpdateBehavior common.MetadataUpdateEnum `protobuf:"varint,101,opt,name=metadata_update_behavior,json=metadataUpdateBehavior,proto3,enum=common.MetadataUpdateEnum" json:"metadata_update_behavior,omitempty"`
+}
+
+func (x *UpdateActionRequest) Reset() {
+	*x = UpdateActionRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_policy_actions_actions_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UpdateActionRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateActionRequest) ProtoMessage() {}
+
+func (x *UpdateActionRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_policy_actions_actions_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateActionRequest.ProtoReflect.Descriptor instead.
+func (*UpdateActionRequest) Descriptor() ([]byte, []int) {
+	return file_policy_actions_actions_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *UpdateActionRequest) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *UpdateActionRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *UpdateActionRequest) GetMetadata() *common.MetadataMutable {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *UpdateActionRequest) GetMetadataUpdateBehavior() common.MetadataUpdateEnum {
+	if x != nil {
+		return x.MetadataUpdateBehavior
+	}
+	return common.MetadataUpdateEnum(0)
+}
+
+type UpdateActionResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Action *policy.Action `protobuf:"bytes,1,opt,name=action,proto3" json:"action,omitempty"`
+}
+
+func (x *UpdateActionResponse) Reset() {
+	*x = UpdateActionResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_policy_actions_actions_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UpdateActionResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateActionResponse) ProtoMessage() {}
+
+func (x *UpdateActionResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_policy_actions_actions_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateActionResponse.ProtoReflect.Descriptor instead.
+func (*UpdateActionResponse) Descriptor() ([]byte, []int) {
+	return file_policy_actions_actions_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *UpdateActionResponse) GetAction() *policy.Action {
+	if x != nil {
+		return x.Action
+	}
+	return nil
+}
+
+// Deletion of standard actions is not supported.
+type DeleteCustomActionRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Required
+	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+}
+
+func (x *DeleteCustomActionRequest) Reset() {
+	*x = DeleteCustomActionRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_policy_actions_actions_proto_msgTypes[8]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DeleteCustomActionRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteCustomActionRequest) ProtoMessage() {}
+
+func (x *DeleteCustomActionRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_policy_actions_actions_proto_msgTypes[8]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteCustomActionRequest.ProtoReflect.Descriptor instead.
+func (*DeleteCustomActionRequest) Descriptor() ([]byte, []int) {
+	return file_policy_actions_actions_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *DeleteCustomActionRequest) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+type DeleteCustomActionResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Action *policy.Action `protobuf:"bytes,1,opt,name=action,proto3" json:"action,omitempty"`
+}
+
+func (x *DeleteCustomActionResponse) Reset() {
+	*x = DeleteCustomActionResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_policy_actions_actions_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DeleteCustomActionResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteCustomActionResponse) ProtoMessage() {}
+
+func (x *DeleteCustomActionResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_policy_actions_actions_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteCustomActionResponse.ProtoReflect.Descriptor instead.
+func (*DeleteCustomActionResponse) Descriptor() ([]byte, []int) {
+	return file_policy_actions_actions_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *DeleteCustomActionResponse) GetAction() *policy.Action {
+	if x != nil {
+		return x.Action
+	}
+	return nil
+}
+
+var File_policy_actions_actions_proto protoreflect.FileDescriptor
+
+var file_policy_actions_actions_proto_rawDesc = []byte{
+	0x0a, 0x1c, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
+	0x2f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0e,
+	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x1a, 0x1b,
+	0x62, 0x75, 0x66, 0x2f, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2f, 0x76, 0x61, 0x6c,
+	0x69, 0x64, 0x61, 0x74, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x13, 0x63, 0x6f, 0x6d,
+	0x6d, 0x6f, 0x6e, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x1a, 0x14, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x16, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x73,
+	0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xe8,
+	0x02, 0x0a, 0x10, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42,
+	0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x48, 0x00, 0x52, 0x02, 0x69, 0x64, 0x12,
+	0xa2, 0x02, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x8b,
+	0x02, 0xba, 0x48, 0x87, 0x02, 0xba, 0x01, 0xfc, 0x01, 0x0a, 0x12, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0xa8, 0x01,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x6d, 0x75, 0x73, 0x74,
+	0x20, 0x62, 0x65, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65,
+	0x72, 0x69, 0x63, 0x20, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x2c, 0x20, 0x61, 0x6c, 0x6c, 0x6f,
+	0x77, 0x69, 0x6e, 0x67, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x20, 0x61, 0x6e, 0x64,
+	0x20, 0x75, 0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f, 0x72, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74,
+	0x20, 0x6e, 0x6f, 0x74, 0x20, 0x61, 0x73, 0x20, 0x74, 0x68, 0x65, 0x20, 0x66, 0x69, 0x72, 0x73,
+	0x74, 0x20, 0x6f, 0x72, 0x20, 0x6c, 0x61, 0x73, 0x74, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63,
+	0x74, 0x65, 0x72, 0x2e, 0x20, 0x54, 0x68, 0x65, 0x20, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20,
+	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x69, 0x73, 0x20, 0x6e,
+	0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64, 0x20, 0x74, 0x6f, 0x20, 0x6c, 0x6f, 0x77,
+	0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a, 0x3b, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d,
+	0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a,
+	0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d,
+	0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d,
+	0x29, 0x3f, 0x24, 0x27, 0x29, 0x72, 0x05, 0x10, 0x01, 0x18, 0xfd, 0x01, 0x48, 0x00, 0x52, 0x04,
+	0x6e, 0x61, 0x6d, 0x65, 0x42, 0x13, 0x0a, 0x0a, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69,
+	0x65, 0x72, 0x12, 0x05, 0xba, 0x48, 0x02, 0x08, 0x01, 0x22, 0x3b, 0x0a, 0x11, 0x47, 0x65, 0x74,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26,
+	0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e,
+	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06,
+	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x49, 0x0a, 0x12, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x33, 0x0a, 0x0a,
+	0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x13, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x61, 0x67, 0x65, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x52, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x22, 0x75, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x28, 0x0a, 0x07, 0x61, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x07, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x12, 0x34, 0x0a, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
+	0x50, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x52, 0x0a, 0x70, 0x61,
+	0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0xf3, 0x02, 0x0a, 0x19, 0x43, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0xa0, 0x02, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x8b, 0x02, 0xba, 0x48, 0x87, 0x02, 0xba, 0x01, 0xfc, 0x01,
+	0x0a, 0x12, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x66, 0x6f,
+	0x72, 0x6d, 0x61, 0x74, 0x12, 0xa8, 0x01, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61,
+	0x6d, 0x65, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x73, 0x74, 0x72, 0x69, 0x6e,
+	0x67, 0x2c, 0x20, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x69, 0x6e, 0x67, 0x20, 0x68, 0x79, 0x70, 0x68,
+	0x65, 0x6e, 0x73, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x75, 0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f,
+	0x72, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74, 0x20, 0x6e, 0x6f, 0x74, 0x20, 0x61, 0x73, 0x20, 0x74,
+	0x68, 0x65, 0x20, 0x66, 0x69, 0x72, 0x73, 0x74, 0x20, 0x6f, 0x72, 0x20, 0x6c, 0x61, 0x73, 0x74,
+	0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2e, 0x20, 0x54, 0x68, 0x65, 0x20,
+	0x73, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61,
+	0x6d, 0x65, 0x20, 0x69, 0x73, 0x20, 0x6e, 0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64,
+	0x20, 0x74, 0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a,
+	0x3b, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e,
+	0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61,
+	0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a,
+	0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x72, 0x05, 0x10, 0x01,
+	0x18, 0xfd, 0x01, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f,
+	0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4d, 0x75, 0x74,
+	0x61, 0x62, 0x6c, 0x65, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x44,
+	0x0a, 0x1a, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x41, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06,
+	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x22, 0xdd, 0x03, 0x0a, 0x13, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02,
+	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0,
+	0x01, 0x01, 0x52, 0x02, 0x69, 0x64, 0x12, 0xa0, 0x02, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x8b, 0x02, 0xba, 0x48, 0x87, 0x02, 0xba, 0x01, 0xfc, 0x01,
+	0x0a, 0x12, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x66, 0x6f,
+	0x72, 0x6d, 0x61, 0x74, 0x12, 0xa8, 0x01, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61,
+	0x6d, 0x65, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x73, 0x74, 0x72, 0x69, 0x6e,
+	0x67, 0x2c, 0x20, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x69, 0x6e, 0x67, 0x20, 0x68, 0x79, 0x70, 0x68,
+	0x65, 0x6e, 0x73, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x75, 0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f,
+	0x72, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74, 0x20, 0x6e, 0x6f, 0x74, 0x20, 0x61, 0x73, 0x20, 0x74,
+	0x68, 0x65, 0x20, 0x66, 0x69, 0x72, 0x73, 0x74, 0x20, 0x6f, 0x72, 0x20, 0x6c, 0x61, 0x73, 0x74,
+	0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2e, 0x20, 0x54, 0x68, 0x65, 0x20,
+	0x73, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61,
+	0x6d, 0x65, 0x20, 0x69, 0x73, 0x20, 0x6e, 0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64,
+	0x20, 0x74, 0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a,
+	0x3b, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e,
+	0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61,
+	0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a,
+	0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x72, 0x05, 0x10, 0x01,
+	0x18, 0xfd, 0x01, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f,
+	0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4d, 0x75, 0x74,
+	0x61, 0x62, 0x6c, 0x65, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x54,
+	0x0a, 0x18, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x75, 0x70, 0x64, 0x61, 0x74,
+	0x65, 0x5f, 0x62, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x18, 0x65, 0x20, 0x01, 0x28, 0x0e,
+	0x32, 0x1a, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x52, 0x16, 0x6d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x42, 0x65, 0x68, 0x61,
+	0x76, 0x69, 0x6f, 0x72, 0x22, 0x3e, 0x0a, 0x14, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06,
+	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x22, 0x35, 0x0a, 0x19, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x75,
+	0x73, 0x74, 0x6f, 0x6d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba,
+	0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x52, 0x02, 0x69, 0x64, 0x22, 0x44, 0x0a, 0x1a, 0x44,
+	0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x41, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x32, 0xf8, 0x03, 0x0a, 0x0d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x12, 0x52, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x12, 0x20, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x21, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x41,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x22, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
+	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x70, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0x00, 0x12, 0x6d, 0x0a, 0x12, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x75, 0x73, 0x74, 0x6f,
+	0x6d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x29, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43,
+	0x75, 0x73, 0x74, 0x6f, 0x6d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x2a, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00,
+	0x12, 0x5b, 0x0a, 0x0c, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x12, 0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x6d, 0x0a,
+	0x12, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x41, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x12, 0x29, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x75, 0x73, 0x74, 0x6f,
+	0x6d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2a,
+	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e,
+	0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x41, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0xb3, 0x01, 0x0a,
+	0x12, 0x63, 0x6f, 0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x42, 0x0c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x50, 0x72, 0x6f, 0x74,
+	0x6f, 0x50, 0x01, 0x5a, 0x36, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f,
+	0x6f, 0x70, 0x65, 0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d,
+	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x2f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xa2, 0x02, 0x03, 0x50, 0x41,
+	0x58, 0xaa, 0x02, 0x0e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0xca, 0x02, 0x0e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0xe2, 0x02, 0x1a, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0xea, 0x02, 0x0f, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x3a, 0x3a, 0x41, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_policy_actions_actions_proto_rawDescOnce sync.Once
+	file_policy_actions_actions_proto_rawDescData = file_policy_actions_actions_proto_rawDesc
+)
+
+func file_policy_actions_actions_proto_rawDescGZIP() []byte {
+	file_policy_actions_actions_proto_rawDescOnce.Do(func() {
+		file_policy_actions_actions_proto_rawDescData = protoimpl.X.CompressGZIP(file_policy_actions_actions_proto_rawDescData)
+	})
+	return file_policy_actions_actions_proto_rawDescData
+}
+
+var file_policy_actions_actions_proto_msgTypes = make([]protoimpl.MessageInfo, 10)
+var file_policy_actions_actions_proto_goTypes = []interface{}{
+	(*GetActionRequest)(nil),           // 0: policy.actions.GetActionRequest
+	(*GetActionResponse)(nil),          // 1: policy.actions.GetActionResponse
+	(*ListActionsRequest)(nil),         // 2: policy.actions.ListActionsRequest
+	(*ListActionsResponse)(nil),        // 3: policy.actions.ListActionsResponse
+	(*CreateCustomActionRequest)(nil),  // 4: policy.actions.CreateCustomActionRequest
+	(*CreateCustomActionResponse)(nil), // 5: policy.actions.CreateCustomActionResponse
+	(*UpdateActionRequest)(nil),        // 6: policy.actions.UpdateActionRequest
+	(*UpdateActionResponse)(nil),       // 7: policy.actions.UpdateActionResponse
+	(*DeleteCustomActionRequest)(nil),  // 8: policy.actions.DeleteCustomActionRequest
+	(*DeleteCustomActionResponse)(nil), // 9: policy.actions.DeleteCustomActionResponse
+	(*policy.Action)(nil),              // 10: policy.Action
+	(*policy.PageRequest)(nil),         // 11: policy.PageRequest
+	(*policy.PageResponse)(nil),        // 12: policy.PageResponse
+	(*common.MetadataMutable)(nil),     // 13: common.MetadataMutable
+	(common.MetadataUpdateEnum)(0),     // 14: common.MetadataUpdateEnum
+}
+var file_policy_actions_actions_proto_depIdxs = []int32{
+	10, // 0: policy.actions.GetActionResponse.action:type_name -> policy.Action
+	11, // 1: policy.actions.ListActionsRequest.pagination:type_name -> policy.PageRequest
+	10, // 2: policy.actions.ListActionsResponse.actions:type_name -> policy.Action
+	12, // 3: policy.actions.ListActionsResponse.pagination:type_name -> policy.PageResponse
+	13, // 4: policy.actions.CreateCustomActionRequest.metadata:type_name -> common.MetadataMutable
+	10, // 5: policy.actions.CreateCustomActionResponse.action:type_name -> policy.Action
+	13, // 6: policy.actions.UpdateActionRequest.metadata:type_name -> common.MetadataMutable
+	14, // 7: policy.actions.UpdateActionRequest.metadata_update_behavior:type_name -> common.MetadataUpdateEnum
+	10, // 8: policy.actions.UpdateActionResponse.action:type_name -> policy.Action
+	10, // 9: policy.actions.DeleteCustomActionResponse.action:type_name -> policy.Action
+	0,  // 10: policy.actions.ActionService.GetAction:input_type -> policy.actions.GetActionRequest
+	2,  // 11: policy.actions.ActionService.ListActions:input_type -> policy.actions.ListActionsRequest
+	4,  // 12: policy.actions.ActionService.CreateCustomAction:input_type -> policy.actions.CreateCustomActionRequest
+	6,  // 13: policy.actions.ActionService.UpdateAction:input_type -> policy.actions.UpdateActionRequest
+	8,  // 14: policy.actions.ActionService.DeleteCustomAction:input_type -> policy.actions.DeleteCustomActionRequest
+	1,  // 15: policy.actions.ActionService.GetAction:output_type -> policy.actions.GetActionResponse
+	3,  // 16: policy.actions.ActionService.ListActions:output_type -> policy.actions.ListActionsResponse
+	5,  // 17: policy.actions.ActionService.CreateCustomAction:output_type -> policy.actions.CreateCustomActionResponse
+	7,  // 18: policy.actions.ActionService.UpdateAction:output_type -> policy.actions.UpdateActionResponse
+	9,  // 19: policy.actions.ActionService.DeleteCustomAction:output_type -> policy.actions.DeleteCustomActionResponse
+	15, // [15:20] is the sub-list for method output_type
+	10, // [10:15] is the sub-list for method input_type
+	10, // [10:10] is the sub-list for extension type_name
+	10, // [10:10] is the sub-list for extension extendee
+	0,  // [0:10] is the sub-list for field type_name
+}
+
+func init() { file_policy_actions_actions_proto_init() }
+func file_policy_actions_actions_proto_init() {
+	if File_policy_actions_actions_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_policy_actions_actions_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetActionRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_policy_actions_actions_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetActionResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_policy_actions_actions_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ListActionsRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_policy_actions_actions_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ListActionsResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_policy_actions_actions_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CreateCustomActionRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_policy_actions_actions_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CreateCustomActionResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_policy_actions_actions_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UpdateActionRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_policy_actions_actions_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UpdateActionResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_policy_actions_actions_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DeleteCustomActionRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_policy_actions_actions_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DeleteCustomActionResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_policy_actions_actions_proto_msgTypes[0].OneofWrappers = []interface{}{
+		(*GetActionRequest_Id)(nil),
+		(*GetActionRequest_Name)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_policy_actions_actions_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   10,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_policy_actions_actions_proto_goTypes,
+		DependencyIndexes: file_policy_actions_actions_proto_depIdxs,
+		MessageInfos:      file_policy_actions_actions_proto_msgTypes,
+	}.Build()
+	File_policy_actions_actions_proto = out.File
+	file_policy_actions_actions_proto_rawDesc = nil
+	file_policy_actions_actions_proto_goTypes = nil
+	file_policy_actions_actions_proto_depIdxs = nil
+}
diff --git a/protocol/go/policy/actions/actions_grpc.pb.go b/protocol/go/policy/actions/actions_grpc.pb.go
new file mode 100644
index 0000000000..44026dd2f1
--- /dev/null
+++ b/protocol/go/policy/actions/actions_grpc.pb.go
@@ -0,0 +1,257 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             (unknown)
+// source: policy/actions/actions.proto
+
+package actions
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
+
+const (
+	ActionService_GetAction_FullMethodName          = "/policy.actions.ActionService/GetAction"
+	ActionService_ListActions_FullMethodName        = "/policy.actions.ActionService/ListActions"
+	ActionService_CreateCustomAction_FullMethodName = "/policy.actions.ActionService/CreateCustomAction"
+	ActionService_UpdateAction_FullMethodName       = "/policy.actions.ActionService/UpdateAction"
+	ActionService_DeleteCustomAction_FullMethodName = "/policy.actions.ActionService/DeleteCustomAction"
+)
+
+// ActionServiceClient is the client API for ActionService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type ActionServiceClient interface {
+	GetAction(ctx context.Context, in *GetActionRequest, opts ...grpc.CallOption) (*GetActionResponse, error)
+	ListActions(ctx context.Context, in *ListActionsRequest, opts ...grpc.CallOption) (*ListActionsResponse, error)
+	CreateCustomAction(ctx context.Context, in *CreateCustomActionRequest, opts ...grpc.CallOption) (*CreateCustomActionResponse, error)
+	UpdateAction(ctx context.Context, in *UpdateActionRequest, opts ...grpc.CallOption) (*UpdateActionResponse, error)
+	DeleteCustomAction(ctx context.Context, in *DeleteCustomActionRequest, opts ...grpc.CallOption) (*DeleteCustomActionResponse, error)
+}
+
+type actionServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewActionServiceClient(cc grpc.ClientConnInterface) ActionServiceClient {
+	return &actionServiceClient{cc}
+}
+
+func (c *actionServiceClient) GetAction(ctx context.Context, in *GetActionRequest, opts ...grpc.CallOption) (*GetActionResponse, error) {
+	out := new(GetActionResponse)
+	err := c.cc.Invoke(ctx, ActionService_GetAction_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *actionServiceClient) ListActions(ctx context.Context, in *ListActionsRequest, opts ...grpc.CallOption) (*ListActionsResponse, error) {
+	out := new(ListActionsResponse)
+	err := c.cc.Invoke(ctx, ActionService_ListActions_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *actionServiceClient) CreateCustomAction(ctx context.Context, in *CreateCustomActionRequest, opts ...grpc.CallOption) (*CreateCustomActionResponse, error) {
+	out := new(CreateCustomActionResponse)
+	err := c.cc.Invoke(ctx, ActionService_CreateCustomAction_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *actionServiceClient) UpdateAction(ctx context.Context, in *UpdateActionRequest, opts ...grpc.CallOption) (*UpdateActionResponse, error) {
+	out := new(UpdateActionResponse)
+	err := c.cc.Invoke(ctx, ActionService_UpdateAction_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *actionServiceClient) DeleteCustomAction(ctx context.Context, in *DeleteCustomActionRequest, opts ...grpc.CallOption) (*DeleteCustomActionResponse, error) {
+	out := new(DeleteCustomActionResponse)
+	err := c.cc.Invoke(ctx, ActionService_DeleteCustomAction_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// ActionServiceServer is the server API for ActionService service.
+// All implementations must embed UnimplementedActionServiceServer
+// for forward compatibility
+type ActionServiceServer interface {
+	GetAction(context.Context, *GetActionRequest) (*GetActionResponse, error)
+	ListActions(context.Context, *ListActionsRequest) (*ListActionsResponse, error)
+	CreateCustomAction(context.Context, *CreateCustomActionRequest) (*CreateCustomActionResponse, error)
+	UpdateAction(context.Context, *UpdateActionRequest) (*UpdateActionResponse, error)
+	DeleteCustomAction(context.Context, *DeleteCustomActionRequest) (*DeleteCustomActionResponse, error)
+	mustEmbedUnimplementedActionServiceServer()
+}
+
+// UnimplementedActionServiceServer must be embedded to have forward compatible implementations.
+type UnimplementedActionServiceServer struct {
+}
+
+func (UnimplementedActionServiceServer) GetAction(context.Context, *GetActionRequest) (*GetActionResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetAction not implemented")
+}
+func (UnimplementedActionServiceServer) ListActions(context.Context, *ListActionsRequest) (*ListActionsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListActions not implemented")
+}
+func (UnimplementedActionServiceServer) CreateCustomAction(context.Context, *CreateCustomActionRequest) (*CreateCustomActionResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateCustomAction not implemented")
+}
+func (UnimplementedActionServiceServer) UpdateAction(context.Context, *UpdateActionRequest) (*UpdateActionResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UpdateAction not implemented")
+}
+func (UnimplementedActionServiceServer) DeleteCustomAction(context.Context, *DeleteCustomActionRequest) (*DeleteCustomActionResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DeleteCustomAction not implemented")
+}
+func (UnimplementedActionServiceServer) mustEmbedUnimplementedActionServiceServer() {}
+
+// UnsafeActionServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to ActionServiceServer will
+// result in compilation errors.
+type UnsafeActionServiceServer interface {
+	mustEmbedUnimplementedActionServiceServer()
+}
+
+func RegisterActionServiceServer(s grpc.ServiceRegistrar, srv ActionServiceServer) {
+	s.RegisterService(&ActionService_ServiceDesc, srv)
+}
+
+func _ActionService_GetAction_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetActionRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ActionServiceServer).GetAction(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ActionService_GetAction_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ActionServiceServer).GetAction(ctx, req.(*GetActionRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ActionService_ListActions_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListActionsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ActionServiceServer).ListActions(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ActionService_ListActions_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ActionServiceServer).ListActions(ctx, req.(*ListActionsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ActionService_CreateCustomAction_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateCustomActionRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ActionServiceServer).CreateCustomAction(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ActionService_CreateCustomAction_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ActionServiceServer).CreateCustomAction(ctx, req.(*CreateCustomActionRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ActionService_UpdateAction_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdateActionRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ActionServiceServer).UpdateAction(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ActionService_UpdateAction_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ActionServiceServer).UpdateAction(ctx, req.(*UpdateActionRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ActionService_DeleteCustomAction_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteCustomActionRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ActionServiceServer).DeleteCustomAction(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ActionService_DeleteCustomAction_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ActionServiceServer).DeleteCustomAction(ctx, req.(*DeleteCustomActionRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// ActionService_ServiceDesc is the grpc.ServiceDesc for ActionService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var ActionService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "policy.actions.ActionService",
+	HandlerType: (*ActionServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "GetAction",
+			Handler:    _ActionService_GetAction_Handler,
+		},
+		{
+			MethodName: "ListActions",
+			Handler:    _ActionService_ListActions_Handler,
+		},
+		{
+			MethodName: "CreateCustomAction",
+			Handler:    _ActionService_CreateCustomAction_Handler,
+		},
+		{
+			MethodName: "UpdateAction",
+			Handler:    _ActionService_UpdateAction_Handler,
+		},
+		{
+			MethodName: "DeleteCustomAction",
+			Handler:    _ActionService_DeleteCustomAction_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "policy/actions/actions.proto",
+}
diff --git a/protocol/go/policy/actions/actionsconnect/actions.connect.go b/protocol/go/policy/actions/actionsconnect/actions.connect.go
new file mode 100644
index 0000000000..8469807704
--- /dev/null
+++ b/protocol/go/policy/actions/actionsconnect/actions.connect.go
@@ -0,0 +1,232 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: policy/actions/actions.proto
+
+package actionsconnect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	actions "github.com/opentdf/platform/protocol/go/policy/actions"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// ActionServiceName is the fully-qualified name of the ActionService service.
+	ActionServiceName = "policy.actions.ActionService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// ActionServiceGetActionProcedure is the fully-qualified name of the ActionService's GetAction RPC.
+	ActionServiceGetActionProcedure = "/policy.actions.ActionService/GetAction"
+	// ActionServiceListActionsProcedure is the fully-qualified name of the ActionService's ListActions
+	// RPC.
+	ActionServiceListActionsProcedure = "/policy.actions.ActionService/ListActions"
+	// ActionServiceCreateCustomActionProcedure is the fully-qualified name of the ActionService's
+	// CreateCustomAction RPC.
+	ActionServiceCreateCustomActionProcedure = "/policy.actions.ActionService/CreateCustomAction"
+	// ActionServiceUpdateActionProcedure is the fully-qualified name of the ActionService's
+	// UpdateAction RPC.
+	ActionServiceUpdateActionProcedure = "/policy.actions.ActionService/UpdateAction"
+	// ActionServiceDeleteCustomActionProcedure is the fully-qualified name of the ActionService's
+	// DeleteCustomAction RPC.
+	ActionServiceDeleteCustomActionProcedure = "/policy.actions.ActionService/DeleteCustomAction"
+)
+
+// These variables are the protoreflect.Descriptor objects for the RPCs defined in this package.
+var (
+	actionServiceServiceDescriptor                  = actions.File_policy_actions_actions_proto.Services().ByName("ActionService")
+	actionServiceGetActionMethodDescriptor          = actionServiceServiceDescriptor.Methods().ByName("GetAction")
+	actionServiceListActionsMethodDescriptor        = actionServiceServiceDescriptor.Methods().ByName("ListActions")
+	actionServiceCreateCustomActionMethodDescriptor = actionServiceServiceDescriptor.Methods().ByName("CreateCustomAction")
+	actionServiceUpdateActionMethodDescriptor       = actionServiceServiceDescriptor.Methods().ByName("UpdateAction")
+	actionServiceDeleteCustomActionMethodDescriptor = actionServiceServiceDescriptor.Methods().ByName("DeleteCustomAction")
+)
+
+// ActionServiceClient is a client for the policy.actions.ActionService service.
+type ActionServiceClient interface {
+	GetAction(context.Context, *connect.Request[actions.GetActionRequest]) (*connect.Response[actions.GetActionResponse], error)
+	ListActions(context.Context, *connect.Request[actions.ListActionsRequest]) (*connect.Response[actions.ListActionsResponse], error)
+	CreateCustomAction(context.Context, *connect.Request[actions.CreateCustomActionRequest]) (*connect.Response[actions.CreateCustomActionResponse], error)
+	UpdateAction(context.Context, *connect.Request[actions.UpdateActionRequest]) (*connect.Response[actions.UpdateActionResponse], error)
+	DeleteCustomAction(context.Context, *connect.Request[actions.DeleteCustomActionRequest]) (*connect.Response[actions.DeleteCustomActionResponse], error)
+}
+
+// NewActionServiceClient constructs a client for the policy.actions.ActionService service. By
+// default, it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses,
+// and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the
+// connect.WithGRPC() or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewActionServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) ActionServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	return &actionServiceClient{
+		getAction: connect.NewClient[actions.GetActionRequest, actions.GetActionResponse](
+			httpClient,
+			baseURL+ActionServiceGetActionProcedure,
+			connect.WithSchema(actionServiceGetActionMethodDescriptor),
+			connect.WithClientOptions(opts...),
+		),
+		listActions: connect.NewClient[actions.ListActionsRequest, actions.ListActionsResponse](
+			httpClient,
+			baseURL+ActionServiceListActionsProcedure,
+			connect.WithSchema(actionServiceListActionsMethodDescriptor),
+			connect.WithClientOptions(opts...),
+		),
+		createCustomAction: connect.NewClient[actions.CreateCustomActionRequest, actions.CreateCustomActionResponse](
+			httpClient,
+			baseURL+ActionServiceCreateCustomActionProcedure,
+			connect.WithSchema(actionServiceCreateCustomActionMethodDescriptor),
+			connect.WithClientOptions(opts...),
+		),
+		updateAction: connect.NewClient[actions.UpdateActionRequest, actions.UpdateActionResponse](
+			httpClient,
+			baseURL+ActionServiceUpdateActionProcedure,
+			connect.WithSchema(actionServiceUpdateActionMethodDescriptor),
+			connect.WithClientOptions(opts...),
+		),
+		deleteCustomAction: connect.NewClient[actions.DeleteCustomActionRequest, actions.DeleteCustomActionResponse](
+			httpClient,
+			baseURL+ActionServiceDeleteCustomActionProcedure,
+			connect.WithSchema(actionServiceDeleteCustomActionMethodDescriptor),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// actionServiceClient implements ActionServiceClient.
+type actionServiceClient struct {
+	getAction          *connect.Client[actions.GetActionRequest, actions.GetActionResponse]
+	listActions        *connect.Client[actions.ListActionsRequest, actions.ListActionsResponse]
+	createCustomAction *connect.Client[actions.CreateCustomActionRequest, actions.CreateCustomActionResponse]
+	updateAction       *connect.Client[actions.UpdateActionRequest, actions.UpdateActionResponse]
+	deleteCustomAction *connect.Client[actions.DeleteCustomActionRequest, actions.DeleteCustomActionResponse]
+}
+
+// GetAction calls policy.actions.ActionService.GetAction.
+func (c *actionServiceClient) GetAction(ctx context.Context, req *connect.Request[actions.GetActionRequest]) (*connect.Response[actions.GetActionResponse], error) {
+	return c.getAction.CallUnary(ctx, req)
+}
+
+// ListActions calls policy.actions.ActionService.ListActions.
+func (c *actionServiceClient) ListActions(ctx context.Context, req *connect.Request[actions.ListActionsRequest]) (*connect.Response[actions.ListActionsResponse], error) {
+	return c.listActions.CallUnary(ctx, req)
+}
+
+// CreateCustomAction calls policy.actions.ActionService.CreateCustomAction.
+func (c *actionServiceClient) CreateCustomAction(ctx context.Context, req *connect.Request[actions.CreateCustomActionRequest]) (*connect.Response[actions.CreateCustomActionResponse], error) {
+	return c.createCustomAction.CallUnary(ctx, req)
+}
+
+// UpdateAction calls policy.actions.ActionService.UpdateAction.
+func (c *actionServiceClient) UpdateAction(ctx context.Context, req *connect.Request[actions.UpdateActionRequest]) (*connect.Response[actions.UpdateActionResponse], error) {
+	return c.updateAction.CallUnary(ctx, req)
+}
+
+// DeleteCustomAction calls policy.actions.ActionService.DeleteCustomAction.
+func (c *actionServiceClient) DeleteCustomAction(ctx context.Context, req *connect.Request[actions.DeleteCustomActionRequest]) (*connect.Response[actions.DeleteCustomActionResponse], error) {
+	return c.deleteCustomAction.CallUnary(ctx, req)
+}
+
+// ActionServiceHandler is an implementation of the policy.actions.ActionService service.
+type ActionServiceHandler interface {
+	GetAction(context.Context, *connect.Request[actions.GetActionRequest]) (*connect.Response[actions.GetActionResponse], error)
+	ListActions(context.Context, *connect.Request[actions.ListActionsRequest]) (*connect.Response[actions.ListActionsResponse], error)
+	CreateCustomAction(context.Context, *connect.Request[actions.CreateCustomActionRequest]) (*connect.Response[actions.CreateCustomActionResponse], error)
+	UpdateAction(context.Context, *connect.Request[actions.UpdateActionRequest]) (*connect.Response[actions.UpdateActionResponse], error)
+	DeleteCustomAction(context.Context, *connect.Request[actions.DeleteCustomActionRequest]) (*connect.Response[actions.DeleteCustomActionResponse], error)
+}
+
+// NewActionServiceHandler builds an HTTP handler from the service implementation. It returns the
+// path on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewActionServiceHandler(svc ActionServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	actionServiceGetActionHandler := connect.NewUnaryHandler(
+		ActionServiceGetActionProcedure,
+		svc.GetAction,
+		connect.WithSchema(actionServiceGetActionMethodDescriptor),
+		connect.WithHandlerOptions(opts...),
+	)
+	actionServiceListActionsHandler := connect.NewUnaryHandler(
+		ActionServiceListActionsProcedure,
+		svc.ListActions,
+		connect.WithSchema(actionServiceListActionsMethodDescriptor),
+		connect.WithHandlerOptions(opts...),
+	)
+	actionServiceCreateCustomActionHandler := connect.NewUnaryHandler(
+		ActionServiceCreateCustomActionProcedure,
+		svc.CreateCustomAction,
+		connect.WithSchema(actionServiceCreateCustomActionMethodDescriptor),
+		connect.WithHandlerOptions(opts...),
+	)
+	actionServiceUpdateActionHandler := connect.NewUnaryHandler(
+		ActionServiceUpdateActionProcedure,
+		svc.UpdateAction,
+		connect.WithSchema(actionServiceUpdateActionMethodDescriptor),
+		connect.WithHandlerOptions(opts...),
+	)
+	actionServiceDeleteCustomActionHandler := connect.NewUnaryHandler(
+		ActionServiceDeleteCustomActionProcedure,
+		svc.DeleteCustomAction,
+		connect.WithSchema(actionServiceDeleteCustomActionMethodDescriptor),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/policy.actions.ActionService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case ActionServiceGetActionProcedure:
+			actionServiceGetActionHandler.ServeHTTP(w, r)
+		case ActionServiceListActionsProcedure:
+			actionServiceListActionsHandler.ServeHTTP(w, r)
+		case ActionServiceCreateCustomActionProcedure:
+			actionServiceCreateCustomActionHandler.ServeHTTP(w, r)
+		case ActionServiceUpdateActionProcedure:
+			actionServiceUpdateActionHandler.ServeHTTP(w, r)
+		case ActionServiceDeleteCustomActionProcedure:
+			actionServiceDeleteCustomActionHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedActionServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedActionServiceHandler struct{}
+
+func (UnimplementedActionServiceHandler) GetAction(context.Context, *connect.Request[actions.GetActionRequest]) (*connect.Response[actions.GetActionResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("policy.actions.ActionService.GetAction is not implemented"))
+}
+
+func (UnimplementedActionServiceHandler) ListActions(context.Context, *connect.Request[actions.ListActionsRequest]) (*connect.Response[actions.ListActionsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("policy.actions.ActionService.ListActions is not implemented"))
+}
+
+func (UnimplementedActionServiceHandler) CreateCustomAction(context.Context, *connect.Request[actions.CreateCustomActionRequest]) (*connect.Response[actions.CreateCustomActionResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("policy.actions.ActionService.CreateCustomAction is not implemented"))
+}
+
+func (UnimplementedActionServiceHandler) UpdateAction(context.Context, *connect.Request[actions.UpdateActionRequest]) (*connect.Response[actions.UpdateActionResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("policy.actions.ActionService.UpdateAction is not implemented"))
+}
+
+func (UnimplementedActionServiceHandler) DeleteCustomAction(context.Context, *connect.Request[actions.DeleteCustomActionRequest]) (*connect.Response[actions.DeleteCustomActionResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("policy.actions.ActionService.DeleteCustomAction is not implemented"))
+}
diff --git a/protocol/go/policy/objects.pb.go b/protocol/go/policy/objects.pb.go
index b2d806fbb6..c1be1be035 100644
--- a/protocol/go/policy/objects.pb.go
+++ b/protocol/go/policy/objects.pb.go
@@ -23,8 +23,6 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
-// buflint ENUM_VALUE_PREFIX: to make sure that C++ scoping rules aren't
-// violated when users add new enum values to an enum in a given package
 type AttributeRuleTypeEnum int32
 
 const (
@@ -77,8 +75,6 @@ func (AttributeRuleTypeEnum) EnumDescriptor() ([]byte, []int) {
 	return file_policy_objects_proto_rawDescGZIP(), []int{0}
 }
 
-// buflint ENUM_VALUE_PREFIX: to make sure that C++ scoping rules aren't
-// violated when users add new enum values to an enum in a given package
 type SubjectMappingOperatorEnum int32
 
 const (
@@ -135,8 +131,6 @@ func (SubjectMappingOperatorEnum) EnumDescriptor() ([]byte, []int) {
 	return file_policy_objects_proto_rawDescGZIP(), []int{1}
 }
 
-// buflint ENUM_VALUE_PREFIX: to make sure that C++ scoping rules aren't
-// violated when users add new enum values to an enum in a given package
 type ConditionBooleanTypeEnum int32
 
 const (
@@ -249,21 +243,27 @@ type Action_StandardAction int32
 
 const (
 	Action_STANDARD_ACTION_UNSPECIFIED Action_StandardAction = 0
-	Action_STANDARD_ACTION_DECRYPT     Action_StandardAction = 1
-	Action_STANDARD_ACTION_TRANSMIT    Action_StandardAction = 2
+	Action_STANDARD_ACTION_CREATE      Action_StandardAction = 3
+	Action_STANDARD_ACTION_READ        Action_StandardAction = 4
+	Action_STANDARD_ACTION_UPDATE      Action_StandardAction = 5
+	Action_STANDARD_ACTION_DELETE      Action_StandardAction = 6
 )
 
 // Enum value maps for Action_StandardAction.
 var (
 	Action_StandardAction_name = map[int32]string{
 		0: "STANDARD_ACTION_UNSPECIFIED",
-		1: "STANDARD_ACTION_DECRYPT",
-		2: "STANDARD_ACTION_TRANSMIT",
+		3: "STANDARD_ACTION_CREATE",
+		4: "STANDARD_ACTION_READ",
+		5: "STANDARD_ACTION_UPDATE",
+		6: "STANDARD_ACTION_DELETE",
 	}
 	Action_StandardAction_value = map[string]int32{
 		"STANDARD_ACTION_UNSPECIFIED": 0,
-		"STANDARD_ACTION_DECRYPT":     1,
-		"STANDARD_ACTION_TRANSMIT":    2,
+		"STANDARD_ACTION_CREATE":      3,
+		"STANDARD_ACTION_READ":        4,
+		"STANDARD_ACTION_UPDATE":      5,
+		"STANDARD_ACTION_DELETE":      6,
 	}
 )
 
@@ -648,7 +648,8 @@ type Action struct {
 	//
 	//	*Action_Standard
 	//	*Action_Custom
-	Value isAction_Value `protobuf_oneof:"value"`
+	Value    isAction_Value   `protobuf_oneof:"value"`
+	Metadata *common.Metadata `protobuf:"bytes,100,opt,name=metadata,proto3" json:"metadata,omitempty"`
 }
 
 func (x *Action) Reset() {
@@ -704,15 +705,24 @@ func (x *Action) GetCustom() string {
 	return ""
 }
 
+func (x *Action) GetMetadata() *common.Metadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
 type isAction_Value interface {
 	isAction_Value()
 }
 
 type Action_Standard struct {
+	// standard CRUD action
 	Standard Action_StandardAction `protobuf:"varint,1,opt,name=standard,proto3,enum=policy.Action_StandardAction,oneof"`
 }
 
 type Action_Custom struct {
+	// distinctly custom action
 	Custom string `protobuf:"bytes,2,opt,name=custom,proto3,oneof"`
 }
 
@@ -1723,261 +1733,268 @@ var file_policy_objects_proto_rawDesc = []byte{
 	0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e,
 	0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
 	0x74, 0x61, 0x4a, 0x04, 0x08, 0x04, 0x10, 0x05, 0x52, 0x07, 0x6d, 0x65, 0x6d, 0x62, 0x65, 0x72,
-	0x73, 0x22, 0xd6, 0x01, 0x0a, 0x06, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x3b, 0x0a, 0x08,
+	0x73, 0x22, 0xc4, 0x02, 0x0a, 0x06, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x3b, 0x0a, 0x08,
 	0x73, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1d,
 	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x53,
 	0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x48, 0x00, 0x52,
 	0x08, 0x73, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x12, 0x18, 0x0a, 0x06, 0x63, 0x75, 0x73,
 	0x74, 0x6f, 0x6d, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x06, 0x63, 0x75, 0x73,
-	0x74, 0x6f, 0x6d, 0x22, 0x6c, 0x0a, 0x0e, 0x53, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x41,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1f, 0x0a, 0x1b, 0x53, 0x54, 0x41, 0x4e, 0x44, 0x41, 0x52,
-	0x44, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49,
-	0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x1b, 0x0a, 0x17, 0x53, 0x54, 0x41, 0x4e, 0x44, 0x41,
-	0x52, 0x44, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x44, 0x45, 0x43, 0x52, 0x59, 0x50,
-	0x54, 0x10, 0x01, 0x12, 0x1c, 0x0a, 0x18, 0x53, 0x54, 0x41, 0x4e, 0x44, 0x41, 0x52, 0x44, 0x5f,
-	0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x54, 0x52, 0x41, 0x4e, 0x53, 0x4d, 0x49, 0x54, 0x10,
-	0x02, 0x42, 0x07, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x81, 0x02, 0x0a, 0x0e, 0x53,
-	0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x0e, 0x0a,
-	0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x36, 0x0a,
-	0x0f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
-	0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0e, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65,
-	0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x4f, 0x0a, 0x15, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74,
-	0x5f, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x73, 0x65, 0x74, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75,
-	0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65,
-	0x74, 0x52, 0x13, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74,
-	0x69, 0x6f, 0x6e, 0x53, 0x65, 0x74, 0x12, 0x28, 0x0a, 0x07, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x07, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61,
-	0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0xe9,
-	0x01, 0x0a, 0x09, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x4d, 0x0a, 0x1f,
-	0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c,
-	0x5f, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x1c, 0x73,
-	0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x53, 0x65,
-	0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x4b, 0x0a, 0x08, 0x6f,
-	0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x22, 0x2e,
-	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4d, 0x61,
-	0x70, 0x70, 0x69, 0x6e, 0x67, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x45, 0x6e, 0x75,
-	0x6d, 0x42, 0x0b, 0xba, 0x48, 0x08, 0xc8, 0x01, 0x01, 0x82, 0x01, 0x02, 0x10, 0x01, 0x52, 0x08,
-	0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x12, 0x40, 0x0a, 0x17, 0x73, 0x75, 0x62, 0x6a,
-	0x65, 0x63, 0x74, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x76, 0x61, 0x6c,
-	0x75, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01,
-	0x02, 0x08, 0x01, 0x52, 0x15, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x45, 0x78, 0x74, 0x65,
-	0x72, 0x6e, 0x61, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x22, 0xa7, 0x01, 0x0a, 0x0e, 0x43,
-	0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x3b, 0x0a,
-	0x0a, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x11, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69,
-	0x74, 0x69, 0x6f, 0x6e, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x0a,
-	0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x58, 0x0a, 0x10, 0x62, 0x6f,
-	0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x5f, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0e, 0x32, 0x20, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x43, 0x6f,
-	0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x54, 0x79,
-	0x70, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x42, 0x0b, 0xba, 0x48, 0x08, 0xc8, 0x01, 0x01, 0x82, 0x01,
-	0x02, 0x10, 0x01, 0x52, 0x0f, 0x62, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x4f, 0x70, 0x65, 0x72,
-	0x61, 0x74, 0x6f, 0x72, 0x22, 0x59, 0x0a, 0x0a, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x53,
-	0x65, 0x74, 0x12, 0x4b, 0x0a, 0x10, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x5f,
-	0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x70,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x47,
-	0x72, 0x6f, 0x75, 0x70, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x0f,
-	0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x22,
-	0x94, 0x01, 0x0a, 0x13, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64, 0x69,
-	0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x3f, 0x0a, 0x0c, 0x73, 0x75, 0x62, 0x6a, 0x65,
-	0x63, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x12, 0x2e,
-	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x53, 0x65,
-	0x74, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x0b, 0x73, 0x75, 0x62,
-	0x6a, 0x65, 0x63, 0x74, 0x53, 0x65, 0x74, 0x73, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61,
-	0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d,
-	0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65,
-	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x7c, 0x0a, 0x0f, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63,
-	0x74, 0x50, 0x72, 0x6f, 0x70, 0x65, 0x72, 0x74, 0x79, 0x12, 0x42, 0x0a, 0x17, 0x65, 0x78, 0x74,
-	0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x76,
-	0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xba, 0x48, 0x07, 0xc8,
-	0x01, 0x01, 0x72, 0x02, 0x10, 0x01, 0x52, 0x15, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c,
-	0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x25, 0x0a,
-	0x0e, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x56,
-	0x61, 0x6c, 0x75, 0x65, 0x22, 0x9b, 0x01, 0x0a, 0x14, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x0e, 0x0a,
-	0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x29, 0x0a,
-	0x0c, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x0b, 0x6e, 0x61, 0x6d,
-	0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x49, 0x64, 0x12, 0x1a, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x04,
-	0x6e, 0x61, 0x6d, 0x65, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
-	0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e,
-	0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x22, 0xd9, 0x01, 0x0a, 0x0f, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d,
-	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f,
+	0x74, 0x6f, 0x6d, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18,
+	0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0x22, 0xab, 0x01, 0x0a, 0x0e, 0x53, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x41, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1f, 0x0a, 0x1b, 0x53, 0x54, 0x41, 0x4e, 0x44, 0x41, 0x52, 0x44,
+	0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46,
+	0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x1a, 0x0a, 0x16, 0x53, 0x54, 0x41, 0x4e, 0x44, 0x41, 0x52,
+	0x44, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x43, 0x52, 0x45, 0x41, 0x54, 0x45, 0x10,
+	0x03, 0x12, 0x18, 0x0a, 0x14, 0x53, 0x54, 0x41, 0x4e, 0x44, 0x41, 0x52, 0x44, 0x5f, 0x41, 0x43,
+	0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x52, 0x45, 0x41, 0x44, 0x10, 0x04, 0x12, 0x1a, 0x0a, 0x16, 0x53,
+	0x54, 0x41, 0x4e, 0x44, 0x41, 0x52, 0x44, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55,
+	0x50, 0x44, 0x41, 0x54, 0x45, 0x10, 0x05, 0x12, 0x1a, 0x0a, 0x16, 0x53, 0x54, 0x41, 0x4e, 0x44,
+	0x41, 0x52, 0x44, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x44, 0x45, 0x4c, 0x45, 0x54,
+	0x45, 0x10, 0x06, 0x22, 0x04, 0x08, 0x01, 0x10, 0x01, 0x22, 0x04, 0x08, 0x02, 0x10, 0x02, 0x42,
+	0x07, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x81, 0x02, 0x0a, 0x0e, 0x53, 0x75, 0x62,
+	0x6a, 0x65, 0x63, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x0e, 0x0a, 0x02, 0x69,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x36, 0x0a, 0x0f, 0x61,
+	0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x56, 0x61,
+	0x6c, 0x75, 0x65, 0x52, 0x0e, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x56, 0x61,
+	0x6c, 0x75, 0x65, 0x12, 0x4f, 0x0a, 0x15, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x63,
+	0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x73, 0x65, 0x74, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a,
+	0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x74, 0x52,
+	0x13, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f,
+	0x6e, 0x53, 0x65, 0x74, 0x12, 0x28, 0x0a, 0x07, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18,
+	0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x07, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x2c,
+	0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0xe9, 0x01, 0x0a,
+	0x09, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x4d, 0x0a, 0x1f, 0x73, 0x75,
+	0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x73,
+	0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x1c, 0x73, 0x75, 0x62,
+	0x6a, 0x65, 0x63, 0x74, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x53, 0x65, 0x6c, 0x65,
+	0x63, 0x74, 0x6f, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x4b, 0x0a, 0x08, 0x6f, 0x70, 0x65,
+	0x72, 0x61, 0x74, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x22, 0x2e, 0x70, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4d, 0x61, 0x70, 0x70,
+	0x69, 0x6e, 0x67, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x45, 0x6e, 0x75, 0x6d, 0x42,
+	0x0b, 0xba, 0x48, 0x08, 0xc8, 0x01, 0x01, 0x82, 0x01, 0x02, 0x10, 0x01, 0x52, 0x08, 0x6f, 0x70,
+	0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x12, 0x40, 0x0a, 0x17, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63,
+	0x74, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08,
+	0x01, 0x52, 0x15, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e,
+	0x61, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x22, 0xa7, 0x01, 0x0a, 0x0e, 0x43, 0x6f, 0x6e,
+	0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x3b, 0x0a, 0x0a, 0x63,
+	0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x11, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69,
+	0x6f, 0x6e, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x0a, 0x63, 0x6f,
+	0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x58, 0x0a, 0x10, 0x62, 0x6f, 0x6f, 0x6c,
+	0x65, 0x61, 0x6e, 0x5f, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x0e, 0x32, 0x20, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x43, 0x6f, 0x6e, 0x64,
+	0x69, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x54, 0x79, 0x70, 0x65,
+	0x45, 0x6e, 0x75, 0x6d, 0x42, 0x0b, 0xba, 0x48, 0x08, 0xc8, 0x01, 0x01, 0x82, 0x01, 0x02, 0x10,
+	0x01, 0x52, 0x0f, 0x62, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74,
+	0x6f, 0x72, 0x22, 0x59, 0x0a, 0x0a, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x53, 0x65, 0x74,
+	0x12, 0x4b, 0x0a, 0x10, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x67, 0x72,
+	0x6f, 0x75, 0x70, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x70, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f,
+	0x75, 0x70, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x0f, 0x63, 0x6f,
+	0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x22, 0x94, 0x01,
+	0x0a, 0x13, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69,
+	0x6f, 0x6e, 0x53, 0x65, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x3f, 0x0a, 0x0c, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74,
+	0x5f, 0x73, 0x65, 0x74, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x70, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x53, 0x65, 0x74, 0x42,
+	0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x0b, 0x73, 0x75, 0x62, 0x6a, 0x65,
+	0x63, 0x74, 0x53, 0x65, 0x74, 0x73, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f,
 	0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61,
-	0x64, 0x61, 0x74, 0x61, 0x12, 0x3e, 0x0a, 0x0f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74,
-	0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e,
-	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x06, 0xba, 0x48,
-	0x03, 0xc8, 0x01, 0x01, 0x52, 0x0e, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x56,
-	0x61, 0x6c, 0x75, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x65, 0x72, 0x6d, 0x73, 0x18, 0x04, 0x20,
-	0x03, 0x28, 0x09, 0x52, 0x05, 0x74, 0x65, 0x72, 0x6d, 0x73, 0x12, 0x32, 0x0a, 0x05, 0x67, 0x72,
-	0x6f, 0x75, 0x70, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69,
-	0x6e, 0x67, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x05, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x22, 0x9f,
-	0x04, 0x0a, 0x0f, 0x4b, 0x65, 0x79, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x53, 0x65, 0x72, 0x76,
-	0x65, 0x72, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02,
-	0x69, 0x64, 0x12, 0x87, 0x03, 0x0a, 0x03, 0x75, 0x72, 0x69, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x42, 0xf4, 0x02, 0xba, 0x48, 0xf0, 0x02, 0xba, 0x01, 0xec, 0x02, 0x0a, 0x0a, 0x75, 0x72, 0x69,
-	0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0xcf, 0x01, 0x55, 0x52, 0x49, 0x20, 0x6d, 0x75,
-	0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x61, 0x20, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x20, 0x55, 0x52,
-	0x4c, 0x20, 0x28, 0x65, 0x2e, 0x67, 0x2e, 0x2c, 0x20, 0x27, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a,
-	0x2f, 0x2f, 0x64, 0x65, 0x6d, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x27, 0x29, 0x20, 0x66, 0x6f,
-	0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x20, 0x62, 0x79, 0x20, 0x61, 0x64, 0x64, 0x69, 0x74, 0x69,
-	0x6f, 0x6e, 0x61, 0x6c, 0x20, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x20, 0x45,
-	0x61, 0x63, 0x68, 0x20, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x20, 0x6d, 0x75, 0x73, 0x74,
-	0x20, 0x73, 0x74, 0x61, 0x72, 0x74, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x65, 0x6e, 0x64, 0x20, 0x77,
-	0x69, 0x74, 0x68, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65,
-	0x72, 0x69, 0x63, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2c, 0x20, 0x63,
-	0x61, 0x6e, 0x20, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65,
-	0x6e, 0x73, 0x2c, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63,
-	0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x73, 0x2c, 0x20, 0x61, 0x6e, 0x64,
-	0x20, 0x73, 0x6c, 0x61, 0x73, 0x68, 0x65, 0x73, 0x2e, 0x1a, 0x8b, 0x01, 0x74, 0x68, 0x69, 0x73,
-	0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x68, 0x74, 0x74, 0x70, 0x73,
-	0x3f, 0x3a, 0x2f, 0x2f, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28,
-	0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b, 0x30,
-	0x2c, 0x36, 0x31, 0x7d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29,
-	0x3f, 0x28, 0x5c, 0x5c, 0x2e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d,
-	0x28, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b,
-	0x30, 0x2c, 0x36, 0x31, 0x7d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d,
-	0x29, 0x3f, 0x29, 0x2a, 0x28, 0x3a, 0x5b, 0x30, 0x2d, 0x39, 0x5d, 0x2b, 0x29, 0x3f, 0x28, 0x2f,
-	0x2e, 0x2a, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x52, 0x03, 0x75, 0x72, 0x69, 0x12, 0x30, 0x0a, 0x0a,
-	0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x11, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63,
-	0x4b, 0x65, 0x79, 0x52, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x12,
-	0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x22, 0x7c, 0x0a, 0x0f, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x50,
+	0x72, 0x6f, 0x70, 0x65, 0x72, 0x74, 0x79, 0x12, 0x42, 0x0a, 0x17, 0x65, 0x78, 0x74, 0x65, 0x72,
+	0x6e, 0x61, 0x6c, 0x5f, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x76, 0x61, 0x6c,
+	0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xba, 0x48, 0x07, 0xc8, 0x01, 0x01,
+	0x72, 0x02, 0x10, 0x01, 0x52, 0x15, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x53, 0x65,
+	0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x25, 0x0a, 0x0e, 0x65,
+	0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0d, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x56, 0x61, 0x6c,
+	0x75, 0x65, 0x22, 0x9b, 0x01, 0x0a, 0x14, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d,
+	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x0e, 0x0a, 0x02, 0x69,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x29, 0x0a, 0x0c, 0x6e,
+	0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x73,
+	0x70, 0x61, 0x63, 0x65, 0x49, 0x64, 0x12, 0x1a, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x04, 0x6e, 0x61,
 	0x6d, 0x65, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64,
 	0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65,
 	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
-	0x22, 0x97, 0x02, 0x0a, 0x03, 0x4b, 0x65, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x37, 0x0a, 0x09, 0x69, 0x73, 0x5f, 0x61,
-	0x63, 0x74, 0x69, 0x76, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f,
-	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42, 0x6f,
-	0x6f, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x08, 0x69, 0x73, 0x41, 0x63, 0x74, 0x69, 0x76,
-	0x65, 0x12, 0x39, 0x0a, 0x0a, 0x77, 0x61, 0x73, 0x5f, 0x6d, 0x61, 0x70, 0x70, 0x65, 0x64, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42, 0x6f, 0x6f, 0x6c, 0x56, 0x61, 0x6c, 0x75,
-	0x65, 0x52, 0x09, 0x77, 0x61, 0x73, 0x4d, 0x61, 0x70, 0x70, 0x65, 0x64, 0x12, 0x33, 0x0a, 0x0a,
-	0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b,
+	0x22, 0xd9, 0x01, 0x0a, 0x0f, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x61, 0x70,
+	0x70, 0x69, 0x6e, 0x67, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x02, 0x69, 0x64, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e,
+	0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x12, 0x3e, 0x0a, 0x0f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x70, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8,
+	0x01, 0x01, 0x52, 0x0e, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x56, 0x61, 0x6c,
+	0x75, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x65, 0x72, 0x6d, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28,
+	0x09, 0x52, 0x05, 0x74, 0x65, 0x72, 0x6d, 0x73, 0x12, 0x32, 0x0a, 0x05, 0x67, 0x72, 0x6f, 0x75,
+	0x70, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67,
+	0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x05, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x22, 0x9f, 0x04, 0x0a,
+	0x0f, 0x4b, 0x65, 0x79, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
+	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64,
+	0x12, 0x87, 0x03, 0x0a, 0x03, 0x75, 0x72, 0x69, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0xf4,
+	0x02, 0xba, 0x48, 0xf0, 0x02, 0xba, 0x01, 0xec, 0x02, 0x0a, 0x0a, 0x75, 0x72, 0x69, 0x5f, 0x66,
+	0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0xcf, 0x01, 0x55, 0x52, 0x49, 0x20, 0x6d, 0x75, 0x73, 0x74,
+	0x20, 0x62, 0x65, 0x20, 0x61, 0x20, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x20, 0x55, 0x52, 0x4c, 0x20,
+	0x28, 0x65, 0x2e, 0x67, 0x2e, 0x2c, 0x20, 0x27, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f,
+	0x64, 0x65, 0x6d, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x27, 0x29, 0x20, 0x66, 0x6f, 0x6c, 0x6c,
+	0x6f, 0x77, 0x65, 0x64, 0x20, 0x62, 0x79, 0x20, 0x61, 0x64, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e,
+	0x61, 0x6c, 0x20, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x20, 0x45, 0x61, 0x63,
+	0x68, 0x20, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x73,
+	0x74, 0x61, 0x72, 0x74, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x65, 0x6e, 0x64, 0x20, 0x77, 0x69, 0x74,
+	0x68, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69,
+	0x63, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2c, 0x20, 0x63, 0x61, 0x6e,
+	0x20, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73,
+	0x2c, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x63,
+	0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x73, 0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x73,
+	0x6c, 0x61, 0x73, 0x68, 0x65, 0x73, 0x2e, 0x1a, 0x8b, 0x01, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d,
+	0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3f, 0x3a,
+	0x2f, 0x2f, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b, 0x61,
+	0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b, 0x30, 0x2c, 0x36,
+	0x31, 0x7d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x28,
+	0x5c, 0x5c, 0x2e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b,
+	0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b, 0x30, 0x2c,
+	0x36, 0x31, 0x7d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f,
+	0x29, 0x2a, 0x28, 0x3a, 0x5b, 0x30, 0x2d, 0x39, 0x5d, 0x2b, 0x29, 0x3f, 0x28, 0x2f, 0x2e, 0x2a,
+	0x29, 0x3f, 0x24, 0x27, 0x29, 0x52, 0x03, 0x75, 0x72, 0x69, 0x12, 0x30, 0x0a, 0x0a, 0x70, 0x75,
+	0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x11,
+	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65,
+	0x79, 0x52, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x12, 0x0a, 0x04,
+	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65,
+	0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x97,
+	0x02, 0x0a, 0x03, 0x4b, 0x65, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x37, 0x0a, 0x09, 0x69, 0x73, 0x5f, 0x61, 0x63, 0x74,
+	0x69, 0x76, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42, 0x6f, 0x6f, 0x6c,
+	0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x08, 0x69, 0x73, 0x41, 0x63, 0x74, 0x69, 0x76, 0x65, 0x12,
+	0x39, 0x0a, 0x0a, 0x77, 0x61, 0x73, 0x5f, 0x6d, 0x61, 0x70, 0x70, 0x65, 0x64, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42, 0x6f, 0x6f, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52,
+	0x09, 0x77, 0x61, 0x73, 0x4d, 0x61, 0x70, 0x70, 0x65, 0x64, 0x12, 0x33, 0x0a, 0x0a, 0x70, 0x75,
+	0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14,
+	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69,
+	0x63, 0x4b, 0x65, 0x79, 0x52, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12,
+	0x29, 0x0a, 0x03, 0x6b, 0x61, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x70,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x65, 0x79, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x53,
+	0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x03, 0x6b, 0x61, 0x73, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63,
+	0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08,
+	0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x84, 0x01, 0x0a, 0x0c, 0x4b, 0x61, 0x73,
+	0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x1c, 0x0a, 0x03, 0x70, 0x65, 0x6d,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xba, 0x48, 0x07, 0x72, 0x05, 0x10, 0x01, 0x18,
+	0x80, 0x40, 0x52, 0x03, 0x70, 0x65, 0x6d, 0x12, 0x1b, 0x0a, 0x03, 0x6b, 0x69, 0x64, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x42, 0x09, 0xba, 0x48, 0x06, 0x72, 0x04, 0x10, 0x01, 0x18, 0x20, 0x52,
+	0x03, 0x6b, 0x69, 0x64, 0x12, 0x39, 0x0a, 0x03, 0x61, 0x6c, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x0e, 0x32, 0x1b, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73, 0x50, 0x75,
+	0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x41, 0x6c, 0x67, 0x45, 0x6e, 0x75, 0x6d, 0x42, 0x0a,
+	0xba, 0x48, 0x07, 0x82, 0x01, 0x04, 0x10, 0x01, 0x20, 0x00, 0x52, 0x03, 0x61, 0x6c, 0x67, 0x22,
+	0x3b, 0x0a, 0x0f, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x53,
+	0x65, 0x74, 0x12, 0x28, 0x0a, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
 	0x32, 0x14, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62,
-	0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x52, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65,
-	0x79, 0x12, 0x29, 0x0a, 0x03, 0x6b, 0x61, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17,
-	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x65, 0x79, 0x41, 0x63, 0x63, 0x65, 0x73,
-	0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x03, 0x6b, 0x61, 0x73, 0x12, 0x2c, 0x0a, 0x08,
-	0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10,
-	0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
-	0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x84, 0x01, 0x0a, 0x0c, 0x4b,
-	0x61, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x1c, 0x0a, 0x03, 0x70,
-	0x65, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xba, 0x48, 0x07, 0x72, 0x05, 0x10,
-	0x01, 0x18, 0x80, 0x40, 0x52, 0x03, 0x70, 0x65, 0x6d, 0x12, 0x1b, 0x0a, 0x03, 0x6b, 0x69, 0x64,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x09, 0xba, 0x48, 0x06, 0x72, 0x04, 0x10, 0x01, 0x18,
-	0x20, 0x52, 0x03, 0x6b, 0x69, 0x64, 0x12, 0x39, 0x0a, 0x03, 0x61, 0x6c, 0x67, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x0e, 0x32, 0x1b, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73,
-	0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x41, 0x6c, 0x67, 0x45, 0x6e, 0x75, 0x6d,
-	0x42, 0x0a, 0xba, 0x48, 0x07, 0x82, 0x01, 0x04, 0x10, 0x01, 0x20, 0x00, 0x52, 0x03, 0x61, 0x6c,
-	0x67, 0x22, 0x3b, 0x0a, 0x0f, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65,
-	0x79, 0x53, 0x65, 0x74, 0x12, 0x28, 0x0a, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x18, 0x01, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x14, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73, 0x50,
-	0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x52, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x22, 0xe0,
-	0x03, 0x0a, 0x09, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x84, 0x03, 0x0a,
-	0x06, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0xe9, 0x02,
-	0xba, 0x48, 0xe5, 0x02, 0xba, 0x01, 0xe1, 0x02, 0x0a, 0x0a, 0x75, 0x72, 0x69, 0x5f, 0x66, 0x6f,
-	0x72, 0x6d, 0x61, 0x74, 0x12, 0xcf, 0x01, 0x55, 0x52, 0x49, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20,
-	0x62, 0x65, 0x20, 0x61, 0x20, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x20, 0x55, 0x52, 0x4c, 0x20, 0x28,
-	0x65, 0x2e, 0x67, 0x2e, 0x2c, 0x20, 0x27, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x64,
-	0x65, 0x6d, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x27, 0x29, 0x20, 0x66, 0x6f, 0x6c, 0x6c, 0x6f,
-	0x77, 0x65, 0x64, 0x20, 0x62, 0x79, 0x20, 0x61, 0x64, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x61,
-	0x6c, 0x20, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x20, 0x45, 0x61, 0x63, 0x68,
-	0x20, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x73, 0x74,
-	0x61, 0x72, 0x74, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x65, 0x6e, 0x64, 0x20, 0x77, 0x69, 0x74, 0x68,
-	0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63,
-	0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2c, 0x20, 0x63, 0x61, 0x6e, 0x20,
-	0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x2c,
-	0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x63, 0x68,
-	0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x73, 0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x73, 0x6c,
-	0x61, 0x73, 0x68, 0x65, 0x73, 0x2e, 0x1a, 0x80, 0x01, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61,
-	0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f,
-	0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b, 0x61, 0x2d, 0x7a,
-	0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b, 0x30, 0x2c, 0x36, 0x31, 0x7d,
-	0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x28, 0x5c, 0x5c,
-	0x2e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b, 0x61, 0x2d,
-	0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b, 0x30, 0x2c, 0x36, 0x31,
-	0x7d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x29, 0x2a,
-	0x28, 0x2f, 0x2e, 0x2a, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x48, 0x00, 0x52, 0x06, 0x72, 0x65, 0x6d,
-	0x6f, 0x74, 0x65, 0x12, 0x31, 0x0a, 0x06, 0x63, 0x61, 0x63, 0x68, 0x65, 0x64, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73,
-	0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x53, 0x65, 0x74, 0x48, 0x00, 0x52, 0x06,
-	0x63, 0x61, 0x63, 0x68, 0x65, 0x64, 0x42, 0x0c, 0x0a, 0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63,
-	0x5f, 0x6b, 0x65, 0x79, 0x4a, 0x04, 0x08, 0x02, 0x10, 0x03, 0x52, 0x05, 0x6c, 0x6f, 0x63, 0x61,
-	0x6c, 0x2a, 0xb3, 0x01, 0x0a, 0x15, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x52,
-	0x75, 0x6c, 0x65, 0x54, 0x79, 0x70, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x12, 0x28, 0x0a, 0x24, 0x41,
-	0x54, 0x54, 0x52, 0x49, 0x42, 0x55, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54, 0x59,
-	0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46,
-	0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x23, 0x0a, 0x1f, 0x41, 0x54, 0x54, 0x52, 0x49, 0x42, 0x55,
-	0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55,
-	0x4d, 0x5f, 0x41, 0x4c, 0x4c, 0x5f, 0x4f, 0x46, 0x10, 0x01, 0x12, 0x23, 0x0a, 0x1f, 0x41, 0x54,
-	0x54, 0x52, 0x49, 0x42, 0x55, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54, 0x59, 0x50,
-	0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x41, 0x4e, 0x59, 0x5f, 0x4f, 0x46, 0x10, 0x02, 0x12,
-	0x26, 0x0a, 0x22, 0x41, 0x54, 0x54, 0x52, 0x49, 0x42, 0x55, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c,
-	0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x48, 0x49, 0x45, 0x52,
-	0x41, 0x52, 0x43, 0x48, 0x59, 0x10, 0x03, 0x2a, 0xca, 0x01, 0x0a, 0x1a, 0x53, 0x75, 0x62, 0x6a,
-	0x65, 0x63, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74,
-	0x6f, 0x72, 0x45, 0x6e, 0x75, 0x6d, 0x12, 0x2d, 0x0a, 0x29, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43,
-	0x54, 0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54,
-	0x4f, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46,
-	0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x24, 0x0a, 0x20, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43, 0x54,
-	0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x4f,
-	0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x49, 0x4e, 0x10, 0x01, 0x12, 0x28, 0x0a, 0x24, 0x53,
-	0x55, 0x42, 0x4a, 0x45, 0x43, 0x54, 0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f,
-	0x50, 0x45, 0x52, 0x41, 0x54, 0x4f, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x4e, 0x4f, 0x54,
-	0x5f, 0x49, 0x4e, 0x10, 0x02, 0x12, 0x2d, 0x0a, 0x29, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43, 0x54,
-	0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x4f,
-	0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x49, 0x4e, 0x5f, 0x43, 0x4f, 0x4e, 0x54, 0x41, 0x49,
-	0x4e, 0x53, 0x10, 0x03, 0x2a, 0x90, 0x01, 0x0a, 0x18, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69,
-	0x6f, 0x6e, 0x42, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x45, 0x6e, 0x75,
-	0x6d, 0x12, 0x2b, 0x0a, 0x27, 0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x42,
+	0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x52, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x22, 0xe0, 0x03, 0x0a,
+	0x09, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x84, 0x03, 0x0a, 0x06, 0x72,
+	0x65, 0x6d, 0x6f, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0xe9, 0x02, 0xba, 0x48,
+	0xe5, 0x02, 0xba, 0x01, 0xe1, 0x02, 0x0a, 0x0a, 0x75, 0x72, 0x69, 0x5f, 0x66, 0x6f, 0x72, 0x6d,
+	0x61, 0x74, 0x12, 0xcf, 0x01, 0x55, 0x52, 0x49, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65,
+	0x20, 0x61, 0x20, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x20, 0x55, 0x52, 0x4c, 0x20, 0x28, 0x65, 0x2e,
+	0x67, 0x2e, 0x2c, 0x20, 0x27, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x64, 0x65, 0x6d,
+	0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x27, 0x29, 0x20, 0x66, 0x6f, 0x6c, 0x6c, 0x6f, 0x77, 0x65,
+	0x64, 0x20, 0x62, 0x79, 0x20, 0x61, 0x64, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x20,
+	0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x20, 0x45, 0x61, 0x63, 0x68, 0x20, 0x73,
+	0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x73, 0x74, 0x61, 0x72,
+	0x74, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x65, 0x6e, 0x64, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x61,
+	0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x63,
+	0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2c, 0x20, 0x63, 0x61, 0x6e, 0x20, 0x63, 0x6f,
+	0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x2c, 0x20, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x63, 0x68, 0x61, 0x72,
+	0x61, 0x63, 0x74, 0x65, 0x72, 0x73, 0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x73, 0x6c, 0x61, 0x73,
+	0x68, 0x65, 0x73, 0x2e, 0x1a, 0x80, 0x01, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63,
+	0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x5b, 0x61,
+	0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d,
+	0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b, 0x30, 0x2c, 0x36, 0x31, 0x7d, 0x5b, 0x61,
+	0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x28, 0x5c, 0x5c, 0x2e, 0x5b,
+	0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b, 0x61, 0x2d, 0x7a, 0x41,
+	0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b, 0x30, 0x2c, 0x36, 0x31, 0x7d, 0x5b,
+	0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x29, 0x2a, 0x28, 0x2f,
+	0x2e, 0x2a, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x48, 0x00, 0x52, 0x06, 0x72, 0x65, 0x6d, 0x6f, 0x74,
+	0x65, 0x12, 0x31, 0x0a, 0x06, 0x63, 0x61, 0x63, 0x68, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x17, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73, 0x50, 0x75,
+	0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x53, 0x65, 0x74, 0x48, 0x00, 0x52, 0x06, 0x63, 0x61,
+	0x63, 0x68, 0x65, 0x64, 0x42, 0x0c, 0x0a, 0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b,
+	0x65, 0x79, 0x4a, 0x04, 0x08, 0x02, 0x10, 0x03, 0x52, 0x05, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x2a,
+	0xb3, 0x01, 0x0a, 0x15, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x52, 0x75, 0x6c,
+	0x65, 0x54, 0x79, 0x70, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x12, 0x28, 0x0a, 0x24, 0x41, 0x54, 0x54,
+	0x52, 0x49, 0x42, 0x55, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45,
+	0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45,
+	0x44, 0x10, 0x00, 0x12, 0x23, 0x0a, 0x1f, 0x41, 0x54, 0x54, 0x52, 0x49, 0x42, 0x55, 0x54, 0x45,
+	0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f,
+	0x41, 0x4c, 0x4c, 0x5f, 0x4f, 0x46, 0x10, 0x01, 0x12, 0x23, 0x0a, 0x1f, 0x41, 0x54, 0x54, 0x52,
+	0x49, 0x42, 0x55, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f,
+	0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x41, 0x4e, 0x59, 0x5f, 0x4f, 0x46, 0x10, 0x02, 0x12, 0x26, 0x0a,
+	0x22, 0x41, 0x54, 0x54, 0x52, 0x49, 0x42, 0x55, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f,
+	0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x48, 0x49, 0x45, 0x52, 0x41, 0x52,
+	0x43, 0x48, 0x59, 0x10, 0x03, 0x2a, 0xca, 0x01, 0x0a, 0x1a, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63,
+	0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72,
+	0x45, 0x6e, 0x75, 0x6d, 0x12, 0x2d, 0x0a, 0x29, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43, 0x54, 0x5f,
+	0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x4f, 0x52,
+	0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45,
+	0x44, 0x10, 0x00, 0x12, 0x24, 0x0a, 0x20, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43, 0x54, 0x5f, 0x4d,
+	0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x4f, 0x52, 0x5f,
+	0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x49, 0x4e, 0x10, 0x01, 0x12, 0x28, 0x0a, 0x24, 0x53, 0x55, 0x42,
+	0x4a, 0x45, 0x43, 0x54, 0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45,
+	0x52, 0x41, 0x54, 0x4f, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x4e, 0x4f, 0x54, 0x5f, 0x49,
+	0x4e, 0x10, 0x02, 0x12, 0x2d, 0x0a, 0x29, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43, 0x54, 0x5f, 0x4d,
+	0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x4f, 0x52, 0x5f,
+	0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x49, 0x4e, 0x5f, 0x43, 0x4f, 0x4e, 0x54, 0x41, 0x49, 0x4e, 0x53,
+	0x10, 0x03, 0x2a, 0x90, 0x01, 0x0a, 0x18, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e,
+	0x42, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x12,
+	0x2b, 0x0a, 0x27, 0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x42, 0x4f, 0x4f,
+	0x4c, 0x45, 0x41, 0x4e, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55,
+	0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x23, 0x0a, 0x1f,
+	0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x42, 0x4f, 0x4f, 0x4c, 0x45, 0x41,
+	0x4e, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x41, 0x4e, 0x44, 0x10,
+	0x01, 0x12, 0x22, 0x0a, 0x1e, 0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x42,
 	0x4f, 0x4f, 0x4c, 0x45, 0x41, 0x4e, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d,
-	0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x23,
-	0x0a, 0x1f, 0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x42, 0x4f, 0x4f, 0x4c,
-	0x45, 0x41, 0x4e, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x41, 0x4e,
-	0x44, 0x10, 0x01, 0x12, 0x22, 0x0a, 0x1e, 0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e,
-	0x5f, 0x42, 0x4f, 0x4f, 0x4c, 0x45, 0x41, 0x4e, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e,
-	0x55, 0x4d, 0x5f, 0x4f, 0x52, 0x10, 0x02, 0x2a, 0x88, 0x02, 0x0a, 0x13, 0x4b, 0x61, 0x73, 0x50,
-	0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x41, 0x6c, 0x67, 0x45, 0x6e, 0x75, 0x6d, 0x12,
-	0x27, 0x0a, 0x23, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45,
-	0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45,
-	0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x24, 0x0a, 0x20, 0x4b, 0x41, 0x53, 0x5f,
-	0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45,
-	0x4e, 0x55, 0x4d, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x32, 0x30, 0x34, 0x38, 0x10, 0x01, 0x12, 0x24,
-	0x0a, 0x20, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59,
-	0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x34, 0x30,
-	0x39, 0x36, 0x10, 0x02, 0x12, 0x28, 0x0a, 0x24, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c,
-	0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f,
-	0x45, 0x43, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x32, 0x35, 0x36, 0x52, 0x31, 0x10, 0x05, 0x12, 0x28,
-	0x0a, 0x24, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59,
-	0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x45, 0x43, 0x5f, 0x53, 0x45, 0x43,
-	0x50, 0x33, 0x38, 0x34, 0x52, 0x31, 0x10, 0x06, 0x12, 0x28, 0x0a, 0x24, 0x4b, 0x41, 0x53, 0x5f,
-	0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45,
-	0x4e, 0x55, 0x4d, 0x5f, 0x45, 0x43, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x35, 0x32, 0x31, 0x52, 0x31,
-	0x10, 0x07, 0x42, 0x82, 0x01, 0x0a, 0x0a, 0x63, 0x6f, 0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63,
-	0x79, 0x42, 0x0c, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50,
-	0x01, 0x5a, 0x2e, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70,
-	0x65, 0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63,
-	0x79, 0xa2, 0x02, 0x03, 0x50, 0x58, 0x58, 0xaa, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0xca, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xe2, 0x02, 0x12, 0x50, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02,
-	0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x5f, 0x4f, 0x52, 0x10, 0x02, 0x2a, 0x88, 0x02, 0x0a, 0x13, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62,
+	0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x41, 0x6c, 0x67, 0x45, 0x6e, 0x75, 0x6d, 0x12, 0x27, 0x0a,
+	0x23, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f,
+	0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49,
+	0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x24, 0x0a, 0x20, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55,
+	0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55,
+	0x4d, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x32, 0x30, 0x34, 0x38, 0x10, 0x01, 0x12, 0x24, 0x0a, 0x20,
+	0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41,
+	0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x34, 0x30, 0x39, 0x36,
+	0x10, 0x02, 0x12, 0x28, 0x0a, 0x24, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43,
+	0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x45, 0x43,
+	0x5f, 0x53, 0x45, 0x43, 0x50, 0x32, 0x35, 0x36, 0x52, 0x31, 0x10, 0x05, 0x12, 0x28, 0x0a, 0x24,
+	0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41,
+	0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x45, 0x43, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x33,
+	0x38, 0x34, 0x52, 0x31, 0x10, 0x06, 0x12, 0x28, 0x0a, 0x24, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55,
+	0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55,
+	0x4d, 0x5f, 0x45, 0x43, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x35, 0x32, 0x31, 0x52, 0x31, 0x10, 0x07,
+	0x42, 0x82, 0x01, 0x0a, 0x0a, 0x63, 0x6f, 0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x42,
+	0x0c, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a,
+	0x2e, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65, 0x6e,
+	0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xa2,
+	0x02, 0x03, 0x50, 0x58, 0x58, 0xaa, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xca, 0x02,
+	0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xe2, 0x02, 0x12, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x06, 0x50,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -2039,35 +2056,36 @@ var file_policy_objects_proto_depIdxs = []int32{
 	18, // 15: policy.Value.keys:type_name -> policy.Key
 	23, // 16: policy.Value.metadata:type_name -> common.Metadata
 	4,  // 17: policy.Action.standard:type_name -> policy.Action.StandardAction
-	7,  // 18: policy.SubjectMapping.attribute_value:type_name -> policy.Value
-	13, // 19: policy.SubjectMapping.subject_condition_set:type_name -> policy.SubjectConditionSet
-	8,  // 20: policy.SubjectMapping.actions:type_name -> policy.Action
-	23, // 21: policy.SubjectMapping.metadata:type_name -> common.Metadata
-	1,  // 22: policy.Condition.operator:type_name -> policy.SubjectMappingOperatorEnum
-	10, // 23: policy.ConditionGroup.conditions:type_name -> policy.Condition
-	2,  // 24: policy.ConditionGroup.boolean_operator:type_name -> policy.ConditionBooleanTypeEnum
-	11, // 25: policy.SubjectSet.condition_groups:type_name -> policy.ConditionGroup
-	12, // 26: policy.SubjectConditionSet.subject_sets:type_name -> policy.SubjectSet
-	23, // 27: policy.SubjectConditionSet.metadata:type_name -> common.Metadata
-	23, // 28: policy.ResourceMappingGroup.metadata:type_name -> common.Metadata
-	23, // 29: policy.ResourceMapping.metadata:type_name -> common.Metadata
-	7,  // 30: policy.ResourceMapping.attribute_value:type_name -> policy.Value
-	15, // 31: policy.ResourceMapping.group:type_name -> policy.ResourceMappingGroup
-	21, // 32: policy.KeyAccessServer.public_key:type_name -> policy.PublicKey
-	23, // 33: policy.KeyAccessServer.metadata:type_name -> common.Metadata
-	22, // 34: policy.Key.is_active:type_name -> google.protobuf.BoolValue
-	22, // 35: policy.Key.was_mapped:type_name -> google.protobuf.BoolValue
-	19, // 36: policy.Key.public_key:type_name -> policy.KasPublicKey
-	17, // 37: policy.Key.kas:type_name -> policy.KeyAccessServer
-	23, // 38: policy.Key.metadata:type_name -> common.Metadata
-	3,  // 39: policy.KasPublicKey.alg:type_name -> policy.KasPublicKeyAlgEnum
-	19, // 40: policy.KasPublicKeySet.keys:type_name -> policy.KasPublicKey
-	20, // 41: policy.PublicKey.cached:type_name -> policy.KasPublicKeySet
-	42, // [42:42] is the sub-list for method output_type
-	42, // [42:42] is the sub-list for method input_type
-	42, // [42:42] is the sub-list for extension type_name
-	42, // [42:42] is the sub-list for extension extendee
-	0,  // [0:42] is the sub-list for field type_name
+	23, // 18: policy.Action.metadata:type_name -> common.Metadata
+	7,  // 19: policy.SubjectMapping.attribute_value:type_name -> policy.Value
+	13, // 20: policy.SubjectMapping.subject_condition_set:type_name -> policy.SubjectConditionSet
+	8,  // 21: policy.SubjectMapping.actions:type_name -> policy.Action
+	23, // 22: policy.SubjectMapping.metadata:type_name -> common.Metadata
+	1,  // 23: policy.Condition.operator:type_name -> policy.SubjectMappingOperatorEnum
+	10, // 24: policy.ConditionGroup.conditions:type_name -> policy.Condition
+	2,  // 25: policy.ConditionGroup.boolean_operator:type_name -> policy.ConditionBooleanTypeEnum
+	11, // 26: policy.SubjectSet.condition_groups:type_name -> policy.ConditionGroup
+	12, // 27: policy.SubjectConditionSet.subject_sets:type_name -> policy.SubjectSet
+	23, // 28: policy.SubjectConditionSet.metadata:type_name -> common.Metadata
+	23, // 29: policy.ResourceMappingGroup.metadata:type_name -> common.Metadata
+	23, // 30: policy.ResourceMapping.metadata:type_name -> common.Metadata
+	7,  // 31: policy.ResourceMapping.attribute_value:type_name -> policy.Value
+	15, // 32: policy.ResourceMapping.group:type_name -> policy.ResourceMappingGroup
+	21, // 33: policy.KeyAccessServer.public_key:type_name -> policy.PublicKey
+	23, // 34: policy.KeyAccessServer.metadata:type_name -> common.Metadata
+	22, // 35: policy.Key.is_active:type_name -> google.protobuf.BoolValue
+	22, // 36: policy.Key.was_mapped:type_name -> google.protobuf.BoolValue
+	19, // 37: policy.Key.public_key:type_name -> policy.KasPublicKey
+	17, // 38: policy.Key.kas:type_name -> policy.KeyAccessServer
+	23, // 39: policy.Key.metadata:type_name -> common.Metadata
+	3,  // 40: policy.KasPublicKey.alg:type_name -> policy.KasPublicKeyAlgEnum
+	19, // 41: policy.KasPublicKeySet.keys:type_name -> policy.KasPublicKey
+	20, // 42: policy.PublicKey.cached:type_name -> policy.KasPublicKeySet
+	43, // [43:43] is the sub-list for method output_type
+	43, // [43:43] is the sub-list for method input_type
+	43, // [43:43] is the sub-list for extension type_name
+	43, // [43:43] is the sub-list for extension extendee
+	0,  // [0:43] is the sub-list for field type_name
 }
 
 func init() { file_policy_objects_proto_init() }
diff --git a/service/policy/actions/actions.proto b/service/policy/actions/actions.proto
new file mode 100644
index 0000000000..3777d6363f
--- /dev/null
+++ b/service/policy/actions/actions.proto
@@ -0,0 +1,116 @@
+syntax = "proto3";
+
+package policy.actions;
+
+import "buf/validate/validate.proto";
+import "common/common.proto";
+import "policy/objects.proto";
+import "policy/selectors.proto";
+
+/*
+   Actions CRUD Operations
+*/
+
+message GetActionRequest {
+  // Required
+  oneof identifier {
+    option (buf.validate.oneof).required = true;
+    string id = 1 [(buf.validate.field).string.uuid = true];
+    string name = 2 [
+      (buf.validate.field).string.min_len = 1,
+      (buf.validate.field).string.max_len = 253,
+      (buf.validate.field).cel = {
+        id: "action_name_format"
+        message:
+          "Action name must be an alphanumeric string, "
+          "allowing hyphens and underscores but not as the "
+          "first or last character. The stored action name "
+          "is normalized to lower case."
+        expression: "this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$')"
+      }
+    ];
+  }
+}
+message GetActionResponse {
+  policy.Action action = 1;
+}
+
+message ListActionsRequest {
+  // Optional
+  policy.PageRequest pagination = 10;
+}
+message ListActionsResponse {
+  repeated policy.Action actions = 1;
+  policy.PageResponse pagination = 10;
+}
+
+// Create a new custom action name with optional metadata.
+message CreateCustomActionRequest {
+  // Required
+  string name = 1 [
+    (buf.validate.field).string.min_len = 1,
+    (buf.validate.field).string.max_len = 253,
+    (buf.validate.field).cel = {
+      id: "action_name_format"
+      message:
+        "Action name must be an alphanumeric string, "
+        "allowing hyphens and underscores but not as the "
+        "first or last character. The stored action name "
+        "is normalized to lower case."
+      expression: "this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$')"
+    }
+  ];
+
+  // Optional
+  common.MetadataMutable metadata = 100;
+}
+message CreateCustomActionResponse {
+  policy.Action action = 1;
+}
+
+// Names may only be updated for custom actions.
+// Metadata may be updated for either custom or standard actions.
+message UpdateActionRequest {
+  // Required
+  string id = 1 [(buf.validate.field).string.uuid = true];
+
+  // Optional
+  // Custom actions only: replaces the existing action name
+  string name = 2 [
+    (buf.validate.field).string.min_len = 1,
+    (buf.validate.field).string.max_len = 253,
+    (buf.validate.field).cel = {
+      id: "action_name_format"
+      message:
+        "Action name must be an alphanumeric string, "
+        "allowing hyphens and underscores but not as the "
+        "first or last character. The stored action name "
+        "is normalized to lower case."
+      expression: "this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$')"
+    }
+  ];
+
+  // Common metadata
+  common.MetadataMutable metadata = 100;
+  common.MetadataUpdateEnum metadata_update_behavior = 101;
+}
+message UpdateActionResponse {
+  policy.Action action = 1;
+}
+
+// Deletion of standard actions is not supported.
+message DeleteCustomActionRequest {
+  // Required
+  string id = 1 [(buf.validate.field).string.uuid = true];
+}
+message DeleteCustomActionResponse {
+  policy.Action action = 1;
+}
+
+service ActionService {
+  rpc GetAction(GetActionRequest) returns (GetActionResponse) {}
+  rpc ListActions(ListActionsRequest) returns (ListActionsResponse) {}
+  rpc CreateCustomAction(CreateCustomActionRequest) returns (CreateCustomActionResponse) {}
+  rpc UpdateAction(UpdateActionRequest) returns (UpdateActionResponse) {}
+  rpc DeleteCustomAction(DeleteCustomActionRequest) returns (DeleteCustomActionResponse) {}
+}
diff --git a/service/policy/objects.proto b/service/policy/objects.proto
index 593e4c228d..941e0cb21a 100644
--- a/service/policy/objects.proto
+++ b/service/policy/objects.proto
@@ -59,8 +59,6 @@ message Attribute {
   common.Metadata metadata = 100;
 }
 
-// buflint ENUM_VALUE_PREFIX: to make sure that C++ scoping rules aren't
-// violated when users add new enum values to an enum in a given package
 enum AttributeRuleTypeEnum {
   ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED = 0;
   ATTRIBUTE_RULE_TYPE_ENUM_ALL_OF = 1;
@@ -103,13 +101,28 @@ message Action {
   // Standard actions supported by the platform
   enum StandardAction {
     STANDARD_ACTION_UNSPECIFIED = 0;
-    STANDARD_ACTION_DECRYPT = 1;
-    STANDARD_ACTION_TRANSMIT = 2;
+
+    // Deprecated STANDARD_ACTION_DECRYPT
+    // Migrated to `STANDARD_ACTION_READ`
+    reserved 1;
+
+    // Deprecated STANDARD_ACTION_TRANSMIT
+    // Migrated to `STANDARD_ACTION_CREATE`
+    reserved 2;
+
+    STANDARD_ACTION_CREATE = 3;
+    STANDARD_ACTION_READ = 4;
+    STANDARD_ACTION_UPDATE = 5;
+    STANDARD_ACTION_DELETE = 6;
   }
   oneof value {
+    // standard CRUD action
     StandardAction standard = 1;
+    // distinctly custom action
     string custom = 2;
   }
+
+  common.Metadata metadata = 100;
 }
 
 /*
@@ -117,8 +130,6 @@ message Action {
    supporting the mapping of Subjects and Attributes (e.g. Entitlement)
 */
 
-// buflint ENUM_VALUE_PREFIX: to make sure that C++ scoping rules aren't
-// violated when users add new enum values to an enum in a given package
 enum SubjectMappingOperatorEnum {
   SUBJECT_MAPPING_OPERATOR_ENUM_UNSPECIFIED = 0;
   // operator that returns true if a value in a list matches the string
@@ -130,8 +141,6 @@ enum SubjectMappingOperatorEnum {
   SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS = 3;
 }
 
-// buflint ENUM_VALUE_PREFIX: to make sure that C++ scoping rules aren't
-// violated when users add new enum values to an enum in a given package
 enum ConditionBooleanTypeEnum {
   CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED = 0;
   CONDITION_BOOLEAN_TYPE_ENUM_AND = 1;

From 05334f24bfe0e4e7f7d03867a69761ccd1c14a58 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 31 Mar 2025 14:50:53 -0700
Subject: [PATCH 002/110] reserve field names as well

---
 protocol/go/policy/objects.pb.go | 465 ++++++++++++++++---------------
 service/policy/objects.proto     | 106 ++++---
 2 files changed, 285 insertions(+), 286 deletions(-)

diff --git a/protocol/go/policy/objects.pb.go b/protocol/go/policy/objects.pb.go
index c1be1be035..397d386a9f 100644
--- a/protocol/go/policy/objects.pb.go
+++ b/protocol/go/policy/objects.pb.go
@@ -1733,7 +1733,7 @@ var file_policy_objects_proto_rawDesc = []byte{
 	0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e,
 	0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
 	0x74, 0x61, 0x4a, 0x04, 0x08, 0x04, 0x10, 0x05, 0x52, 0x07, 0x6d, 0x65, 0x6d, 0x62, 0x65, 0x72,
-	0x73, 0x22, 0xc4, 0x02, 0x0a, 0x06, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x3b, 0x0a, 0x08,
+	0x73, 0x22, 0xf7, 0x02, 0x0a, 0x06, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x3b, 0x0a, 0x08,
 	0x73, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1d,
 	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x53,
 	0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x48, 0x00, 0x52,
@@ -1742,7 +1742,7 @@ var file_policy_objects_proto_rawDesc = []byte{
 	0x74, 0x6f, 0x6d, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18,
 	0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d,
 	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x22, 0xab, 0x01, 0x0a, 0x0e, 0x53, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x41, 0x63,
+	0x61, 0x22, 0xde, 0x01, 0x0a, 0x0e, 0x53, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x41, 0x63,
 	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1f, 0x0a, 0x1b, 0x53, 0x54, 0x41, 0x4e, 0x44, 0x41, 0x52, 0x44,
 	0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46,
 	0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x1a, 0x0a, 0x16, 0x53, 0x54, 0x41, 0x4e, 0x44, 0x41, 0x52,
@@ -1752,100 +1752,166 @@ var file_policy_objects_proto_rawDesc = []byte{
 	0x54, 0x41, 0x4e, 0x44, 0x41, 0x52, 0x44, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55,
 	0x50, 0x44, 0x41, 0x54, 0x45, 0x10, 0x05, 0x12, 0x1a, 0x0a, 0x16, 0x53, 0x54, 0x41, 0x4e, 0x44,
 	0x41, 0x52, 0x44, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x44, 0x45, 0x4c, 0x45, 0x54,
-	0x45, 0x10, 0x06, 0x22, 0x04, 0x08, 0x01, 0x10, 0x01, 0x22, 0x04, 0x08, 0x02, 0x10, 0x02, 0x42,
-	0x07, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x81, 0x02, 0x0a, 0x0e, 0x53, 0x75, 0x62,
-	0x6a, 0x65, 0x63, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x0e, 0x0a, 0x02, 0x69,
-	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x36, 0x0a, 0x0f, 0x61,
-	0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x56, 0x61,
-	0x6c, 0x75, 0x65, 0x52, 0x0e, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x56, 0x61,
-	0x6c, 0x75, 0x65, 0x12, 0x4f, 0x0a, 0x15, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x63,
-	0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x73, 0x65, 0x74, 0x18, 0x03, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a,
-	0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x74, 0x52,
-	0x13, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f,
-	0x6e, 0x53, 0x65, 0x74, 0x12, 0x28, 0x0a, 0x07, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18,
-	0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x07, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x2c,
-	0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0xe9, 0x01, 0x0a,
-	0x09, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x4d, 0x0a, 0x1f, 0x73, 0x75,
-	0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x73,
-	0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x1c, 0x73, 0x75, 0x62,
-	0x6a, 0x65, 0x63, 0x74, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x53, 0x65, 0x6c, 0x65,
-	0x63, 0x74, 0x6f, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x4b, 0x0a, 0x08, 0x6f, 0x70, 0x65,
-	0x72, 0x61, 0x74, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x22, 0x2e, 0x70, 0x6f,
-	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4d, 0x61, 0x70, 0x70,
-	0x69, 0x6e, 0x67, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x45, 0x6e, 0x75, 0x6d, 0x42,
-	0x0b, 0xba, 0x48, 0x08, 0xc8, 0x01, 0x01, 0x82, 0x01, 0x02, 0x10, 0x01, 0x52, 0x08, 0x6f, 0x70,
-	0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x12, 0x40, 0x0a, 0x17, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63,
-	0x74, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08,
-	0x01, 0x52, 0x15, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e,
-	0x61, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x22, 0xa7, 0x01, 0x0a, 0x0e, 0x43, 0x6f, 0x6e,
-	0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x3b, 0x0a, 0x0a, 0x63,
-	0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x11, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69,
-	0x6f, 0x6e, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x0a, 0x63, 0x6f,
-	0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x58, 0x0a, 0x10, 0x62, 0x6f, 0x6f, 0x6c,
-	0x65, 0x61, 0x6e, 0x5f, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x0e, 0x32, 0x20, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x43, 0x6f, 0x6e, 0x64,
-	0x69, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x54, 0x79, 0x70, 0x65,
-	0x45, 0x6e, 0x75, 0x6d, 0x42, 0x0b, 0xba, 0x48, 0x08, 0xc8, 0x01, 0x01, 0x82, 0x01, 0x02, 0x10,
-	0x01, 0x52, 0x0f, 0x62, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74,
-	0x6f, 0x72, 0x22, 0x59, 0x0a, 0x0a, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x53, 0x65, 0x74,
-	0x12, 0x4b, 0x0a, 0x10, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x67, 0x72,
-	0x6f, 0x75, 0x70, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x70, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f,
-	0x75, 0x70, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x0f, 0x63, 0x6f,
-	0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x22, 0x94, 0x01,
-	0x0a, 0x13, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69,
-	0x6f, 0x6e, 0x53, 0x65, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x3f, 0x0a, 0x0c, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74,
-	0x5f, 0x73, 0x65, 0x74, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x70, 0x6f,
-	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x53, 0x65, 0x74, 0x42,
-	0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x0b, 0x73, 0x75, 0x62, 0x6a, 0x65,
-	0x63, 0x74, 0x53, 0x65, 0x74, 0x73, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f,
-	0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61,
-	0x64, 0x61, 0x74, 0x61, 0x22, 0x7c, 0x0a, 0x0f, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x50,
-	0x72, 0x6f, 0x70, 0x65, 0x72, 0x74, 0x79, 0x12, 0x42, 0x0a, 0x17, 0x65, 0x78, 0x74, 0x65, 0x72,
-	0x6e, 0x61, 0x6c, 0x5f, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x76, 0x61, 0x6c,
-	0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xba, 0x48, 0x07, 0xc8, 0x01, 0x01,
-	0x72, 0x02, 0x10, 0x01, 0x52, 0x15, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x53, 0x65,
-	0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x25, 0x0a, 0x0e, 0x65,
-	0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x0d, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x56, 0x61, 0x6c,
-	0x75, 0x65, 0x22, 0x9b, 0x01, 0x0a, 0x14, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d,
-	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x0e, 0x0a, 0x02, 0x69,
-	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x29, 0x0a, 0x0c, 0x6e,
-	0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x09, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x73,
-	0x70, 0x61, 0x63, 0x65, 0x49, 0x64, 0x12, 0x1a, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x09, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x04, 0x6e, 0x61,
-	0x6d, 0x65, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65,
-	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
-	0x22, 0xd9, 0x01, 0x0a, 0x0f, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x61, 0x70,
-	0x70, 0x69, 0x6e, 0x67, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x02, 0x69, 0x64, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e,
-	0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x12, 0x3e, 0x0a, 0x0f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f,
-	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x70, 0x6f,
-	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8,
-	0x01, 0x01, 0x52, 0x0e, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x56, 0x61, 0x6c,
-	0x75, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x65, 0x72, 0x6d, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28,
-	0x09, 0x52, 0x05, 0x74, 0x65, 0x72, 0x6d, 0x73, 0x12, 0x32, 0x0a, 0x05, 0x67, 0x72, 0x6f, 0x75,
-	0x70, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67,
-	0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x05, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x22, 0x9f, 0x04, 0x0a,
-	0x0f, 0x4b, 0x65, 0x79, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
-	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64,
-	0x12, 0x87, 0x03, 0x0a, 0x03, 0x75, 0x72, 0x69, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0xf4,
-	0x02, 0xba, 0x48, 0xf0, 0x02, 0xba, 0x01, 0xec, 0x02, 0x0a, 0x0a, 0x75, 0x72, 0x69, 0x5f, 0x66,
+	0x45, 0x10, 0x06, 0x22, 0x04, 0x08, 0x01, 0x10, 0x01, 0x22, 0x04, 0x08, 0x02, 0x10, 0x02, 0x2a,
+	0x17, 0x53, 0x54, 0x41, 0x4e, 0x44, 0x41, 0x52, 0x44, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e,
+	0x5f, 0x44, 0x45, 0x43, 0x52, 0x59, 0x50, 0x54, 0x2a, 0x18, 0x53, 0x54, 0x41, 0x4e, 0x44, 0x41,
+	0x52, 0x44, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x54, 0x52, 0x41, 0x4e, 0x53, 0x4d,
+	0x49, 0x54, 0x42, 0x07, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x81, 0x02, 0x0a, 0x0e,
+	0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x0e,
+	0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x36,
+	0x0a, 0x0f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x2e, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0e, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74,
+	0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x4f, 0x0a, 0x15, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63,
+	0x74, 0x5f, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x73, 0x65, 0x74, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53,
+	0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x53,
+	0x65, 0x74, 0x52, 0x13, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64, 0x69,
+	0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x74, 0x12, 0x28, 0x0a, 0x07, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63,
+	0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x07, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22,
+	0xe9, 0x01, 0x0a, 0x09, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x4d, 0x0a,
+	0x1f, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61,
+	0x6c, 0x5f, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x1c,
+	0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x53,
+	0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x4b, 0x0a, 0x08,
+	0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x22,
+	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4d,
+	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x45, 0x6e,
+	0x75, 0x6d, 0x42, 0x0b, 0xba, 0x48, 0x08, 0xc8, 0x01, 0x01, 0x82, 0x01, 0x02, 0x10, 0x01, 0x52,
+	0x08, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x12, 0x40, 0x0a, 0x17, 0x73, 0x75, 0x62,
+	0x6a, 0x65, 0x63, 0x74, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x76, 0x61,
+	0x6c, 0x75, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92,
+	0x01, 0x02, 0x08, 0x01, 0x52, 0x15, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x45, 0x78, 0x74,
+	0x65, 0x72, 0x6e, 0x61, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x22, 0xa7, 0x01, 0x0a, 0x0e,
+	0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x3b,
+	0x0a, 0x0a, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x11, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x43, 0x6f, 0x6e, 0x64,
+	0x69, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52,
+	0x0a, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x58, 0x0a, 0x10, 0x62,
+	0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x5f, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x20, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x43,
+	0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x54,
+	0x79, 0x70, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x42, 0x0b, 0xba, 0x48, 0x08, 0xc8, 0x01, 0x01, 0x82,
+	0x01, 0x02, 0x10, 0x01, 0x52, 0x0f, 0x62, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x4f, 0x70, 0x65,
+	0x72, 0x61, 0x74, 0x6f, 0x72, 0x22, 0x59, 0x0a, 0x0a, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74,
+	0x53, 0x65, 0x74, 0x12, 0x4b, 0x0a, 0x10, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e,
+	0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e,
+	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e,
+	0x47, 0x72, 0x6f, 0x75, 0x70, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52,
+	0x0f, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73,
+	0x22, 0x94, 0x01, 0x0a, 0x13, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64,
+	0x69, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x3f, 0x0a, 0x0c, 0x73, 0x75, 0x62, 0x6a,
+	0x65, 0x63, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x12,
+	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x53,
+	0x65, 0x74, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x0b, 0x73, 0x75,
+	0x62, 0x6a, 0x65, 0x63, 0x74, 0x53, 0x65, 0x74, 0x73, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f,
+	0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x7c, 0x0a, 0x0f, 0x53, 0x75, 0x62, 0x6a, 0x65,
+	0x63, 0x74, 0x50, 0x72, 0x6f, 0x70, 0x65, 0x72, 0x74, 0x79, 0x12, 0x42, 0x0a, 0x17, 0x65, 0x78,
+	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xba, 0x48, 0x07,
+	0xc8, 0x01, 0x01, 0x72, 0x02, 0x10, 0x01, 0x52, 0x15, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61,
+	0x6c, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x25,
+	0x0a, 0x0e, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c,
+	0x56, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x9b, 0x01, 0x0a, 0x14, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x0e,
+	0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x29,
+	0x0a, 0x0c, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x0b, 0x6e, 0x61,
+	0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x49, 0x64, 0x12, 0x1a, 0x0a, 0x04, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e,
+	0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x22, 0xd9, 0x01, 0x0a, 0x0f, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d,
+	0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x3e, 0x0a, 0x0f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75,
+	0x74, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d,
+	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x06, 0xba,
+	0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x0e, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65,
+	0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x65, 0x72, 0x6d, 0x73, 0x18, 0x04,
+	0x20, 0x03, 0x28, 0x09, 0x52, 0x05, 0x74, 0x65, 0x72, 0x6d, 0x73, 0x12, 0x32, 0x0a, 0x05, 0x67,
+	0x72, 0x6f, 0x75, 0x70, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x70, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x61, 0x70, 0x70,
+	0x69, 0x6e, 0x67, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x05, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x22,
+	0x9f, 0x04, 0x0a, 0x0f, 0x4b, 0x65, 0x79, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x53, 0x65, 0x72,
+	0x76, 0x65, 0x72, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x02, 0x69, 0x64, 0x12, 0x87, 0x03, 0x0a, 0x03, 0x75, 0x72, 0x69, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x42, 0xf4, 0x02, 0xba, 0x48, 0xf0, 0x02, 0xba, 0x01, 0xec, 0x02, 0x0a, 0x0a, 0x75, 0x72,
+	0x69, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0xcf, 0x01, 0x55, 0x52, 0x49, 0x20, 0x6d,
+	0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x61, 0x20, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x20, 0x55,
+	0x52, 0x4c, 0x20, 0x28, 0x65, 0x2e, 0x67, 0x2e, 0x2c, 0x20, 0x27, 0x68, 0x74, 0x74, 0x70, 0x73,
+	0x3a, 0x2f, 0x2f, 0x64, 0x65, 0x6d, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x27, 0x29, 0x20, 0x66,
+	0x6f, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x20, 0x62, 0x79, 0x20, 0x61, 0x64, 0x64, 0x69, 0x74,
+	0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x20, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x20,
+	0x45, 0x61, 0x63, 0x68, 0x20, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x20, 0x6d, 0x75, 0x73,
+	0x74, 0x20, 0x73, 0x74, 0x61, 0x72, 0x74, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x65, 0x6e, 0x64, 0x20,
+	0x77, 0x69, 0x74, 0x68, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d,
+	0x65, 0x72, 0x69, 0x63, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2c, 0x20,
+	0x63, 0x61, 0x6e, 0x20, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20, 0x68, 0x79, 0x70, 0x68,
+	0x65, 0x6e, 0x73, 0x2c, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69,
+	0x63, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x73, 0x2c, 0x20, 0x61, 0x6e,
+	0x64, 0x20, 0x73, 0x6c, 0x61, 0x73, 0x68, 0x65, 0x73, 0x2e, 0x1a, 0x8b, 0x01, 0x74, 0x68, 0x69,
+	0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x68, 0x74, 0x74, 0x70,
+	0x73, 0x3f, 0x3a, 0x2f, 0x2f, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d,
+	0x28, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b,
+	0x30, 0x2c, 0x36, 0x31, 0x7d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d,
+	0x29, 0x3f, 0x28, 0x5c, 0x5c, 0x2e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39,
+	0x5d, 0x28, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d,
+	0x7b, 0x30, 0x2c, 0x36, 0x31, 0x7d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39,
+	0x5d, 0x29, 0x3f, 0x29, 0x2a, 0x28, 0x3a, 0x5b, 0x30, 0x2d, 0x39, 0x5d, 0x2b, 0x29, 0x3f, 0x28,
+	0x2f, 0x2e, 0x2a, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x52, 0x03, 0x75, 0x72, 0x69, 0x12, 0x30, 0x0a,
+	0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x11, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x75, 0x62, 0x6c, 0x69,
+	0x63, 0x4b, 0x65, 0x79, 0x52, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12,
+	0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e,
+	0x61, 0x6d, 0x65, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18,
+	0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0x22, 0x97, 0x02, 0x0a, 0x03, 0x4b, 0x65, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x37, 0x0a, 0x09, 0x69, 0x73, 0x5f,
+	0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42,
+	0x6f, 0x6f, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x08, 0x69, 0x73, 0x41, 0x63, 0x74, 0x69,
+	0x76, 0x65, 0x12, 0x39, 0x0a, 0x0a, 0x77, 0x61, 0x73, 0x5f, 0x6d, 0x61, 0x70, 0x70, 0x65, 0x64,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42, 0x6f, 0x6f, 0x6c, 0x56, 0x61, 0x6c,
+	0x75, 0x65, 0x52, 0x09, 0x77, 0x61, 0x73, 0x4d, 0x61, 0x70, 0x70, 0x65, 0x64, 0x12, 0x33, 0x0a,
+	0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x14, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73, 0x50, 0x75,
+	0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x52, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b,
+	0x65, 0x79, 0x12, 0x29, 0x0a, 0x03, 0x6b, 0x61, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x17, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x65, 0x79, 0x41, 0x63, 0x63, 0x65,
+	0x73, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x03, 0x6b, 0x61, 0x73, 0x12, 0x2c, 0x0a,
+	0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x84, 0x01, 0x0a, 0x0c,
+	0x4b, 0x61, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x1c, 0x0a, 0x03,
+	0x70, 0x65, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xba, 0x48, 0x07, 0x72, 0x05,
+	0x10, 0x01, 0x18, 0x80, 0x40, 0x52, 0x03, 0x70, 0x65, 0x6d, 0x12, 0x1b, 0x0a, 0x03, 0x6b, 0x69,
+	0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x09, 0xba, 0x48, 0x06, 0x72, 0x04, 0x10, 0x01,
+	0x18, 0x20, 0x52, 0x03, 0x6b, 0x69, 0x64, 0x12, 0x39, 0x0a, 0x03, 0x61, 0x6c, 0x67, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0e, 0x32, 0x1b, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61,
+	0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x41, 0x6c, 0x67, 0x45, 0x6e, 0x75,
+	0x6d, 0x42, 0x0a, 0xba, 0x48, 0x07, 0x82, 0x01, 0x04, 0x10, 0x01, 0x20, 0x00, 0x52, 0x03, 0x61,
+	0x6c, 0x67, 0x22, 0x3b, 0x0a, 0x0f, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b,
+	0x65, 0x79, 0x53, 0x65, 0x74, 0x12, 0x28, 0x0a, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x18, 0x01, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73,
+	0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x52, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x22,
+	0xe0, 0x03, 0x0a, 0x09, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x84, 0x03,
+	0x0a, 0x06, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0xe9,
+	0x02, 0xba, 0x48, 0xe5, 0x02, 0xba, 0x01, 0xe1, 0x02, 0x0a, 0x0a, 0x75, 0x72, 0x69, 0x5f, 0x66,
 	0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0xcf, 0x01, 0x55, 0x52, 0x49, 0x20, 0x6d, 0x75, 0x73, 0x74,
 	0x20, 0x62, 0x65, 0x20, 0x61, 0x20, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x20, 0x55, 0x52, 0x4c, 0x20,
 	0x28, 0x65, 0x2e, 0x67, 0x2e, 0x2c, 0x20, 0x27, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f,
@@ -1859,142 +1925,79 @@ var file_policy_objects_proto_rawDesc = []byte{
 	0x20, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73,
 	0x2c, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x63,
 	0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x73, 0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x73,
-	0x6c, 0x61, 0x73, 0x68, 0x65, 0x73, 0x2e, 0x1a, 0x8b, 0x01, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d,
-	0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3f, 0x3a,
-	0x2f, 0x2f, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b, 0x61,
+	0x6c, 0x61, 0x73, 0x68, 0x65, 0x73, 0x2e, 0x1a, 0x80, 0x01, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d,
+	0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f,
+	0x2f, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b, 0x61, 0x2d,
+	0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b, 0x30, 0x2c, 0x36, 0x31,
+	0x7d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x28, 0x5c,
+	0x5c, 0x2e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b, 0x61,
 	0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b, 0x30, 0x2c, 0x36,
-	0x31, 0x7d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x28,
-	0x5c, 0x5c, 0x2e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b,
-	0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b, 0x30, 0x2c,
-	0x36, 0x31, 0x7d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f,
-	0x29, 0x2a, 0x28, 0x3a, 0x5b, 0x30, 0x2d, 0x39, 0x5d, 0x2b, 0x29, 0x3f, 0x28, 0x2f, 0x2e, 0x2a,
-	0x29, 0x3f, 0x24, 0x27, 0x29, 0x52, 0x03, 0x75, 0x72, 0x69, 0x12, 0x30, 0x0a, 0x0a, 0x70, 0x75,
-	0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x11,
-	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65,
-	0x79, 0x52, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x12, 0x0a, 0x04,
-	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65,
-	0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61,
-	0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x97,
-	0x02, 0x0a, 0x03, 0x4b, 0x65, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x37, 0x0a, 0x09, 0x69, 0x73, 0x5f, 0x61, 0x63, 0x74,
-	0x69, 0x76, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42, 0x6f, 0x6f, 0x6c,
-	0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x08, 0x69, 0x73, 0x41, 0x63, 0x74, 0x69, 0x76, 0x65, 0x12,
-	0x39, 0x0a, 0x0a, 0x77, 0x61, 0x73, 0x5f, 0x6d, 0x61, 0x70, 0x70, 0x65, 0x64, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42, 0x6f, 0x6f, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52,
-	0x09, 0x77, 0x61, 0x73, 0x4d, 0x61, 0x70, 0x70, 0x65, 0x64, 0x12, 0x33, 0x0a, 0x0a, 0x70, 0x75,
-	0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14,
-	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69,
-	0x63, 0x4b, 0x65, 0x79, 0x52, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12,
-	0x29, 0x0a, 0x03, 0x6b, 0x61, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x70,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x65, 0x79, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x53,
-	0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x03, 0x6b, 0x61, 0x73, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65,
-	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63,
-	0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08,
-	0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x84, 0x01, 0x0a, 0x0c, 0x4b, 0x61, 0x73,
-	0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x1c, 0x0a, 0x03, 0x70, 0x65, 0x6d,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xba, 0x48, 0x07, 0x72, 0x05, 0x10, 0x01, 0x18,
-	0x80, 0x40, 0x52, 0x03, 0x70, 0x65, 0x6d, 0x12, 0x1b, 0x0a, 0x03, 0x6b, 0x69, 0x64, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x42, 0x09, 0xba, 0x48, 0x06, 0x72, 0x04, 0x10, 0x01, 0x18, 0x20, 0x52,
-	0x03, 0x6b, 0x69, 0x64, 0x12, 0x39, 0x0a, 0x03, 0x61, 0x6c, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x0e, 0x32, 0x1b, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73, 0x50, 0x75,
-	0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x41, 0x6c, 0x67, 0x45, 0x6e, 0x75, 0x6d, 0x42, 0x0a,
-	0xba, 0x48, 0x07, 0x82, 0x01, 0x04, 0x10, 0x01, 0x20, 0x00, 0x52, 0x03, 0x61, 0x6c, 0x67, 0x22,
-	0x3b, 0x0a, 0x0f, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x53,
-	0x65, 0x74, 0x12, 0x28, 0x0a, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x14, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62,
-	0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x52, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x22, 0xe0, 0x03, 0x0a,
-	0x09, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x84, 0x03, 0x0a, 0x06, 0x72,
-	0x65, 0x6d, 0x6f, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0xe9, 0x02, 0xba, 0x48,
-	0xe5, 0x02, 0xba, 0x01, 0xe1, 0x02, 0x0a, 0x0a, 0x75, 0x72, 0x69, 0x5f, 0x66, 0x6f, 0x72, 0x6d,
-	0x61, 0x74, 0x12, 0xcf, 0x01, 0x55, 0x52, 0x49, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65,
-	0x20, 0x61, 0x20, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x20, 0x55, 0x52, 0x4c, 0x20, 0x28, 0x65, 0x2e,
-	0x67, 0x2e, 0x2c, 0x20, 0x27, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x64, 0x65, 0x6d,
-	0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x27, 0x29, 0x20, 0x66, 0x6f, 0x6c, 0x6c, 0x6f, 0x77, 0x65,
-	0x64, 0x20, 0x62, 0x79, 0x20, 0x61, 0x64, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x20,
-	0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x20, 0x45, 0x61, 0x63, 0x68, 0x20, 0x73,
-	0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x73, 0x74, 0x61, 0x72,
-	0x74, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x65, 0x6e, 0x64, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x61,
-	0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x63,
-	0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2c, 0x20, 0x63, 0x61, 0x6e, 0x20, 0x63, 0x6f,
-	0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x2c, 0x20, 0x61,
-	0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x63, 0x68, 0x61, 0x72,
-	0x61, 0x63, 0x74, 0x65, 0x72, 0x73, 0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x73, 0x6c, 0x61, 0x73,
-	0x68, 0x65, 0x73, 0x2e, 0x1a, 0x80, 0x01, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63,
-	0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x5b, 0x61,
-	0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d,
-	0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b, 0x30, 0x2c, 0x36, 0x31, 0x7d, 0x5b, 0x61,
-	0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x28, 0x5c, 0x5c, 0x2e, 0x5b,
-	0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b, 0x61, 0x2d, 0x7a, 0x41,
-	0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b, 0x30, 0x2c, 0x36, 0x31, 0x7d, 0x5b,
-	0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x29, 0x2a, 0x28, 0x2f,
-	0x2e, 0x2a, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x48, 0x00, 0x52, 0x06, 0x72, 0x65, 0x6d, 0x6f, 0x74,
-	0x65, 0x12, 0x31, 0x0a, 0x06, 0x63, 0x61, 0x63, 0x68, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x17, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73, 0x50, 0x75,
-	0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x53, 0x65, 0x74, 0x48, 0x00, 0x52, 0x06, 0x63, 0x61,
-	0x63, 0x68, 0x65, 0x64, 0x42, 0x0c, 0x0a, 0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b,
-	0x65, 0x79, 0x4a, 0x04, 0x08, 0x02, 0x10, 0x03, 0x52, 0x05, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x2a,
-	0xb3, 0x01, 0x0a, 0x15, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x52, 0x75, 0x6c,
-	0x65, 0x54, 0x79, 0x70, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x12, 0x28, 0x0a, 0x24, 0x41, 0x54, 0x54,
-	0x52, 0x49, 0x42, 0x55, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45,
-	0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45,
-	0x44, 0x10, 0x00, 0x12, 0x23, 0x0a, 0x1f, 0x41, 0x54, 0x54, 0x52, 0x49, 0x42, 0x55, 0x54, 0x45,
-	0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f,
-	0x41, 0x4c, 0x4c, 0x5f, 0x4f, 0x46, 0x10, 0x01, 0x12, 0x23, 0x0a, 0x1f, 0x41, 0x54, 0x54, 0x52,
-	0x49, 0x42, 0x55, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f,
-	0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x41, 0x4e, 0x59, 0x5f, 0x4f, 0x46, 0x10, 0x02, 0x12, 0x26, 0x0a,
-	0x22, 0x41, 0x54, 0x54, 0x52, 0x49, 0x42, 0x55, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f,
-	0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x48, 0x49, 0x45, 0x52, 0x41, 0x52,
-	0x43, 0x48, 0x59, 0x10, 0x03, 0x2a, 0xca, 0x01, 0x0a, 0x1a, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63,
-	0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72,
-	0x45, 0x6e, 0x75, 0x6d, 0x12, 0x2d, 0x0a, 0x29, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43, 0x54, 0x5f,
-	0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x4f, 0x52,
-	0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45,
-	0x44, 0x10, 0x00, 0x12, 0x24, 0x0a, 0x20, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43, 0x54, 0x5f, 0x4d,
-	0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x4f, 0x52, 0x5f,
-	0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x49, 0x4e, 0x10, 0x01, 0x12, 0x28, 0x0a, 0x24, 0x53, 0x55, 0x42,
-	0x4a, 0x45, 0x43, 0x54, 0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45,
-	0x52, 0x41, 0x54, 0x4f, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x4e, 0x4f, 0x54, 0x5f, 0x49,
-	0x4e, 0x10, 0x02, 0x12, 0x2d, 0x0a, 0x29, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43, 0x54, 0x5f, 0x4d,
-	0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x4f, 0x52, 0x5f,
-	0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x49, 0x4e, 0x5f, 0x43, 0x4f, 0x4e, 0x54, 0x41, 0x49, 0x4e, 0x53,
-	0x10, 0x03, 0x2a, 0x90, 0x01, 0x0a, 0x18, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e,
-	0x42, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x12,
-	0x2b, 0x0a, 0x27, 0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x42, 0x4f, 0x4f,
-	0x4c, 0x45, 0x41, 0x4e, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55,
-	0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x23, 0x0a, 0x1f,
-	0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x42, 0x4f, 0x4f, 0x4c, 0x45, 0x41,
-	0x4e, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x41, 0x4e, 0x44, 0x10,
-	0x01, 0x12, 0x22, 0x0a, 0x1e, 0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x42,
-	0x4f, 0x4f, 0x4c, 0x45, 0x41, 0x4e, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d,
-	0x5f, 0x4f, 0x52, 0x10, 0x02, 0x2a, 0x88, 0x02, 0x0a, 0x13, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62,
-	0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x41, 0x6c, 0x67, 0x45, 0x6e, 0x75, 0x6d, 0x12, 0x27, 0x0a,
-	0x23, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f,
-	0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49,
-	0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x24, 0x0a, 0x20, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55,
-	0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55,
-	0x4d, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x32, 0x30, 0x34, 0x38, 0x10, 0x01, 0x12, 0x24, 0x0a, 0x20,
-	0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41,
-	0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x34, 0x30, 0x39, 0x36,
-	0x10, 0x02, 0x12, 0x28, 0x0a, 0x24, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43,
-	0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x45, 0x43,
-	0x5f, 0x53, 0x45, 0x43, 0x50, 0x32, 0x35, 0x36, 0x52, 0x31, 0x10, 0x05, 0x12, 0x28, 0x0a, 0x24,
-	0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41,
-	0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x45, 0x43, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x33,
-	0x38, 0x34, 0x52, 0x31, 0x10, 0x06, 0x12, 0x28, 0x0a, 0x24, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55,
-	0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55,
-	0x4d, 0x5f, 0x45, 0x43, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x35, 0x32, 0x31, 0x52, 0x31, 0x10, 0x07,
-	0x42, 0x82, 0x01, 0x0a, 0x0a, 0x63, 0x6f, 0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x42,
-	0x0c, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a,
-	0x2e, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65, 0x6e,
-	0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xa2,
-	0x02, 0x03, 0x50, 0x58, 0x58, 0xaa, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xca, 0x02,
-	0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xe2, 0x02, 0x12, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x06, 0x50,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x31, 0x7d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x29,
+	0x2a, 0x28, 0x2f, 0x2e, 0x2a, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x48, 0x00, 0x52, 0x06, 0x72, 0x65,
+	0x6d, 0x6f, 0x74, 0x65, 0x12, 0x31, 0x0a, 0x06, 0x63, 0x61, 0x63, 0x68, 0x65, 0x64, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61,
+	0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x53, 0x65, 0x74, 0x48, 0x00, 0x52,
+	0x06, 0x63, 0x61, 0x63, 0x68, 0x65, 0x64, 0x42, 0x0c, 0x0a, 0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69,
+	0x63, 0x5f, 0x6b, 0x65, 0x79, 0x4a, 0x04, 0x08, 0x02, 0x10, 0x03, 0x52, 0x05, 0x6c, 0x6f, 0x63,
+	0x61, 0x6c, 0x2a, 0xb3, 0x01, 0x0a, 0x15, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65,
+	0x52, 0x75, 0x6c, 0x65, 0x54, 0x79, 0x70, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x12, 0x28, 0x0a, 0x24,
+	0x41, 0x54, 0x54, 0x52, 0x49, 0x42, 0x55, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54,
+	0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49,
+	0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x23, 0x0a, 0x1f, 0x41, 0x54, 0x54, 0x52, 0x49, 0x42,
+	0x55, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e,
+	0x55, 0x4d, 0x5f, 0x41, 0x4c, 0x4c, 0x5f, 0x4f, 0x46, 0x10, 0x01, 0x12, 0x23, 0x0a, 0x1f, 0x41,
+	0x54, 0x54, 0x52, 0x49, 0x42, 0x55, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54, 0x59,
+	0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x41, 0x4e, 0x59, 0x5f, 0x4f, 0x46, 0x10, 0x02,
+	0x12, 0x26, 0x0a, 0x22, 0x41, 0x54, 0x54, 0x52, 0x49, 0x42, 0x55, 0x54, 0x45, 0x5f, 0x52, 0x55,
+	0x4c, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x48, 0x49, 0x45,
+	0x52, 0x41, 0x52, 0x43, 0x48, 0x59, 0x10, 0x03, 0x2a, 0xca, 0x01, 0x0a, 0x1a, 0x53, 0x75, 0x62,
+	0x6a, 0x65, 0x63, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x4f, 0x70, 0x65, 0x72, 0x61,
+	0x74, 0x6f, 0x72, 0x45, 0x6e, 0x75, 0x6d, 0x12, 0x2d, 0x0a, 0x29, 0x53, 0x55, 0x42, 0x4a, 0x45,
+	0x43, 0x54, 0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41,
+	0x54, 0x4f, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49,
+	0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x24, 0x0a, 0x20, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43,
+	0x54, 0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54,
+	0x4f, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x49, 0x4e, 0x10, 0x01, 0x12, 0x28, 0x0a, 0x24,
+	0x53, 0x55, 0x42, 0x4a, 0x45, 0x43, 0x54, 0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f,
+	0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x4f, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x4e, 0x4f,
+	0x54, 0x5f, 0x49, 0x4e, 0x10, 0x02, 0x12, 0x2d, 0x0a, 0x29, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43,
+	0x54, 0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54,
+	0x4f, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x49, 0x4e, 0x5f, 0x43, 0x4f, 0x4e, 0x54, 0x41,
+	0x49, 0x4e, 0x53, 0x10, 0x03, 0x2a, 0x90, 0x01, 0x0a, 0x18, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74,
+	0x69, 0x6f, 0x6e, 0x42, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x45, 0x6e,
+	0x75, 0x6d, 0x12, 0x2b, 0x0a, 0x27, 0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f,
+	0x42, 0x4f, 0x4f, 0x4c, 0x45, 0x41, 0x4e, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55,
+	0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12,
+	0x23, 0x0a, 0x1f, 0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x42, 0x4f, 0x4f,
+	0x4c, 0x45, 0x41, 0x4e, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x41,
+	0x4e, 0x44, 0x10, 0x01, 0x12, 0x22, 0x0a, 0x1e, 0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f,
+	0x4e, 0x5f, 0x42, 0x4f, 0x4f, 0x4c, 0x45, 0x41, 0x4e, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45,
+	0x4e, 0x55, 0x4d, 0x5f, 0x4f, 0x52, 0x10, 0x02, 0x2a, 0x88, 0x02, 0x0a, 0x13, 0x4b, 0x61, 0x73,
+	0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x41, 0x6c, 0x67, 0x45, 0x6e, 0x75, 0x6d,
+	0x12, 0x27, 0x0a, 0x23, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b,
+	0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50,
+	0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x24, 0x0a, 0x20, 0x4b, 0x41, 0x53,
+	0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f,
+	0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x32, 0x30, 0x34, 0x38, 0x10, 0x01, 0x12,
+	0x24, 0x0a, 0x20, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45,
+	0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x34,
+	0x30, 0x39, 0x36, 0x10, 0x02, 0x12, 0x28, 0x0a, 0x24, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42,
+	0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d,
+	0x5f, 0x45, 0x43, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x32, 0x35, 0x36, 0x52, 0x31, 0x10, 0x05, 0x12,
+	0x28, 0x0a, 0x24, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45,
+	0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x45, 0x43, 0x5f, 0x53, 0x45,
+	0x43, 0x50, 0x33, 0x38, 0x34, 0x52, 0x31, 0x10, 0x06, 0x12, 0x28, 0x0a, 0x24, 0x4b, 0x41, 0x53,
+	0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f,
+	0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x45, 0x43, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x35, 0x32, 0x31, 0x52,
+	0x31, 0x10, 0x07, 0x42, 0x82, 0x01, 0x0a, 0x0a, 0x63, 0x6f, 0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x42, 0x0c, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f,
+	0x50, 0x01, 0x5a, 0x2e, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f,
+	0x70, 0x65, 0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0xa2, 0x02, 0x03, 0x50, 0x58, 0x58, 0xaa, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63,
+	0x79, 0xca, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xe2, 0x02, 0x12, 0x50, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea,
+	0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/service/policy/objects.proto b/service/policy/objects.proto
index 941e0cb21a..cabcb372a8 100644
--- a/service/policy/objects.proto
+++ b/service/policy/objects.proto
@@ -105,10 +105,12 @@ message Action {
     // Deprecated STANDARD_ACTION_DECRYPT
     // Migrated to `STANDARD_ACTION_READ`
     reserved 1;
+    reserved "STANDARD_ACTION_DECRYPT";
 
     // Deprecated STANDARD_ACTION_TRANSMIT
     // Migrated to `STANDARD_ACTION_CREATE`
     reserved 2;
+    reserved "STANDARD_ACTION_TRANSMIT";
 
     STANDARD_ACTION_CREATE = 3;
     STANDARD_ACTION_READ = 4;
@@ -173,8 +175,7 @@ message SubjectMapping {
 message Condition {
   // a selector for a field value on a flattened Entity Representation (such as
   // from idP/LDAP)
-  string subject_external_selector_value = 1
-      [ (buf.validate.field).required = true ];
+  string subject_external_selector_value = 1 [(buf.validate.field).required = true];
 
   // the evaluation operator of relation
   SubjectMappingOperatorEnum operator = 2 [
@@ -185,14 +186,12 @@ message Condition {
   // list of comparison values for the result of applying the
   // subject_external_selector_value on a flattened Entity Representation
   // (Subject), evaluated by the operator
-  repeated string subject_external_values = 3
-      [ (buf.validate.field).repeated .min_items = 1 ];
+  repeated string subject_external_values = 3 [(buf.validate.field).repeated.min_items = 1];
 }
 
 // A collection of Conditions evaluated by the boolean_operator provided
 message ConditionGroup {
-  repeated Condition conditions = 1
-      [ (buf.validate.field).repeated .min_items = 1 ];
+  repeated Condition conditions = 1 [(buf.validate.field).repeated.min_items = 1];
 
   // the boolean evaluation type across the conditions
   ConditionBooleanTypeEnum boolean_operator = 2 [
@@ -204,8 +203,7 @@ message ConditionGroup {
 // A collection of Condition Groups
 message SubjectSet {
   // multiple Condition Groups are evaluated with AND logic
-  repeated ConditionGroup condition_groups = 1
-      [ (buf.validate.field).repeated .min_items = 1 ];
+  repeated ConditionGroup condition_groups = 1 [(buf.validate.field).repeated.min_items = 1];
 }
 
 /*
@@ -218,8 +216,7 @@ message SubjectSet {
 message SubjectConditionSet {
   string id = 1;
 
-  repeated SubjectSet subject_sets = 3
-      [ (buf.validate.field).repeated .min_items = 1 ];
+  repeated SubjectSet subject_sets = 3 [(buf.validate.field).repeated.min_items = 1];
 
   common.Metadata metadata = 100;
 }
@@ -240,7 +237,7 @@ message SubjectConditionSet {
 message SubjectProperty {
   string external_selector_value = 1 [
     (buf.validate.field).required = true,
-    (buf.validate.field).string = {min_len : 1}
+    (buf.validate.field).string = {min_len: 1}
   ];
   string external_value = 2;
 }
@@ -253,11 +250,11 @@ message ResourceMappingGroup {
   string id = 1;
 
   // the namespace containing the group of resource mappings
-  string namespace_id = 2 [ (buf.validate.field).required = true ];
+  string namespace_id = 2 [(buf.validate.field).required = true];
 
   // the common name for the group of resource mappings, which must be unique
   // per namespace
-  string name = 3 [ (buf.validate.field).required = true ];
+  string name = 3 [(buf.validate.field).required = true];
 
   // Common metadata
   common.Metadata metadata = 100;
@@ -272,7 +269,7 @@ message ResourceMapping {
 
   common.Metadata metadata = 2;
 
-  policy.Value attribute_value = 3 [ (buf.validate.field).required = true ];
+  policy.Value attribute_value = 3 [(buf.validate.field).required = true];
 
   repeated string terms = 4;
 
@@ -285,17 +282,19 @@ message ResourceMapping {
 message KeyAccessServer {
   string id = 1;
   // Address of a KAS instance
-  string uri = 2 [ (buf.validate.field).cel = {
-    id : "uri_format",
-    message : "URI must be a valid URL (e.g., 'https://demo.com/') followed by "
-              "additional segments. Each segment must start and end with an "
-              "alphanumeric character, can contain hyphens, alphanumeric "
-              "characters, and slashes.",
-    expression : "this.matches('^https?://"
-                 "[a-zA-Z0-9]([a-zA-Z0-9\\\\-]{0,61}[a-zA-Z0-9])?(\\\\.[a-zA-"
-                 "Z0-9]([a-zA-Z0-9\\\\-]{0,61}[a-zA-Z0-9])?)*(:[0-9]+)?(/"
-                 ".*)?$')"
-  } ];
+  string uri = 2 [(buf.validate.field).cel = {
+    id: "uri_format"
+    message:
+      "URI must be a valid URL (e.g., 'https://demo.com/') followed by "
+      "additional segments. Each segment must start and end with an "
+      "alphanumeric character, can contain hyphens, alphanumeric "
+      "characters, and slashes."
+    expression:
+      "this.matches('^https?://"
+      "[a-zA-Z0-9]([a-zA-Z0-9\\\\-]{0,61}[a-zA-Z0-9])?(\\\\.[a-zA-"
+      "Z0-9]([a-zA-Z0-9\\\\-]{0,61}[a-zA-Z0-9])?)*(:[0-9]+)?(/"
+      ".*)?$')"
+  }];
 
   // Deprecated
   PublicKey public_key = 3;
@@ -337,36 +336,31 @@ enum KasPublicKeyAlgEnum {
 // A KAS public key and some associated metadata for further identifcation
 message KasPublicKey {
   // x509 ASN.1 content in PEM envelope, usually
-  string pem = 1 [
-     (buf.validate.field).string = {
-        min_len: 1,
-        max_len: 8192
-      }
-  ];
+  string pem = 1 [(buf.validate.field).string = {
+    min_len: 1
+    max_len: 8192
+  }];
 
   // A unique string identifier for this key
-  string kid = 2 [
-    (buf.validate.field).string = {
-      min_len : 1,
-      max_len : 32
-    }
-  ];
+  string kid = 2 [(buf.validate.field).string = {
+    min_len: 1
+    max_len: 32
+  }];
 
   // A known algorithm type with any additional parameters encoded.
   // To start, these may be `rsa:2048` for encrypting ZTDF files and
   // `ec:secp256r1` for nanoTDF, but more formats may be added as needed.
-  KasPublicKeyAlgEnum alg = 3 [
-    (buf.validate.field).enum = {
-      defined_only: true,
-      not_in: [0]
-    }
-
-  ];
+  KasPublicKeyAlgEnum alg = 3 [(buf.validate.field).enum = {
+    defined_only: true
+    not_in: [0]
+  }];
 }
 
 // Deprecated
 // A list of known KAS public keys
-message KasPublicKeySet { repeated KasPublicKey keys = 1; }
+message KasPublicKeySet {
+  repeated KasPublicKey keys = 1;
+}
 
 // Deprecated
 message PublicKey {
@@ -376,16 +370,18 @@ message PublicKey {
 
   oneof public_key {
     // kas public key url - optional since can also be retrieved via public key
-    string remote = 1 [ (buf.validate.field).cel = {
-      id : "uri_format"
-      message : "URI must be a valid URL (e.g., 'https://demo.com/') followed "
-                "by additional segments. Each segment must start and end with "
-                "an alphanumeric character, can contain hyphens, alphanumeric "
-                "characters, and slashes."
-      expression : "this.matches('^https://"
-                   "[a-zA-Z0-9]([a-zA-Z0-9\\\\-]{0,61}[a-zA-Z0-9])?(\\\\.[a-zA-"
-                   "Z0-9]([a-zA-Z0-9\\\\-]{0,61}[a-zA-Z0-9])?)*(/.*)?$')"
-    } ];
+    string remote = 1 [(buf.validate.field).cel = {
+      id: "uri_format"
+      message:
+        "URI must be a valid URL (e.g., 'https://demo.com/') followed "
+        "by additional segments. Each segment must start and end with "
+        "an alphanumeric character, can contain hyphens, alphanumeric "
+        "characters, and slashes."
+      expression:
+        "this.matches('^https://"
+        "[a-zA-Z0-9]([a-zA-Z0-9\\\\-]{0,61}[a-zA-Z0-9])?(\\\\.[a-zA-"
+        "Z0-9]([a-zA-Z0-9\\\\-]{0,61}[a-zA-Z0-9])?)*(/.*)?$')"
+    }];
 
     // public key with additional information. Current preferred version
     KasPublicKeySet cached = 3;

From 375125025603ff16bbd5719abc63442e8d9feab8 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 31 Mar 2025 14:58:30 -0700
Subject: [PATCH 003/110] rm deprecated actions

---
 examples/cmd/authorization.go                 |  4 +--
 examples/cmd/benchmark_decision.go            |  2 +-
 service/authorization/authorization.go        |  4 +--
 service/integration/subject_mappings_test.go  | 25 +++++++++++--------
 service/kas/access/accessPdp.go               |  2 +-
 .../subjectmapping/subject_mapping_test.go    |  2 +-
 service/rttests/rt_test.go                    |  4 +--
 7 files changed, 24 insertions(+), 19 deletions(-)

diff --git a/examples/cmd/authorization.go b/examples/cmd/authorization.go
index 9d3364e21b..aba7cbb28e 100644
--- a/examples/cmd/authorization.go
+++ b/examples/cmd/authorization.go
@@ -28,9 +28,9 @@ func authorizationExamples() error {
 	}
 	defer s.Close()
 
-	// request decision on "TRANSMIT" Action
+	// request decision on "CREATE" Action
 	actions := []*policy.Action{{
-		Value: &policy.Action_Standard{Standard: policy.Action_STANDARD_ACTION_TRANSMIT},
+		Value: &policy.Action_Standard{Standard: policy.Action_STANDARD_ACTION_CREATE},
 	}}
 
 	// model two groups of entities; user bob and user alice
diff --git a/examples/cmd/benchmark_decision.go b/examples/cmd/benchmark_decision.go
index a69a3a2801..1120f7182e 100644
--- a/examples/cmd/benchmark_decision.go
+++ b/examples/cmd/benchmark_decision.go
@@ -37,7 +37,7 @@ func runDecisionBenchmark(cmd *cobra.Command, args []string) error {
 		DecisionRequests: []*authorization.DecisionRequest{
 			{
 				Actions: []*policy.Action{{Value: &policy.Action_Standard{
-					Standard: policy.Action_STANDARD_ACTION_DECRYPT,
+					Standard: policy.Action_STANDARD_ACTION_READ,
 				}}},
 				EntityChains: []*authorization.EntityChain{
 					{Id: "rewrap-tok", Entities: []*authorization.Entity{
diff --git a/service/authorization/authorization.go b/service/authorization/authorization.go
index 17622be148..6c74757f4b 100644
--- a/service/authorization/authorization.go
+++ b/service/authorization/authorization.go
@@ -221,7 +221,7 @@ func (as *AuthorizationService) getDecisions(ctx context.Context, dr *authorizat
 						EntityChainId: ec.GetId(),
 						Action: &policy.Action{
 							Value: &policy.Action_Standard{
-								Standard: policy.Action_STANDARD_ACTION_TRANSMIT,
+								Standard: policy.Action_STANDARD_ACTION_CREATE,
 							},
 						},
 					}
@@ -385,7 +385,7 @@ func (as *AuthorizationService) getDecisions(ctx context.Context, dr *authorizat
 				EntityChainId: ec.GetId(),
 				Action: &policy.Action{
 					Value: &policy.Action_Standard{
-						Standard: policy.Action_STANDARD_ACTION_TRANSMIT,
+						Standard: policy.Action_STANDARD_ACTION_CREATE,
 					},
 				},
 			}
diff --git a/service/integration/subject_mappings_test.go b/service/integration/subject_mappings_test.go
index 541537e7c4..e2d40dbc4e 100644
--- a/service/integration/subject_mappings_test.go
+++ b/service/integration/subject_mappings_test.go
@@ -42,20 +42,20 @@ func (s *SubjectMappingsSuite) TearDownSuite() {
 
 // a set of easily accessible actions for use in tests
 var (
-	Decrypt        = "DECRYPT"
-	Transmit       = "TRANSMIT"
+	Read           = "READ"
+	Transmit       = "CUSTOM_TRANSMIT"
 	CustomDownload = "CUSTOM_DOWNLOAD"
 	CustomUpload   = "CUSTOM_UPLOAD"
 
 	fixtureActions = map[string]*policy.Action{
-		"DECRYPT": {
+		"READ": {
 			Value: &policy.Action_Standard{
-				Standard: policy.Action_STANDARD_ACTION_DECRYPT,
+				Standard: policy.Action_STANDARD_ACTION_READ,
 			},
 		},
-		"TRANSMIT": {
+		"CREATE": {
 			Value: &policy.Action_Standard{
-				Standard: policy.Action_STANDARD_ACTION_TRANSMIT,
+				Standard: policy.Action_STANDARD_ACTION_CREATE,
 			},
 		},
 		"CUSTOM_DOWNLOAD": {
@@ -63,6 +63,11 @@ var (
 				Custom: "DOWNLOAD",
 			},
 		},
+		"CUSTOM_TRANSMIT": {
+			Value: &policy.Action_Custom{
+				Custom: "TRANSMIT",
+			},
+		},
 		"CUSTOM_UPLOAD": {
 			Value: &policy.Action_Custom{
 				Custom: "UPLOAD",
@@ -82,7 +87,7 @@ func (s *SubjectMappingsSuite) TestCreateSubjectMapping_ExistingSubjectCondition
 	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value2").ID
 	fixtureSCSId := s.f.GetSubjectConditionSetKey("subject_condition_set1").ID
 
-	aDecrypt := fixtureActions[Decrypt]
+	aDecrypt := fixtureActions[Read]
 	aTransmit := fixtureActions[Transmit]
 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              fixtureAttrValID,
@@ -816,7 +821,7 @@ func (s *SubjectMappingsSuite) TestDeleteAllUnmappedSubjectConditionSets() {
 
 	sm, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              s.f.GetAttributeValueKey("example.net/attr/attr1/value/value2").ID,
-		Actions:                       []*policy.Action{fixtureActions[Decrypt]},
+		Actions:                       []*policy.Action{fixtureActions[Read]},
 		ExistingSubjectConditionSetId: mapped.GetId(),
 	})
 	s.Require().NoError(err)
@@ -1258,7 +1263,7 @@ func (s *SubjectMappingsSuite) TestGetMatchedSubjectMappings_ConditionSetReusedB
 	sm1, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              attrVal1,
 		ExistingSubjectConditionSetId: createdSCS.GetId(),
-		Actions:                       []*policy.Action{fixtureActions[Decrypt]},
+		Actions:                       []*policy.Action{fixtureActions[Read]},
 	})
 	s.Require().NoError(err)
 	s.NotNil(sm1)
@@ -1326,7 +1331,7 @@ func (s *SubjectMappingsSuite) TestGetMatchedSubjectMappings_OnlyMatchesOnePrope
 
 	subjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:       fixtureAttrValID,
-		Actions:                []*policy.Action{fixtureActions[Transmit], fixtureActions[Decrypt]},
+		Actions:                []*policy.Action{fixtureActions[Transmit], fixtureActions[Read]},
 		NewSubjectConditionSet: newScs,
 	}
 
diff --git a/service/kas/access/accessPdp.go b/service/kas/access/accessPdp.go
index 8bdfb87e7b..59a3a2ce17 100644
--- a/service/kas/access/accessPdp.go
+++ b/service/kas/access/accessPdp.go
@@ -64,7 +64,7 @@ func (p *Provider) checkAttributes(ctx context.Context, ras []*authorization.Res
 		DecisionRequests: []*authorization.TokenDecisionRequest{
 			{
 				Actions: []*policy.Action{
-					{Value: &policy.Action_Standard{Standard: policy.Action_STANDARD_ACTION_DECRYPT}},
+					{Value: &policy.Action_Standard{Standard: policy.Action_STANDARD_ACTION_READ}},
 				},
 				Tokens:             []*authorization.Token{ent},
 				ResourceAttributes: ras,
diff --git a/service/policy/subjectmapping/subject_mapping_test.go b/service/policy/subjectmapping/subject_mapping_test.go
index 659b069710..e229e67b2a 100644
--- a/service/policy/subjectmapping/subject_mapping_test.go
+++ b/service/policy/subjectmapping/subject_mapping_test.go
@@ -83,7 +83,7 @@ func Test_CreateSubjectMappingRequest_WithExistingSubjectConditionSetID_Succeeds
 		Actions: []*policy.Action{
 			{
 				Value: &policy.Action_Standard{
-					Standard: policy.Action_STANDARD_ACTION_DECRYPT,
+					Standard: policy.Action_STANDARD_ACTION_READ,
 				},
 			},
 		},
diff --git a/service/rttests/rt_test.go b/service/rttests/rt_test.go
index f911fcfc4e..df539de228 100644
--- a/service/rttests/rt_test.go
+++ b/service/rttests/rt_test.go
@@ -289,10 +289,10 @@ func (s *RoundtripSuite) CreateTestData() error {
 			AttributeValueId: attributeID,
 			Actions: []*policy.Action{
 				{Value: &policy.Action_Standard{
-					Standard: policy.Action_STANDARD_ACTION_DECRYPT,
+					Standard: policy.Action_STANDARD_ACTION_READ,
 				}},
 				{Value: &policy.Action_Standard{
-					Standard: policy.Action_STANDARD_ACTION_TRANSMIT,
+					Standard: policy.Action_STANDARD_ACTION_CREATE,
 				}},
 			},
 			NewSubjectConditionSet: &subjectmapping.SubjectConditionSetCreate{

From 824f876f6a0899346a315b5cfd76ba2aaf9fb91b Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 31 Mar 2025 15:05:37 -0700
Subject: [PATCH 004/110] allow migration before hard deprecation

---
 docs/grpc/index.html                          |  14 +
 .../authorization/authorization.swagger.json  |   3 +
 .../policy/actions/actions.swagger.json       |   3 +
 .../policy/attributes/attributes.swagger.json |   3 +
 .../resource_mapping.swagger.json             |   3 +
 .../subject_mapping.swagger.json              |   3 +
 .../openapi/policy/unsafe/unsafe.swagger.json |   3 +
 protocol/go/policy/objects.pb.go              | 506 +++++++++---------
 service/authorization/authorization.go        |   4 +-
 service/integration/attribute_fqns_test.go    |   4 +-
 service/policy/objects.proto                  |  16 +-
 11 files changed, 301 insertions(+), 261 deletions(-)

diff --git a/docs/grpc/index.html b/docs/grpc/index.html
index 0b6c404966..6c25c0f142 100644
--- a/docs/grpc/index.html
+++ b/docs/grpc/index.html
@@ -2424,6 +2424,20 @@ <h3 id="policy.Action.StandardAction">Action.StandardAction</h3>
                 <td><p></p></td>
               </tr>
             
+              <tr>
+                <td>STANDARD_ACTION_DECRYPT</td>
+                <td>1</td>
+                <td><p>Deprecated
+Migrate to `STANDARD_ACTION_READ`</p></td>
+              </tr>
+            
+              <tr>
+                <td>STANDARD_ACTION_TRANSMIT</td>
+                <td>2</td>
+                <td><p>Deprecated
+Migrate to `STANDARD_ACTION_CREATE` or a custom action</p></td>
+              </tr>
+            
               <tr>
                 <td>STANDARD_ACTION_CREATE</td>
                 <td>3</td>
diff --git a/docs/openapi/authorization/authorization.swagger.json b/docs/openapi/authorization/authorization.swagger.json
index ad470f259a..f2dfb8a62f 100644
--- a/docs/openapi/authorization/authorization.swagger.json
+++ b/docs/openapi/authorization/authorization.swagger.json
@@ -109,12 +109,15 @@
       "type": "string",
       "enum": [
         "STANDARD_ACTION_UNSPECIFIED",
+        "STANDARD_ACTION_DECRYPT",
+        "STANDARD_ACTION_TRANSMIT",
         "STANDARD_ACTION_CREATE",
         "STANDARD_ACTION_READ",
         "STANDARD_ACTION_UPDATE",
         "STANDARD_ACTION_DELETE"
       ],
       "default": "STANDARD_ACTION_UNSPECIFIED",
+      "description": "- STANDARD_ACTION_DECRYPT: Deprecated\nMigrate to `STANDARD_ACTION_READ`\n - STANDARD_ACTION_TRANSMIT: Deprecated\nMigrate to `STANDARD_ACTION_CREATE` or a custom action",
       "title": "Standard actions supported by the platform"
     },
     "DecisionResponseDecision": {
diff --git a/docs/openapi/policy/actions/actions.swagger.json b/docs/openapi/policy/actions/actions.swagger.json
index 4e65ac5d6b..97db821e80 100644
--- a/docs/openapi/policy/actions/actions.swagger.json
+++ b/docs/openapi/policy/actions/actions.swagger.json
@@ -21,12 +21,15 @@
       "type": "string",
       "enum": [
         "STANDARD_ACTION_UNSPECIFIED",
+        "STANDARD_ACTION_DECRYPT",
+        "STANDARD_ACTION_TRANSMIT",
         "STANDARD_ACTION_CREATE",
         "STANDARD_ACTION_READ",
         "STANDARD_ACTION_UPDATE",
         "STANDARD_ACTION_DELETE"
       ],
       "default": "STANDARD_ACTION_UNSPECIFIED",
+      "description": "- STANDARD_ACTION_DECRYPT: Deprecated\nMigrate to `STANDARD_ACTION_READ`\n - STANDARD_ACTION_TRANSMIT: Deprecated\nMigrate to `STANDARD_ACTION_CREATE` or a custom action",
       "title": "Standard actions supported by the platform"
     },
     "actionsCreateCustomActionResponse": {
diff --git a/docs/openapi/policy/attributes/attributes.swagger.json b/docs/openapi/policy/attributes/attributes.swagger.json
index ee55aa4752..78b30e2772 100644
--- a/docs/openapi/policy/attributes/attributes.swagger.json
+++ b/docs/openapi/policy/attributes/attributes.swagger.json
@@ -661,12 +661,15 @@
       "type": "string",
       "enum": [
         "STANDARD_ACTION_UNSPECIFIED",
+        "STANDARD_ACTION_DECRYPT",
+        "STANDARD_ACTION_TRANSMIT",
         "STANDARD_ACTION_CREATE",
         "STANDARD_ACTION_READ",
         "STANDARD_ACTION_UPDATE",
         "STANDARD_ACTION_DELETE"
       ],
       "default": "STANDARD_ACTION_UNSPECIFIED",
+      "description": "- STANDARD_ACTION_DECRYPT: Deprecated\nMigrate to `STANDARD_ACTION_READ`\n - STANDARD_ACTION_TRANSMIT: Deprecated\nMigrate to `STANDARD_ACTION_CREATE` or a custom action",
       "title": "Standard actions supported by the platform"
     },
     "AttributeValueSelectorAttributeSelectorNamespaceSelector": {
diff --git a/docs/openapi/policy/resourcemapping/resource_mapping.swagger.json b/docs/openapi/policy/resourcemapping/resource_mapping.swagger.json
index af9b514616..4e44c3fefe 100644
--- a/docs/openapi/policy/resourcemapping/resource_mapping.swagger.json
+++ b/docs/openapi/policy/resourcemapping/resource_mapping.swagger.json
@@ -446,12 +446,15 @@
       "type": "string",
       "enum": [
         "STANDARD_ACTION_UNSPECIFIED",
+        "STANDARD_ACTION_DECRYPT",
+        "STANDARD_ACTION_TRANSMIT",
         "STANDARD_ACTION_CREATE",
         "STANDARD_ACTION_READ",
         "STANDARD_ACTION_UPDATE",
         "STANDARD_ACTION_DELETE"
       ],
       "default": "STANDARD_ACTION_UNSPECIFIED",
+      "description": "- STANDARD_ACTION_DECRYPT: Deprecated\nMigrate to `STANDARD_ACTION_READ`\n - STANDARD_ACTION_TRANSMIT: Deprecated\nMigrate to `STANDARD_ACTION_CREATE` or a custom action",
       "title": "Standard actions supported by the platform"
     },
     "commonMetadata": {
diff --git a/docs/openapi/policy/subjectmapping/subject_mapping.swagger.json b/docs/openapi/policy/subjectmapping/subject_mapping.swagger.json
index 6662a882a3..1b57d4b041 100644
--- a/docs/openapi/policy/subjectmapping/subject_mapping.swagger.json
+++ b/docs/openapi/policy/subjectmapping/subject_mapping.swagger.json
@@ -453,12 +453,15 @@
       "type": "string",
       "enum": [
         "STANDARD_ACTION_UNSPECIFIED",
+        "STANDARD_ACTION_DECRYPT",
+        "STANDARD_ACTION_TRANSMIT",
         "STANDARD_ACTION_CREATE",
         "STANDARD_ACTION_READ",
         "STANDARD_ACTION_UPDATE",
         "STANDARD_ACTION_DELETE"
       ],
       "default": "STANDARD_ACTION_UNSPECIFIED",
+      "description": "- STANDARD_ACTION_DECRYPT: Deprecated\nMigrate to `STANDARD_ACTION_READ`\n - STANDARD_ACTION_TRANSMIT: Deprecated\nMigrate to `STANDARD_ACTION_CREATE` or a custom action",
       "title": "Standard actions supported by the platform"
     },
     "commonMetadata": {
diff --git a/docs/openapi/policy/unsafe/unsafe.swagger.json b/docs/openapi/policy/unsafe/unsafe.swagger.json
index f2f559217f..99f0fa6a7e 100644
--- a/docs/openapi/policy/unsafe/unsafe.swagger.json
+++ b/docs/openapi/policy/unsafe/unsafe.swagger.json
@@ -365,12 +365,15 @@
       "type": "string",
       "enum": [
         "STANDARD_ACTION_UNSPECIFIED",
+        "STANDARD_ACTION_DECRYPT",
+        "STANDARD_ACTION_TRANSMIT",
         "STANDARD_ACTION_CREATE",
         "STANDARD_ACTION_READ",
         "STANDARD_ACTION_UPDATE",
         "STANDARD_ACTION_DELETE"
       ],
       "default": "STANDARD_ACTION_UNSPECIFIED",
+      "description": "- STANDARD_ACTION_DECRYPT: Deprecated\nMigrate to `STANDARD_ACTION_READ`\n - STANDARD_ACTION_TRANSMIT: Deprecated\nMigrate to `STANDARD_ACTION_CREATE` or a custom action",
       "title": "Standard actions supported by the platform"
     },
     "commonMetadata": {
diff --git a/protocol/go/policy/objects.pb.go b/protocol/go/policy/objects.pb.go
index 397d386a9f..bc4caea347 100644
--- a/protocol/go/policy/objects.pb.go
+++ b/protocol/go/policy/objects.pb.go
@@ -243,16 +243,24 @@ type Action_StandardAction int32
 
 const (
 	Action_STANDARD_ACTION_UNSPECIFIED Action_StandardAction = 0
-	Action_STANDARD_ACTION_CREATE      Action_StandardAction = 3
-	Action_STANDARD_ACTION_READ        Action_StandardAction = 4
-	Action_STANDARD_ACTION_UPDATE      Action_StandardAction = 5
-	Action_STANDARD_ACTION_DELETE      Action_StandardAction = 6
+	// Deprecated
+	// Migrate to `STANDARD_ACTION_READ`
+	Action_STANDARD_ACTION_DECRYPT Action_StandardAction = 1
+	// Deprecated
+	// Migrate to `STANDARD_ACTION_CREATE` or a custom action
+	Action_STANDARD_ACTION_TRANSMIT Action_StandardAction = 2
+	Action_STANDARD_ACTION_CREATE   Action_StandardAction = 3
+	Action_STANDARD_ACTION_READ     Action_StandardAction = 4
+	Action_STANDARD_ACTION_UPDATE   Action_StandardAction = 5
+	Action_STANDARD_ACTION_DELETE   Action_StandardAction = 6
 )
 
 // Enum value maps for Action_StandardAction.
 var (
 	Action_StandardAction_name = map[int32]string{
 		0: "STANDARD_ACTION_UNSPECIFIED",
+		1: "STANDARD_ACTION_DECRYPT",
+		2: "STANDARD_ACTION_TRANSMIT",
 		3: "STANDARD_ACTION_CREATE",
 		4: "STANDARD_ACTION_READ",
 		5: "STANDARD_ACTION_UPDATE",
@@ -260,6 +268,8 @@ var (
 	}
 	Action_StandardAction_value = map[string]int32{
 		"STANDARD_ACTION_UNSPECIFIED": 0,
+		"STANDARD_ACTION_DECRYPT":     1,
+		"STANDARD_ACTION_TRANSMIT":    2,
 		"STANDARD_ACTION_CREATE":      3,
 		"STANDARD_ACTION_READ":        4,
 		"STANDARD_ACTION_UPDATE":      5,
@@ -1733,7 +1743,7 @@ var file_policy_objects_proto_rawDesc = []byte{
 	0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e,
 	0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
 	0x74, 0x61, 0x4a, 0x04, 0x08, 0x04, 0x10, 0x05, 0x52, 0x07, 0x6d, 0x65, 0x6d, 0x62, 0x65, 0x72,
-	0x73, 0x22, 0xf7, 0x02, 0x0a, 0x06, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x3b, 0x0a, 0x08,
+	0x73, 0x22, 0xf3, 0x02, 0x0a, 0x06, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x3b, 0x0a, 0x08,
 	0x73, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1d,
 	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x53,
 	0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x48, 0x00, 0x52,
@@ -1742,262 +1752,262 @@ var file_policy_objects_proto_rawDesc = []byte{
 	0x74, 0x6f, 0x6d, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18,
 	0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d,
 	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x22, 0xde, 0x01, 0x0a, 0x0e, 0x53, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x41, 0x63,
+	0x61, 0x22, 0xda, 0x01, 0x0a, 0x0e, 0x53, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x41, 0x63,
 	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1f, 0x0a, 0x1b, 0x53, 0x54, 0x41, 0x4e, 0x44, 0x41, 0x52, 0x44,
 	0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46,
-	0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x1a, 0x0a, 0x16, 0x53, 0x54, 0x41, 0x4e, 0x44, 0x41, 0x52,
-	0x44, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x43, 0x52, 0x45, 0x41, 0x54, 0x45, 0x10,
-	0x03, 0x12, 0x18, 0x0a, 0x14, 0x53, 0x54, 0x41, 0x4e, 0x44, 0x41, 0x52, 0x44, 0x5f, 0x41, 0x43,
-	0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x52, 0x45, 0x41, 0x44, 0x10, 0x04, 0x12, 0x1a, 0x0a, 0x16, 0x53,
-	0x54, 0x41, 0x4e, 0x44, 0x41, 0x52, 0x44, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55,
-	0x50, 0x44, 0x41, 0x54, 0x45, 0x10, 0x05, 0x12, 0x1a, 0x0a, 0x16, 0x53, 0x54, 0x41, 0x4e, 0x44,
-	0x41, 0x52, 0x44, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x44, 0x45, 0x4c, 0x45, 0x54,
-	0x45, 0x10, 0x06, 0x22, 0x04, 0x08, 0x01, 0x10, 0x01, 0x22, 0x04, 0x08, 0x02, 0x10, 0x02, 0x2a,
-	0x17, 0x53, 0x54, 0x41, 0x4e, 0x44, 0x41, 0x52, 0x44, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e,
-	0x5f, 0x44, 0x45, 0x43, 0x52, 0x59, 0x50, 0x54, 0x2a, 0x18, 0x53, 0x54, 0x41, 0x4e, 0x44, 0x41,
-	0x52, 0x44, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x54, 0x52, 0x41, 0x4e, 0x53, 0x4d,
-	0x49, 0x54, 0x42, 0x07, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x81, 0x02, 0x0a, 0x0e,
-	0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x0e,
-	0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x36,
-	0x0a, 0x0f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75,
-	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x2e, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0e, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74,
-	0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x4f, 0x0a, 0x15, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63,
-	0x74, 0x5f, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x73, 0x65, 0x74, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53,
-	0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x53,
-	0x65, 0x74, 0x52, 0x13, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64, 0x69,
-	0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x74, 0x12, 0x28, 0x0a, 0x07, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63,
-	0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x07, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x73, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74,
-	0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22,
-	0xe9, 0x01, 0x0a, 0x09, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x4d, 0x0a,
-	0x1f, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61,
-	0x6c, 0x5f, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x1c,
-	0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x53,
-	0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x4b, 0x0a, 0x08,
-	0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x22,
-	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4d,
-	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x45, 0x6e,
-	0x75, 0x6d, 0x42, 0x0b, 0xba, 0x48, 0x08, 0xc8, 0x01, 0x01, 0x82, 0x01, 0x02, 0x10, 0x01, 0x52,
-	0x08, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x12, 0x40, 0x0a, 0x17, 0x73, 0x75, 0x62,
-	0x6a, 0x65, 0x63, 0x74, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x76, 0x61,
-	0x6c, 0x75, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92,
-	0x01, 0x02, 0x08, 0x01, 0x52, 0x15, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x45, 0x78, 0x74,
-	0x65, 0x72, 0x6e, 0x61, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x22, 0xa7, 0x01, 0x0a, 0x0e,
-	0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x3b,
-	0x0a, 0x0a, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x11, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x43, 0x6f, 0x6e, 0x64,
-	0x69, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52,
-	0x0a, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x58, 0x0a, 0x10, 0x62,
-	0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x5f, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x20, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x43,
-	0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x54,
-	0x79, 0x70, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x42, 0x0b, 0xba, 0x48, 0x08, 0xc8, 0x01, 0x01, 0x82,
-	0x01, 0x02, 0x10, 0x01, 0x52, 0x0f, 0x62, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x4f, 0x70, 0x65,
-	0x72, 0x61, 0x74, 0x6f, 0x72, 0x22, 0x59, 0x0a, 0x0a, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74,
-	0x53, 0x65, 0x74, 0x12, 0x4b, 0x0a, 0x10, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e,
-	0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e,
-	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e,
-	0x47, 0x72, 0x6f, 0x75, 0x70, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52,
-	0x0f, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73,
-	0x22, 0x94, 0x01, 0x0a, 0x13, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64,
-	0x69, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x3f, 0x0a, 0x0c, 0x73, 0x75, 0x62, 0x6a,
-	0x65, 0x63, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x12,
-	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x53,
-	0x65, 0x74, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x0b, 0x73, 0x75,
-	0x62, 0x6a, 0x65, 0x63, 0x74, 0x53, 0x65, 0x74, 0x73, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74,
-	0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f,
-	0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d,
-	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x7c, 0x0a, 0x0f, 0x53, 0x75, 0x62, 0x6a, 0x65,
-	0x63, 0x74, 0x50, 0x72, 0x6f, 0x70, 0x65, 0x72, 0x74, 0x79, 0x12, 0x42, 0x0a, 0x17, 0x65, 0x78,
-	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f,
-	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xba, 0x48, 0x07,
-	0xc8, 0x01, 0x01, 0x72, 0x02, 0x10, 0x01, 0x52, 0x15, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61,
-	0x6c, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x25,
-	0x0a, 0x0e, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c,
-	0x56, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x9b, 0x01, 0x0a, 0x14, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x0e,
-	0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x29,
-	0x0a, 0x0c, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x0b, 0x6e, 0x61,
-	0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x49, 0x64, 0x12, 0x1a, 0x0a, 0x04, 0x6e, 0x61, 0x6d,
-	0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52,
-	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x1b, 0x0a, 0x17, 0x53, 0x54, 0x41, 0x4e, 0x44, 0x41, 0x52,
+	0x44, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x44, 0x45, 0x43, 0x52, 0x59, 0x50, 0x54,
+	0x10, 0x01, 0x12, 0x1c, 0x0a, 0x18, 0x53, 0x54, 0x41, 0x4e, 0x44, 0x41, 0x52, 0x44, 0x5f, 0x41,
+	0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x54, 0x52, 0x41, 0x4e, 0x53, 0x4d, 0x49, 0x54, 0x10, 0x02,
+	0x12, 0x1a, 0x0a, 0x16, 0x53, 0x54, 0x41, 0x4e, 0x44, 0x41, 0x52, 0x44, 0x5f, 0x41, 0x43, 0x54,
+	0x49, 0x4f, 0x4e, 0x5f, 0x43, 0x52, 0x45, 0x41, 0x54, 0x45, 0x10, 0x03, 0x12, 0x18, 0x0a, 0x14,
+	0x53, 0x54, 0x41, 0x4e, 0x44, 0x41, 0x52, 0x44, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f,
+	0x52, 0x45, 0x41, 0x44, 0x10, 0x04, 0x12, 0x1a, 0x0a, 0x16, 0x53, 0x54, 0x41, 0x4e, 0x44, 0x41,
+	0x52, 0x44, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x50, 0x44, 0x41, 0x54, 0x45,
+	0x10, 0x05, 0x12, 0x1a, 0x0a, 0x16, 0x53, 0x54, 0x41, 0x4e, 0x44, 0x41, 0x52, 0x44, 0x5f, 0x41,
+	0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x44, 0x45, 0x4c, 0x45, 0x54, 0x45, 0x10, 0x06, 0x42, 0x07,
+	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x81, 0x02, 0x0a, 0x0e, 0x53, 0x75, 0x62, 0x6a,
+	0x65, 0x63, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x36, 0x0a, 0x0f, 0x61, 0x74,
+	0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x56, 0x61, 0x6c,
+	0x75, 0x65, 0x52, 0x0e, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x56, 0x61, 0x6c,
+	0x75, 0x65, 0x12, 0x4f, 0x0a, 0x15, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x63, 0x6f,
+	0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x73, 0x65, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x1b, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65,
+	0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x74, 0x52, 0x13,
+	0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e,
+	0x53, 0x65, 0x74, 0x12, 0x28, 0x0a, 0x07, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x04,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x07, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x2c, 0x0a,
+	0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0xe9, 0x01, 0x0a, 0x09,
+	0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x4d, 0x0a, 0x1f, 0x73, 0x75, 0x62,
+	0x6a, 0x65, 0x63, 0x74, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x73, 0x65,
+	0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x1c, 0x73, 0x75, 0x62, 0x6a,
+	0x65, 0x63, 0x74, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x53, 0x65, 0x6c, 0x65, 0x63,
+	0x74, 0x6f, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x4b, 0x0a, 0x08, 0x6f, 0x70, 0x65, 0x72,
+	0x61, 0x74, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x22, 0x2e, 0x70, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69,
+	0x6e, 0x67, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x45, 0x6e, 0x75, 0x6d, 0x42, 0x0b,
+	0xba, 0x48, 0x08, 0xc8, 0x01, 0x01, 0x82, 0x01, 0x02, 0x10, 0x01, 0x52, 0x08, 0x6f, 0x70, 0x65,
+	0x72, 0x61, 0x74, 0x6f, 0x72, 0x12, 0x40, 0x0a, 0x17, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74,
+	0x5f, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73,
+	0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01,
+	0x52, 0x15, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61,
+	0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x22, 0xa7, 0x01, 0x0a, 0x0e, 0x43, 0x6f, 0x6e, 0x64,
+	0x69, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x3b, 0x0a, 0x0a, 0x63, 0x6f,
+	0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x11,
+	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f,
+	0x6e, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x0a, 0x63, 0x6f, 0x6e,
+	0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x58, 0x0a, 0x10, 0x62, 0x6f, 0x6f, 0x6c, 0x65,
+	0x61, 0x6e, 0x5f, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x0e, 0x32, 0x20, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69,
+	0x74, 0x69, 0x6f, 0x6e, 0x42, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x45,
+	0x6e, 0x75, 0x6d, 0x42, 0x0b, 0xba, 0x48, 0x08, 0xc8, 0x01, 0x01, 0x82, 0x01, 0x02, 0x10, 0x01,
+	0x52, 0x0f, 0x62, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f,
+	0x72, 0x22, 0x59, 0x0a, 0x0a, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x53, 0x65, 0x74, 0x12,
+	0x4b, 0x0a, 0x10, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x67, 0x72, 0x6f,
+	0x75, 0x70, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75,
+	0x70, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x0f, 0x63, 0x6f, 0x6e,
+	0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x22, 0x94, 0x01, 0x0a,
+	0x13, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f,
+	0x6e, 0x53, 0x65, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x02, 0x69, 0x64, 0x12, 0x3f, 0x0a, 0x0c, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f,
+	0x73, 0x65, 0x74, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x70, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x53, 0x65, 0x74, 0x42, 0x08,
+	0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x0b, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63,
+	0x74, 0x53, 0x65, 0x74, 0x73, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
 	0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e,
 	0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64,
-	0x61, 0x74, 0x61, 0x22, 0xd9, 0x01, 0x0a, 0x0f, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64,
-	0x61, 0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d,
-	0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74,
-	0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x3e, 0x0a, 0x0f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75,
-	0x74, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d,
-	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x06, 0xba,
-	0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x0e, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65,
-	0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x65, 0x72, 0x6d, 0x73, 0x18, 0x04,
-	0x20, 0x03, 0x28, 0x09, 0x52, 0x05, 0x74, 0x65, 0x72, 0x6d, 0x73, 0x12, 0x32, 0x0a, 0x05, 0x67,
-	0x72, 0x6f, 0x75, 0x70, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x70, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x61, 0x70, 0x70,
-	0x69, 0x6e, 0x67, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x05, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x22,
-	0x9f, 0x04, 0x0a, 0x0f, 0x4b, 0x65, 0x79, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x53, 0x65, 0x72,
-	0x76, 0x65, 0x72, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x02, 0x69, 0x64, 0x12, 0x87, 0x03, 0x0a, 0x03, 0x75, 0x72, 0x69, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x09, 0x42, 0xf4, 0x02, 0xba, 0x48, 0xf0, 0x02, 0xba, 0x01, 0xec, 0x02, 0x0a, 0x0a, 0x75, 0x72,
-	0x69, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0xcf, 0x01, 0x55, 0x52, 0x49, 0x20, 0x6d,
-	0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x61, 0x20, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x20, 0x55,
-	0x52, 0x4c, 0x20, 0x28, 0x65, 0x2e, 0x67, 0x2e, 0x2c, 0x20, 0x27, 0x68, 0x74, 0x74, 0x70, 0x73,
-	0x3a, 0x2f, 0x2f, 0x64, 0x65, 0x6d, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x27, 0x29, 0x20, 0x66,
-	0x6f, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x20, 0x62, 0x79, 0x20, 0x61, 0x64, 0x64, 0x69, 0x74,
-	0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x20, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x20,
-	0x45, 0x61, 0x63, 0x68, 0x20, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x20, 0x6d, 0x75, 0x73,
-	0x74, 0x20, 0x73, 0x74, 0x61, 0x72, 0x74, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x65, 0x6e, 0x64, 0x20,
-	0x77, 0x69, 0x74, 0x68, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d,
-	0x65, 0x72, 0x69, 0x63, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2c, 0x20,
-	0x63, 0x61, 0x6e, 0x20, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20, 0x68, 0x79, 0x70, 0x68,
-	0x65, 0x6e, 0x73, 0x2c, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69,
-	0x63, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x73, 0x2c, 0x20, 0x61, 0x6e,
-	0x64, 0x20, 0x73, 0x6c, 0x61, 0x73, 0x68, 0x65, 0x73, 0x2e, 0x1a, 0x8b, 0x01, 0x74, 0x68, 0x69,
-	0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x68, 0x74, 0x74, 0x70,
-	0x73, 0x3f, 0x3a, 0x2f, 0x2f, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d,
-	0x28, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b,
-	0x30, 0x2c, 0x36, 0x31, 0x7d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d,
-	0x29, 0x3f, 0x28, 0x5c, 0x5c, 0x2e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39,
-	0x5d, 0x28, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d,
-	0x7b, 0x30, 0x2c, 0x36, 0x31, 0x7d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39,
-	0x5d, 0x29, 0x3f, 0x29, 0x2a, 0x28, 0x3a, 0x5b, 0x30, 0x2d, 0x39, 0x5d, 0x2b, 0x29, 0x3f, 0x28,
-	0x2f, 0x2e, 0x2a, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x52, 0x03, 0x75, 0x72, 0x69, 0x12, 0x30, 0x0a,
-	0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x11, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x75, 0x62, 0x6c, 0x69,
-	0x63, 0x4b, 0x65, 0x79, 0x52, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12,
-	0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e,
-	0x61, 0x6d, 0x65, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18,
-	0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d,
+	0x61, 0x74, 0x61, 0x22, 0x7c, 0x0a, 0x0f, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x50, 0x72,
+	0x6f, 0x70, 0x65, 0x72, 0x74, 0x79, 0x12, 0x42, 0x0a, 0x17, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e,
+	0x61, 0x6c, 0x5f, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xba, 0x48, 0x07, 0xc8, 0x01, 0x01, 0x72,
+	0x02, 0x10, 0x01, 0x52, 0x15, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x53, 0x65, 0x6c,
+	0x65, 0x63, 0x74, 0x6f, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x25, 0x0a, 0x0e, 0x65, 0x78,
+	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0d, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x56, 0x61, 0x6c, 0x75,
+	0x65, 0x22, 0x9b, 0x01, 0x0a, 0x14, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x61,
+	0x70, 0x70, 0x69, 0x6e, 0x67, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x29, 0x0a, 0x0c, 0x6e, 0x61,
+	0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70,
+	0x61, 0x63, 0x65, 0x49, 0x64, 0x12, 0x1a, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x09, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x04, 0x6e, 0x61, 0x6d,
+	0x65, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22,
+	0xd9, 0x01, 0x0a, 0x0f, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x61, 0x70, 0x70,
+	0x69, 0x6e, 0x67, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x02, 0x69, 0x64, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d,
 	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x22, 0x97, 0x02, 0x0a, 0x03, 0x4b, 0x65, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x37, 0x0a, 0x09, 0x69, 0x73, 0x5f,
-	0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67,
-	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42,
-	0x6f, 0x6f, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x08, 0x69, 0x73, 0x41, 0x63, 0x74, 0x69,
-	0x76, 0x65, 0x12, 0x39, 0x0a, 0x0a, 0x77, 0x61, 0x73, 0x5f, 0x6d, 0x61, 0x70, 0x70, 0x65, 0x64,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42, 0x6f, 0x6f, 0x6c, 0x56, 0x61, 0x6c,
-	0x75, 0x65, 0x52, 0x09, 0x77, 0x61, 0x73, 0x4d, 0x61, 0x70, 0x70, 0x65, 0x64, 0x12, 0x33, 0x0a,
-	0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x14, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73, 0x50, 0x75,
-	0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x52, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b,
-	0x65, 0x79, 0x12, 0x29, 0x0a, 0x03, 0x6b, 0x61, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x17, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x65, 0x79, 0x41, 0x63, 0x63, 0x65,
-	0x73, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x03, 0x6b, 0x61, 0x73, 0x12, 0x2c, 0x0a,
-	0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x84, 0x01, 0x0a, 0x0c,
-	0x4b, 0x61, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x1c, 0x0a, 0x03,
-	0x70, 0x65, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xba, 0x48, 0x07, 0x72, 0x05,
-	0x10, 0x01, 0x18, 0x80, 0x40, 0x52, 0x03, 0x70, 0x65, 0x6d, 0x12, 0x1b, 0x0a, 0x03, 0x6b, 0x69,
-	0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x09, 0xba, 0x48, 0x06, 0x72, 0x04, 0x10, 0x01,
-	0x18, 0x20, 0x52, 0x03, 0x6b, 0x69, 0x64, 0x12, 0x39, 0x0a, 0x03, 0x61, 0x6c, 0x67, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x0e, 0x32, 0x1b, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61,
-	0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x41, 0x6c, 0x67, 0x45, 0x6e, 0x75,
-	0x6d, 0x42, 0x0a, 0xba, 0x48, 0x07, 0x82, 0x01, 0x04, 0x10, 0x01, 0x20, 0x00, 0x52, 0x03, 0x61,
-	0x6c, 0x67, 0x22, 0x3b, 0x0a, 0x0f, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b,
-	0x65, 0x79, 0x53, 0x65, 0x74, 0x12, 0x28, 0x0a, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x18, 0x01, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73,
-	0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x52, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x22,
-	0xe0, 0x03, 0x0a, 0x09, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x84, 0x03,
-	0x0a, 0x06, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0xe9,
-	0x02, 0xba, 0x48, 0xe5, 0x02, 0xba, 0x01, 0xe1, 0x02, 0x0a, 0x0a, 0x75, 0x72, 0x69, 0x5f, 0x66,
-	0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0xcf, 0x01, 0x55, 0x52, 0x49, 0x20, 0x6d, 0x75, 0x73, 0x74,
-	0x20, 0x62, 0x65, 0x20, 0x61, 0x20, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x20, 0x55, 0x52, 0x4c, 0x20,
-	0x28, 0x65, 0x2e, 0x67, 0x2e, 0x2c, 0x20, 0x27, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f,
-	0x64, 0x65, 0x6d, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x27, 0x29, 0x20, 0x66, 0x6f, 0x6c, 0x6c,
-	0x6f, 0x77, 0x65, 0x64, 0x20, 0x62, 0x79, 0x20, 0x61, 0x64, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e,
-	0x61, 0x6c, 0x20, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x20, 0x45, 0x61, 0x63,
-	0x68, 0x20, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x73,
-	0x74, 0x61, 0x72, 0x74, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x65, 0x6e, 0x64, 0x20, 0x77, 0x69, 0x74,
-	0x68, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69,
-	0x63, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2c, 0x20, 0x63, 0x61, 0x6e,
-	0x20, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73,
-	0x2c, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x63,
-	0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x73, 0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x73,
-	0x6c, 0x61, 0x73, 0x68, 0x65, 0x73, 0x2e, 0x1a, 0x80, 0x01, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d,
-	0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f,
+	0x61, 0x12, 0x3e, 0x0a, 0x0f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x70, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x2e, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01,
+	0x01, 0x52, 0x0e, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x56, 0x61, 0x6c, 0x75,
+	0x65, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x65, 0x72, 0x6d, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09,
+	0x52, 0x05, 0x74, 0x65, 0x72, 0x6d, 0x73, 0x12, 0x32, 0x0a, 0x05, 0x67, 0x72, 0x6f, 0x75, 0x70,
+	0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
+	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x47,
+	0x72, 0x6f, 0x75, 0x70, 0x52, 0x05, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x22, 0x9f, 0x04, 0x0a, 0x0f,
+	0x4b, 0x65, 0x79, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x12,
+	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12,
+	0x87, 0x03, 0x0a, 0x03, 0x75, 0x72, 0x69, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0xf4, 0x02,
+	0xba, 0x48, 0xf0, 0x02, 0xba, 0x01, 0xec, 0x02, 0x0a, 0x0a, 0x75, 0x72, 0x69, 0x5f, 0x66, 0x6f,
+	0x72, 0x6d, 0x61, 0x74, 0x12, 0xcf, 0x01, 0x55, 0x52, 0x49, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20,
+	0x62, 0x65, 0x20, 0x61, 0x20, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x20, 0x55, 0x52, 0x4c, 0x20, 0x28,
+	0x65, 0x2e, 0x67, 0x2e, 0x2c, 0x20, 0x27, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x64,
+	0x65, 0x6d, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x27, 0x29, 0x20, 0x66, 0x6f, 0x6c, 0x6c, 0x6f,
+	0x77, 0x65, 0x64, 0x20, 0x62, 0x79, 0x20, 0x61, 0x64, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x61,
+	0x6c, 0x20, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x20, 0x45, 0x61, 0x63, 0x68,
+	0x20, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x73, 0x74,
+	0x61, 0x72, 0x74, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x65, 0x6e, 0x64, 0x20, 0x77, 0x69, 0x74, 0x68,
+	0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63,
+	0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2c, 0x20, 0x63, 0x61, 0x6e, 0x20,
+	0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x2c,
+	0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x63, 0x68,
+	0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x73, 0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x73, 0x6c,
+	0x61, 0x73, 0x68, 0x65, 0x73, 0x2e, 0x1a, 0x8b, 0x01, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61,
+	0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3f, 0x3a, 0x2f,
 	0x2f, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b, 0x61, 0x2d,
 	0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b, 0x30, 0x2c, 0x36, 0x31,
 	0x7d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x28, 0x5c,
 	0x5c, 0x2e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b, 0x61,
 	0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b, 0x30, 0x2c, 0x36,
 	0x31, 0x7d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x29,
-	0x2a, 0x28, 0x2f, 0x2e, 0x2a, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x48, 0x00, 0x52, 0x06, 0x72, 0x65,
-	0x6d, 0x6f, 0x74, 0x65, 0x12, 0x31, 0x0a, 0x06, 0x63, 0x61, 0x63, 0x68, 0x65, 0x64, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61,
-	0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x53, 0x65, 0x74, 0x48, 0x00, 0x52,
-	0x06, 0x63, 0x61, 0x63, 0x68, 0x65, 0x64, 0x42, 0x0c, 0x0a, 0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69,
-	0x63, 0x5f, 0x6b, 0x65, 0x79, 0x4a, 0x04, 0x08, 0x02, 0x10, 0x03, 0x52, 0x05, 0x6c, 0x6f, 0x63,
-	0x61, 0x6c, 0x2a, 0xb3, 0x01, 0x0a, 0x15, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65,
-	0x52, 0x75, 0x6c, 0x65, 0x54, 0x79, 0x70, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x12, 0x28, 0x0a, 0x24,
+	0x2a, 0x28, 0x3a, 0x5b, 0x30, 0x2d, 0x39, 0x5d, 0x2b, 0x29, 0x3f, 0x28, 0x2f, 0x2e, 0x2a, 0x29,
+	0x3f, 0x24, 0x27, 0x29, 0x52, 0x03, 0x75, 0x72, 0x69, 0x12, 0x30, 0x0a, 0x0a, 0x70, 0x75, 0x62,
+	0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e,
+	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79,
+	0x52, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x12, 0x0a, 0x04, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12,
+	0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x97, 0x02,
+	0x0a, 0x03, 0x4b, 0x65, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x37, 0x0a, 0x09, 0x69, 0x73, 0x5f, 0x61, 0x63, 0x74, 0x69,
+	0x76, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42, 0x6f, 0x6f, 0x6c, 0x56,
+	0x61, 0x6c, 0x75, 0x65, 0x52, 0x08, 0x69, 0x73, 0x41, 0x63, 0x74, 0x69, 0x76, 0x65, 0x12, 0x39,
+	0x0a, 0x0a, 0x77, 0x61, 0x73, 0x5f, 0x6d, 0x61, 0x70, 0x70, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42, 0x6f, 0x6f, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x09,
+	0x77, 0x61, 0x73, 0x4d, 0x61, 0x70, 0x70, 0x65, 0x64, 0x12, 0x33, 0x0a, 0x0a, 0x70, 0x75, 0x62,
+	0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e,
+	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63,
+	0x4b, 0x65, 0x79, 0x52, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x29,
+	0x0a, 0x03, 0x6b, 0x61, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x70, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x65, 0x79, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x53, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x52, 0x03, 0x6b, 0x61, 0x73, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f,
+	0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x84, 0x01, 0x0a, 0x0c, 0x4b, 0x61, 0x73, 0x50,
+	0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x1c, 0x0a, 0x03, 0x70, 0x65, 0x6d, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xba, 0x48, 0x07, 0x72, 0x05, 0x10, 0x01, 0x18, 0x80,
+	0x40, 0x52, 0x03, 0x70, 0x65, 0x6d, 0x12, 0x1b, 0x0a, 0x03, 0x6b, 0x69, 0x64, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x42, 0x09, 0xba, 0x48, 0x06, 0x72, 0x04, 0x10, 0x01, 0x18, 0x20, 0x52, 0x03,
+	0x6b, 0x69, 0x64, 0x12, 0x39, 0x0a, 0x03, 0x61, 0x6c, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e,
+	0x32, 0x1b, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62,
+	0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x41, 0x6c, 0x67, 0x45, 0x6e, 0x75, 0x6d, 0x42, 0x0a, 0xba,
+	0x48, 0x07, 0x82, 0x01, 0x04, 0x10, 0x01, 0x20, 0x00, 0x52, 0x03, 0x61, 0x6c, 0x67, 0x22, 0x3b,
+	0x0a, 0x0f, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x53, 0x65,
+	0x74, 0x12, 0x28, 0x0a, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x14, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62, 0x6c,
+	0x69, 0x63, 0x4b, 0x65, 0x79, 0x52, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x22, 0xe0, 0x03, 0x0a, 0x09,
+	0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x84, 0x03, 0x0a, 0x06, 0x72, 0x65,
+	0x6d, 0x6f, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0xe9, 0x02, 0xba, 0x48, 0xe5,
+	0x02, 0xba, 0x01, 0xe1, 0x02, 0x0a, 0x0a, 0x75, 0x72, 0x69, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61,
+	0x74, 0x12, 0xcf, 0x01, 0x55, 0x52, 0x49, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20,
+	0x61, 0x20, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x20, 0x55, 0x52, 0x4c, 0x20, 0x28, 0x65, 0x2e, 0x67,
+	0x2e, 0x2c, 0x20, 0x27, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x64, 0x65, 0x6d, 0x6f,
+	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x27, 0x29, 0x20, 0x66, 0x6f, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64,
+	0x20, 0x62, 0x79, 0x20, 0x61, 0x64, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x20, 0x73,
+	0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x20, 0x45, 0x61, 0x63, 0x68, 0x20, 0x73, 0x65,
+	0x67, 0x6d, 0x65, 0x6e, 0x74, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x73, 0x74, 0x61, 0x72, 0x74,
+	0x20, 0x61, 0x6e, 0x64, 0x20, 0x65, 0x6e, 0x64, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x61, 0x6e,
+	0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x63, 0x68,
+	0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2c, 0x20, 0x63, 0x61, 0x6e, 0x20, 0x63, 0x6f, 0x6e,
+	0x74, 0x61, 0x69, 0x6e, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x2c, 0x20, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61,
+	0x63, 0x74, 0x65, 0x72, 0x73, 0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x73, 0x6c, 0x61, 0x73, 0x68,
+	0x65, 0x73, 0x2e, 0x1a, 0x80, 0x01, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68,
+	0x65, 0x73, 0x28, 0x27, 0x5e, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x5b, 0x61, 0x2d,
+	0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a,
+	0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b, 0x30, 0x2c, 0x36, 0x31, 0x7d, 0x5b, 0x61, 0x2d,
+	0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x28, 0x5c, 0x5c, 0x2e, 0x5b, 0x61,
+	0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d,
+	0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b, 0x30, 0x2c, 0x36, 0x31, 0x7d, 0x5b, 0x61,
+	0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x29, 0x2a, 0x28, 0x2f, 0x2e,
+	0x2a, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x48, 0x00, 0x52, 0x06, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65,
+	0x12, 0x31, 0x0a, 0x06, 0x63, 0x61, 0x63, 0x68, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x17, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62,
+	0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x53, 0x65, 0x74, 0x48, 0x00, 0x52, 0x06, 0x63, 0x61, 0x63,
+	0x68, 0x65, 0x64, 0x42, 0x0c, 0x0a, 0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65,
+	0x79, 0x4a, 0x04, 0x08, 0x02, 0x10, 0x03, 0x52, 0x05, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x2a, 0xb3,
+	0x01, 0x0a, 0x15, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x52, 0x75, 0x6c, 0x65,
+	0x54, 0x79, 0x70, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x12, 0x28, 0x0a, 0x24, 0x41, 0x54, 0x54, 0x52,
+	0x49, 0x42, 0x55, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f,
+	0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44,
+	0x10, 0x00, 0x12, 0x23, 0x0a, 0x1f, 0x41, 0x54, 0x54, 0x52, 0x49, 0x42, 0x55, 0x54, 0x45, 0x5f,
+	0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x41,
+	0x4c, 0x4c, 0x5f, 0x4f, 0x46, 0x10, 0x01, 0x12, 0x23, 0x0a, 0x1f, 0x41, 0x54, 0x54, 0x52, 0x49,
+	0x42, 0x55, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45,
+	0x4e, 0x55, 0x4d, 0x5f, 0x41, 0x4e, 0x59, 0x5f, 0x4f, 0x46, 0x10, 0x02, 0x12, 0x26, 0x0a, 0x22,
 	0x41, 0x54, 0x54, 0x52, 0x49, 0x42, 0x55, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54,
-	0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49,
-	0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x23, 0x0a, 0x1f, 0x41, 0x54, 0x54, 0x52, 0x49, 0x42,
-	0x55, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e,
-	0x55, 0x4d, 0x5f, 0x41, 0x4c, 0x4c, 0x5f, 0x4f, 0x46, 0x10, 0x01, 0x12, 0x23, 0x0a, 0x1f, 0x41,
-	0x54, 0x54, 0x52, 0x49, 0x42, 0x55, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54, 0x59,
-	0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x41, 0x4e, 0x59, 0x5f, 0x4f, 0x46, 0x10, 0x02,
-	0x12, 0x26, 0x0a, 0x22, 0x41, 0x54, 0x54, 0x52, 0x49, 0x42, 0x55, 0x54, 0x45, 0x5f, 0x52, 0x55,
-	0x4c, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x48, 0x49, 0x45,
-	0x52, 0x41, 0x52, 0x43, 0x48, 0x59, 0x10, 0x03, 0x2a, 0xca, 0x01, 0x0a, 0x1a, 0x53, 0x75, 0x62,
-	0x6a, 0x65, 0x63, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x4f, 0x70, 0x65, 0x72, 0x61,
-	0x74, 0x6f, 0x72, 0x45, 0x6e, 0x75, 0x6d, 0x12, 0x2d, 0x0a, 0x29, 0x53, 0x55, 0x42, 0x4a, 0x45,
-	0x43, 0x54, 0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41,
-	0x54, 0x4f, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49,
-	0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x24, 0x0a, 0x20, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43,
-	0x54, 0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54,
-	0x4f, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x49, 0x4e, 0x10, 0x01, 0x12, 0x28, 0x0a, 0x24,
-	0x53, 0x55, 0x42, 0x4a, 0x45, 0x43, 0x54, 0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f,
-	0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x4f, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x4e, 0x4f,
-	0x54, 0x5f, 0x49, 0x4e, 0x10, 0x02, 0x12, 0x2d, 0x0a, 0x29, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43,
-	0x54, 0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54,
-	0x4f, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x49, 0x4e, 0x5f, 0x43, 0x4f, 0x4e, 0x54, 0x41,
-	0x49, 0x4e, 0x53, 0x10, 0x03, 0x2a, 0x90, 0x01, 0x0a, 0x18, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74,
-	0x69, 0x6f, 0x6e, 0x42, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x45, 0x6e,
-	0x75, 0x6d, 0x12, 0x2b, 0x0a, 0x27, 0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f,
-	0x42, 0x4f, 0x4f, 0x4c, 0x45, 0x41, 0x4e, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55,
-	0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12,
-	0x23, 0x0a, 0x1f, 0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x42, 0x4f, 0x4f,
-	0x4c, 0x45, 0x41, 0x4e, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x41,
-	0x4e, 0x44, 0x10, 0x01, 0x12, 0x22, 0x0a, 0x1e, 0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f,
-	0x4e, 0x5f, 0x42, 0x4f, 0x4f, 0x4c, 0x45, 0x41, 0x4e, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45,
-	0x4e, 0x55, 0x4d, 0x5f, 0x4f, 0x52, 0x10, 0x02, 0x2a, 0x88, 0x02, 0x0a, 0x13, 0x4b, 0x61, 0x73,
-	0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x41, 0x6c, 0x67, 0x45, 0x6e, 0x75, 0x6d,
-	0x12, 0x27, 0x0a, 0x23, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b,
-	0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50,
-	0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x24, 0x0a, 0x20, 0x4b, 0x41, 0x53,
-	0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f,
-	0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x32, 0x30, 0x34, 0x38, 0x10, 0x01, 0x12,
-	0x24, 0x0a, 0x20, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45,
-	0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x34,
-	0x30, 0x39, 0x36, 0x10, 0x02, 0x12, 0x28, 0x0a, 0x24, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42,
+	0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x48, 0x49, 0x45, 0x52, 0x41, 0x52, 0x43,
+	0x48, 0x59, 0x10, 0x03, 0x2a, 0xca, 0x01, 0x0a, 0x1a, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74,
+	0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x45,
+	0x6e, 0x75, 0x6d, 0x12, 0x2d, 0x0a, 0x29, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43, 0x54, 0x5f, 0x4d,
+	0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x4f, 0x52, 0x5f,
+	0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44,
+	0x10, 0x00, 0x12, 0x24, 0x0a, 0x20, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43, 0x54, 0x5f, 0x4d, 0x41,
+	0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x4f, 0x52, 0x5f, 0x45,
+	0x4e, 0x55, 0x4d, 0x5f, 0x49, 0x4e, 0x10, 0x01, 0x12, 0x28, 0x0a, 0x24, 0x53, 0x55, 0x42, 0x4a,
+	0x45, 0x43, 0x54, 0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52,
+	0x41, 0x54, 0x4f, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x4e, 0x4f, 0x54, 0x5f, 0x49, 0x4e,
+	0x10, 0x02, 0x12, 0x2d, 0x0a, 0x29, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43, 0x54, 0x5f, 0x4d, 0x41,
+	0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x4f, 0x52, 0x5f, 0x45,
+	0x4e, 0x55, 0x4d, 0x5f, 0x49, 0x4e, 0x5f, 0x43, 0x4f, 0x4e, 0x54, 0x41, 0x49, 0x4e, 0x53, 0x10,
+	0x03, 0x2a, 0x90, 0x01, 0x0a, 0x18, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x42,
+	0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x12, 0x2b,
+	0x0a, 0x27, 0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x42, 0x4f, 0x4f, 0x4c,
+	0x45, 0x41, 0x4e, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e,
+	0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x23, 0x0a, 0x1f, 0x43,
+	0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x42, 0x4f, 0x4f, 0x4c, 0x45, 0x41, 0x4e,
+	0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x41, 0x4e, 0x44, 0x10, 0x01,
+	0x12, 0x22, 0x0a, 0x1e, 0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x42, 0x4f,
+	0x4f, 0x4c, 0x45, 0x41, 0x4e, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f,
+	0x4f, 0x52, 0x10, 0x02, 0x2a, 0x88, 0x02, 0x0a, 0x13, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62, 0x6c,
+	0x69, 0x63, 0x4b, 0x65, 0x79, 0x41, 0x6c, 0x67, 0x45, 0x6e, 0x75, 0x6d, 0x12, 0x27, 0x0a, 0x23,
+	0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41,
+	0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46,
+	0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x24, 0x0a, 0x20, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42,
+	0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d,
+	0x5f, 0x52, 0x53, 0x41, 0x5f, 0x32, 0x30, 0x34, 0x38, 0x10, 0x01, 0x12, 0x24, 0x0a, 0x20, 0x4b,
+	0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c,
+	0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x34, 0x30, 0x39, 0x36, 0x10,
+	0x02, 0x12, 0x28, 0x0a, 0x24, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f,
+	0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x45, 0x43, 0x5f,
+	0x53, 0x45, 0x43, 0x50, 0x32, 0x35, 0x36, 0x52, 0x31, 0x10, 0x05, 0x12, 0x28, 0x0a, 0x24, 0x4b,
+	0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c,
+	0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x45, 0x43, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x33, 0x38,
+	0x34, 0x52, 0x31, 0x10, 0x06, 0x12, 0x28, 0x0a, 0x24, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42,
 	0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d,
-	0x5f, 0x45, 0x43, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x32, 0x35, 0x36, 0x52, 0x31, 0x10, 0x05, 0x12,
-	0x28, 0x0a, 0x24, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45,
-	0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x45, 0x43, 0x5f, 0x53, 0x45,
-	0x43, 0x50, 0x33, 0x38, 0x34, 0x52, 0x31, 0x10, 0x06, 0x12, 0x28, 0x0a, 0x24, 0x4b, 0x41, 0x53,
-	0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f,
-	0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x45, 0x43, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x35, 0x32, 0x31, 0x52,
-	0x31, 0x10, 0x07, 0x42, 0x82, 0x01, 0x0a, 0x0a, 0x63, 0x6f, 0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x42, 0x0c, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f,
-	0x50, 0x01, 0x5a, 0x2e, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f,
-	0x70, 0x65, 0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0xa2, 0x02, 0x03, 0x50, 0x58, 0x58, 0xaa, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63,
-	0x79, 0xca, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xe2, 0x02, 0x12, 0x50, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea,
-	0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x5f, 0x45, 0x43, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x35, 0x32, 0x31, 0x52, 0x31, 0x10, 0x07, 0x42,
+	0x82, 0x01, 0x0a, 0x0a, 0x63, 0x6f, 0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x42, 0x0c,
+	0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x2e,
+	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x74,
+	0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xa2, 0x02,
+	0x03, 0x50, 0x58, 0x58, 0xaa, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xca, 0x02, 0x06,
+	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xe2, 0x02, 0x12, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c,
+	0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x06, 0x50, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/service/authorization/authorization.go b/service/authorization/authorization.go
index 6c74757f4b..17622be148 100644
--- a/service/authorization/authorization.go
+++ b/service/authorization/authorization.go
@@ -221,7 +221,7 @@ func (as *AuthorizationService) getDecisions(ctx context.Context, dr *authorizat
 						EntityChainId: ec.GetId(),
 						Action: &policy.Action{
 							Value: &policy.Action_Standard{
-								Standard: policy.Action_STANDARD_ACTION_CREATE,
+								Standard: policy.Action_STANDARD_ACTION_TRANSMIT,
 							},
 						},
 					}
@@ -385,7 +385,7 @@ func (as *AuthorizationService) getDecisions(ctx context.Context, dr *authorizat
 				EntityChainId: ec.GetId(),
 				Action: &policy.Action{
 					Value: &policy.Action_Standard{
-						Standard: policy.Action_STANDARD_ACTION_CREATE,
+						Standard: policy.Action_STANDARD_ACTION_TRANSMIT,
 					},
 				},
 			}
diff --git a/service/integration/attribute_fqns_test.go b/service/integration/attribute_fqns_test.go
index 020703d5de..5dff45f951 100644
--- a/service/integration/attribute_fqns_test.go
+++ b/service/integration/attribute_fqns_test.go
@@ -734,7 +734,7 @@ func (s *AttributeFqnSuite) bigTestSetup(namespaceName string) bigSetup {
 	val2SM, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              val2.GetId(),
 		ExistingSubjectConditionSetId: s.f.GetSubjectConditionSetKey("subject_condition_set2").ID,
-		Actions:                       []*policy.Action{fixtureActions[Decrypt]},
+		Actions:                       []*policy.Action{fixtureActions[Read]},
 	})
 	s.Require().NoError(err)
 	s.NotNil(val2SM)
@@ -743,7 +743,7 @@ func (s *AttributeFqnSuite) bigTestSetup(namespaceName string) bigSetup {
 	val2SM2, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              val2.GetId(),
 		ExistingSubjectConditionSetId: s.f.GetSubjectConditionSetKey("subject_condition_set3").ID,
-		Actions:                       []*policy.Action{fixtureActions[Transmit], fixtureActions[Decrypt]},
+		Actions:                       []*policy.Action{fixtureActions[Transmit], fixtureActions[Read]},
 	})
 	s.Require().NoError(err)
 	s.NotNil(val2SM2)
diff --git a/service/policy/objects.proto b/service/policy/objects.proto
index cabcb372a8..532e6694e7 100644
--- a/service/policy/objects.proto
+++ b/service/policy/objects.proto
@@ -102,15 +102,13 @@ message Action {
   enum StandardAction {
     STANDARD_ACTION_UNSPECIFIED = 0;
 
-    // Deprecated STANDARD_ACTION_DECRYPT
-    // Migrated to `STANDARD_ACTION_READ`
-    reserved 1;
-    reserved "STANDARD_ACTION_DECRYPT";
-
-    // Deprecated STANDARD_ACTION_TRANSMIT
-    // Migrated to `STANDARD_ACTION_CREATE`
-    reserved 2;
-    reserved "STANDARD_ACTION_TRANSMIT";
+    // Deprecated
+    // Migrate to `STANDARD_ACTION_READ`
+    STANDARD_ACTION_DECRYPT = 1;
+
+    // Deprecated
+    // Migrate to `STANDARD_ACTION_CREATE` or a custom action
+    STANDARD_ACTION_TRANSMIT = 2;
 
     STANDARD_ACTION_CREATE = 3;
     STANDARD_ACTION_READ = 4;

From d83783ea84ed49ae54ad6270444629b033ff8ec8 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 31 Mar 2025 15:12:59 -0700
Subject: [PATCH 005/110] access pdp todo comment

---
 service/kas/access/accessPdp.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/service/kas/access/accessPdp.go b/service/kas/access/accessPdp.go
index 59a3a2ce17..5037eed686 100644
--- a/service/kas/access/accessPdp.go
+++ b/service/kas/access/accessPdp.go
@@ -64,6 +64,7 @@ func (p *Provider) checkAttributes(ctx context.Context, ras []*authorization.Res
 		DecisionRequests: []*authorization.TokenDecisionRequest{
 			{
 				Actions: []*policy.Action{
+					// TODO: support other actions rather than hardcoding read here
 					{Value: &policy.Action_Standard{Standard: policy.Action_STANDARD_ACTION_READ}},
 				},
 				Tokens:             []*authorization.Token{ent},

From ad9512cce22361d375f2f692055a8b030fc754d0 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Tue, 1 Apr 2025 09:07:57 -0700
Subject: [PATCH 006/110] list should specify stand/cust in response, and
 proactively prevent future breaking changes in action protos

---
 docs/grpc/index.html                          |  43 +-
 .../policy/actions/actions.swagger.json       |  13 +-
 protocol/go/policy/actions/actions.pb.go      | 421 +++++++++---------
 protocol/go/policy/actions/actions_grpc.pb.go |  66 +--
 .../actions/actionsconnect/actions.connect.go |  98 ++--
 service/policy/actions/actions.proto          |  25 +-
 6 files changed, 347 insertions(+), 319 deletions(-)

diff --git a/docs/grpc/index.html b/docs/grpc/index.html
index 6c25c0f142..8b9ef1abf6 100644
--- a/docs/grpc/index.html
+++ b/docs/grpc/index.html
@@ -573,19 +573,19 @@ <h2>Table of Contents</h2>
             <ul>
               
                 <li>
-                  <a href="#policy.actions.CreateCustomActionRequest"><span class="badge">M</span>CreateCustomActionRequest</a>
+                  <a href="#policy.actions.CreateActionRequest"><span class="badge">M</span>CreateActionRequest</a>
                 </li>
               
                 <li>
-                  <a href="#policy.actions.CreateCustomActionResponse"><span class="badge">M</span>CreateCustomActionResponse</a>
+                  <a href="#policy.actions.CreateActionResponse"><span class="badge">M</span>CreateActionResponse</a>
                 </li>
               
                 <li>
-                  <a href="#policy.actions.DeleteCustomActionRequest"><span class="badge">M</span>DeleteCustomActionRequest</a>
+                  <a href="#policy.actions.DeleteActionRequest"><span class="badge">M</span>DeleteActionRequest</a>
                 </li>
               
                 <li>
-                  <a href="#policy.actions.DeleteCustomActionResponse"><span class="badge">M</span>DeleteCustomActionResponse</a>
+                  <a href="#policy.actions.DeleteActionResponse"><span class="badge">M</span>DeleteActionResponse</a>
                 </li>
               
                 <li>
@@ -4686,8 +4686,8 @@ <h2 id="policy/actions/actions.proto">policy/actions/actions.proto</h2><a href="
       <p></p>
 
       
-        <h3 id="policy.actions.CreateCustomActionRequest">CreateCustomActionRequest</h3>
-        <p>Create a new custom action name with optional metadata.</p>
+        <h3 id="policy.actions.CreateActionRequest">CreateActionRequest</h3>
+        <p>Create a new Custom action name with optional metadata.</p><p>Creation of Standard actions is not supported.</p>
 
         
           <table class="field-table">
@@ -4717,7 +4717,7 @@ <h3 id="policy.actions.CreateCustomActionRequest">CreateCustomActionRequest</h3>
 
         
       
-        <h3 id="policy.actions.CreateCustomActionResponse">CreateCustomActionResponse</h3>
+        <h3 id="policy.actions.CreateActionResponse">CreateActionResponse</h3>
         <p></p>
 
         
@@ -4741,8 +4741,8 @@ <h3 id="policy.actions.CreateCustomActionResponse">CreateCustomActionResponse</h
 
         
       
-        <h3 id="policy.actions.DeleteCustomActionRequest">DeleteCustomActionRequest</h3>
-        <p>Deletion of standard actions is not supported.</p>
+        <h3 id="policy.actions.DeleteActionRequest">DeleteActionRequest</h3>
+        <p>Custom only: deletion of Standard actions is not supported.</p>
 
         
           <table class="field-table">
@@ -4765,7 +4765,7 @@ <h3 id="policy.actions.DeleteCustomActionRequest">DeleteCustomActionRequest</h3>
 
         
       
-        <h3 id="policy.actions.DeleteCustomActionResponse">DeleteCustomActionResponse</h3>
+        <h3 id="policy.actions.DeleteActionResponse">DeleteActionResponse</h3>
         <p></p>
 
         
@@ -4879,7 +4879,14 @@ <h3 id="policy.actions.ListActionsResponse">ListActionsResponse</h3>
             <tbody>
               
                 <tr>
-                  <td>actions</td>
+                  <td>actions_standard</td>
+                  <td><a href="#policy.Action">policy.Action</a></td>
+                  <td>repeated</td>
+                  <td><p> </p></td>
+                </tr>
+              
+                <tr>
+                  <td>actions_custom</td>
                   <td><a href="#policy.Action">policy.Action</a></td>
                   <td>repeated</td>
                   <td><p> </p></td>
@@ -4900,7 +4907,7 @@ <h3 id="policy.actions.ListActionsResponse">ListActionsResponse</h3>
         
       
         <h3 id="policy.actions.UpdateActionRequest">UpdateActionRequest</h3>
-        <p>Names may only be updated for custom actions.</p><p>Metadata may be updated for either custom or standard actions.</p>
+        <p>Metadata may be updated for either Custom or Standard actions.</p><p>Names may only be updated for Custom actions.</p>
 
         
           <table class="field-table">
@@ -4998,9 +5005,9 @@ <h3 id="policy.actions.ActionService">ActionService</h3>
               </tr>
             
               <tr>
-                <td>CreateCustomAction</td>
-                <td><a href="#policy.actions.CreateCustomActionRequest">CreateCustomActionRequest</a></td>
-                <td><a href="#policy.actions.CreateCustomActionResponse">CreateCustomActionResponse</a></td>
+                <td>CreateAction</td>
+                <td><a href="#policy.actions.CreateActionRequest">CreateActionRequest</a></td>
+                <td><a href="#policy.actions.CreateActionResponse">CreateActionResponse</a></td>
                 <td><p></p></td>
               </tr>
             
@@ -5012,9 +5019,9 @@ <h3 id="policy.actions.ActionService">ActionService</h3>
               </tr>
             
               <tr>
-                <td>DeleteCustomAction</td>
-                <td><a href="#policy.actions.DeleteCustomActionRequest">DeleteCustomActionRequest</a></td>
-                <td><a href="#policy.actions.DeleteCustomActionResponse">DeleteCustomActionResponse</a></td>
+                <td>DeleteAction</td>
+                <td><a href="#policy.actions.DeleteActionRequest">DeleteActionRequest</a></td>
+                <td><a href="#policy.actions.DeleteActionResponse">DeleteActionResponse</a></td>
                 <td><p></p></td>
               </tr>
             
diff --git a/docs/openapi/policy/actions/actions.swagger.json b/docs/openapi/policy/actions/actions.swagger.json
index 97db821e80..5f136e72fa 100644
--- a/docs/openapi/policy/actions/actions.swagger.json
+++ b/docs/openapi/policy/actions/actions.swagger.json
@@ -32,7 +32,7 @@
       "description": "- STANDARD_ACTION_DECRYPT: Deprecated\nMigrate to `STANDARD_ACTION_READ`\n - STANDARD_ACTION_TRANSMIT: Deprecated\nMigrate to `STANDARD_ACTION_CREATE` or a custom action",
       "title": "Standard actions supported by the platform"
     },
-    "actionsCreateCustomActionResponse": {
+    "actionsCreateActionResponse": {
       "type": "object",
       "properties": {
         "action": {
@@ -40,7 +40,7 @@
         }
       }
     },
-    "actionsDeleteCustomActionResponse": {
+    "actionsDeleteActionResponse": {
       "type": "object",
       "properties": {
         "action": {
@@ -59,7 +59,14 @@
     "actionsListActionsResponse": {
       "type": "object",
       "properties": {
-        "actions": {
+        "actionsStandard": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/policyAction"
+          }
+        },
+        "actionsCustom": {
           "type": "array",
           "items": {
             "type": "object",
diff --git a/protocol/go/policy/actions/actions.pb.go b/protocol/go/policy/actions/actions.pb.go
index 4338990a4c..e11d958c7d 100644
--- a/protocol/go/policy/actions/actions.pb.go
+++ b/protocol/go/policy/actions/actions.pb.go
@@ -206,8 +206,9 @@ type ListActionsResponse struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Actions    []*policy.Action     `protobuf:"bytes,1,rep,name=actions,proto3" json:"actions,omitempty"`
-	Pagination *policy.PageResponse `protobuf:"bytes,10,opt,name=pagination,proto3" json:"pagination,omitempty"`
+	ActionsStandard []*policy.Action     `protobuf:"bytes,1,rep,name=actions_standard,json=actionsStandard,proto3" json:"actions_standard,omitempty"`
+	ActionsCustom   []*policy.Action     `protobuf:"bytes,2,rep,name=actions_custom,json=actionsCustom,proto3" json:"actions_custom,omitempty"`
+	Pagination      *policy.PageResponse `protobuf:"bytes,10,opt,name=pagination,proto3" json:"pagination,omitempty"`
 }
 
 func (x *ListActionsResponse) Reset() {
@@ -242,9 +243,16 @@ func (*ListActionsResponse) Descriptor() ([]byte, []int) {
 	return file_policy_actions_actions_proto_rawDescGZIP(), []int{3}
 }
 
-func (x *ListActionsResponse) GetActions() []*policy.Action {
+func (x *ListActionsResponse) GetActionsStandard() []*policy.Action {
 	if x != nil {
-		return x.Actions
+		return x.ActionsStandard
+	}
+	return nil
+}
+
+func (x *ListActionsResponse) GetActionsCustom() []*policy.Action {
+	if x != nil {
+		return x.ActionsCustom
 	}
 	return nil
 }
@@ -256,8 +264,9 @@ func (x *ListActionsResponse) GetPagination() *policy.PageResponse {
 	return nil
 }
 
-// Create a new custom action name with optional metadata.
-type CreateCustomActionRequest struct {
+// Create a new Custom action name with optional metadata.
+// Creation of Standard actions is not supported.
+type CreateActionRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
@@ -268,8 +277,8 @@ type CreateCustomActionRequest struct {
 	Metadata *common.MetadataMutable `protobuf:"bytes,100,opt,name=metadata,proto3" json:"metadata,omitempty"`
 }
 
-func (x *CreateCustomActionRequest) Reset() {
-	*x = CreateCustomActionRequest{}
+func (x *CreateActionRequest) Reset() {
+	*x = CreateActionRequest{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_policy_actions_actions_proto_msgTypes[4]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -277,13 +286,13 @@ func (x *CreateCustomActionRequest) Reset() {
 	}
 }
 
-func (x *CreateCustomActionRequest) String() string {
+func (x *CreateActionRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*CreateCustomActionRequest) ProtoMessage() {}
+func (*CreateActionRequest) ProtoMessage() {}
 
-func (x *CreateCustomActionRequest) ProtoReflect() protoreflect.Message {
+func (x *CreateActionRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_policy_actions_actions_proto_msgTypes[4]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -295,26 +304,26 @@ func (x *CreateCustomActionRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use CreateCustomActionRequest.ProtoReflect.Descriptor instead.
-func (*CreateCustomActionRequest) Descriptor() ([]byte, []int) {
+// Deprecated: Use CreateActionRequest.ProtoReflect.Descriptor instead.
+func (*CreateActionRequest) Descriptor() ([]byte, []int) {
 	return file_policy_actions_actions_proto_rawDescGZIP(), []int{4}
 }
 
-func (x *CreateCustomActionRequest) GetName() string {
+func (x *CreateActionRequest) GetName() string {
 	if x != nil {
 		return x.Name
 	}
 	return ""
 }
 
-func (x *CreateCustomActionRequest) GetMetadata() *common.MetadataMutable {
+func (x *CreateActionRequest) GetMetadata() *common.MetadataMutable {
 	if x != nil {
 		return x.Metadata
 	}
 	return nil
 }
 
-type CreateCustomActionResponse struct {
+type CreateActionResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
@@ -322,8 +331,8 @@ type CreateCustomActionResponse struct {
 	Action *policy.Action `protobuf:"bytes,1,opt,name=action,proto3" json:"action,omitempty"`
 }
 
-func (x *CreateCustomActionResponse) Reset() {
-	*x = CreateCustomActionResponse{}
+func (x *CreateActionResponse) Reset() {
+	*x = CreateActionResponse{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_policy_actions_actions_proto_msgTypes[5]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -331,13 +340,13 @@ func (x *CreateCustomActionResponse) Reset() {
 	}
 }
 
-func (x *CreateCustomActionResponse) String() string {
+func (x *CreateActionResponse) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*CreateCustomActionResponse) ProtoMessage() {}
+func (*CreateActionResponse) ProtoMessage() {}
 
-func (x *CreateCustomActionResponse) ProtoReflect() protoreflect.Message {
+func (x *CreateActionResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_policy_actions_actions_proto_msgTypes[5]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -349,20 +358,20 @@ func (x *CreateCustomActionResponse) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use CreateCustomActionResponse.ProtoReflect.Descriptor instead.
-func (*CreateCustomActionResponse) Descriptor() ([]byte, []int) {
+// Deprecated: Use CreateActionResponse.ProtoReflect.Descriptor instead.
+func (*CreateActionResponse) Descriptor() ([]byte, []int) {
 	return file_policy_actions_actions_proto_rawDescGZIP(), []int{5}
 }
 
-func (x *CreateCustomActionResponse) GetAction() *policy.Action {
+func (x *CreateActionResponse) GetAction() *policy.Action {
 	if x != nil {
 		return x.Action
 	}
 	return nil
 }
 
-// Names may only be updated for custom actions.
-// Metadata may be updated for either custom or standard actions.
+// Metadata may be updated for either Custom or Standard actions.
+// Names may only be updated for Custom actions.
 type UpdateActionRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -485,8 +494,8 @@ func (x *UpdateActionResponse) GetAction() *policy.Action {
 	return nil
 }
 
-// Deletion of standard actions is not supported.
-type DeleteCustomActionRequest struct {
+// Custom only: deletion of Standard actions is not supported.
+type DeleteActionRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
@@ -495,8 +504,8 @@ type DeleteCustomActionRequest struct {
 	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
 }
 
-func (x *DeleteCustomActionRequest) Reset() {
-	*x = DeleteCustomActionRequest{}
+func (x *DeleteActionRequest) Reset() {
+	*x = DeleteActionRequest{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_policy_actions_actions_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -504,13 +513,13 @@ func (x *DeleteCustomActionRequest) Reset() {
 	}
 }
 
-func (x *DeleteCustomActionRequest) String() string {
+func (x *DeleteActionRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*DeleteCustomActionRequest) ProtoMessage() {}
+func (*DeleteActionRequest) ProtoMessage() {}
 
-func (x *DeleteCustomActionRequest) ProtoReflect() protoreflect.Message {
+func (x *DeleteActionRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_policy_actions_actions_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -522,19 +531,19 @@ func (x *DeleteCustomActionRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use DeleteCustomActionRequest.ProtoReflect.Descriptor instead.
-func (*DeleteCustomActionRequest) Descriptor() ([]byte, []int) {
+// Deprecated: Use DeleteActionRequest.ProtoReflect.Descriptor instead.
+func (*DeleteActionRequest) Descriptor() ([]byte, []int) {
 	return file_policy_actions_actions_proto_rawDescGZIP(), []int{8}
 }
 
-func (x *DeleteCustomActionRequest) GetId() string {
+func (x *DeleteActionRequest) GetId() string {
 	if x != nil {
 		return x.Id
 	}
 	return ""
 }
 
-type DeleteCustomActionResponse struct {
+type DeleteActionResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
@@ -542,8 +551,8 @@ type DeleteCustomActionResponse struct {
 	Action *policy.Action `protobuf:"bytes,1,opt,name=action,proto3" json:"action,omitempty"`
 }
 
-func (x *DeleteCustomActionResponse) Reset() {
-	*x = DeleteCustomActionResponse{}
+func (x *DeleteActionResponse) Reset() {
+	*x = DeleteActionResponse{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_policy_actions_actions_proto_msgTypes[9]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -551,13 +560,13 @@ func (x *DeleteCustomActionResponse) Reset() {
 	}
 }
 
-func (x *DeleteCustomActionResponse) String() string {
+func (x *DeleteActionResponse) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*DeleteCustomActionResponse) ProtoMessage() {}
+func (*DeleteActionResponse) ProtoMessage() {}
 
-func (x *DeleteCustomActionResponse) ProtoReflect() protoreflect.Message {
+func (x *DeleteActionResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_policy_actions_actions_proto_msgTypes[9]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -569,12 +578,12 @@ func (x *DeleteCustomActionResponse) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use DeleteCustomActionResponse.ProtoReflect.Descriptor instead.
-func (*DeleteCustomActionResponse) Descriptor() ([]byte, []int) {
+// Deprecated: Use DeleteActionResponse.ProtoReflect.Descriptor instead.
+func (*DeleteActionResponse) Descriptor() ([]byte, []int) {
 	return file_policy_actions_actions_proto_rawDescGZIP(), []int{9}
 }
 
-func (x *DeleteCustomActionResponse) GetAction() *policy.Action {
+func (x *DeleteActionResponse) GetAction() *policy.Action {
 	if x != nil {
 		return x.Action
 	}
@@ -624,127 +633,128 @@ var file_policy_actions_actions_proto_rawDesc = []byte{
 	0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b,
 	0x32, 0x13, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x61, 0x67, 0x65, 0x52, 0x65,
 	0x71, 0x75, 0x65, 0x73, 0x74, 0x52, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x22, 0x75, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x28, 0x0a, 0x07, 0x61, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x07, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x12, 0x34, 0x0a, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
-	0x50, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x52, 0x0a, 0x70, 0x61,
-	0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0xf3, 0x02, 0x0a, 0x19, 0x43, 0x72, 0x65,
-	0x61, 0x74, 0x65, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0xa0, 0x02, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x8b, 0x02, 0xba, 0x48, 0x87, 0x02, 0xba, 0x01, 0xfc, 0x01,
-	0x0a, 0x12, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x66, 0x6f,
-	0x72, 0x6d, 0x61, 0x74, 0x12, 0xa8, 0x01, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61,
-	0x6d, 0x65, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c,
-	0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x73, 0x74, 0x72, 0x69, 0x6e,
-	0x67, 0x2c, 0x20, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x69, 0x6e, 0x67, 0x20, 0x68, 0x79, 0x70, 0x68,
-	0x65, 0x6e, 0x73, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x75, 0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f,
-	0x72, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74, 0x20, 0x6e, 0x6f, 0x74, 0x20, 0x61, 0x73, 0x20, 0x74,
-	0x68, 0x65, 0x20, 0x66, 0x69, 0x72, 0x73, 0x74, 0x20, 0x6f, 0x72, 0x20, 0x6c, 0x61, 0x73, 0x74,
-	0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2e, 0x20, 0x54, 0x68, 0x65, 0x20,
-	0x73, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61,
-	0x6d, 0x65, 0x20, 0x69, 0x73, 0x20, 0x6e, 0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64,
-	0x20, 0x74, 0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a,
-	0x3b, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e,
-	0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61,
-	0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a,
-	0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x72, 0x05, 0x10, 0x01,
-	0x18, 0xfd, 0x01, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74,
-	0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f,
-	0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4d, 0x75, 0x74,
-	0x61, 0x62, 0x6c, 0x65, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x44,
-	0x0a, 0x1a, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x41, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06,
-	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x22, 0xdd, 0x03, 0x0a, 0x13, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02,
-	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0,
-	0x01, 0x01, 0x52, 0x02, 0x69, 0x64, 0x12, 0xa0, 0x02, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x8b, 0x02, 0xba, 0x48, 0x87, 0x02, 0xba, 0x01, 0xfc, 0x01,
-	0x0a, 0x12, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x66, 0x6f,
-	0x72, 0x6d, 0x61, 0x74, 0x12, 0xa8, 0x01, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61,
-	0x6d, 0x65, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c,
-	0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x73, 0x74, 0x72, 0x69, 0x6e,
-	0x67, 0x2c, 0x20, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x69, 0x6e, 0x67, 0x20, 0x68, 0x79, 0x70, 0x68,
-	0x65, 0x6e, 0x73, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x75, 0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f,
-	0x72, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74, 0x20, 0x6e, 0x6f, 0x74, 0x20, 0x61, 0x73, 0x20, 0x74,
-	0x68, 0x65, 0x20, 0x66, 0x69, 0x72, 0x73, 0x74, 0x20, 0x6f, 0x72, 0x20, 0x6c, 0x61, 0x73, 0x74,
-	0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2e, 0x20, 0x54, 0x68, 0x65, 0x20,
-	0x73, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61,
-	0x6d, 0x65, 0x20, 0x69, 0x73, 0x20, 0x6e, 0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64,
-	0x20, 0x74, 0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a,
-	0x3b, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e,
-	0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61,
-	0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a,
-	0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x72, 0x05, 0x10, 0x01,
-	0x18, 0xfd, 0x01, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74,
-	0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f,
-	0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4d, 0x75, 0x74,
-	0x61, 0x62, 0x6c, 0x65, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x54,
-	0x0a, 0x18, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x75, 0x70, 0x64, 0x61, 0x74,
-	0x65, 0x5f, 0x62, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x18, 0x65, 0x20, 0x01, 0x28, 0x0e,
-	0x32, 0x1a, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x52, 0x16, 0x6d, 0x65,
-	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x42, 0x65, 0x68, 0x61,
-	0x76, 0x69, 0x6f, 0x72, 0x22, 0x3e, 0x0a, 0x14, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06,
-	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x22, 0x35, 0x0a, 0x19, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x75,
-	0x73, 0x74, 0x6f, 0x6d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba,
-	0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x52, 0x02, 0x69, 0x64, 0x22, 0x44, 0x0a, 0x1a, 0x44,
-	0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x41, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x22, 0xbd, 0x01, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x39, 0x0a, 0x10, 0x61, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x5f, 0x73, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x18, 0x01, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x52, 0x0f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x53, 0x74, 0x61, 0x6e,
+	0x64, 0x61, 0x72, 0x64, 0x12, 0x35, 0x0a, 0x0e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x5f,
+	0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0d, 0x61, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x12, 0x34, 0x0a, 0x0a, 0x70,
+	0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x14, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x52, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x22, 0xed, 0x02, 0x0a, 0x13, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0xa0, 0x02, 0x0a, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x8b, 0x02, 0xba, 0x48, 0x87, 0x02, 0xba,
+	0x01, 0xfc, 0x01, 0x0a, 0x12, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65,
+	0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0xa8, 0x01, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x61, 0x6e,
+	0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x73, 0x74,
+	0x72, 0x69, 0x6e, 0x67, 0x2c, 0x20, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x69, 0x6e, 0x67, 0x20, 0x68,
+	0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x75, 0x6e, 0x64, 0x65, 0x72,
+	0x73, 0x63, 0x6f, 0x72, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74, 0x20, 0x6e, 0x6f, 0x74, 0x20, 0x61,
+	0x73, 0x20, 0x74, 0x68, 0x65, 0x20, 0x66, 0x69, 0x72, 0x73, 0x74, 0x20, 0x6f, 0x72, 0x20, 0x6c,
+	0x61, 0x73, 0x74, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2e, 0x20, 0x54,
+	0x68, 0x65, 0x20, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x69, 0x73, 0x20, 0x6e, 0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69,
+	0x7a, 0x65, 0x64, 0x20, 0x74, 0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20, 0x63, 0x61, 0x73,
+	0x65, 0x2e, 0x1a, 0x3b, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73,
+	0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f,
+	0x3a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b,
+	0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x72,
+	0x05, 0x10, 0x01, 0x18, 0xfd, 0x01, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a, 0x08,
+	0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17,
+	0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0x4d, 0x75, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0x22, 0x3e, 0x0a, 0x14, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x22, 0xdd, 0x03, 0x0a, 0x13, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x52,
+	0x02, 0x69, 0x64, 0x12, 0xa0, 0x02, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x42, 0x8b, 0x02, 0xba, 0x48, 0x87, 0x02, 0xba, 0x01, 0xfc, 0x01, 0x0a, 0x12, 0x61,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61,
+	0x74, 0x12, 0xa8, 0x01, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20,
+	0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x2c, 0x20,
+	0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x69, 0x6e, 0x67, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73,
+	0x20, 0x61, 0x6e, 0x64, 0x20, 0x75, 0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f, 0x72, 0x65, 0x73,
+	0x20, 0x62, 0x75, 0x74, 0x20, 0x6e, 0x6f, 0x74, 0x20, 0x61, 0x73, 0x20, 0x74, 0x68, 0x65, 0x20,
+	0x66, 0x69, 0x72, 0x73, 0x74, 0x20, 0x6f, 0x72, 0x20, 0x6c, 0x61, 0x73, 0x74, 0x20, 0x63, 0x68,
+	0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2e, 0x20, 0x54, 0x68, 0x65, 0x20, 0x73, 0x74, 0x6f,
+	0x72, 0x65, 0x64, 0x20, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20,
+	0x69, 0x73, 0x20, 0x6e, 0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64, 0x20, 0x74, 0x6f,
+	0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a, 0x3b, 0x74, 0x68,
+	0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d,
+	0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61, 0x2d, 0x7a, 0x41,
+	0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a,
+	0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x72, 0x05, 0x10, 0x01, 0x18, 0xfd, 0x01,
+	0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f,
+	0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4d, 0x75, 0x74, 0x61, 0x62, 0x6c,
+	0x65, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x54, 0x0a, 0x18, 0x6d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x62,
+	0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x18, 0x65, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e,
+	0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x55,
+	0x70, 0x64, 0x61, 0x74, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x52, 0x16, 0x6d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x42, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f,
+	0x72, 0x22, 0x3e, 0x0a, 0x14, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f,
 	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74,
 	0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
 	0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x32, 0xf8, 0x03, 0x0a, 0x0d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x12, 0x52, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x12, 0x20, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x21, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x41,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x22, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
-	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x70, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74,
-	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
-	0x00, 0x12, 0x6d, 0x0a, 0x12, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x75, 0x73, 0x74, 0x6f,
-	0x6d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x29, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43,
-	0x75, 0x73, 0x74, 0x6f, 0x6d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x2a, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d,
-	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00,
-	0x12, 0x5b, 0x0a, 0x0c, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x12, 0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x73, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x6d, 0x0a,
-	0x12, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x41, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x12, 0x29, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x75, 0x73, 0x74, 0x6f,
-	0x6d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2a,
-	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e,
-	0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x41, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0xb3, 0x01, 0x0a,
-	0x12, 0x63, 0x6f, 0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x42, 0x0c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x50, 0x72, 0x6f, 0x74,
-	0x6f, 0x50, 0x01, 0x5a, 0x36, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f,
-	0x6f, 0x70, 0x65, 0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d,
-	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x2f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xa2, 0x02, 0x03, 0x50, 0x41,
-	0x58, 0xaa, 0x02, 0x0e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0xca, 0x02, 0x0e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0xe2, 0x02, 0x1a, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
-	0xea, 0x02, 0x0f, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x3a, 0x3a, 0x41, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x6e, 0x22, 0x2f, 0x0a, 0x13, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x52, 0x02,
+	0x69, 0x64, 0x22, 0x3e, 0x0a, 0x14, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x32, 0xd4, 0x03, 0x0a, 0x0d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x12, 0x52, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x12, 0x20, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x22, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x70, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73,
+	0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x12, 0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12,
+	0x5b, 0x0a, 0x0c, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12,
+	0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
+	0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c,
+	0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x2e, 0x70,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x44, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0xb3, 0x01, 0x0a, 0x12, 0x63, 0x6f,
+	0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
+	0x42, 0x0c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01,
+	0x5a, 0x36, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65,
+	0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x2f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xa2, 0x02, 0x03, 0x50, 0x41, 0x58, 0xaa, 0x02,
+	0x0e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xca,
+	0x02, 0x0e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
+	0xe2, 0x02, 0x1a, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x0f,
+	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x3a, 0x3a, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x62,
+	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -761,48 +771,49 @@ func file_policy_actions_actions_proto_rawDescGZIP() []byte {
 
 var file_policy_actions_actions_proto_msgTypes = make([]protoimpl.MessageInfo, 10)
 var file_policy_actions_actions_proto_goTypes = []interface{}{
-	(*GetActionRequest)(nil),           // 0: policy.actions.GetActionRequest
-	(*GetActionResponse)(nil),          // 1: policy.actions.GetActionResponse
-	(*ListActionsRequest)(nil),         // 2: policy.actions.ListActionsRequest
-	(*ListActionsResponse)(nil),        // 3: policy.actions.ListActionsResponse
-	(*CreateCustomActionRequest)(nil),  // 4: policy.actions.CreateCustomActionRequest
-	(*CreateCustomActionResponse)(nil), // 5: policy.actions.CreateCustomActionResponse
-	(*UpdateActionRequest)(nil),        // 6: policy.actions.UpdateActionRequest
-	(*UpdateActionResponse)(nil),       // 7: policy.actions.UpdateActionResponse
-	(*DeleteCustomActionRequest)(nil),  // 8: policy.actions.DeleteCustomActionRequest
-	(*DeleteCustomActionResponse)(nil), // 9: policy.actions.DeleteCustomActionResponse
-	(*policy.Action)(nil),              // 10: policy.Action
-	(*policy.PageRequest)(nil),         // 11: policy.PageRequest
-	(*policy.PageResponse)(nil),        // 12: policy.PageResponse
-	(*common.MetadataMutable)(nil),     // 13: common.MetadataMutable
-	(common.MetadataUpdateEnum)(0),     // 14: common.MetadataUpdateEnum
+	(*GetActionRequest)(nil),       // 0: policy.actions.GetActionRequest
+	(*GetActionResponse)(nil),      // 1: policy.actions.GetActionResponse
+	(*ListActionsRequest)(nil),     // 2: policy.actions.ListActionsRequest
+	(*ListActionsResponse)(nil),    // 3: policy.actions.ListActionsResponse
+	(*CreateActionRequest)(nil),    // 4: policy.actions.CreateActionRequest
+	(*CreateActionResponse)(nil),   // 5: policy.actions.CreateActionResponse
+	(*UpdateActionRequest)(nil),    // 6: policy.actions.UpdateActionRequest
+	(*UpdateActionResponse)(nil),   // 7: policy.actions.UpdateActionResponse
+	(*DeleteActionRequest)(nil),    // 8: policy.actions.DeleteActionRequest
+	(*DeleteActionResponse)(nil),   // 9: policy.actions.DeleteActionResponse
+	(*policy.Action)(nil),          // 10: policy.Action
+	(*policy.PageRequest)(nil),     // 11: policy.PageRequest
+	(*policy.PageResponse)(nil),    // 12: policy.PageResponse
+	(*common.MetadataMutable)(nil), // 13: common.MetadataMutable
+	(common.MetadataUpdateEnum)(0), // 14: common.MetadataUpdateEnum
 }
 var file_policy_actions_actions_proto_depIdxs = []int32{
 	10, // 0: policy.actions.GetActionResponse.action:type_name -> policy.Action
 	11, // 1: policy.actions.ListActionsRequest.pagination:type_name -> policy.PageRequest
-	10, // 2: policy.actions.ListActionsResponse.actions:type_name -> policy.Action
-	12, // 3: policy.actions.ListActionsResponse.pagination:type_name -> policy.PageResponse
-	13, // 4: policy.actions.CreateCustomActionRequest.metadata:type_name -> common.MetadataMutable
-	10, // 5: policy.actions.CreateCustomActionResponse.action:type_name -> policy.Action
-	13, // 6: policy.actions.UpdateActionRequest.metadata:type_name -> common.MetadataMutable
-	14, // 7: policy.actions.UpdateActionRequest.metadata_update_behavior:type_name -> common.MetadataUpdateEnum
-	10, // 8: policy.actions.UpdateActionResponse.action:type_name -> policy.Action
-	10, // 9: policy.actions.DeleteCustomActionResponse.action:type_name -> policy.Action
-	0,  // 10: policy.actions.ActionService.GetAction:input_type -> policy.actions.GetActionRequest
-	2,  // 11: policy.actions.ActionService.ListActions:input_type -> policy.actions.ListActionsRequest
-	4,  // 12: policy.actions.ActionService.CreateCustomAction:input_type -> policy.actions.CreateCustomActionRequest
-	6,  // 13: policy.actions.ActionService.UpdateAction:input_type -> policy.actions.UpdateActionRequest
-	8,  // 14: policy.actions.ActionService.DeleteCustomAction:input_type -> policy.actions.DeleteCustomActionRequest
-	1,  // 15: policy.actions.ActionService.GetAction:output_type -> policy.actions.GetActionResponse
-	3,  // 16: policy.actions.ActionService.ListActions:output_type -> policy.actions.ListActionsResponse
-	5,  // 17: policy.actions.ActionService.CreateCustomAction:output_type -> policy.actions.CreateCustomActionResponse
-	7,  // 18: policy.actions.ActionService.UpdateAction:output_type -> policy.actions.UpdateActionResponse
-	9,  // 19: policy.actions.ActionService.DeleteCustomAction:output_type -> policy.actions.DeleteCustomActionResponse
-	15, // [15:20] is the sub-list for method output_type
-	10, // [10:15] is the sub-list for method input_type
-	10, // [10:10] is the sub-list for extension type_name
-	10, // [10:10] is the sub-list for extension extendee
-	0,  // [0:10] is the sub-list for field type_name
+	10, // 2: policy.actions.ListActionsResponse.actions_standard:type_name -> policy.Action
+	10, // 3: policy.actions.ListActionsResponse.actions_custom:type_name -> policy.Action
+	12, // 4: policy.actions.ListActionsResponse.pagination:type_name -> policy.PageResponse
+	13, // 5: policy.actions.CreateActionRequest.metadata:type_name -> common.MetadataMutable
+	10, // 6: policy.actions.CreateActionResponse.action:type_name -> policy.Action
+	13, // 7: policy.actions.UpdateActionRequest.metadata:type_name -> common.MetadataMutable
+	14, // 8: policy.actions.UpdateActionRequest.metadata_update_behavior:type_name -> common.MetadataUpdateEnum
+	10, // 9: policy.actions.UpdateActionResponse.action:type_name -> policy.Action
+	10, // 10: policy.actions.DeleteActionResponse.action:type_name -> policy.Action
+	0,  // 11: policy.actions.ActionService.GetAction:input_type -> policy.actions.GetActionRequest
+	2,  // 12: policy.actions.ActionService.ListActions:input_type -> policy.actions.ListActionsRequest
+	4,  // 13: policy.actions.ActionService.CreateAction:input_type -> policy.actions.CreateActionRequest
+	6,  // 14: policy.actions.ActionService.UpdateAction:input_type -> policy.actions.UpdateActionRequest
+	8,  // 15: policy.actions.ActionService.DeleteAction:input_type -> policy.actions.DeleteActionRequest
+	1,  // 16: policy.actions.ActionService.GetAction:output_type -> policy.actions.GetActionResponse
+	3,  // 17: policy.actions.ActionService.ListActions:output_type -> policy.actions.ListActionsResponse
+	5,  // 18: policy.actions.ActionService.CreateAction:output_type -> policy.actions.CreateActionResponse
+	7,  // 19: policy.actions.ActionService.UpdateAction:output_type -> policy.actions.UpdateActionResponse
+	9,  // 20: policy.actions.ActionService.DeleteAction:output_type -> policy.actions.DeleteActionResponse
+	16, // [16:21] is the sub-list for method output_type
+	11, // [11:16] is the sub-list for method input_type
+	11, // [11:11] is the sub-list for extension type_name
+	11, // [11:11] is the sub-list for extension extendee
+	0,  // [0:11] is the sub-list for field type_name
 }
 
 func init() { file_policy_actions_actions_proto_init() }
@@ -860,7 +871,7 @@ func file_policy_actions_actions_proto_init() {
 			}
 		}
 		file_policy_actions_actions_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CreateCustomActionRequest); i {
+			switch v := v.(*CreateActionRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -872,7 +883,7 @@ func file_policy_actions_actions_proto_init() {
 			}
 		}
 		file_policy_actions_actions_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CreateCustomActionResponse); i {
+			switch v := v.(*CreateActionResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -908,7 +919,7 @@ func file_policy_actions_actions_proto_init() {
 			}
 		}
 		file_policy_actions_actions_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DeleteCustomActionRequest); i {
+			switch v := v.(*DeleteActionRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -920,7 +931,7 @@ func file_policy_actions_actions_proto_init() {
 			}
 		}
 		file_policy_actions_actions_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DeleteCustomActionResponse); i {
+			switch v := v.(*DeleteActionResponse); i {
 			case 0:
 				return &v.state
 			case 1:
diff --git a/protocol/go/policy/actions/actions_grpc.pb.go b/protocol/go/policy/actions/actions_grpc.pb.go
index 44026dd2f1..1f6c88cb54 100644
--- a/protocol/go/policy/actions/actions_grpc.pb.go
+++ b/protocol/go/policy/actions/actions_grpc.pb.go
@@ -19,11 +19,11 @@ import (
 const _ = grpc.SupportPackageIsVersion7
 
 const (
-	ActionService_GetAction_FullMethodName          = "/policy.actions.ActionService/GetAction"
-	ActionService_ListActions_FullMethodName        = "/policy.actions.ActionService/ListActions"
-	ActionService_CreateCustomAction_FullMethodName = "/policy.actions.ActionService/CreateCustomAction"
-	ActionService_UpdateAction_FullMethodName       = "/policy.actions.ActionService/UpdateAction"
-	ActionService_DeleteCustomAction_FullMethodName = "/policy.actions.ActionService/DeleteCustomAction"
+	ActionService_GetAction_FullMethodName    = "/policy.actions.ActionService/GetAction"
+	ActionService_ListActions_FullMethodName  = "/policy.actions.ActionService/ListActions"
+	ActionService_CreateAction_FullMethodName = "/policy.actions.ActionService/CreateAction"
+	ActionService_UpdateAction_FullMethodName = "/policy.actions.ActionService/UpdateAction"
+	ActionService_DeleteAction_FullMethodName = "/policy.actions.ActionService/DeleteAction"
 )
 
 // ActionServiceClient is the client API for ActionService service.
@@ -32,9 +32,9 @@ const (
 type ActionServiceClient interface {
 	GetAction(ctx context.Context, in *GetActionRequest, opts ...grpc.CallOption) (*GetActionResponse, error)
 	ListActions(ctx context.Context, in *ListActionsRequest, opts ...grpc.CallOption) (*ListActionsResponse, error)
-	CreateCustomAction(ctx context.Context, in *CreateCustomActionRequest, opts ...grpc.CallOption) (*CreateCustomActionResponse, error)
+	CreateAction(ctx context.Context, in *CreateActionRequest, opts ...grpc.CallOption) (*CreateActionResponse, error)
 	UpdateAction(ctx context.Context, in *UpdateActionRequest, opts ...grpc.CallOption) (*UpdateActionResponse, error)
-	DeleteCustomAction(ctx context.Context, in *DeleteCustomActionRequest, opts ...grpc.CallOption) (*DeleteCustomActionResponse, error)
+	DeleteAction(ctx context.Context, in *DeleteActionRequest, opts ...grpc.CallOption) (*DeleteActionResponse, error)
 }
 
 type actionServiceClient struct {
@@ -63,9 +63,9 @@ func (c *actionServiceClient) ListActions(ctx context.Context, in *ListActionsRe
 	return out, nil
 }
 
-func (c *actionServiceClient) CreateCustomAction(ctx context.Context, in *CreateCustomActionRequest, opts ...grpc.CallOption) (*CreateCustomActionResponse, error) {
-	out := new(CreateCustomActionResponse)
-	err := c.cc.Invoke(ctx, ActionService_CreateCustomAction_FullMethodName, in, out, opts...)
+func (c *actionServiceClient) CreateAction(ctx context.Context, in *CreateActionRequest, opts ...grpc.CallOption) (*CreateActionResponse, error) {
+	out := new(CreateActionResponse)
+	err := c.cc.Invoke(ctx, ActionService_CreateAction_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -81,9 +81,9 @@ func (c *actionServiceClient) UpdateAction(ctx context.Context, in *UpdateAction
 	return out, nil
 }
 
-func (c *actionServiceClient) DeleteCustomAction(ctx context.Context, in *DeleteCustomActionRequest, opts ...grpc.CallOption) (*DeleteCustomActionResponse, error) {
-	out := new(DeleteCustomActionResponse)
-	err := c.cc.Invoke(ctx, ActionService_DeleteCustomAction_FullMethodName, in, out, opts...)
+func (c *actionServiceClient) DeleteAction(ctx context.Context, in *DeleteActionRequest, opts ...grpc.CallOption) (*DeleteActionResponse, error) {
+	out := new(DeleteActionResponse)
+	err := c.cc.Invoke(ctx, ActionService_DeleteAction_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -96,9 +96,9 @@ func (c *actionServiceClient) DeleteCustomAction(ctx context.Context, in *Delete
 type ActionServiceServer interface {
 	GetAction(context.Context, *GetActionRequest) (*GetActionResponse, error)
 	ListActions(context.Context, *ListActionsRequest) (*ListActionsResponse, error)
-	CreateCustomAction(context.Context, *CreateCustomActionRequest) (*CreateCustomActionResponse, error)
+	CreateAction(context.Context, *CreateActionRequest) (*CreateActionResponse, error)
 	UpdateAction(context.Context, *UpdateActionRequest) (*UpdateActionResponse, error)
-	DeleteCustomAction(context.Context, *DeleteCustomActionRequest) (*DeleteCustomActionResponse, error)
+	DeleteAction(context.Context, *DeleteActionRequest) (*DeleteActionResponse, error)
 	mustEmbedUnimplementedActionServiceServer()
 }
 
@@ -112,14 +112,14 @@ func (UnimplementedActionServiceServer) GetAction(context.Context, *GetActionReq
 func (UnimplementedActionServiceServer) ListActions(context.Context, *ListActionsRequest) (*ListActionsResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ListActions not implemented")
 }
-func (UnimplementedActionServiceServer) CreateCustomAction(context.Context, *CreateCustomActionRequest) (*CreateCustomActionResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method CreateCustomAction not implemented")
+func (UnimplementedActionServiceServer) CreateAction(context.Context, *CreateActionRequest) (*CreateActionResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateAction not implemented")
 }
 func (UnimplementedActionServiceServer) UpdateAction(context.Context, *UpdateActionRequest) (*UpdateActionResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method UpdateAction not implemented")
 }
-func (UnimplementedActionServiceServer) DeleteCustomAction(context.Context, *DeleteCustomActionRequest) (*DeleteCustomActionResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method DeleteCustomAction not implemented")
+func (UnimplementedActionServiceServer) DeleteAction(context.Context, *DeleteActionRequest) (*DeleteActionResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DeleteAction not implemented")
 }
 func (UnimplementedActionServiceServer) mustEmbedUnimplementedActionServiceServer() {}
 
@@ -170,20 +170,20 @@ func _ActionService_ListActions_Handler(srv interface{}, ctx context.Context, de
 	return interceptor(ctx, in, info, handler)
 }
 
-func _ActionService_CreateCustomAction_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(CreateCustomActionRequest)
+func _ActionService_CreateAction_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateActionRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(ActionServiceServer).CreateCustomAction(ctx, in)
+		return srv.(ActionServiceServer).CreateAction(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: ActionService_CreateCustomAction_FullMethodName,
+		FullMethod: ActionService_CreateAction_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ActionServiceServer).CreateCustomAction(ctx, req.(*CreateCustomActionRequest))
+		return srv.(ActionServiceServer).CreateAction(ctx, req.(*CreateActionRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }
@@ -206,20 +206,20 @@ func _ActionService_UpdateAction_Handler(srv interface{}, ctx context.Context, d
 	return interceptor(ctx, in, info, handler)
 }
 
-func _ActionService_DeleteCustomAction_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(DeleteCustomActionRequest)
+func _ActionService_DeleteAction_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteActionRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(ActionServiceServer).DeleteCustomAction(ctx, in)
+		return srv.(ActionServiceServer).DeleteAction(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: ActionService_DeleteCustomAction_FullMethodName,
+		FullMethod: ActionService_DeleteAction_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(ActionServiceServer).DeleteCustomAction(ctx, req.(*DeleteCustomActionRequest))
+		return srv.(ActionServiceServer).DeleteAction(ctx, req.(*DeleteActionRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }
@@ -240,16 +240,16 @@ var ActionService_ServiceDesc = grpc.ServiceDesc{
 			Handler:    _ActionService_ListActions_Handler,
 		},
 		{
-			MethodName: "CreateCustomAction",
-			Handler:    _ActionService_CreateCustomAction_Handler,
+			MethodName: "CreateAction",
+			Handler:    _ActionService_CreateAction_Handler,
 		},
 		{
 			MethodName: "UpdateAction",
 			Handler:    _ActionService_UpdateAction_Handler,
 		},
 		{
-			MethodName: "DeleteCustomAction",
-			Handler:    _ActionService_DeleteCustomAction_Handler,
+			MethodName: "DeleteAction",
+			Handler:    _ActionService_DeleteAction_Handler,
 		},
 	},
 	Streams:  []grpc.StreamDesc{},
diff --git a/protocol/go/policy/actions/actionsconnect/actions.connect.go b/protocol/go/policy/actions/actionsconnect/actions.connect.go
index 8469807704..38a80350e3 100644
--- a/protocol/go/policy/actions/actionsconnect/actions.connect.go
+++ b/protocol/go/policy/actions/actionsconnect/actions.connect.go
@@ -38,34 +38,34 @@ const (
 	// ActionServiceListActionsProcedure is the fully-qualified name of the ActionService's ListActions
 	// RPC.
 	ActionServiceListActionsProcedure = "/policy.actions.ActionService/ListActions"
-	// ActionServiceCreateCustomActionProcedure is the fully-qualified name of the ActionService's
-	// CreateCustomAction RPC.
-	ActionServiceCreateCustomActionProcedure = "/policy.actions.ActionService/CreateCustomAction"
+	// ActionServiceCreateActionProcedure is the fully-qualified name of the ActionService's
+	// CreateAction RPC.
+	ActionServiceCreateActionProcedure = "/policy.actions.ActionService/CreateAction"
 	// ActionServiceUpdateActionProcedure is the fully-qualified name of the ActionService's
 	// UpdateAction RPC.
 	ActionServiceUpdateActionProcedure = "/policy.actions.ActionService/UpdateAction"
-	// ActionServiceDeleteCustomActionProcedure is the fully-qualified name of the ActionService's
-	// DeleteCustomAction RPC.
-	ActionServiceDeleteCustomActionProcedure = "/policy.actions.ActionService/DeleteCustomAction"
+	// ActionServiceDeleteActionProcedure is the fully-qualified name of the ActionService's
+	// DeleteAction RPC.
+	ActionServiceDeleteActionProcedure = "/policy.actions.ActionService/DeleteAction"
 )
 
 // These variables are the protoreflect.Descriptor objects for the RPCs defined in this package.
 var (
-	actionServiceServiceDescriptor                  = actions.File_policy_actions_actions_proto.Services().ByName("ActionService")
-	actionServiceGetActionMethodDescriptor          = actionServiceServiceDescriptor.Methods().ByName("GetAction")
-	actionServiceListActionsMethodDescriptor        = actionServiceServiceDescriptor.Methods().ByName("ListActions")
-	actionServiceCreateCustomActionMethodDescriptor = actionServiceServiceDescriptor.Methods().ByName("CreateCustomAction")
-	actionServiceUpdateActionMethodDescriptor       = actionServiceServiceDescriptor.Methods().ByName("UpdateAction")
-	actionServiceDeleteCustomActionMethodDescriptor = actionServiceServiceDescriptor.Methods().ByName("DeleteCustomAction")
+	actionServiceServiceDescriptor            = actions.File_policy_actions_actions_proto.Services().ByName("ActionService")
+	actionServiceGetActionMethodDescriptor    = actionServiceServiceDescriptor.Methods().ByName("GetAction")
+	actionServiceListActionsMethodDescriptor  = actionServiceServiceDescriptor.Methods().ByName("ListActions")
+	actionServiceCreateActionMethodDescriptor = actionServiceServiceDescriptor.Methods().ByName("CreateAction")
+	actionServiceUpdateActionMethodDescriptor = actionServiceServiceDescriptor.Methods().ByName("UpdateAction")
+	actionServiceDeleteActionMethodDescriptor = actionServiceServiceDescriptor.Methods().ByName("DeleteAction")
 )
 
 // ActionServiceClient is a client for the policy.actions.ActionService service.
 type ActionServiceClient interface {
 	GetAction(context.Context, *connect.Request[actions.GetActionRequest]) (*connect.Response[actions.GetActionResponse], error)
 	ListActions(context.Context, *connect.Request[actions.ListActionsRequest]) (*connect.Response[actions.ListActionsResponse], error)
-	CreateCustomAction(context.Context, *connect.Request[actions.CreateCustomActionRequest]) (*connect.Response[actions.CreateCustomActionResponse], error)
+	CreateAction(context.Context, *connect.Request[actions.CreateActionRequest]) (*connect.Response[actions.CreateActionResponse], error)
 	UpdateAction(context.Context, *connect.Request[actions.UpdateActionRequest]) (*connect.Response[actions.UpdateActionResponse], error)
-	DeleteCustomAction(context.Context, *connect.Request[actions.DeleteCustomActionRequest]) (*connect.Response[actions.DeleteCustomActionResponse], error)
+	DeleteAction(context.Context, *connect.Request[actions.DeleteActionRequest]) (*connect.Response[actions.DeleteActionResponse], error)
 }
 
 // NewActionServiceClient constructs a client for the policy.actions.ActionService service. By
@@ -90,10 +90,10 @@ func NewActionServiceClient(httpClient connect.HTTPClient, baseURL string, opts
 			connect.WithSchema(actionServiceListActionsMethodDescriptor),
 			connect.WithClientOptions(opts...),
 		),
-		createCustomAction: connect.NewClient[actions.CreateCustomActionRequest, actions.CreateCustomActionResponse](
+		createAction: connect.NewClient[actions.CreateActionRequest, actions.CreateActionResponse](
 			httpClient,
-			baseURL+ActionServiceCreateCustomActionProcedure,
-			connect.WithSchema(actionServiceCreateCustomActionMethodDescriptor),
+			baseURL+ActionServiceCreateActionProcedure,
+			connect.WithSchema(actionServiceCreateActionMethodDescriptor),
 			connect.WithClientOptions(opts...),
 		),
 		updateAction: connect.NewClient[actions.UpdateActionRequest, actions.UpdateActionResponse](
@@ -102,10 +102,10 @@ func NewActionServiceClient(httpClient connect.HTTPClient, baseURL string, opts
 			connect.WithSchema(actionServiceUpdateActionMethodDescriptor),
 			connect.WithClientOptions(opts...),
 		),
-		deleteCustomAction: connect.NewClient[actions.DeleteCustomActionRequest, actions.DeleteCustomActionResponse](
+		deleteAction: connect.NewClient[actions.DeleteActionRequest, actions.DeleteActionResponse](
 			httpClient,
-			baseURL+ActionServiceDeleteCustomActionProcedure,
-			connect.WithSchema(actionServiceDeleteCustomActionMethodDescriptor),
+			baseURL+ActionServiceDeleteActionProcedure,
+			connect.WithSchema(actionServiceDeleteActionMethodDescriptor),
 			connect.WithClientOptions(opts...),
 		),
 	}
@@ -113,11 +113,11 @@ func NewActionServiceClient(httpClient connect.HTTPClient, baseURL string, opts
 
 // actionServiceClient implements ActionServiceClient.
 type actionServiceClient struct {
-	getAction          *connect.Client[actions.GetActionRequest, actions.GetActionResponse]
-	listActions        *connect.Client[actions.ListActionsRequest, actions.ListActionsResponse]
-	createCustomAction *connect.Client[actions.CreateCustomActionRequest, actions.CreateCustomActionResponse]
-	updateAction       *connect.Client[actions.UpdateActionRequest, actions.UpdateActionResponse]
-	deleteCustomAction *connect.Client[actions.DeleteCustomActionRequest, actions.DeleteCustomActionResponse]
+	getAction    *connect.Client[actions.GetActionRequest, actions.GetActionResponse]
+	listActions  *connect.Client[actions.ListActionsRequest, actions.ListActionsResponse]
+	createAction *connect.Client[actions.CreateActionRequest, actions.CreateActionResponse]
+	updateAction *connect.Client[actions.UpdateActionRequest, actions.UpdateActionResponse]
+	deleteAction *connect.Client[actions.DeleteActionRequest, actions.DeleteActionResponse]
 }
 
 // GetAction calls policy.actions.ActionService.GetAction.
@@ -130,9 +130,9 @@ func (c *actionServiceClient) ListActions(ctx context.Context, req *connect.Requ
 	return c.listActions.CallUnary(ctx, req)
 }
 
-// CreateCustomAction calls policy.actions.ActionService.CreateCustomAction.
-func (c *actionServiceClient) CreateCustomAction(ctx context.Context, req *connect.Request[actions.CreateCustomActionRequest]) (*connect.Response[actions.CreateCustomActionResponse], error) {
-	return c.createCustomAction.CallUnary(ctx, req)
+// CreateAction calls policy.actions.ActionService.CreateAction.
+func (c *actionServiceClient) CreateAction(ctx context.Context, req *connect.Request[actions.CreateActionRequest]) (*connect.Response[actions.CreateActionResponse], error) {
+	return c.createAction.CallUnary(ctx, req)
 }
 
 // UpdateAction calls policy.actions.ActionService.UpdateAction.
@@ -140,18 +140,18 @@ func (c *actionServiceClient) UpdateAction(ctx context.Context, req *connect.Req
 	return c.updateAction.CallUnary(ctx, req)
 }
 
-// DeleteCustomAction calls policy.actions.ActionService.DeleteCustomAction.
-func (c *actionServiceClient) DeleteCustomAction(ctx context.Context, req *connect.Request[actions.DeleteCustomActionRequest]) (*connect.Response[actions.DeleteCustomActionResponse], error) {
-	return c.deleteCustomAction.CallUnary(ctx, req)
+// DeleteAction calls policy.actions.ActionService.DeleteAction.
+func (c *actionServiceClient) DeleteAction(ctx context.Context, req *connect.Request[actions.DeleteActionRequest]) (*connect.Response[actions.DeleteActionResponse], error) {
+	return c.deleteAction.CallUnary(ctx, req)
 }
 
 // ActionServiceHandler is an implementation of the policy.actions.ActionService service.
 type ActionServiceHandler interface {
 	GetAction(context.Context, *connect.Request[actions.GetActionRequest]) (*connect.Response[actions.GetActionResponse], error)
 	ListActions(context.Context, *connect.Request[actions.ListActionsRequest]) (*connect.Response[actions.ListActionsResponse], error)
-	CreateCustomAction(context.Context, *connect.Request[actions.CreateCustomActionRequest]) (*connect.Response[actions.CreateCustomActionResponse], error)
+	CreateAction(context.Context, *connect.Request[actions.CreateActionRequest]) (*connect.Response[actions.CreateActionResponse], error)
 	UpdateAction(context.Context, *connect.Request[actions.UpdateActionRequest]) (*connect.Response[actions.UpdateActionResponse], error)
-	DeleteCustomAction(context.Context, *connect.Request[actions.DeleteCustomActionRequest]) (*connect.Response[actions.DeleteCustomActionResponse], error)
+	DeleteAction(context.Context, *connect.Request[actions.DeleteActionRequest]) (*connect.Response[actions.DeleteActionResponse], error)
 }
 
 // NewActionServiceHandler builds an HTTP handler from the service implementation. It returns the
@@ -172,10 +172,10 @@ func NewActionServiceHandler(svc ActionServiceHandler, opts ...connect.HandlerOp
 		connect.WithSchema(actionServiceListActionsMethodDescriptor),
 		connect.WithHandlerOptions(opts...),
 	)
-	actionServiceCreateCustomActionHandler := connect.NewUnaryHandler(
-		ActionServiceCreateCustomActionProcedure,
-		svc.CreateCustomAction,
-		connect.WithSchema(actionServiceCreateCustomActionMethodDescriptor),
+	actionServiceCreateActionHandler := connect.NewUnaryHandler(
+		ActionServiceCreateActionProcedure,
+		svc.CreateAction,
+		connect.WithSchema(actionServiceCreateActionMethodDescriptor),
 		connect.WithHandlerOptions(opts...),
 	)
 	actionServiceUpdateActionHandler := connect.NewUnaryHandler(
@@ -184,10 +184,10 @@ func NewActionServiceHandler(svc ActionServiceHandler, opts ...connect.HandlerOp
 		connect.WithSchema(actionServiceUpdateActionMethodDescriptor),
 		connect.WithHandlerOptions(opts...),
 	)
-	actionServiceDeleteCustomActionHandler := connect.NewUnaryHandler(
-		ActionServiceDeleteCustomActionProcedure,
-		svc.DeleteCustomAction,
-		connect.WithSchema(actionServiceDeleteCustomActionMethodDescriptor),
+	actionServiceDeleteActionHandler := connect.NewUnaryHandler(
+		ActionServiceDeleteActionProcedure,
+		svc.DeleteAction,
+		connect.WithSchema(actionServiceDeleteActionMethodDescriptor),
 		connect.WithHandlerOptions(opts...),
 	)
 	return "/policy.actions.ActionService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -196,12 +196,12 @@ func NewActionServiceHandler(svc ActionServiceHandler, opts ...connect.HandlerOp
 			actionServiceGetActionHandler.ServeHTTP(w, r)
 		case ActionServiceListActionsProcedure:
 			actionServiceListActionsHandler.ServeHTTP(w, r)
-		case ActionServiceCreateCustomActionProcedure:
-			actionServiceCreateCustomActionHandler.ServeHTTP(w, r)
+		case ActionServiceCreateActionProcedure:
+			actionServiceCreateActionHandler.ServeHTTP(w, r)
 		case ActionServiceUpdateActionProcedure:
 			actionServiceUpdateActionHandler.ServeHTTP(w, r)
-		case ActionServiceDeleteCustomActionProcedure:
-			actionServiceDeleteCustomActionHandler.ServeHTTP(w, r)
+		case ActionServiceDeleteActionProcedure:
+			actionServiceDeleteActionHandler.ServeHTTP(w, r)
 		default:
 			http.NotFound(w, r)
 		}
@@ -219,14 +219,14 @@ func (UnimplementedActionServiceHandler) ListActions(context.Context, *connect.R
 	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("policy.actions.ActionService.ListActions is not implemented"))
 }
 
-func (UnimplementedActionServiceHandler) CreateCustomAction(context.Context, *connect.Request[actions.CreateCustomActionRequest]) (*connect.Response[actions.CreateCustomActionResponse], error) {
-	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("policy.actions.ActionService.CreateCustomAction is not implemented"))
+func (UnimplementedActionServiceHandler) CreateAction(context.Context, *connect.Request[actions.CreateActionRequest]) (*connect.Response[actions.CreateActionResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("policy.actions.ActionService.CreateAction is not implemented"))
 }
 
 func (UnimplementedActionServiceHandler) UpdateAction(context.Context, *connect.Request[actions.UpdateActionRequest]) (*connect.Response[actions.UpdateActionResponse], error) {
 	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("policy.actions.ActionService.UpdateAction is not implemented"))
 }
 
-func (UnimplementedActionServiceHandler) DeleteCustomAction(context.Context, *connect.Request[actions.DeleteCustomActionRequest]) (*connect.Response[actions.DeleteCustomActionResponse], error) {
-	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("policy.actions.ActionService.DeleteCustomAction is not implemented"))
+func (UnimplementedActionServiceHandler) DeleteAction(context.Context, *connect.Request[actions.DeleteActionRequest]) (*connect.Response[actions.DeleteActionResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("policy.actions.ActionService.DeleteAction is not implemented"))
 }
diff --git a/service/policy/actions/actions.proto b/service/policy/actions/actions.proto
index 3777d6363f..7ff597039d 100644
--- a/service/policy/actions/actions.proto
+++ b/service/policy/actions/actions.proto
@@ -40,12 +40,15 @@ message ListActionsRequest {
   policy.PageRequest pagination = 10;
 }
 message ListActionsResponse {
-  repeated policy.Action actions = 1;
+  repeated policy.Action actions_standard = 1;
+  repeated policy.Action actions_custom = 2;
+
   policy.PageResponse pagination = 10;
 }
 
-// Create a new custom action name with optional metadata.
-message CreateCustomActionRequest {
+// Create a new Custom action name with optional metadata.
+// Creation of Standard actions is not supported.
+message CreateActionRequest {
   // Required
   string name = 1 [
     (buf.validate.field).string.min_len = 1,
@@ -64,12 +67,12 @@ message CreateCustomActionRequest {
   // Optional
   common.MetadataMutable metadata = 100;
 }
-message CreateCustomActionResponse {
+message CreateActionResponse {
   policy.Action action = 1;
 }
 
-// Names may only be updated for custom actions.
-// Metadata may be updated for either custom or standard actions.
+// Metadata may be updated for either Custom or Standard actions.
+// Names may only be updated for Custom actions.
 message UpdateActionRequest {
   // Required
   string id = 1 [(buf.validate.field).string.uuid = true];
@@ -98,19 +101,19 @@ message UpdateActionResponse {
   policy.Action action = 1;
 }
 
-// Deletion of standard actions is not supported.
-message DeleteCustomActionRequest {
+// Custom only: deletion of Standard actions is not supported.
+message DeleteActionRequest {
   // Required
   string id = 1 [(buf.validate.field).string.uuid = true];
 }
-message DeleteCustomActionResponse {
+message DeleteActionResponse {
   policy.Action action = 1;
 }
 
 service ActionService {
   rpc GetAction(GetActionRequest) returns (GetActionResponse) {}
   rpc ListActions(ListActionsRequest) returns (ListActionsResponse) {}
-  rpc CreateCustomAction(CreateCustomActionRequest) returns (CreateCustomActionResponse) {}
+  rpc CreateAction(CreateActionRequest) returns (CreateActionResponse) {}
   rpc UpdateAction(UpdateActionRequest) returns (UpdateActionResponse) {}
-  rpc DeleteCustomAction(DeleteCustomActionRequest) returns (DeleteCustomActionResponse) {}
+  rpc DeleteAction(DeleteActionRequest) returns (DeleteActionResponse) {}
 }

From 809b956cb85a06b31766083e527b8dd1ef2dafda Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Tue, 1 Apr 2025 10:16:25 -0700
Subject: [PATCH 007/110] Merge branch 'main' into feat/actions-svc

---
 .release-please-manifest.json |  2 +-
 sdk/tdf.go                    |  4 ++++
 sdk/tdf_config.go             | 26 +++++++++++++++++---------
 service/CHANGELOG.md          |  7 +++++++
 service/cmd/version.go        |  2 +-
 5 files changed, 30 insertions(+), 11 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 0348e8bb6b..726a67b7f2 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -4,5 +4,5 @@
   "lib/flattening": "0.1.3",
   "protocol/go": "0.2.29",
   "sdk": "0.3.29",
-  "service": "0.5.1"
+  "service": "0.5.2"
 }
diff --git a/sdk/tdf.go b/sdk/tdf.go
index 04dfdf231e..726d235e7f 100644
--- a/sdk/tdf.go
+++ b/sdk/tdf.go
@@ -646,6 +646,10 @@ func (s SDK) LoadTDF(reader io.ReadSeeker, opts ...TDFReaderOption) (*Reader, er
 		return nil, fmt.Errorf("archive.NewTDFReader failed: %w", err)
 	}
 
+	if s.kasSessionKey != nil {
+		opts = append([]TDFReaderOption{withSessionKey(s.kasSessionKey)}, opts...)
+	}
+
 	config, err := newTDFReaderConfig(opts...)
 	if err != nil {
 		return nil, fmt.Errorf("newAssertionConfig failed: %w", err)
diff --git a/sdk/tdf_config.go b/sdk/tdf_config.go
index 98b7f2e7f5..0cc57bc64e 100644
--- a/sdk/tdf_config.go
+++ b/sdk/tdf_config.go
@@ -255,14 +255,11 @@ type TDFReaderConfig struct {
 
 	schemaValidationIntensity SchemaValidationIntensity
 	kasSessionKey             ocrypto.KeyPair
-	keyType                   ocrypto.KeyType
 }
 
 func newTDFReaderConfig(opt ...TDFReaderOption) (*TDFReaderConfig, error) {
-	var err error
 	c := &TDFReaderConfig{
 		disableAssertionVerification: false,
-		keyType:                      ocrypto.RSA2048Key,
 	}
 
 	for _, o := range opt {
@@ -272,9 +269,12 @@ func newTDFReaderConfig(opt ...TDFReaderOption) (*TDFReaderConfig, error) {
 		}
 	}
 
-	c.kasSessionKey, err = ocrypto.NewKeyPair(c.keyType)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create RSA key pair: %w", err)
+	if c.kasSessionKey == nil {
+		// Default to RSA 2048
+		err := WithSessionKeyType(ocrypto.RSA2048Key)(c)
+		if err != nil {
+			return nil, err
+		}
 	}
 
 	return c, nil
@@ -303,10 +303,18 @@ func WithDisableAssertionVerification(disable bool) TDFReaderOption {
 
 func WithSessionKeyType(keyType ocrypto.KeyType) TDFReaderOption {
 	return func(c *TDFReaderConfig) error {
-		if c.keyType == "" {
-			return errors.New("key type missing")
+		kasSessionKey, err := ocrypto.NewKeyPair(keyType)
+		if err != nil {
+			return fmt.Errorf("failed to create RSA key pair: %w", err)
 		}
-		c.keyType = keyType
+		c.kasSessionKey = kasSessionKey
+		return nil
+	}
+}
+
+func withSessionKey(k ocrypto.KeyPair) TDFReaderOption {
+	return func(c *TDFReaderConfig) error {
+		c.kasSessionKey = k
 		return nil
 	}
 }
diff --git a/service/CHANGELOG.md b/service/CHANGELOG.md
index ac4d2b2209..6f320218c6 100644
--- a/service/CHANGELOG.md
+++ b/service/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.5.2](https://github.com/opentdf/platform/compare/service/v0.5.1...service/v0.5.2) (2025-04-01)
+
+
+### Bug Fixes
+
+* **core:** map IPC reauth routes config  ([#2021](https://github.com/opentdf/platform/issues/2021)) ([b232fc6](https://github.com/opentdf/platform/commit/b232fc60283302174109fc201b2233303444fd7b))
+
 ## [0.5.1](https://github.com/opentdf/platform/compare/service/v0.5.0...service/v0.5.1) (2025-03-31)
 
 
diff --git a/service/cmd/version.go b/service/cmd/version.go
index 601d2d40b6..94a841325b 100644
--- a/service/cmd/version.go
+++ b/service/cmd/version.go
@@ -2,7 +2,7 @@ package cmd
 
 import "github.com/spf13/cobra"
 
-const Version = "0.5.1" // Service Version // x-release-please-version
+const Version = "0.5.2" // Service Version // x-release-please-version
 
 func init() {
 	rootCmd.AddCommand(&cobra.Command{

From f39adacc948d98885dc31d8afb1ddd86c259488c Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Tue, 1 Apr 2025 10:16:35 -0700
Subject: [PATCH 008/110] actions svc

---
 service/policy/actions/actions.go | 60 +++++++++++++++++++++++++++++++
 1 file changed, 60 insertions(+)
 create mode 100644 service/policy/actions/actions.go

diff --git a/service/policy/actions/actions.go b/service/policy/actions/actions.go
new file mode 100644
index 0000000000..418dd6e8bb
--- /dev/null
+++ b/service/policy/actions/actions.go
@@ -0,0 +1,60 @@
+package actions
+
+import (
+	"context"
+	"errors"
+
+	"connectrpc.com/connect"
+	"github.com/opentdf/platform/protocol/go/policy/actions"
+	"github.com/opentdf/platform/protocol/go/policy/actions/actionsconnect"
+	"github.com/opentdf/platform/service/logger"
+	"github.com/opentdf/platform/service/pkg/serviceregistry"
+
+	policyconfig "github.com/opentdf/platform/service/policy/config"
+	policydb "github.com/opentdf/platform/service/policy/db"
+)
+
+type ActionsService struct { //nolint:revive // ActionsService is a valid name for this struct
+	dbClient policydb.PolicyDBClient
+	logger   *logger.Logger
+	config   *policyconfig.Config
+}
+
+func NewRegistration(ns string, dbRegister serviceregistry.DBRegister) *serviceregistry.Service[actionsconnect.ActionServiceHandler] {
+	return &serviceregistry.Service[actionsconnect.ActionServiceHandler]{
+		ServiceOptions: serviceregistry.ServiceOptions[actionsconnect.ActionServiceHandler]{
+			Namespace:      ns,
+			DB:             dbRegister,
+			ServiceDesc:    &actions.ActionService_ServiceDesc,
+			ConnectRPCFunc: actionsconnect.NewActionServiceHandler,
+			RegisterFunc: func(srp serviceregistry.RegistrationParams) (actionsconnect.ActionServiceHandler, serviceregistry.HandlerServer) {
+				cfg := policyconfig.GetSharedPolicyConfig(srp)
+				return &ActionsService{
+					dbClient: policydb.NewClient(srp.DBClient, srp.Logger, int32(cfg.ListRequestLimitMax), int32(cfg.ListRequestLimitDefault)),
+					logger:   srp.Logger,
+					config:   cfg,
+				}, nil
+			},
+		},
+	}
+}
+
+func (a *ActionsService) GetAction(context.Context, *connect.Request[actions.GetActionRequest]) (*connect.Response[actions.GetActionResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("GetAction is not implemented"))
+}
+
+func (a *ActionsService) ListActions(context.Context, *connect.Request[actions.ListActionsRequest]) (*connect.Response[actions.ListActionsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ListActions is not implemented"))
+}
+
+func (a *ActionsService) CreateAction(context.Context, *connect.Request[actions.CreateActionRequest]) (*connect.Response[actions.CreateActionResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("CreateAction is not implemented"))
+}
+
+func (a *ActionsService) UpdateAction(context.Context, *connect.Request[actions.UpdateActionRequest]) (*connect.Response[actions.UpdateActionResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("UpdateAction is not implemented"))
+}
+
+func (a *ActionsService) DeleteAction(context.Context, *connect.Request[actions.DeleteActionRequest]) (*connect.Response[actions.DeleteActionResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("DeleteAction is not implemented"))
+}

From 1fe24f5bdd8fb9493d6ecd70046110305aeea8b8 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Tue, 1 Apr 2025 11:26:26 -0700
Subject: [PATCH 009/110] proto validation

---
 protocol/go/policy/actions/actions.pb.go | 156 +++++++-------
 service/policy/actions/actions.proto     |   8 +-
 service/policy/actions/actions_test.go   | 262 +++++++++++++++++++++++
 3 files changed, 346 insertions(+), 80 deletions(-)
 create mode 100644 service/policy/actions/actions_test.go

diff --git a/protocol/go/policy/actions/actions.pb.go b/protocol/go/policy/actions/actions.pb.go
index e11d958c7d..c981ae5a0d 100644
--- a/protocol/go/policy/actions/actions.pb.go
+++ b/protocol/go/policy/actions/actions.pb.go
@@ -672,89 +672,91 @@ var file_policy_actions_actions_proto_rawDesc = []byte{
 	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74,
 	0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
 	0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x22, 0xdd, 0x03, 0x0a, 0x13, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
+	0x6e, 0x22, 0xfa, 0x03, 0x0a, 0x13, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
 	0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64, 0x18,
 	0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x52,
-	0x02, 0x69, 0x64, 0x12, 0xa0, 0x02, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x42, 0x8b, 0x02, 0xba, 0x48, 0x87, 0x02, 0xba, 0x01, 0xfc, 0x01, 0x0a, 0x12, 0x61,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61,
-	0x74, 0x12, 0xa8, 0x01, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20,
-	0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61,
-	0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x2c, 0x20,
-	0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x69, 0x6e, 0x67, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73,
-	0x20, 0x61, 0x6e, 0x64, 0x20, 0x75, 0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f, 0x72, 0x65, 0x73,
-	0x20, 0x62, 0x75, 0x74, 0x20, 0x6e, 0x6f, 0x74, 0x20, 0x61, 0x73, 0x20, 0x74, 0x68, 0x65, 0x20,
-	0x66, 0x69, 0x72, 0x73, 0x74, 0x20, 0x6f, 0x72, 0x20, 0x6c, 0x61, 0x73, 0x74, 0x20, 0x63, 0x68,
-	0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2e, 0x20, 0x54, 0x68, 0x65, 0x20, 0x73, 0x74, 0x6f,
-	0x72, 0x65, 0x64, 0x20, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20,
-	0x69, 0x73, 0x20, 0x6e, 0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64, 0x20, 0x74, 0x6f,
-	0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a, 0x3b, 0x74, 0x68,
-	0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d,
-	0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61, 0x2d, 0x7a, 0x41,
-	0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a,
-	0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x72, 0x05, 0x10, 0x01, 0x18, 0xfd, 0x01,
-	0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f,
-	0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4d, 0x75, 0x74, 0x61, 0x62, 0x6c,
-	0x65, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x54, 0x0a, 0x18, 0x6d,
-	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x62,
-	0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x18, 0x65, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e,
-	0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x55,
-	0x70, 0x64, 0x61, 0x74, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x52, 0x16, 0x6d, 0x65, 0x74, 0x61, 0x64,
-	0x61, 0x74, 0x61, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x42, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f,
-	0x72, 0x22, 0x3e, 0x0a, 0x14, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x22, 0x2f, 0x0a, 0x13, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x52, 0x02,
-	0x69, 0x64, 0x22, 0x3e, 0x0a, 0x14, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x32, 0xd4, 0x03, 0x0a, 0x0d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x72,
-	0x76, 0x69, 0x63, 0x65, 0x12, 0x52, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x12, 0x20, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74,
-	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x22, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x70, 0x6f,
-	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73,
-	0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x12, 0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12,
-	0x5b, 0x0a, 0x0c, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12,
+	0x02, 0x69, 0x64, 0x12, 0xbd, 0x02, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x42, 0xa8, 0x02, 0xba, 0x48, 0xa4, 0x02, 0xba, 0x01, 0x98, 0x02, 0x0a, 0x1b, 0x6f,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e,
+	0x61, 0x6d, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0xa8, 0x01, 0x41, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65,
+	0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63,
+	0x20, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x2c, 0x20, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x69, 0x6e,
+	0x67, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x75, 0x6e,
+	0x64, 0x65, 0x72, 0x73, 0x63, 0x6f, 0x72, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74, 0x20, 0x6e, 0x6f,
+	0x74, 0x20, 0x61, 0x73, 0x20, 0x74, 0x68, 0x65, 0x20, 0x66, 0x69, 0x72, 0x73, 0x74, 0x20, 0x6f,
+	0x72, 0x20, 0x6c, 0x61, 0x73, 0x74, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72,
+	0x2e, 0x20, 0x54, 0x68, 0x65, 0x20, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20, 0x61, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x69, 0x73, 0x20, 0x6e, 0x6f, 0x72, 0x6d,
+	0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64, 0x20, 0x74, 0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20,
+	0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a, 0x4e, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73,
+	0x29, 0x20, 0x3d, 0x3d, 0x20, 0x30, 0x20, 0x7c, 0x7c, 0x20, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d,
+	0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a,
+	0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d,
+	0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d,
+	0x29, 0x3f, 0x24, 0x27, 0x29, 0xc8, 0x01, 0x00, 0x72, 0x03, 0x18, 0xfd, 0x01, 0x52, 0x04, 0x6e,
+	0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18,
+	0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4d, 0x75, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x08,
+	0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x54, 0x0a, 0x18, 0x6d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x5f, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x62, 0x65, 0x68, 0x61,
+	0x76, 0x69, 0x6f, 0x72, 0x18, 0x65, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e, 0x63, 0x6f, 0x6d,
+	0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x55, 0x70, 0x64, 0x61,
+	0x74, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x52, 0x16, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x42, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x22, 0x3e,
+	0x0a, 0x14, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x2f,
+	0x0a, 0x13, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x52, 0x02, 0x69, 0x64, 0x22,
+	0x3e, 0x0a, 0x14, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x32,
+	0xd4, 0x03, 0x0a, 0x0d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x12, 0x52, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x20,
+	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e,
+	0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x21, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x12, 0x22, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63,
+	0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12,
+	0x5b, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12,
 	0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71,
+	0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71,
 	0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
 	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c,
-	0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x2e, 0x70,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x44, 0x65,
-	0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x2e, 0x70,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x55, 0x70,
+	0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
 	0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0xb3, 0x01, 0x0a, 0x12, 0x63, 0x6f,
-	0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x42, 0x0c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01,
-	0x5a, 0x36, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65,
-	0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x2f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xa2, 0x02, 0x03, 0x50, 0x41, 0x58, 0xaa, 0x02,
-	0x0e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xca,
-	0x02, 0x0e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0xe2, 0x02, 0x1a, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x73, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x0f,
-	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x3a, 0x3a, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x62,
-	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x6e, 0x73, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x44, 0x65, 0x6c,
+	0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74,
+	0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24,
+	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e,
+	0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0xb3, 0x01, 0x0a, 0x12, 0x63, 0x6f, 0x6d, 0x2e, 0x70,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x42, 0x0c, 0x41,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x36, 0x67,
+	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x64,
+	0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x61, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0xa2, 0x02, 0x03, 0x50, 0x41, 0x58, 0xaa, 0x02, 0x0e, 0x50, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xca, 0x02, 0x0e, 0x50,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xe2, 0x02, 0x1a,
+	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x5c, 0x47,
+	0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x0f, 0x50, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x3a, 0x3a, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/service/policy/actions/actions.proto b/service/policy/actions/actions.proto
index 7ff597039d..747ed29483 100644
--- a/service/policy/actions/actions.proto
+++ b/service/policy/actions/actions.proto
@@ -80,16 +80,18 @@ message UpdateActionRequest {
   // Optional
   // Custom actions only: replaces the existing action name
   string name = 2 [
-    (buf.validate.field).string.min_len = 1,
+    (buf.validate.field).required = false,
     (buf.validate.field).string.max_len = 253,
     (buf.validate.field).cel = {
-      id: "action_name_format"
+      id: "optional_action_name_format"
       message:
         "Action name must be an alphanumeric string, "
         "allowing hyphens and underscores but not as the "
         "first or last character. The stored action name "
         "is normalized to lower case."
-      expression: "this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$')"
+      expression:
+        "size(this) == 0 || "
+        "this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$')"
     }
   ];
 
diff --git a/service/policy/actions/actions_test.go b/service/policy/actions/actions_test.go
new file mode 100644
index 0000000000..3d4abf8a89
--- /dev/null
+++ b/service/policy/actions/actions_test.go
@@ -0,0 +1,262 @@
+package actions
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/bufbuild/protovalidate-go"
+	"github.com/opentdf/platform/protocol/go/common"
+	"github.com/opentdf/platform/protocol/go/policy"
+	"github.com/opentdf/platform/protocol/go/policy/actions"
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+)
+
+const (
+	validUUID                  = "00000000-0000-0000-0000-000000000000"
+	errMessageUUID             = "string.uuid"
+	errMessageActionNameFormat = "action_name_format"
+	errMessageMinLen           = "string.min_len"
+	errMessageMaxLen           = "string.max_len"
+	errMessageURI              = "string.uri"
+	errMessageRequired         = "required"
+)
+
+var (
+	validNames = []string{"valid_Name", "valid_name", "NAME", "NAME-IS-VALID", "SOME_VALID_NAME", "valid-name", strings.Repeat("a", 253), strings.Repeat("a", 1)}
+
+	invalidNameTests = []struct {
+		name           string
+		expectedErrMsg string
+	}{
+		{strings.Repeat("a", 254), errMessageMaxLen},
+		{"!", errMessageActionNameFormat},
+		{"name with space", errMessageActionNameFormat},
+		{"slash/", errMessageActionNameFormat},
+		{"slash\\", errMessageActionNameFormat},
+		{"name:with:colon", errMessageActionNameFormat},
+		{"name.dot.delimited", errMessageActionNameFormat},
+		{"_cannot_start_with_underscore", errMessageActionNameFormat},
+		{"cannot_end_with__underscore_", errMessageActionNameFormat},
+		{"-cannot-start-with-hyphen", errMessageActionNameFormat},
+		{"cannot-end-with-hyphen-", errMessageActionNameFormat},
+	}
+)
+
+// Actions proto validation
+
+type ActionSuite struct {
+	suite.Suite
+	v *protovalidate.Validator
+}
+
+// Set up the test environment
+func (s *ActionSuite) SetupSuite() {
+	v, err := protovalidate.New()
+	if err != nil {
+		panic(err)
+	}
+	s.v = v
+}
+
+func TestActionsServiceProtos(t *testing.T) {
+	suite.Run(t, new(ActionSuite))
+}
+
+func (s *ActionSuite) Test_CreateActionRequest_Fails() {
+	for _, test := range invalidNameTests {
+		s.Run(test.name, func() {
+			req := &actions.CreateActionRequest{
+				Name: test.name,
+			}
+			err := s.v.Validate(req)
+			require.Error(s.T(), err)
+			require.Contains(s.T(), err.Error(), test.expectedErrMsg)
+		})
+	}
+
+	// no name
+	req := &actions.CreateActionRequest{
+		Name: "",
+	}
+	err := s.v.Validate(req)
+	require.Error(s.T(), err)
+	require.Contains(s.T(), err.Error(), errMessageMinLen)
+}
+
+func (s *ActionSuite) Test_CreateActionRequest_Succeeds() {
+	for _, name := range validNames {
+		s.Run(name, func() {
+			req := &actions.CreateActionRequest{
+				Name: name,
+			}
+			err := s.v.Validate(req)
+			require.NoError(s.T(), err)
+		})
+	}
+
+	// with metadata
+	req := &actions.CreateActionRequest{
+		Name: "valid_name",
+		Metadata: &common.MetadataMutable{
+			Labels: map[string]string{"key": "value"},
+		},
+	}
+	err := s.v.Validate(req)
+	require.NoError(s.T(), err)
+}
+
+func (s *ActionSuite) Test_GetAction_Succeeds() {
+	req := &actions.GetActionRequest{
+		Identifier: &actions.GetActionRequest_Id{
+			Id: validUUID,
+		},
+	}
+	err := s.v.Validate(req)
+	require.NoError(s.T(), err)
+
+	for _, name := range validNames {
+		s.Run(name, func() {
+			req := &actions.GetActionRequest{
+				Identifier: &actions.GetActionRequest_Name{
+					Name: name,
+				},
+			}
+			err := s.v.Validate(req)
+			require.NoError(s.T(), err)
+		})
+	}
+}
+
+func (s *ActionSuite) Test_GetAction_Fails() {
+	req := &actions.GetActionRequest{
+		Identifier: &actions.GetActionRequest_Id{
+			Id: "",
+		},
+	}
+	err := s.v.Validate(req)
+	require.Error(s.T(), err)
+	require.Contains(s.T(), err.Error(), errMessageUUID)
+
+	req = &actions.GetActionRequest{}
+	err = s.v.Validate(req)
+	require.Error(s.T(), err)
+	require.Contains(s.T(), err.Error(), errMessageRequired)
+
+	for _, test := range invalidNameTests {
+		s.Run(test.name, func() {
+			req := &actions.GetActionRequest{
+				Identifier: &actions.GetActionRequest_Name{
+					Name: test.name,
+				},
+			}
+			err := s.v.Validate(req)
+			require.Error(s.T(), err)
+			require.Contains(s.T(), err.Error(), test.expectedErrMsg)
+		})
+	}
+
+	// no name
+	req = &actions.GetActionRequest{
+		Identifier: &actions.GetActionRequest_Name{
+			Name: "",
+		},
+	}
+	err = s.v.Validate(req)
+	require.Error(s.T(), err)
+	require.Contains(s.T(), err.Error(), errMessageMinLen)
+}
+
+func (s *ActionSuite) Test_ListActions_Succeeds() {
+	reqPaginated := &actions.ListActionsRequest{
+		Pagination: &policy.PageRequest{
+			Limit: 1,
+		},
+	}
+	err := s.v.Validate(reqPaginated)
+	require.NoError(s.T(), err)
+
+	reqPaginated.Pagination.Offset = 100
+	err = s.v.Validate(reqPaginated)
+	require.NoError(s.T(), err)
+
+	reqNoPagination := &actions.ListActionsRequest{}
+	err = s.v.Validate(reqNoPagination)
+	require.NoError(s.T(), err)
+}
+
+func (s *ActionSuite) Test_UpdateActionRequest_Succeeds() {
+	req := &actions.UpdateActionRequest{
+		Id: validUUID,
+		Metadata: &common.MetadataMutable{
+			Labels: map[string]string{"key": "value"},
+		},
+	}
+	err := s.v.Validate(req)
+	require.NoError(s.T(), err)
+
+	for _, name := range validNames {
+		s.Run(name, func() {
+			req.Name = name
+			err := s.v.Validate(req)
+			require.NoError(s.T(), err)
+		})
+	}
+
+	req = &actions.UpdateActionRequest{
+		Id:   validUUID,
+		Name: "no-metadata",
+	}
+	err = s.v.Validate(req)
+	require.NoError(s.T(), err)
+}
+
+func (s *ActionSuite) Test_UpdateActionRequest_Fails() {
+	req := &actions.UpdateActionRequest{
+		Id: "",
+	}
+	err := s.v.Validate(req)
+	require.Error(s.T(), err)
+	require.Contains(s.T(), err.Error(), errMessageUUID)
+
+	for _, test := range invalidNameTests {
+		s.Run(test.name, func() {
+			req := &actions.UpdateActionRequest{
+				Id:   validUUID,
+				Name: test.name,
+			}
+			err := s.v.Validate(req)
+			require.Error(s.T(), err)
+			require.Contains(s.T(), err.Error(), test.expectedErrMsg)
+		})
+	}
+}
+
+func (s *ActionSuite) Test_DeleteActionRequest_Succeeds() {
+	req := &actions.DeleteActionRequest{
+		Id: validUUID,
+	}
+	err := s.v.Validate(req)
+	require.NoError(s.T(), err)
+}
+
+func (s *ActionSuite) Test_DeleteActionRequest_Fails() {
+	req := &actions.DeleteActionRequest{
+		Id: "",
+	}
+	err := s.v.Validate(req)
+	require.Error(s.T(), err)
+	require.Contains(s.T(), err.Error(), errMessageUUID)
+
+	req = &actions.DeleteActionRequest{}
+	err = s.v.Validate(req)
+	require.Error(s.T(), err)
+	require.Contains(s.T(), err.Error(), errMessageUUID)
+
+	req = &actions.DeleteActionRequest{
+		Id: "custom_action_name_used_as_id",
+	}
+	err = s.v.Validate(req)
+	require.Error(s.T(), err)
+	require.Contains(s.T(), err.Error(), errMessageUUID)
+}

From 03fcd4c4dfc5b5c3f8f6e5d23adf07c983231d0d Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Tue, 1 Apr 2025 12:56:48 -0700
Subject: [PATCH 010/110] actions mermaid ERD for the migration

---
 .../20250401000000_add_actions_table.md       | 35 +++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 service/policy/db/migrations/20250401000000_add_actions_table.md

diff --git a/service/policy/db/migrations/20250401000000_add_actions_table.md b/service/policy/db/migrations/20250401000000_add_actions_table.md
new file mode 100644
index 0000000000..fc5e6fb0aa
--- /dev/null
+++ b/service/policy/db/migrations/20250401000000_add_actions_table.md
@@ -0,0 +1,35 @@
+# Add Actions Table
+
+Actions will evolve from a simple enum with limited options (decrypt, transmit) defined solely in protos
+to a comprehensive CRUD-inspired policy object with dedicated database storage, explicit relationships to subject
+mappings and (incoming) obligations, and improved API support.
+
+This enhancement provides greater flexibility for defining permitted operations on protected
+resources while eliminating confusion in action handling across the platform.
+
+```mermaid
+
+erDiagram
+
+    SubjectMapping {
+        uuid           id                          PK
+        uuid           attribute_value_id          FK
+        uuid[]         subject_condition_set_id    FK
+        uuid[]         actions                     FK "actions are now defined in actions table"
+        jsonb          metadata
+        timestamp      created_at
+        timestamp      updated_at
+    }
+
+    Actions {
+        uuid        id              PK  "id used for administration"
+        name        varchar         UK  "unique name of the action"
+        bool        is_standard         "only custom actions can be updated/deleted"
+        jsonb       metadata
+        timestamp   created_at
+        timestamp   updated_at
+    }
+
+    SubjectMapping 1 -- 1+ Actions : "has"
+
+```

From b8005175b6044d04b3df4da660631d34c76dac81 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Tue, 1 Apr 2025 14:30:21 -0700
Subject: [PATCH 011/110] migrate up and down

---
 .../20250401000000_add_actions_table.sql      | 161 ++++++++++++++++++
 1 file changed, 161 insertions(+)
 create mode 100644 service/policy/db/migrations/20250401000000_add_actions_table.sql

diff --git a/service/policy/db/migrations/20250401000000_add_actions_table.sql b/service/policy/db/migrations/20250401000000_add_actions_table.sql
new file mode 100644
index 0000000000..2471847bde
--- /dev/null
+++ b/service/policy/db/migrations/20250401000000_add_actions_table.sql
@@ -0,0 +1,161 @@
+-- +goose Up
+-- +goose StatementBegin
+
+-- 1. Create new 'actions' table
+CREATE TABLE IF NOT EXISTS
+    actions (
+        id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+        name VARCHAR NOT NULL,
+        is_standard BOOLEAN NOT NULL DEFAULT FALSE,
+        metadata JSONB,
+        created_at TIMESTAMP NOT NULL DEFAULT NOW(),
+        updated_at TIMESTAMP NOT NULL DEFAULT NOW(),
+        CONSTRAINT actions_name_unique UNIQUE (name) 
+    );
+
+COMMENT ON TABLE actions IS 'Table to store actions for use in ABAC decisioning';
+
+COMMENT ON COLUMN actions.id IS 'Unique identifier for the action';
+
+COMMENT ON COLUMN actions.name IS 'Unique name of the action, e.g. "read", "write", etc.';
+
+COMMENT ON COLUMN actions.is_standard IS 'Whether the action is standard (proto-enum) or custom (user-defined).';
+
+COMMENT ON COLUMN actions.metadata IS 'Metadata for the action (see protos for structure)';
+
+CREATE TRIGGER actions_updated_at
+  BEFORE UPDATE ON actions
+  FOR EACH ROW
+  EXECUTE FUNCTION update_updated_at();
+
+-- 2. Insert standard CRUD actions from protos
+INSERT INTO actions (name, is_standard) VALUES
+    ('create', TRUE),
+    ('read', TRUE),
+    ('update', TRUE),
+    ('delete', TRUE);
+
+-- 3. Persist subject mapping relations from marshaled proto actions to actions table rows.
+
+-- 3a. Validate custom actions align with new proto requirements as they were very loose previously.
+-- 3a. Validate custom actions
+DO $$
+DECLARE
+    invalid_action text;
+    invalid_count int;
+BEGIN
+    WITH custom_actions AS (
+        SELECT DISTINCT elem->>'custom' AS custom_action_name
+        FROM subject_mappings sm
+        CROSS JOIN LATERAL jsonb_array_elements(sm.actions) AS elem
+        WHERE elem->>'custom' IS NOT NULL
+    ),
+    invalid_actions AS (
+        SELECT custom_action_name
+        FROM custom_actions
+        WHERE 
+          LENGTH(custom_action_name) > 253 OR
+          LENGTH(custom_action_name) < 1 OR
+          custom_action_name !~ '^[a-zA-Z0-9]' OR
+          custom_action_name !~ '[a-zA-Z0-9]$' OR
+          custom_action_name ~ '[^a-zA-Z0-9_-]'
+    )
+    SELECT COUNT(*) INTO invalid_count FROM invalid_actions;
+    
+    IF invalid_count > 0 THEN
+        SELECT custom_action_name INTO invalid_action FROM invalid_actions LIMIT 1;
+        RAISE EXCEPTION 'Invalid custom action name found: % (and % others). Names must be 1-253 characters, start and end with alphanumeric, and contain only alphanumeric, underscore, or hyphen.', 
+                        invalid_action, invalid_count - 1;
+    END IF;
+END $$;
+
+-- 3b. Extract unique custom actions from subject_mappings.actions and insert into actions table.
+WITH custom_actions AS (
+    SELECT DISTINCT elem->>'custom' AS custom_action_name
+    FROM subject_mappings sm
+    CROSS JOIN LATERAL jsonb_array_elements(sm.actions) AS elem
+    WHERE elem->>'custom' IS NOT NULL
+)
+INSERT INTO actions (name, is_standard)
+SELECT LOWER(custom_action_name), FALSE
+FROM custom_actions
+WHERE LOWER(custom_action_name) NOT IN (SELECT name FROM actions)
+ON CONFLICT (name) DO NOTHING;
+
+-- Add temporary column to hold actions row ids that match the old actions column marshaled proto values.
+ALTER TABLE subject_mappings ADD COLUMN actions_uuid UUID[];
+
+-- 3c. Map the old actions column to the new actions_uuid column.
+-- | old actions column JSON array element    | new row with actions.name column value |
+-- | ---------------------------------------- | -------------------------------------- |
+-- | {"standard": "STANDARD_ACTION_TRANSMIT"} | create                                 |
+-- | {"standard": "STANDARD_ACTION_DECRYPT"}  | read                                   |
+-- | {"custom": "custom_action_name"}         | custom_action_name                     |
+UPDATE subject_mappings
+SET actions_uuid = (
+    SELECT array_agg(a.id)
+    FROM (
+        SELECT 
+            CASE 
+                WHEN elem->>'standard' = 'STANDARD_ACTION_TRANSMIT' THEN 'create'
+                WHEN elem->>'standard' = 'STANDARD_ACTION_DECRYPT' THEN 'read'
+                WHEN elem->>'custom' IS NOT NULL THEN elem->>'custom'
+                ELSE NULL
+            END AS action_name
+        FROM jsonb_array_elements(subject_mappings.actions) AS elem
+        WHERE elem->>'standard' IS NOT NULL OR elem->>'custom' IS NOT NULL
+    ) s
+    JOIN actions a ON s.action_name = a.name
+);
+
+-- Verify data was properly converted from marshaled protos to actions table row ids.
+DO $$
+BEGIN
+    IF EXISTS (SELECT 1 FROM subject_mappings WHERE actions_uuid IS NULL) THEN
+        RAISE EXCEPTION 'Migration failed: Some rows have NULL actions_uuid';
+    END IF;
+END $$;
+
+-- 3c. Drop the old JSONB column and rename the new UUID[] column to the old name.
+ALTER TABLE subject_mappings DROP COLUMN actions;
+ALTER TABLE subject_mappings RENAME COLUMN actions_uuid TO actions;
+
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+
+-- 1. Add a temporary JSONB column to hold the original format
+ALTER TABLE subject_mappings ADD COLUMN actions_jsonb JSONB;
+
+-- 2. Convert the UUID[] action references back to the original JSONB format
+UPDATE subject_mappings sm
+SET actions_jsonb = (
+    SELECT jsonb_agg(
+        CASE
+            WHEN a.name = 'create' THEN jsonb_build_object('standard', 'STANDARD_ACTION_TRANSMIT')
+            WHEN a.name = 'read' THEN jsonb_build_object('standard', 'STANDARD_ACTION_DECRYPT')
+            -- Note: update / delete standard action enums in updated proto cannot be backported
+            ELSE jsonb_build_object('custom', a.name)
+        END
+    )
+    FROM unnest(sm.actions) AS action_id
+    JOIN actions a ON a.id = action_id
+);
+
+-- 3. Verify the conversion worked
+DO $$
+BEGIN
+    IF EXISTS (SELECT 1 FROM subject_mappings WHERE actions_jsonb IS NULL AND actions IS NOT NULL) THEN
+        RAISE EXCEPTION 'Down migration failed: Some rows have NULL actions_jsonb';
+    END IF;
+END $$;
+
+-- 4. Drop the UUID[] column and rename the JSONB column back to actions
+ALTER TABLE subject_mappings DROP COLUMN actions;
+ALTER TABLE subject_mappings RENAME COLUMN actions_jsonb TO actions;
+
+-- 5. Drop the actions table
+DROP TABLE actions;
+
+-- +goose StatementEnd
\ No newline at end of file

From f5592b140bc51c24d827b7f8f17e51f1356a1f09 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Tue, 1 Apr 2025 14:44:50 -0700
Subject: [PATCH 012/110] wip

---
 .../policy/db/migrations/20250401000000_add_actions_table.sql   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/service/policy/db/migrations/20250401000000_add_actions_table.sql b/service/policy/db/migrations/20250401000000_add_actions_table.sql
index 2471847bde..7537c197eb 100644
--- a/service/policy/db/migrations/20250401000000_add_actions_table.sql
+++ b/service/policy/db/migrations/20250401000000_add_actions_table.sql
@@ -17,7 +17,7 @@ COMMENT ON TABLE actions IS 'Table to store actions for use in ABAC decisioning'
 
 COMMENT ON COLUMN actions.id IS 'Unique identifier for the action';
 
-COMMENT ON COLUMN actions.name IS 'Unique name of the action, e.g. "read", "write", etc.';
+COMMENT ON COLUMN actions.name IS 'Unique name of the action, e.g. read, write, etc.';
 
 COMMENT ON COLUMN actions.is_standard IS 'Whether the action is standard (proto-enum) or custom (user-defined).';
 

From 021d2c780733e00929df6fceaecea2a20d81e262 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Tue, 1 Apr 2025 14:44:57 -0700
Subject: [PATCH 013/110] update overall erd

---
 service/policy/db/schema_erd.md | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/service/policy/db/schema_erd.md b/service/policy/db/schema_erd.md
index 5cd666dbc9..5f7c3e995b 100644
--- a/service/policy/db/schema_erd.md
+++ b/service/policy/db/schema_erd.md
@@ -1,5 +1,26 @@
+<style>
+div.mermaid {
+	overflow-x: scroll;
+	background: rgb(15, 15, 15);
+}
+div.mermaid > svg {
+	width: 200rem; 
+	height: 100%;
+	padding: 1em;
+}
+</style>
+
 ```mermaid
 erDiagram
+    actions {
+        timestamp_without_time_zone created_at 
+        uuid id PK "Unique identifier for the action"
+        boolean is_standard "Whether the action is standard (proto-enum) or custom (user-defined)."
+        jsonb metadata "Metadata for the action (see protos for structure)"
+        character_varying name UK "Unique name of the action, e.g. read, write, etc."
+        timestamp_without_time_zone updated_at 
+    }
+
     attribute_definition_key_access_grants {
         uuid attribute_definition_id PK,FK "Foreign key to the attribute definition"
         uuid key_access_server_id PK,FK "Foreign key to the KAS registration"
@@ -127,7 +148,7 @@ erDiagram
     }
 
     subject_mappings {
-        jsonb actions "Actions that the subject entity can perform on the attribute value (see protos for details)"
+        ARRAY actions 
         uuid attribute_value_id FK "Foreign key to the attribute value"
         timestamp_with_time_zone created_at 
         uuid id PK "Primary key for the table"

From 4ad71a205176ca0132682e8f7461effede99b7c4 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Tue, 1 Apr 2025 15:07:47 -0700
Subject: [PATCH 014/110] update migrations with relation table

---
 .../20250401000000_add_actions_table.sql      | 141 +++++++++++++-----
 service/policy/db/schema_erd.md               |  24 ++-
 2 files changed, 110 insertions(+), 55 deletions(-)

diff --git a/service/policy/db/migrations/20250401000000_add_actions_table.sql b/service/policy/db/migrations/20250401000000_add_actions_table.sql
index 7537c197eb..e8fd440d01 100644
--- a/service/policy/db/migrations/20250401000000_add_actions_table.sql
+++ b/service/policy/db/migrations/20250401000000_add_actions_table.sql
@@ -28,6 +28,17 @@ CREATE TRIGGER actions_updated_at
   FOR EACH ROW
   EXECUTE FUNCTION update_updated_at();
 
+-- 1a. Create intermediary table to hold the mapping of actions to subject_mappings (potentially many to many)
+CREATE TABLE subject_mapping_actions (
+    subject_mapping_id UUID NOT NULL REFERENCES subject_mappings(id) ON DELETE CASCADE,
+    action_id UUID NOT NULL REFERENCES actions(id) ON DELETE CASCADE,
+    created_at TIMESTAMP NOT NULL DEFAULT NOW(),
+    PRIMARY KEY (subject_mapping_id, action_id)
+);
+
+CREATE INDEX idx_subject_mapping_actions_subject ON subject_mapping_actions(subject_mapping_id);
+CREATE INDEX idx_subject_mapping_actions_action ON subject_mapping_actions(action_id);
+
 -- 2. Insert standard CRUD actions from protos
 INSERT INTO actions (name, is_standard) VALUES
     ('create', TRUE),
@@ -38,7 +49,6 @@ INSERT INTO actions (name, is_standard) VALUES
 -- 3. Persist subject mapping relations from marshaled proto actions to actions table rows.
 
 -- 3a. Validate custom actions align with new proto requirements as they were very loose previously.
--- 3a. Validate custom actions
 DO $$
 DECLARE
     invalid_action text;
@@ -82,80 +92,129 @@ FROM custom_actions
 WHERE LOWER(custom_action_name) NOT IN (SELECT name FROM actions)
 ON CONFLICT (name) DO NOTHING;
 
--- Add temporary column to hold actions row ids that match the old actions column marshaled proto values.
-ALTER TABLE subject_mappings ADD COLUMN actions_uuid UUID[];
 
--- 3c. Map the old actions column to the new actions_uuid column.
--- | old actions column JSON array element    | new row with actions.name column value |
+-- 3c. Map the old actions column to the new relation table.
+-- | old actions column JSON array element    | actions.name of the new relation       |
 -- | ---------------------------------------- | -------------------------------------- |
 -- | {"standard": "STANDARD_ACTION_TRANSMIT"} | create                                 |
 -- | {"standard": "STANDARD_ACTION_DECRYPT"}  | read                                   |
 -- | {"custom": "custom_action_name"}         | custom_action_name                     |
-UPDATE subject_mappings
-SET actions_uuid = (
-    SELECT array_agg(a.id)
-    FROM (
-        SELECT 
-            CASE 
-                WHEN elem->>'standard' = 'STANDARD_ACTION_TRANSMIT' THEN 'create'
-                WHEN elem->>'standard' = 'STANDARD_ACTION_DECRYPT' THEN 'read'
-                WHEN elem->>'custom' IS NOT NULL THEN elem->>'custom'
-                ELSE NULL
-            END AS action_name
-        FROM jsonb_array_elements(subject_mappings.actions) AS elem
-        WHERE elem->>'standard' IS NOT NULL OR elem->>'custom' IS NOT NULL
-    ) s
-    JOIN actions a ON s.action_name = a.name
-);
+INSERT INTO subject_mapping_actions (subject_mapping_id, action_id)
+SELECT 
+    sm.id, 
+    a.id
+FROM 
+    subject_mappings sm,
+    LATERAL jsonb_array_elements(sm.actions) AS elem,
+    LATERAL (
+        SELECT a.id 
+        FROM actions a
+        WHERE a.name = CASE 
+            WHEN elem->>'standard' = 'STANDARD_ACTION_TRANSMIT' THEN 'create'
+            WHEN elem->>'standard' = 'STANDARD_ACTION_DECRYPT' THEN 'read'
+            WHEN elem->>'custom' IS NOT NULL THEN LOWER(elem->>'custom')
+            ELSE NULL
+        END
+    ) a;
 
--- Verify data was properly converted from marshaled protos to actions table row ids.
+-- 3d. Verify data was properly converted from marshaled protos to actions table row ids.
 DO $$
+DECLARE
+    expected_count BIGINT;
+    actual_count BIGINT;
 BEGIN
-    IF EXISTS (SELECT 1 FROM subject_mappings WHERE actions_uuid IS NULL) THEN
-        RAISE EXCEPTION 'Migration failed: Some rows have NULL actions_uuid';
+    SELECT COUNT(*) INTO expected_count
+    FROM 
+        subject_mappings sm,
+        LATERAL jsonb_array_elements(sm.actions) AS elem
+    WHERE 
+        elem->>'standard' IS NOT NULL OR elem->>'custom' IS NOT NULL;
+        
+    SELECT COUNT(*) INTO actual_count 
+    FROM subject_mapping_actions;
+    
+    IF expected_count != actual_count THEN
+        RAISE EXCEPTION 'Migration verification failed: Expected % relationships, found %', 
+                        expected_count, actual_count;
     END IF;
 END $$;
 
--- 3c. Drop the old JSONB column and rename the new UUID[] column to the old name.
+-- 3e. Drop the old JSONB column
 ALTER TABLE subject_mappings DROP COLUMN actions;
-ALTER TABLE subject_mappings RENAME COLUMN actions_uuid TO actions;
+
+-- 4. New indexes on the relation table
+CREATE INDEX IF NOT EXISTS idx_subject_mapping_actions_subject ON subject_mapping_actions(subject_mapping_id);
+CREATE INDEX IF NOT EXISTS idx_subject_mapping_actions_action ON subject_mapping_actions(action_id);
 
 -- +goose StatementEnd
 
 -- +goose Down
 -- +goose StatementBegin
+-- 1. Add a temporary JSONB column to subject_mappings
+ALTER TABLE subject_mappings ADD COLUMN actions JSONB DEFAULT '[]'::JSONB;
 
--- 1. Add a temporary JSONB column to hold the original format
-ALTER TABLE subject_mappings ADD COLUMN actions_jsonb JSONB;
-
--- 2. Convert the UUID[] action references back to the original JSONB format
+-- 2. Convert the intermediary table relationships back to JSONB format
 UPDATE subject_mappings sm
-SET actions_jsonb = (
+SET actions = (
     SELECT jsonb_agg(
         CASE
             WHEN a.name = 'create' THEN jsonb_build_object('standard', 'STANDARD_ACTION_TRANSMIT')
             WHEN a.name = 'read' THEN jsonb_build_object('standard', 'STANDARD_ACTION_DECRYPT')
-            -- Note: update / delete standard action enums in updated proto cannot be backported
+            WHEN a.is_standard = TRUE THEN jsonb_build_object('standard', a.name)
             ELSE jsonb_build_object('custom', a.name)
         END
     )
-    FROM unnest(sm.actions) AS action_id
-    JOIN actions a ON a.id = action_id
+    FROM subject_mapping_actions sma
+    JOIN actions a ON a.id = sma.action_id
+    WHERE sma.subject_mapping_id = sm.id
 );
 
--- 3. Verify the conversion worked
+-- 3. Set empty arrays to NULL to match original schema behavior (if needed)
+UPDATE subject_mappings
+SET actions = NULL
+WHERE actions = '[]'::JSONB;
+
+-- 4. Verify the migration worked correctly
 DO $$
+DECLARE
+    expected_count BIGINT;
+    actual_count BIGINT;
+    subject_mappings_with_actions BIGINT;
+    subject_mappings_with_relations BIGINT;
 BEGIN
-    IF EXISTS (SELECT 1 FROM subject_mappings WHERE actions_jsonb IS NULL AND actions IS NOT NULL) THEN
-        RAISE EXCEPTION 'Down migration failed: Some rows have NULL actions_jsonb';
+    -- Count total elements that should be in the JSONB arrays
+    SELECT COUNT(*) INTO expected_count
+    FROM subject_mapping_actions;
+    
+    -- Count total elements that are in the JSONB arrays
+    SELECT SUM(jsonb_array_length(actions)) INTO actual_count
+    FROM subject_mappings
+    WHERE actions IS NOT NULL;
+    
+    -- Count subject_mappings that have actions
+    SELECT COUNT(*) INTO subject_mappings_with_actions
+    FROM subject_mappings
+    WHERE actions IS NOT NULL;
+    
+    -- Count subject_mappings that had relationships
+    SELECT COUNT(DISTINCT subject_mapping_id) INTO subject_mappings_with_relations
+    FROM subject_mapping_actions;
+    
+    IF expected_count != actual_count THEN
+        RAISE EXCEPTION 'Migration verification failed: Expected % elements in JSONB arrays, found %', 
+                        expected_count, actual_count;
+    END IF;
+    
+    IF subject_mappings_with_actions != subject_mappings_with_relations THEN
+        RAISE EXCEPTION 'Migration verification failed: Expected % subject_mappings with actions, found %', 
+                        subject_mappings_with_relations, subject_mappings_with_actions;
     END IF;
 END $$;
 
--- 4. Drop the UUID[] column and rename the JSONB column back to actions
-ALTER TABLE subject_mappings DROP COLUMN actions;
-ALTER TABLE subject_mappings RENAME COLUMN actions_jsonb TO actions;
+-- 5. Drop the intermediary table
+DROP TABLE subject_mapping_actions;
 
--- 5. Drop the actions table
+-- 6. Drop the actions table
 DROP TABLE actions;
 
 -- +goose StatementEnd
\ No newline at end of file
diff --git a/service/policy/db/schema_erd.md b/service/policy/db/schema_erd.md
index 5f7c3e995b..eca1d4dec8 100644
--- a/service/policy/db/schema_erd.md
+++ b/service/policy/db/schema_erd.md
@@ -1,15 +1,3 @@
-<style>
-div.mermaid {
-	overflow-x: scroll;
-	background: rgb(15, 15, 15);
-}
-div.mermaid > svg {
-	width: 200rem; 
-	height: 100%;
-	padding: 1em;
-}
-</style>
-
 ```mermaid
 erDiagram
     actions {
@@ -147,8 +135,13 @@ erDiagram
         timestamp_with_time_zone updated_at 
     }
 
+    subject_mapping_actions {
+        uuid action_id PK,FK 
+        timestamp_without_time_zone created_at 
+        uuid subject_mapping_id PK,FK 
+    }
+
     subject_mappings {
-        ARRAY actions 
         uuid attribute_value_id FK "Foreign key to the attribute value"
         timestamp_with_time_zone created_at 
         uuid id PK "Primary key for the table"
@@ -157,6 +150,7 @@ erDiagram
         timestamp_with_time_zone updated_at 
     }
 
+    subject_mapping_actions }o--|| actions : "action_id"
     attribute_definition_key_access_grants }o--|| attribute_definitions : "attribute_definition_id"
     attribute_definition_key_access_grants }o--|| key_access_servers : "key_access_server_id"
     attribute_definition_public_key_map }o--|| attribute_definitions : "definition_id"
@@ -180,4 +174,6 @@ erDiagram
     public_keys }o--|| key_access_servers : "key_access_server_id"
     resource_mappings }o--|| resource_mapping_groups : "group_id"
     subject_mappings }o--|| subject_condition_set : "subject_condition_set_id"
-```
\ No newline at end of file
+    subject_mapping_actions }o--|| subject_mappings : "subject_mapping_id"
+```
+<style>div.mermaid{overflow-x:scroll;}div.mermaid>svg{width:250rem;}</style>

From fb3fd2241b367288d8a0e97150c5d1b63bd0d467 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Tue, 1 Apr 2025 15:07:56 -0700
Subject: [PATCH 015/110] global policy erd styling

---
 Makefile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Makefile b/Makefile
index 587a28da69..bab25a99ac 100644
--- a/Makefile
+++ b/Makefile
@@ -79,6 +79,8 @@ policy-erd-gen:
 	@which mermerd > /dev/null || { echo "mermerd not found, please install it: https://github.com/KarnerTh/mermerd#installation"; exit 1; }
 	# Docs: https://github.com/KarnerTh/mermerd#parametersflags
 	mermerd -c 'postgresql://postgres:changeme@localhost:5432/opentdf' -e -o service/policy/db/schema_erd.md -s opentdf_policy --useAllTables --showDescriptions enumValues,columnComments
+	# Add mermaid CSS to the end of the generated file
+	@echo '\n<style>div.mermaid{overflow-x:scroll;}div.mermaid>svg{width:250rem;}</style>' >> service/policy/db/schema_erd.md
 
 test:
 	for m in $(HAND_MODS); do (cd $$m && go test ./... -race) || exit 1; done

From 3c48cba8dd2f5007c57921946e781cf550059bdd Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Tue, 1 Apr 2025 15:13:32 -0700
Subject: [PATCH 016/110] fix migration markdown notes

---
 .../migrations/20250401000000_add_actions_table.md   | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/service/policy/db/migrations/20250401000000_add_actions_table.md b/service/policy/db/migrations/20250401000000_add_actions_table.md
index fc5e6fb0aa..179a9d64cc 100644
--- a/service/policy/db/migrations/20250401000000_add_actions_table.md
+++ b/service/policy/db/migrations/20250401000000_add_actions_table.md
@@ -10,17 +10,14 @@ resources while eliminating confusion in action handling across the platform.
 ```mermaid
 
 erDiagram
-
     SubjectMapping {
         uuid           id                          PK
         uuid           attribute_value_id          FK
         uuid[]         subject_condition_set_id    FK
-        uuid[]         actions                     FK "actions are now defined in actions table"
         jsonb          metadata
         timestamp      created_at
         timestamp      updated_at
     }
-
     Actions {
         uuid        id              PK  "id used for administration"
         name        varchar         UK  "unique name of the action"
@@ -29,7 +26,12 @@ erDiagram
         timestamp   created_at
         timestamp   updated_at
     }
-
-    SubjectMapping 1 -- 1+ Actions : "has"
+    SubjectMappingActions {
+        uuid        subject_mapping_id  PK,FK "references SubjectMapping"
+        uuid        action_id           PK,FK "references Actions"
+        timestamp   created_at
+    }
+    SubjectMapping ||--o{ SubjectMappingActions : "has"
+    SubjectMappingActions }o--|| Actions : "references"
 
 ```

From 85938a41a975845d2b60d0737a3cd21792dccade Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Wed, 2 Apr 2025 12:52:34 -0700
Subject: [PATCH 017/110] timestamp with time zone

---
 .../policy/db/migrations/20250401000000_add_actions_table.sql | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/service/policy/db/migrations/20250401000000_add_actions_table.sql b/service/policy/db/migrations/20250401000000_add_actions_table.sql
index e8fd440d01..05b2ebdcef 100644
--- a/service/policy/db/migrations/20250401000000_add_actions_table.sql
+++ b/service/policy/db/migrations/20250401000000_add_actions_table.sql
@@ -8,8 +8,8 @@ CREATE TABLE IF NOT EXISTS
         name VARCHAR NOT NULL,
         is_standard BOOLEAN NOT NULL DEFAULT FALSE,
         metadata JSONB,
-        created_at TIMESTAMP NOT NULL DEFAULT NOW(),
-        updated_at TIMESTAMP NOT NULL DEFAULT NOW(),
+        created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
+        updated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW(),
         CONSTRAINT actions_name_unique UNIQUE (name) 
     );
 

From 38068ab47080193c46e3fa4742b491fa91278202 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Wed, 2 Apr 2025 13:15:49 -0700
Subject: [PATCH 018/110] list actions query

---
 service/policy/db/query.sql | 47 +++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)

diff --git a/service/policy/db/query.sql b/service/policy/db/query.sql
index 17fb3c83ee..8e83c83aaf 100644
--- a/service/policy/db/query.sql
+++ b/service/policy/db/query.sql
@@ -1140,3 +1140,50 @@ INSERT INTO attribute_value_public_key_map (value_id, key_id) VALUES ($1, $2);
 DELETE FROM attribute_value_public_key_map WHERE value_id = $1 AND key_id = $2;
 
 ----------------------------------------------------------------
+
+
+---------------------------------------------------------------- 
+-- ACTIONS
+----------------------------------------------------------------
+
+-- name: listActions :many
+WITH counted AS (
+    SELECT COUNT(id) AS total FROM actions
+),
+SELECT 
+    (
+        SELECT JSONB_AGG(
+            JSONB_BUILD_OBJECT(
+                'id', id,
+                'name', name,
+                'metadata', JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
+                    'labels', metadata -> 'labels', 
+                    'created_at', created_at, 
+                    'updated_at', updated_at
+                ))
+            )
+        )
+        FROM actions
+        WHERE is_standard = TRUE
+    ) AS standard_actions,
+    (
+        SELECT JSONB_AGG(
+            JSONB_BUILD_OBJECT(
+                'id', id,
+                'name', name,
+                'metadata', JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
+                    'labels', metadata -> 'labels', 
+                    'created_at', created_at, 
+                    'updated_at', updated_at
+                ))
+            )
+        )
+        FROM actions
+        WHERE is_standard = FALSE
+    ) AS custom_actions,
+    (SELECT total FROM counted) AS total
+LIMIT @limit_ 
+OFFSET @offset_;
+
+
+----------------------------------------------------------------
\ No newline at end of file

From 9fa03969f2ff4520efca20e0408cf1b7b737deb7 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Wed, 2 Apr 2025 13:19:23 -0700
Subject: [PATCH 019/110] add subject mappings to get action response

---
 docs/grpc/index.html                          |   7 +
 .../policy/actions/actions.swagger.json       | 386 ++++++++++++++++++
 protocol/go/policy/actions/actions.pb.go      | 319 ++++++++-------
 service/policy/actions/actions.proto          |   3 +
 4 files changed, 563 insertions(+), 152 deletions(-)

diff --git a/docs/grpc/index.html b/docs/grpc/index.html
index 8b9ef1abf6..e3794da18e 100644
--- a/docs/grpc/index.html
+++ b/docs/grpc/index.html
@@ -4837,6 +4837,13 @@ <h3 id="policy.actions.GetActionResponse">GetActionResponse</h3>
                   <td><p> </p></td>
                 </tr>
               
+                <tr>
+                  <td>subject_mappings</td>
+                  <td><a href="#policy.SubjectMapping">policy.SubjectMapping</a></td>
+                  <td>repeated</td>
+                  <td><p>Subject Mappings driving entitlement to the action </p></td>
+                </tr>
+              
             </tbody>
           </table>
 
diff --git a/docs/openapi/policy/actions/actions.swagger.json b/docs/openapi/policy/actions/actions.swagger.json
index 5f136e72fa..230090fde5 100644
--- a/docs/openapi/policy/actions/actions.swagger.json
+++ b/docs/openapi/policy/actions/actions.swagger.json
@@ -53,6 +53,14 @@
       "properties": {
         "action": {
           "$ref": "#/definitions/policyAction"
+        },
+        "subjectMappings": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/policySubjectMapping"
+          },
+          "title": "Subject Mappings driving entitlement to the action"
         }
       }
     },
@@ -148,6 +156,249 @@
       },
       "title": "An action an entity can take"
     },
+    "policyAttribute": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "namespace": {
+          "$ref": "#/definitions/policyNamespace",
+          "title": "namespace of the attribute"
+        },
+        "name": {
+          "type": "string",
+          "title": "attribute name"
+        },
+        "rule": {
+          "$ref": "#/definitions/policyAttributeRuleTypeEnum",
+          "title": "attribute rule enum"
+        },
+        "values": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/policyValue"
+          }
+        },
+        "grants": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/policyKeyAccessServer"
+          },
+          "title": "Deprecated"
+        },
+        "fqn": {
+          "type": "string"
+        },
+        "active": {
+          "type": "boolean",
+          "title": "active by default until explicitly deactivated"
+        },
+        "keys": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/policyKey"
+          },
+          "title": "Keys associated with the attribute"
+        },
+        "metadata": {
+          "$ref": "#/definitions/commonMetadata",
+          "title": "Common metadata"
+        }
+      }
+    },
+    "policyAttributeRuleTypeEnum": {
+      "type": "string",
+      "enum": [
+        "ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED",
+        "ATTRIBUTE_RULE_TYPE_ENUM_ALL_OF",
+        "ATTRIBUTE_RULE_TYPE_ENUM_ANY_OF",
+        "ATTRIBUTE_RULE_TYPE_ENUM_HIERARCHY"
+      ],
+      "default": "ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED"
+    },
+    "policyCondition": {
+      "type": "object",
+      "properties": {
+        "subjectExternalSelectorValue": {
+          "type": "string",
+          "title": "a selector for a field value on a flattened Entity Representation (such as\nfrom idP/LDAP)"
+        },
+        "operator": {
+          "$ref": "#/definitions/policySubjectMappingOperatorEnum",
+          "title": "the evaluation operator of relation"
+        },
+        "subjectExternalValues": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "title": "list of comparison values for the result of applying the\nsubject_external_selector_value on a flattened Entity Representation\n(Subject), evaluated by the operator"
+        }
+      },
+      "title": "*\nA Condition defines a rule of \u003cthe value at the flattened 'selector value'\nlocation\u003e \u003coperator\u003e \u003csubject external values\u003e"
+    },
+    "policyConditionBooleanTypeEnum": {
+      "type": "string",
+      "enum": [
+        "CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED",
+        "CONDITION_BOOLEAN_TYPE_ENUM_AND",
+        "CONDITION_BOOLEAN_TYPE_ENUM_OR"
+      ],
+      "default": "CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED"
+    },
+    "policyConditionGroup": {
+      "type": "object",
+      "properties": {
+        "conditions": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/policyCondition"
+          }
+        },
+        "booleanOperator": {
+          "$ref": "#/definitions/policyConditionBooleanTypeEnum",
+          "title": "the boolean evaluation type across the conditions"
+        }
+      },
+      "title": "A collection of Conditions evaluated by the boolean_operator provided"
+    },
+    "policyKasPublicKey": {
+      "type": "object",
+      "properties": {
+        "pem": {
+          "type": "string",
+          "title": "x509 ASN.1 content in PEM envelope, usually"
+        },
+        "kid": {
+          "type": "string",
+          "title": "A unique string identifier for this key"
+        },
+        "alg": {
+          "$ref": "#/definitions/policyKasPublicKeyAlgEnum",
+          "description": "A known algorithm type with any additional parameters encoded.\nTo start, these may be `rsa:2048` for encrypting ZTDF files and\n`ec:secp256r1` for nanoTDF, but more formats may be added as needed."
+        }
+      },
+      "title": "A KAS public key and some associated metadata for further identifcation"
+    },
+    "policyKasPublicKeyAlgEnum": {
+      "type": "string",
+      "enum": [
+        "KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED",
+        "KAS_PUBLIC_KEY_ALG_ENUM_RSA_2048",
+        "KAS_PUBLIC_KEY_ALG_ENUM_RSA_4096",
+        "KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP256R1",
+        "KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP384R1",
+        "KAS_PUBLIC_KEY_ALG_ENUM_EC_SECP521R1"
+      ],
+      "default": "KAS_PUBLIC_KEY_ALG_ENUM_UNSPECIFIED"
+    },
+    "policyKasPublicKeySet": {
+      "type": "object",
+      "properties": {
+        "keys": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/policyKasPublicKey"
+          }
+        }
+      },
+      "title": "Deprecated\nA list of known KAS public keys"
+    },
+    "policyKey": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "title": "the database record ID, not the key ID (`kid`)"
+        },
+        "isActive": {
+          "type": "boolean"
+        },
+        "wasMapped": {
+          "type": "boolean"
+        },
+        "publicKey": {
+          "$ref": "#/definitions/policyKasPublicKey"
+        },
+        "kas": {
+          "$ref": "#/definitions/policyKeyAccessServer"
+        },
+        "metadata": {
+          "$ref": "#/definitions/commonMetadata",
+          "title": "Common metadata"
+        }
+      }
+    },
+    "policyKeyAccessServer": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "uri": {
+          "type": "string",
+          "title": "Address of a KAS instance"
+        },
+        "publicKey": {
+          "$ref": "#/definitions/policyPublicKey",
+          "title": "Deprecated"
+        },
+        "name": {
+          "type": "string",
+          "title": "Optional\nUnique name of the KAS instance"
+        },
+        "metadata": {
+          "$ref": "#/definitions/commonMetadata",
+          "title": "Common metadata"
+        }
+      },
+      "title": "Key Access Server Registry"
+    },
+    "policyNamespace": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "title": "generated uuid in database"
+        },
+        "name": {
+          "type": "string",
+          "title": "used to partition Attribute Definitions, support by namespace AuthN and\nenable federation"
+        },
+        "fqn": {
+          "type": "string"
+        },
+        "active": {
+          "type": "boolean",
+          "title": "active by default until explicitly deactivated"
+        },
+        "metadata": {
+          "$ref": "#/definitions/commonMetadata"
+        },
+        "grants": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/policyKeyAccessServer"
+          },
+          "title": "KAS grants for the namespace"
+        },
+        "keys": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/policyKey"
+          },
+          "title": "Keys for the namespace"
+        }
+      }
+    },
     "policyPageRequest": {
       "type": "object",
       "properties": {
@@ -183,6 +434,141 @@
         }
       }
     },
+    "policyPublicKey": {
+      "type": "object",
+      "properties": {
+        "remote": {
+          "type": "string",
+          "title": "kas public key url - optional since can also be retrieved via public key"
+        },
+        "cached": {
+          "$ref": "#/definitions/policyKasPublicKeySet",
+          "title": "public key with additional information. Current preferred version"
+        }
+      },
+      "title": "Deprecated"
+    },
+    "policySubjectConditionSet": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "subjectSets": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/policySubjectSet"
+          }
+        },
+        "metadata": {
+          "$ref": "#/definitions/commonMetadata"
+        }
+      },
+      "description": "A container for multiple Subject Sets, each containing Condition Groups, each\ncontaining Conditions. Multiple Subject Sets in a SubjectConditionSet are\nevaluated with AND logic. As each Subject Mapping has only one Attribute\nValue, the SubjectConditionSet is reusable across multiple Subject Mappings /\nAttribute Values and is an independent unit."
+    },
+    "policySubjectMapping": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "attributeValue": {
+          "$ref": "#/definitions/policyValue",
+          "title": "the Attribute Value mapped to; aka: \"The Entity Entitlement Attribute\""
+        },
+        "subjectConditionSet": {
+          "$ref": "#/definitions/policySubjectConditionSet",
+          "title": "the reusable SubjectConditionSet mapped to the given Attribute Value"
+        },
+        "actions": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/policyAction"
+          },
+          "title": "The actions permitted by subjects in this mapping"
+        },
+        "metadata": {
+          "$ref": "#/definitions/commonMetadata"
+        }
+      },
+      "title": "Subject Mapping: A Policy assigning Subject Set(s) to a permitted attribute\nvalue + action(s) combination"
+    },
+    "policySubjectMappingOperatorEnum": {
+      "type": "string",
+      "enum": [
+        "SUBJECT_MAPPING_OPERATOR_ENUM_UNSPECIFIED",
+        "SUBJECT_MAPPING_OPERATOR_ENUM_IN",
+        "SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN",
+        "SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS"
+      ],
+      "default": "SUBJECT_MAPPING_OPERATOR_ENUM_UNSPECIFIED",
+      "title": "- SUBJECT_MAPPING_OPERATOR_ENUM_IN: operator that returns true if a value in a list matches the string\n - SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN: operator that returns true if a value is not in a list that is matched by\nstring\n - SUBJECT_MAPPING_OPERATOR_ENUM_IN_CONTAINS: operator that returns true if a value in a list contains the substring"
+    },
+    "policySubjectSet": {
+      "type": "object",
+      "properties": {
+        "conditionGroups": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/policyConditionGroup"
+          },
+          "title": "multiple Condition Groups are evaluated with AND logic"
+        }
+      },
+      "title": "A collection of Condition Groups"
+    },
+    "policyValue": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "title": "generated uuid in database"
+        },
+        "attribute": {
+          "$ref": "#/definitions/policyAttribute"
+        },
+        "value": {
+          "type": "string"
+        },
+        "grants": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/policyKeyAccessServer"
+          },
+          "title": "Deprecated\nlist of key access servers"
+        },
+        "fqn": {
+          "type": "string"
+        },
+        "active": {
+          "type": "boolean",
+          "title": "active by default until explicitly deactivated"
+        },
+        "subjectMappings": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/policySubjectMapping"
+          },
+          "title": "subject mapping"
+        },
+        "keys": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/policyKey"
+          }
+        },
+        "metadata": {
+          "$ref": "#/definitions/commonMetadata",
+          "title": "Common metadata"
+        }
+      }
+    },
     "protobufAny": {
       "type": "object",
       "properties": {
diff --git a/protocol/go/policy/actions/actions.pb.go b/protocol/go/policy/actions/actions.pb.go
index e11d958c7d..5c2a43fb28 100644
--- a/protocol/go/policy/actions/actions.pb.go
+++ b/protocol/go/policy/actions/actions.pb.go
@@ -112,6 +112,8 @@ type GetActionResponse struct {
 	unknownFields protoimpl.UnknownFields
 
 	Action *policy.Action `protobuf:"bytes,1,opt,name=action,proto3" json:"action,omitempty"`
+	// Subject Mappings driving entitlement to the action
+	SubjectMappings []*policy.SubjectMapping `protobuf:"bytes,2,rep,name=subject_mappings,json=subjectMappings,proto3" json:"subject_mappings,omitempty"`
 }
 
 func (x *GetActionResponse) Reset() {
@@ -153,6 +155,13 @@ func (x *GetActionResponse) GetAction() *policy.Action {
 	return nil
 }
 
+func (x *GetActionResponse) GetSubjectMappings() []*policy.SubjectMapping {
+	if x != nil {
+		return x.SubjectMappings
+	}
+	return nil
+}
+
 type ListActionsRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -624,137 +633,141 @@ var file_policy_actions_actions_proto_rawDesc = []byte{
 	0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d,
 	0x29, 0x3f, 0x24, 0x27, 0x29, 0x72, 0x05, 0x10, 0x01, 0x18, 0xfd, 0x01, 0x48, 0x00, 0x52, 0x04,
 	0x6e, 0x61, 0x6d, 0x65, 0x42, 0x13, 0x0a, 0x0a, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69,
-	0x65, 0x72, 0x12, 0x05, 0xba, 0x48, 0x02, 0x08, 0x01, 0x22, 0x3b, 0x0a, 0x11, 0x47, 0x65, 0x74,
+	0x65, 0x72, 0x12, 0x05, 0xba, 0x48, 0x02, 0x08, 0x01, 0x22, 0x7e, 0x0a, 0x11, 0x47, 0x65, 0x74,
 	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26,
 	0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e,
 	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06,
-	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x49, 0x0a, 0x12, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x33, 0x0a, 0x0a,
-	0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x13, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x61, 0x67, 0x65, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x52, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x22, 0xbd, 0x01, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x39, 0x0a, 0x10, 0x61, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x5f, 0x73, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x18, 0x01, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x52, 0x0f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x53, 0x74, 0x61, 0x6e,
-	0x64, 0x61, 0x72, 0x64, 0x12, 0x35, 0x0a, 0x0e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x5f,
-	0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0d, 0x61, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x12, 0x34, 0x0a, 0x0a, 0x70,
-	0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x14, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x52, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x22, 0xed, 0x02, 0x0a, 0x13, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0xa0, 0x02, 0x0a, 0x04, 0x6e, 0x61,
-	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x8b, 0x02, 0xba, 0x48, 0x87, 0x02, 0xba,
-	0x01, 0xfc, 0x01, 0x0a, 0x12, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65,
-	0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0xa8, 0x01, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x61, 0x6e,
-	0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x73, 0x74,
-	0x72, 0x69, 0x6e, 0x67, 0x2c, 0x20, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x69, 0x6e, 0x67, 0x20, 0x68,
-	0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x75, 0x6e, 0x64, 0x65, 0x72,
-	0x73, 0x63, 0x6f, 0x72, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74, 0x20, 0x6e, 0x6f, 0x74, 0x20, 0x61,
-	0x73, 0x20, 0x74, 0x68, 0x65, 0x20, 0x66, 0x69, 0x72, 0x73, 0x74, 0x20, 0x6f, 0x72, 0x20, 0x6c,
-	0x61, 0x73, 0x74, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2e, 0x20, 0x54,
-	0x68, 0x65, 0x20, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x69, 0x73, 0x20, 0x6e, 0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69,
-	0x7a, 0x65, 0x64, 0x20, 0x74, 0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20, 0x63, 0x61, 0x73,
-	0x65, 0x2e, 0x1a, 0x3b, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73,
-	0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f,
-	0x3a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b,
-	0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x72,
-	0x05, 0x10, 0x01, 0x18, 0xfd, 0x01, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a, 0x08,
-	0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17,
-	0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
-	0x4d, 0x75, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x22, 0x3e, 0x0a, 0x14, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x22, 0xdd, 0x03, 0x0a, 0x13, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x52,
-	0x02, 0x69, 0x64, 0x12, 0xa0, 0x02, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x42, 0x8b, 0x02, 0xba, 0x48, 0x87, 0x02, 0xba, 0x01, 0xfc, 0x01, 0x0a, 0x12, 0x61,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61,
-	0x74, 0x12, 0xa8, 0x01, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20,
-	0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61,
-	0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x2c, 0x20,
-	0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x69, 0x6e, 0x67, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73,
-	0x20, 0x61, 0x6e, 0x64, 0x20, 0x75, 0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f, 0x72, 0x65, 0x73,
-	0x20, 0x62, 0x75, 0x74, 0x20, 0x6e, 0x6f, 0x74, 0x20, 0x61, 0x73, 0x20, 0x74, 0x68, 0x65, 0x20,
-	0x66, 0x69, 0x72, 0x73, 0x74, 0x20, 0x6f, 0x72, 0x20, 0x6c, 0x61, 0x73, 0x74, 0x20, 0x63, 0x68,
-	0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2e, 0x20, 0x54, 0x68, 0x65, 0x20, 0x73, 0x74, 0x6f,
-	0x72, 0x65, 0x64, 0x20, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20,
-	0x69, 0x73, 0x20, 0x6e, 0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64, 0x20, 0x74, 0x6f,
-	0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a, 0x3b, 0x74, 0x68,
-	0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d,
-	0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61, 0x2d, 0x7a, 0x41,
-	0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a,
-	0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x72, 0x05, 0x10, 0x01, 0x18, 0xfd, 0x01,
-	0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f,
-	0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4d, 0x75, 0x74, 0x61, 0x62, 0x6c,
-	0x65, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x54, 0x0a, 0x18, 0x6d,
-	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x62,
-	0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x18, 0x65, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e,
-	0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x55,
-	0x70, 0x64, 0x61, 0x74, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x52, 0x16, 0x6d, 0x65, 0x74, 0x61, 0x64,
-	0x61, 0x74, 0x61, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x42, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f,
-	0x72, 0x22, 0x3e, 0x0a, 0x14, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x22, 0x2f, 0x0a, 0x13, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x52, 0x02,
-	0x69, 0x64, 0x22, 0x3e, 0x0a, 0x14, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x32, 0xd4, 0x03, 0x0a, 0x0d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x72,
-	0x76, 0x69, 0x63, 0x65, 0x12, 0x52, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x12, 0x20, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74,
-	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x22, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x70, 0x6f,
-	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73,
-	0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
+	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x41, 0x0a, 0x10, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63,
+	0x74, 0x5f, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x16, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63,
+	0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x0f, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63,
+	0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x22, 0x49, 0x0a, 0x12, 0x4c, 0x69, 0x73,
+	0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x33, 0x0a, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x0a, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x61, 0x67,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x52, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x22, 0xbd, 0x01, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x39, 0x0a, 0x10,
+	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x5f, 0x73, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64,
+	0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x53,
+	0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x12, 0x35, 0x0a, 0x0e, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x5f, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
+	0x0d, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x12, 0x34,
+	0x0a, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x0a, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x14, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x61, 0x67, 0x65,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x52, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x22, 0xed, 0x02, 0x0a, 0x13, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0xa0, 0x02, 0x0a,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x8b, 0x02, 0xba, 0x48,
+	0x87, 0x02, 0xba, 0x01, 0xfc, 0x01, 0x0a, 0x12, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e,
+	0x61, 0x6d, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0xa8, 0x01, 0x41, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65,
+	0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63,
+	0x20, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x2c, 0x20, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x69, 0x6e,
+	0x67, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x75, 0x6e,
+	0x64, 0x65, 0x72, 0x73, 0x63, 0x6f, 0x72, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74, 0x20, 0x6e, 0x6f,
+	0x74, 0x20, 0x61, 0x73, 0x20, 0x74, 0x68, 0x65, 0x20, 0x66, 0x69, 0x72, 0x73, 0x74, 0x20, 0x6f,
+	0x72, 0x20, 0x6c, 0x61, 0x73, 0x74, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72,
+	0x2e, 0x20, 0x54, 0x68, 0x65, 0x20, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20, 0x61, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x69, 0x73, 0x20, 0x6e, 0x6f, 0x72, 0x6d,
+	0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64, 0x20, 0x74, 0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20,
+	0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a, 0x3b, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63,
+	0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39,
+	0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d,
+	0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24,
+	0x27, 0x29, 0x72, 0x05, 0x10, 0x01, 0x18, 0xfd, 0x01, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12,
+	0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x4d, 0x75, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x22, 0x3e, 0x0a, 0x14, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06,
+	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x22, 0xdd, 0x03, 0x0a, 0x13, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02,
+	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0,
+	0x01, 0x01, 0x52, 0x02, 0x69, 0x64, 0x12, 0xa0, 0x02, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x8b, 0x02, 0xba, 0x48, 0x87, 0x02, 0xba, 0x01, 0xfc, 0x01,
+	0x0a, 0x12, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x66, 0x6f,
+	0x72, 0x6d, 0x61, 0x74, 0x12, 0xa8, 0x01, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61,
+	0x6d, 0x65, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x73, 0x74, 0x72, 0x69, 0x6e,
+	0x67, 0x2c, 0x20, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x69, 0x6e, 0x67, 0x20, 0x68, 0x79, 0x70, 0x68,
+	0x65, 0x6e, 0x73, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x75, 0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f,
+	0x72, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74, 0x20, 0x6e, 0x6f, 0x74, 0x20, 0x61, 0x73, 0x20, 0x74,
+	0x68, 0x65, 0x20, 0x66, 0x69, 0x72, 0x73, 0x74, 0x20, 0x6f, 0x72, 0x20, 0x6c, 0x61, 0x73, 0x74,
+	0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2e, 0x20, 0x54, 0x68, 0x65, 0x20,
+	0x73, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61,
+	0x6d, 0x65, 0x20, 0x69, 0x73, 0x20, 0x6e, 0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64,
+	0x20, 0x74, 0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a,
+	0x3b, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e,
+	0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61,
+	0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a,
+	0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x72, 0x05, 0x10, 0x01,
+	0x18, 0xfd, 0x01, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f,
+	0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4d, 0x75, 0x74,
+	0x61, 0x62, 0x6c, 0x65, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x54,
+	0x0a, 0x18, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x75, 0x70, 0x64, 0x61, 0x74,
+	0x65, 0x5f, 0x62, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x18, 0x65, 0x20, 0x01, 0x28, 0x0e,
+	0x32, 0x1a, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x52, 0x16, 0x6d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x42, 0x65, 0x68, 0x61,
+	0x76, 0x69, 0x6f, 0x72, 0x22, 0x3e, 0x0a, 0x14, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06,
+	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x22, 0x2f, 0x0a, 0x13, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02, 0x69,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01,
+	0x01, 0x52, 0x02, 0x69, 0x64, 0x22, 0x3e, 0x0a, 0x14, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a,
+	0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e,
+	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x32, 0xd4, 0x03, 0x0a, 0x0d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x52, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x41, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x20, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
+	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0b, 0x4c,
+	0x69, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x22, 0x2e, 0x70, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23,
+	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e,
+	0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
 	0x6f, 0x6e, 0x12, 0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x6f, 0x6e, 0x73, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
 	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41,
+	0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41,
 	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12,
-	0x5b, 0x0a, 0x0c, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12,
+	0x5b, 0x0a, 0x0c, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12,
 	0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71,
+	0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71,
 	0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c,
-	0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x2e, 0x70,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x44, 0x65,
-	0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0xb3, 0x01, 0x0a, 0x12, 0x63, 0x6f,
-	0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x42, 0x0c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01,
-	0x5a, 0x36, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65,
-	0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x2f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xa2, 0x02, 0x03, 0x50, 0x41, 0x58, 0xaa, 0x02,
-	0x0e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xca,
-	0x02, 0x0e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0xe2, 0x02, 0x1a, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x73, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x0f,
-	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x3a, 0x3a, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x62,
-	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0xb3, 0x01, 0x0a,
+	0x12, 0x63, 0x6f, 0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x42, 0x0c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x50, 0x72, 0x6f, 0x74,
+	0x6f, 0x50, 0x01, 0x5a, 0x36, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f,
+	0x6f, 0x70, 0x65, 0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d,
+	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x2f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xa2, 0x02, 0x03, 0x50, 0x41,
+	0x58, 0xaa, 0x02, 0x0e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0xca, 0x02, 0x0e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0xe2, 0x02, 0x1a, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0xea, 0x02, 0x0f, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x3a, 0x3a, 0x41, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -782,38 +795,40 @@ var file_policy_actions_actions_proto_goTypes = []interface{}{
 	(*DeleteActionRequest)(nil),    // 8: policy.actions.DeleteActionRequest
 	(*DeleteActionResponse)(nil),   // 9: policy.actions.DeleteActionResponse
 	(*policy.Action)(nil),          // 10: policy.Action
-	(*policy.PageRequest)(nil),     // 11: policy.PageRequest
-	(*policy.PageResponse)(nil),    // 12: policy.PageResponse
-	(*common.MetadataMutable)(nil), // 13: common.MetadataMutable
-	(common.MetadataUpdateEnum)(0), // 14: common.MetadataUpdateEnum
+	(*policy.SubjectMapping)(nil),  // 11: policy.SubjectMapping
+	(*policy.PageRequest)(nil),     // 12: policy.PageRequest
+	(*policy.PageResponse)(nil),    // 13: policy.PageResponse
+	(*common.MetadataMutable)(nil), // 14: common.MetadataMutable
+	(common.MetadataUpdateEnum)(0), // 15: common.MetadataUpdateEnum
 }
 var file_policy_actions_actions_proto_depIdxs = []int32{
 	10, // 0: policy.actions.GetActionResponse.action:type_name -> policy.Action
-	11, // 1: policy.actions.ListActionsRequest.pagination:type_name -> policy.PageRequest
-	10, // 2: policy.actions.ListActionsResponse.actions_standard:type_name -> policy.Action
-	10, // 3: policy.actions.ListActionsResponse.actions_custom:type_name -> policy.Action
-	12, // 4: policy.actions.ListActionsResponse.pagination:type_name -> policy.PageResponse
-	13, // 5: policy.actions.CreateActionRequest.metadata:type_name -> common.MetadataMutable
-	10, // 6: policy.actions.CreateActionResponse.action:type_name -> policy.Action
-	13, // 7: policy.actions.UpdateActionRequest.metadata:type_name -> common.MetadataMutable
-	14, // 8: policy.actions.UpdateActionRequest.metadata_update_behavior:type_name -> common.MetadataUpdateEnum
-	10, // 9: policy.actions.UpdateActionResponse.action:type_name -> policy.Action
-	10, // 10: policy.actions.DeleteActionResponse.action:type_name -> policy.Action
-	0,  // 11: policy.actions.ActionService.GetAction:input_type -> policy.actions.GetActionRequest
-	2,  // 12: policy.actions.ActionService.ListActions:input_type -> policy.actions.ListActionsRequest
-	4,  // 13: policy.actions.ActionService.CreateAction:input_type -> policy.actions.CreateActionRequest
-	6,  // 14: policy.actions.ActionService.UpdateAction:input_type -> policy.actions.UpdateActionRequest
-	8,  // 15: policy.actions.ActionService.DeleteAction:input_type -> policy.actions.DeleteActionRequest
-	1,  // 16: policy.actions.ActionService.GetAction:output_type -> policy.actions.GetActionResponse
-	3,  // 17: policy.actions.ActionService.ListActions:output_type -> policy.actions.ListActionsResponse
-	5,  // 18: policy.actions.ActionService.CreateAction:output_type -> policy.actions.CreateActionResponse
-	7,  // 19: policy.actions.ActionService.UpdateAction:output_type -> policy.actions.UpdateActionResponse
-	9,  // 20: policy.actions.ActionService.DeleteAction:output_type -> policy.actions.DeleteActionResponse
-	16, // [16:21] is the sub-list for method output_type
-	11, // [11:16] is the sub-list for method input_type
-	11, // [11:11] is the sub-list for extension type_name
-	11, // [11:11] is the sub-list for extension extendee
-	0,  // [0:11] is the sub-list for field type_name
+	11, // 1: policy.actions.GetActionResponse.subject_mappings:type_name -> policy.SubjectMapping
+	12, // 2: policy.actions.ListActionsRequest.pagination:type_name -> policy.PageRequest
+	10, // 3: policy.actions.ListActionsResponse.actions_standard:type_name -> policy.Action
+	10, // 4: policy.actions.ListActionsResponse.actions_custom:type_name -> policy.Action
+	13, // 5: policy.actions.ListActionsResponse.pagination:type_name -> policy.PageResponse
+	14, // 6: policy.actions.CreateActionRequest.metadata:type_name -> common.MetadataMutable
+	10, // 7: policy.actions.CreateActionResponse.action:type_name -> policy.Action
+	14, // 8: policy.actions.UpdateActionRequest.metadata:type_name -> common.MetadataMutable
+	15, // 9: policy.actions.UpdateActionRequest.metadata_update_behavior:type_name -> common.MetadataUpdateEnum
+	10, // 10: policy.actions.UpdateActionResponse.action:type_name -> policy.Action
+	10, // 11: policy.actions.DeleteActionResponse.action:type_name -> policy.Action
+	0,  // 12: policy.actions.ActionService.GetAction:input_type -> policy.actions.GetActionRequest
+	2,  // 13: policy.actions.ActionService.ListActions:input_type -> policy.actions.ListActionsRequest
+	4,  // 14: policy.actions.ActionService.CreateAction:input_type -> policy.actions.CreateActionRequest
+	6,  // 15: policy.actions.ActionService.UpdateAction:input_type -> policy.actions.UpdateActionRequest
+	8,  // 16: policy.actions.ActionService.DeleteAction:input_type -> policy.actions.DeleteActionRequest
+	1,  // 17: policy.actions.ActionService.GetAction:output_type -> policy.actions.GetActionResponse
+	3,  // 18: policy.actions.ActionService.ListActions:output_type -> policy.actions.ListActionsResponse
+	5,  // 19: policy.actions.ActionService.CreateAction:output_type -> policy.actions.CreateActionResponse
+	7,  // 20: policy.actions.ActionService.UpdateAction:output_type -> policy.actions.UpdateActionResponse
+	9,  // 21: policy.actions.ActionService.DeleteAction:output_type -> policy.actions.DeleteActionResponse
+	17, // [17:22] is the sub-list for method output_type
+	12, // [12:17] is the sub-list for method input_type
+	12, // [12:12] is the sub-list for extension type_name
+	12, // [12:12] is the sub-list for extension extendee
+	0,  // [0:12] is the sub-list for field type_name
 }
 
 func init() { file_policy_actions_actions_proto_init() }
diff --git a/service/policy/actions/actions.proto b/service/policy/actions/actions.proto
index 7ff597039d..244d2c1f1d 100644
--- a/service/policy/actions/actions.proto
+++ b/service/policy/actions/actions.proto
@@ -33,6 +33,9 @@ message GetActionRequest {
 }
 message GetActionResponse {
   policy.Action action = 1;
+
+  // Subject Mappings driving entitlement to the action
+  repeated policy.SubjectMapping subject_mappings = 2;
 }
 
 message ListActionsRequest {

From 1ddc082a90add0dce78eb16546fbab10b22f78d7 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Wed, 2 Apr 2025 13:36:31 -0700
Subject: [PATCH 020/110] CRUD of actions (not including subject mappings yet

---
 service/policy/db/query.sql | 37 ++++++++++++++++++++++++++++++++++++-
 1 file changed, 36 insertions(+), 1 deletion(-)

diff --git a/service/policy/db/query.sql b/service/policy/db/query.sql
index 8e83c83aaf..6c37322eda 100644
--- a/service/policy/db/query.sql
+++ b/service/policy/db/query.sql
@@ -1149,7 +1149,7 @@ DELETE FROM attribute_value_public_key_map WHERE value_id = $1 AND key_id = $2;
 -- name: listActions :many
 WITH counted AS (
     SELECT COUNT(id) AS total FROM actions
-),
+)
 SELECT 
     (
         SELECT JSONB_AGG(
@@ -1185,5 +1185,40 @@ SELECT
 LIMIT @limit_ 
 OFFSET @offset_;
 
+-- name: getAction :one
+SELECT 
+    id,
+    name,
+    is_standard,
+    JSON_STRIP_NULLS(JSON_BUILD_OBJECT('labels', metadata -> 'labels', 'created_at', created_at, 'updated_at', updated_at)) AS metadata
+FROM actions
+WHERE 
+  (sqlc.narg('id')::uuid IS NULL OR ns.id = sqlc.narg('id')::uuid)
+  AND (sqlc.narg('name')::text IS NULL OR ns.name = sqlc.narg('name')::text);
+
+-- name: createCustomAction :one
+INSERT INTO actions (name, is_standard, metadata)
+VALUES ($1, FALSE, $3)
+RETURNING id;
+
+-- name: updateCustomAction :execrows
+UPDATE actions
+SET
+    name = COALESCE(sqlc.narg('name'), name),
+    metadata = COALESCE(sqlc.narg('metadata'), metadata)
+WHERE id = $1
+  AND is_standard = FALSE;
+
+-- name: updateStandardAction :execrows
+UPDATE actions
+SET metadata = metadata
+WHERE id = $1
+  AND is_standard = TRUE;
+
+-- name: deleteCustomAction :execrows
+DELETE FROM actions
+WHERE id = $1
+  AND is_standard = FALSE;
+
 
 ----------------------------------------------------------------
\ No newline at end of file

From 445ff05cb580f7059fe133c2b54d0c8d4c67878d Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Wed, 2 Apr 2025 14:46:26 -0700
Subject: [PATCH 021/110] wip

---
 service/policy/db/query.sql | 48 ++++++++++++++++++++++++++++++-------
 1 file changed, 39 insertions(+), 9 deletions(-)

diff --git a/service/policy/db/query.sql b/service/policy/db/query.sql
index 6c37322eda..8b4a62ba32 100644
--- a/service/policy/db/query.sql
+++ b/service/policy/db/query.sql
@@ -855,10 +855,20 @@ WITH counted AS (
     SELECT COUNT(sm.id) AS total
     FROM subject_mappings sm
 )
-
 SELECT
     sm.id,
-    sm.actions,
+    (
+        SELECT JSONB_AGG(JSONB_BUILD_OBJECT('id', a.id, 'name', a.name, 'metadata', a.metadata))
+        FROM subject_mapping_actions sma
+        JOIN actions a ON sma.action_id = a.id
+        WHERE sma.subject_mapping_id = sm.id AND a.is_standard = TRUE
+    ) AS standard_actions,
+    (
+        SELECT JSONB_AGG(JSONB_BUILD_OBJECT('id', a.id, 'name', a.name, 'metadata', a.metadata))
+        FROM subject_mapping_actions sma
+        JOIN actions a ON sma.action_id = a.id
+        WHERE sma.subject_mapping_id = sm.id AND a.is_standard = FALSE
+    ) AS custom_actions,
     JSON_STRIP_NULLS(JSON_BUILD_OBJECT('labels', sm.metadata -> 'labels', 'created_at', sm.created_at, 'updated_at', sm.updated_at)) AS metadata,
     JSON_BUILD_OBJECT(
         'id', scs.id,
@@ -884,7 +894,18 @@ OFFSET @offset_;
 -- name: GetSubjectMapping :one
 SELECT
     sm.id,
-    sm.actions,
+    (
+        SELECT JSONB_AGG(JSONB_BUILD_OBJECT('id', a.id, 'name', a.name, 'metadata', a.metadata))
+        FROM subject_mapping_actions sma
+        JOIN actions a ON sma.action_id = a.id
+        WHERE sma.subject_mapping_id = sm.id AND a.is_standard = TRUE
+    ) AS standard_actions,
+    (
+        SELECT JSONB_AGG(JSONB_BUILD_OBJECT('id', a.id, 'name', a.name, 'metadata', a.metadata))
+        FROM subject_mapping_actions sma
+        JOIN actions a ON sma.action_id = a.id
+        WHERE sma.subject_mapping_id = sm.id AND a.is_standard = FALSE
+    ) AS custom_actions,
     JSON_STRIP_NULLS(JSON_BUILD_OBJECT('labels', sm.metadata -> 'labels', 'created_at', sm.created_at, 'updated_at', sm.updated_at)) AS metadata,
     JSON_BUILD_OBJECT(
         'id', scs.id,
@@ -901,7 +922,18 @@ GROUP BY av.id, sm.id, scs.id;
 -- name: MatchSubjectMappings :many
 SELECT
     sm.id,
-    sm.actions,
+    (
+        SELECT JSONB_AGG(JSONB_BUILD_OBJECT('id', a.id, 'name', a.name, 'metadata', a.metadata))
+        FROM subject_mapping_actions sma
+        JOIN actions a ON sma.action_id = a.id
+        WHERE sma.subject_mapping_id = sm.id AND a.is_standard = TRUE
+    ) AS standard_actions,
+    (
+        SELECT JSONB_AGG(JSONB_BUILD_OBJECT('id', a.id, 'name', a.name, 'metadata', a.metadata))
+        FROM subject_mapping_actions sma
+        JOIN actions a ON sma.action_id = a.id
+        WHERE sma.subject_mapping_id = sm.id AND a.is_standard = FALSE
+    ) AS custom_actions,
     JSON_BUILD_OBJECT(
         'id', scs.id,
         'subject_sets', scs.condition
@@ -919,7 +951,6 @@ WHERE ns.active = true AND ad.active = true and av.active = true AND EXISTS (
 )
 GROUP BY av.id, sm.id, scs.id;
 
-
 -- name: CreateSubjectMapping :one
 INSERT INTO subject_mappings (attribute_value_id, actions, metadata, subject_condition_set_id)
 VALUES ($1, $2, $3, $4)
@@ -1191,10 +1222,10 @@ SELECT
     name,
     is_standard,
     JSON_STRIP_NULLS(JSON_BUILD_OBJECT('labels', metadata -> 'labels', 'created_at', created_at, 'updated_at', updated_at)) AS metadata
-FROM actions
+FROM actions a
 WHERE 
-  (sqlc.narg('id')::uuid IS NULL OR ns.id = sqlc.narg('id')::uuid)
-  AND (sqlc.narg('name')::text IS NULL OR ns.name = sqlc.narg('name')::text);
+  (sqlc.narg('id')::uuid IS NULL OR a.id = sqlc.narg('id')::uuid)
+  AND (sqlc.narg('name')::text IS NULL OR a.name = sqlc.narg('name')::text);
 
 -- name: createCustomAction :one
 INSERT INTO actions (name, is_standard, metadata)
@@ -1220,5 +1251,4 @@ DELETE FROM actions
 WHERE id = $1
   AND is_standard = FALSE;
 
-
 ----------------------------------------------------------------
\ No newline at end of file

From dcd40c4dbd1b8a54cd9f8d1d0947862d1863e881 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Wed, 2 Apr 2025 14:58:04 -0700
Subject: [PATCH 022/110] mini ADR for storing standard actions

---
 .../0004-standard-action-storage-handling.md  | 47 +++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 service/policy/adr/0004-standard-action-storage-handling.md

diff --git a/service/policy/adr/0004-standard-action-storage-handling.md b/service/policy/adr/0004-standard-action-storage-handling.md
new file mode 100644
index 0000000000..ac9688603d
--- /dev/null
+++ b/service/policy/adr/0004-standard-action-storage-handling.md
@@ -0,0 +1,47 @@
+# Standard Actions will be storage-driven and exported SDK constants
+
+Admin CRUD and PEP usage of actions (standard and custom) is getting complex.
+
+Protos for Standard Actions are good because PEPs have the acceptable values importable at build/compile time, but interoperability
+with Custom Actions (which must be fetched / configured) is challenging.
+
+## Chosen Option: Standard Actions will be storage-driven and exported SDK constants
+
+1. We will store CRUD action names with `is_standard = TRUE` in policy db table.
+2. We will expose `ActionCreate`, `ActionRead`, etc, via SDK constants to make standard actions importable.
+3. Custom actions in PEPs will be retrievable or configrable as needed (as action name strings or policy object action ids).
+4. We will avoid significant complexity from normalizing proto enums to stored table rows, and vice versa.
+5. Subject Mappings CRUD, Obligations CRUD, and GetDecisions will support actions by `name` or `id` and
+validate that the action exists in the policy database.
+6. We will deprecate the existing standard action enums and suggest use of SDK constants.
+
+## Options
+
+### Enhance existing StandardAction proto enum and normalize when stored in actions table
+1. Standard Actions are proto-defined and normalized into the db (STANDARD_ACTION_ENUM_CREATE => 'create') with is_standard = TRUE.
+2. Admins can write metadata labels for standard actions, but they're otherwise immutable.
+3. This becomes quite complex in Subject Mappings CRUD, Obligations CRUD, and GetDecisions with need to support:
+    1. custom action by id
+    2. custom action by stored, normalized name
+    3. standard action by stored id (to be normalized to proto in API layer)
+    4. standard action by stored, normalized name (to be normalized to proto in API layer)
+    5. proto enum for standard action (to be normalized to a stored name in DB layer)
+
+### Enhance existing StandardAction proto enum but do not store in actions table
+1. Standard Actions are proto-only.
+2. Custom Actions are stored in db table.
+3. Subject Mappings column for standard_actions (marshaled protos), and relation table for custom actions (by id).
+4. Simpler Subject Mappings CRUD, Obligations CRUD, and GetDecisions:
+    1. custom action by id
+    2. custom action by stored, normalized name
+    3. proto enum for standard action
+
+### Standard Actions will be storage-driven and exported SDK constants
+1. Standard Actions become read-only "create, read, update, delete" rows in db table (with column is_standard = TRUE).
+2. Custom Actions are fully writable with unique names and column is_standard = FALSE.
+3. Old proto enums are deprecated.
+4. Simpler Subject Mappings CRUD, Obligations CRUD, and GetDecisions:
+    1. action by id
+    2. action by name
+    3. SDKs can still export constants like ActionCreate, ActionRead, etc
+

From a67018f99b20a4370af60132bfb6add4cd7390c4 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Wed, 2 Apr 2025 15:10:16 -0700
Subject: [PATCH 023/110] rework protos according to mini-ADR and how we'll
 store standard actions

---
 docs/grpc/index.html                          |  48 +-
 .../authorization/authorization.swagger.json  |  20 +-
 .../policy/actions/actions.swagger.json       |  20 +-
 .../policy/attributes/attributes.swagger.json |  20 +-
 .../resource_mapping.swagger.json             |  20 +-
 .../subject_mapping.swagger.json              |  20 +-
 .../openapi/policy/unsafe/unsafe.swagger.json |  20 +-
 examples/cmd/authorization.go                 |   2 +-
 examples/cmd/benchmark_decision.go            |   2 +-
 protocol/go/policy/objects.pb.go              | 542 +++++++++---------
 service/integration/subject_mappings_test.go  |   8 +-
 service/kas/access/accessPdp.go               |   4 +-
 service/policy/objects.proto                  |  20 +-
 .../subjectmapping/subject_mapping_test.go    |   2 +-
 service/rttests/rt_test.go                    |   4 +-
 15 files changed, 378 insertions(+), 374 deletions(-)

diff --git a/docs/grpc/index.html b/docs/grpc/index.html
index e3794da18e..d448c9ecb4 100644
--- a/docs/grpc/index.html
+++ b/docs/grpc/index.html
@@ -1623,18 +1623,32 @@ <h3 id="policy.Action">Action</h3>
             </thead>
             <tbody>
               
+                <tr>
+                  <td>id</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Generated uuid in database </p></td>
+                </tr>
+              
                 <tr>
                   <td>standard</td>
                   <td><a href="#policy.Action.StandardAction">Action.StandardAction</a></td>
                   <td></td>
-                  <td><p>standard CRUD action </p></td>
+                  <td><p>Deprecated </p></td>
                 </tr>
               
                 <tr>
                   <td>custom</td>
                   <td><a href="#string">string</a></td>
                   <td></td>
-                  <td><p>distinctly custom action </p></td>
+                  <td><p>Deprecated </p></td>
+                </tr>
+              
+                <tr>
+                  <td>name</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p> </p></td>
                 </tr>
               
                 <tr>
@@ -2411,7 +2425,7 @@ <h3 id="policy.Value">Value</h3>
 
       
         <h3 id="policy.Action.StandardAction">Action.StandardAction</h3>
-        <p>Standard actions supported by the platform</p>
+        <p></p>
         <table class="enum-table">
           <thead>
             <tr><td>Name</td><td>Number</td><td>Description</td></tr>
@@ -2428,38 +2442,14 @@ <h3 id="policy.Action.StandardAction">Action.StandardAction</h3>
                 <td>STANDARD_ACTION_DECRYPT</td>
                 <td>1</td>
                 <td><p>Deprecated
-Migrate to `STANDARD_ACTION_READ`</p></td>
+Migrate to &#39;read&#39; action name</p></td>
               </tr>
             
               <tr>
                 <td>STANDARD_ACTION_TRANSMIT</td>
                 <td>2</td>
                 <td><p>Deprecated
-Migrate to `STANDARD_ACTION_CREATE` or a custom action</p></td>
-              </tr>
-            
-              <tr>
-                <td>STANDARD_ACTION_CREATE</td>
-                <td>3</td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>STANDARD_ACTION_READ</td>
-                <td>4</td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>STANDARD_ACTION_UPDATE</td>
-                <td>5</td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>STANDARD_ACTION_DELETE</td>
-                <td>6</td>
-                <td><p></p></td>
+Migrate to &#39;create&#39; action name</p></td>
               </tr>
             
           </tbody>
diff --git a/docs/openapi/authorization/authorization.swagger.json b/docs/openapi/authorization/authorization.swagger.json
index f2dfb8a62f..16b31595aa 100644
--- a/docs/openapi/authorization/authorization.swagger.json
+++ b/docs/openapi/authorization/authorization.swagger.json
@@ -110,15 +110,10 @@
       "enum": [
         "STANDARD_ACTION_UNSPECIFIED",
         "STANDARD_ACTION_DECRYPT",
-        "STANDARD_ACTION_TRANSMIT",
-        "STANDARD_ACTION_CREATE",
-        "STANDARD_ACTION_READ",
-        "STANDARD_ACTION_UPDATE",
-        "STANDARD_ACTION_DELETE"
+        "STANDARD_ACTION_TRANSMIT"
       ],
       "default": "STANDARD_ACTION_UNSPECIFIED",
-      "description": "- STANDARD_ACTION_DECRYPT: Deprecated\nMigrate to `STANDARD_ACTION_READ`\n - STANDARD_ACTION_TRANSMIT: Deprecated\nMigrate to `STANDARD_ACTION_CREATE` or a custom action",
-      "title": "Standard actions supported by the platform"
+      "title": "- STANDARD_ACTION_DECRYPT: Deprecated\nMigrate to 'read' action name\n - STANDARD_ACTION_TRANSMIT: Deprecated\nMigrate to 'create' action name"
     },
     "DecisionResponseDecision": {
       "type": "string",
@@ -426,13 +421,20 @@
     "policyAction": {
       "type": "object",
       "properties": {
+        "id": {
+          "type": "string",
+          "title": "Generated uuid in database"
+        },
         "standard": {
           "$ref": "#/definitions/ActionStandardAction",
-          "title": "standard CRUD action"
+          "title": "Deprecated"
         },
         "custom": {
           "type": "string",
-          "title": "distinctly custom action"
+          "title": "Deprecated"
+        },
+        "name": {
+          "type": "string"
         },
         "metadata": {
           "$ref": "#/definitions/commonMetadata"
diff --git a/docs/openapi/policy/actions/actions.swagger.json b/docs/openapi/policy/actions/actions.swagger.json
index 230090fde5..737380e15d 100644
--- a/docs/openapi/policy/actions/actions.swagger.json
+++ b/docs/openapi/policy/actions/actions.swagger.json
@@ -22,15 +22,10 @@
       "enum": [
         "STANDARD_ACTION_UNSPECIFIED",
         "STANDARD_ACTION_DECRYPT",
-        "STANDARD_ACTION_TRANSMIT",
-        "STANDARD_ACTION_CREATE",
-        "STANDARD_ACTION_READ",
-        "STANDARD_ACTION_UPDATE",
-        "STANDARD_ACTION_DELETE"
+        "STANDARD_ACTION_TRANSMIT"
       ],
       "default": "STANDARD_ACTION_UNSPECIFIED",
-      "description": "- STANDARD_ACTION_DECRYPT: Deprecated\nMigrate to `STANDARD_ACTION_READ`\n - STANDARD_ACTION_TRANSMIT: Deprecated\nMigrate to `STANDARD_ACTION_CREATE` or a custom action",
-      "title": "Standard actions supported by the platform"
+      "title": "- STANDARD_ACTION_DECRYPT: Deprecated\nMigrate to 'read' action name\n - STANDARD_ACTION_TRANSMIT: Deprecated\nMigrate to 'create' action name"
     },
     "actionsCreateActionResponse": {
       "type": "object",
@@ -142,13 +137,20 @@
     "policyAction": {
       "type": "object",
       "properties": {
+        "id": {
+          "type": "string",
+          "title": "Generated uuid in database"
+        },
         "standard": {
           "$ref": "#/definitions/ActionStandardAction",
-          "title": "standard CRUD action"
+          "title": "Deprecated"
         },
         "custom": {
           "type": "string",
-          "title": "distinctly custom action"
+          "title": "Deprecated"
+        },
+        "name": {
+          "type": "string"
         },
         "metadata": {
           "$ref": "#/definitions/commonMetadata"
diff --git a/docs/openapi/policy/attributes/attributes.swagger.json b/docs/openapi/policy/attributes/attributes.swagger.json
index 78b30e2772..d545a83514 100644
--- a/docs/openapi/policy/attributes/attributes.swagger.json
+++ b/docs/openapi/policy/attributes/attributes.swagger.json
@@ -662,15 +662,10 @@
       "enum": [
         "STANDARD_ACTION_UNSPECIFIED",
         "STANDARD_ACTION_DECRYPT",
-        "STANDARD_ACTION_TRANSMIT",
-        "STANDARD_ACTION_CREATE",
-        "STANDARD_ACTION_READ",
-        "STANDARD_ACTION_UPDATE",
-        "STANDARD_ACTION_DELETE"
+        "STANDARD_ACTION_TRANSMIT"
       ],
       "default": "STANDARD_ACTION_UNSPECIFIED",
-      "description": "- STANDARD_ACTION_DECRYPT: Deprecated\nMigrate to `STANDARD_ACTION_READ`\n - STANDARD_ACTION_TRANSMIT: Deprecated\nMigrate to `STANDARD_ACTION_CREATE` or a custom action",
-      "title": "Standard actions supported by the platform"
+      "title": "- STANDARD_ACTION_DECRYPT: Deprecated\nMigrate to 'read' action name\n - STANDARD_ACTION_TRANSMIT: Deprecated\nMigrate to 'create' action name"
     },
     "AttributeValueSelectorAttributeSelectorNamespaceSelector": {
       "type": "object"
@@ -999,13 +994,20 @@
     "policyAction": {
       "type": "object",
       "properties": {
+        "id": {
+          "type": "string",
+          "title": "Generated uuid in database"
+        },
         "standard": {
           "$ref": "#/definitions/ActionStandardAction",
-          "title": "standard CRUD action"
+          "title": "Deprecated"
         },
         "custom": {
           "type": "string",
-          "title": "distinctly custom action"
+          "title": "Deprecated"
+        },
+        "name": {
+          "type": "string"
         },
         "metadata": {
           "$ref": "#/definitions/commonMetadata"
diff --git a/docs/openapi/policy/resourcemapping/resource_mapping.swagger.json b/docs/openapi/policy/resourcemapping/resource_mapping.swagger.json
index 4e44c3fefe..8ca0031891 100644
--- a/docs/openapi/policy/resourcemapping/resource_mapping.swagger.json
+++ b/docs/openapi/policy/resourcemapping/resource_mapping.swagger.json
@@ -447,15 +447,10 @@
       "enum": [
         "STANDARD_ACTION_UNSPECIFIED",
         "STANDARD_ACTION_DECRYPT",
-        "STANDARD_ACTION_TRANSMIT",
-        "STANDARD_ACTION_CREATE",
-        "STANDARD_ACTION_READ",
-        "STANDARD_ACTION_UPDATE",
-        "STANDARD_ACTION_DELETE"
+        "STANDARD_ACTION_TRANSMIT"
       ],
       "default": "STANDARD_ACTION_UNSPECIFIED",
-      "description": "- STANDARD_ACTION_DECRYPT: Deprecated\nMigrate to `STANDARD_ACTION_READ`\n - STANDARD_ACTION_TRANSMIT: Deprecated\nMigrate to `STANDARD_ACTION_CREATE` or a custom action",
-      "title": "Standard actions supported by the platform"
+      "title": "- STANDARD_ACTION_DECRYPT: Deprecated\nMigrate to 'read' action name\n - STANDARD_ACTION_TRANSMIT: Deprecated\nMigrate to 'create' action name"
     },
     "commonMetadata": {
       "type": "object",
@@ -505,13 +500,20 @@
     "policyAction": {
       "type": "object",
       "properties": {
+        "id": {
+          "type": "string",
+          "title": "Generated uuid in database"
+        },
         "standard": {
           "$ref": "#/definitions/ActionStandardAction",
-          "title": "standard CRUD action"
+          "title": "Deprecated"
         },
         "custom": {
           "type": "string",
-          "title": "distinctly custom action"
+          "title": "Deprecated"
+        },
+        "name": {
+          "type": "string"
         },
         "metadata": {
           "$ref": "#/definitions/commonMetadata"
diff --git a/docs/openapi/policy/subjectmapping/subject_mapping.swagger.json b/docs/openapi/policy/subjectmapping/subject_mapping.swagger.json
index 1b57d4b041..3f8e55b08e 100644
--- a/docs/openapi/policy/subjectmapping/subject_mapping.swagger.json
+++ b/docs/openapi/policy/subjectmapping/subject_mapping.swagger.json
@@ -454,15 +454,10 @@
       "enum": [
         "STANDARD_ACTION_UNSPECIFIED",
         "STANDARD_ACTION_DECRYPT",
-        "STANDARD_ACTION_TRANSMIT",
-        "STANDARD_ACTION_CREATE",
-        "STANDARD_ACTION_READ",
-        "STANDARD_ACTION_UPDATE",
-        "STANDARD_ACTION_DELETE"
+        "STANDARD_ACTION_TRANSMIT"
       ],
       "default": "STANDARD_ACTION_UNSPECIFIED",
-      "description": "- STANDARD_ACTION_DECRYPT: Deprecated\nMigrate to `STANDARD_ACTION_READ`\n - STANDARD_ACTION_TRANSMIT: Deprecated\nMigrate to `STANDARD_ACTION_CREATE` or a custom action",
-      "title": "Standard actions supported by the platform"
+      "title": "- STANDARD_ACTION_DECRYPT: Deprecated\nMigrate to 'read' action name\n - STANDARD_ACTION_TRANSMIT: Deprecated\nMigrate to 'create' action name"
     },
     "commonMetadata": {
       "type": "object",
@@ -512,13 +507,20 @@
     "policyAction": {
       "type": "object",
       "properties": {
+        "id": {
+          "type": "string",
+          "title": "Generated uuid in database"
+        },
         "standard": {
           "$ref": "#/definitions/ActionStandardAction",
-          "title": "standard CRUD action"
+          "title": "Deprecated"
         },
         "custom": {
           "type": "string",
-          "title": "distinctly custom action"
+          "title": "Deprecated"
+        },
+        "name": {
+          "type": "string"
         },
         "metadata": {
           "$ref": "#/definitions/commonMetadata"
diff --git a/docs/openapi/policy/unsafe/unsafe.swagger.json b/docs/openapi/policy/unsafe/unsafe.swagger.json
index 99f0fa6a7e..1ba1c09bf8 100644
--- a/docs/openapi/policy/unsafe/unsafe.swagger.json
+++ b/docs/openapi/policy/unsafe/unsafe.swagger.json
@@ -366,15 +366,10 @@
       "enum": [
         "STANDARD_ACTION_UNSPECIFIED",
         "STANDARD_ACTION_DECRYPT",
-        "STANDARD_ACTION_TRANSMIT",
-        "STANDARD_ACTION_CREATE",
-        "STANDARD_ACTION_READ",
-        "STANDARD_ACTION_UPDATE",
-        "STANDARD_ACTION_DELETE"
+        "STANDARD_ACTION_TRANSMIT"
       ],
       "default": "STANDARD_ACTION_UNSPECIFIED",
-      "description": "- STANDARD_ACTION_DECRYPT: Deprecated\nMigrate to `STANDARD_ACTION_READ`\n - STANDARD_ACTION_TRANSMIT: Deprecated\nMigrate to `STANDARD_ACTION_CREATE` or a custom action",
-      "title": "Standard actions supported by the platform"
+      "title": "- STANDARD_ACTION_DECRYPT: Deprecated\nMigrate to 'read' action name\n - STANDARD_ACTION_TRANSMIT: Deprecated\nMigrate to 'create' action name"
     },
     "commonMetadata": {
       "type": "object",
@@ -402,13 +397,20 @@
     "policyAction": {
       "type": "object",
       "properties": {
+        "id": {
+          "type": "string",
+          "title": "Generated uuid in database"
+        },
         "standard": {
           "$ref": "#/definitions/ActionStandardAction",
-          "title": "standard CRUD action"
+          "title": "Deprecated"
         },
         "custom": {
           "type": "string",
-          "title": "distinctly custom action"
+          "title": "Deprecated"
+        },
+        "name": {
+          "type": "string"
         },
         "metadata": {
           "$ref": "#/definitions/commonMetadata"
diff --git a/examples/cmd/authorization.go b/examples/cmd/authorization.go
index aba7cbb28e..f401e32c9c 100644
--- a/examples/cmd/authorization.go
+++ b/examples/cmd/authorization.go
@@ -30,7 +30,7 @@ func authorizationExamples() error {
 
 	// request decision on "CREATE" Action
 	actions := []*policy.Action{{
-		Value: &policy.Action_Standard{Standard: policy.Action_STANDARD_ACTION_CREATE},
+		Value: &policy.Action_Standard{Standard: policy.Action_STANDARD_ACTION_DECRYPT},
 	}}
 
 	// model two groups of entities; user bob and user alice
diff --git a/examples/cmd/benchmark_decision.go b/examples/cmd/benchmark_decision.go
index 1120f7182e..a69a3a2801 100644
--- a/examples/cmd/benchmark_decision.go
+++ b/examples/cmd/benchmark_decision.go
@@ -37,7 +37,7 @@ func runDecisionBenchmark(cmd *cobra.Command, args []string) error {
 		DecisionRequests: []*authorization.DecisionRequest{
 			{
 				Actions: []*policy.Action{{Value: &policy.Action_Standard{
-					Standard: policy.Action_STANDARD_ACTION_READ,
+					Standard: policy.Action_STANDARD_ACTION_DECRYPT,
 				}}},
 				EntityChains: []*authorization.EntityChain{
 					{Id: "rewrap-tok", Entities: []*authorization.Entity{
diff --git a/protocol/go/policy/objects.pb.go b/protocol/go/policy/objects.pb.go
index bc4caea347..3a40fb5675 100644
--- a/protocol/go/policy/objects.pb.go
+++ b/protocol/go/policy/objects.pb.go
@@ -238,21 +238,16 @@ func (KasPublicKeyAlgEnum) EnumDescriptor() ([]byte, []int) {
 	return file_policy_objects_proto_rawDescGZIP(), []int{3}
 }
 
-// Standard actions supported by the platform
 type Action_StandardAction int32
 
 const (
 	Action_STANDARD_ACTION_UNSPECIFIED Action_StandardAction = 0
 	// Deprecated
-	// Migrate to `STANDARD_ACTION_READ`
+	// Migrate to 'read' action name
 	Action_STANDARD_ACTION_DECRYPT Action_StandardAction = 1
 	// Deprecated
-	// Migrate to `STANDARD_ACTION_CREATE` or a custom action
+	// Migrate to 'create' action name
 	Action_STANDARD_ACTION_TRANSMIT Action_StandardAction = 2
-	Action_STANDARD_ACTION_CREATE   Action_StandardAction = 3
-	Action_STANDARD_ACTION_READ     Action_StandardAction = 4
-	Action_STANDARD_ACTION_UPDATE   Action_StandardAction = 5
-	Action_STANDARD_ACTION_DELETE   Action_StandardAction = 6
 )
 
 // Enum value maps for Action_StandardAction.
@@ -261,19 +256,11 @@ var (
 		0: "STANDARD_ACTION_UNSPECIFIED",
 		1: "STANDARD_ACTION_DECRYPT",
 		2: "STANDARD_ACTION_TRANSMIT",
-		3: "STANDARD_ACTION_CREATE",
-		4: "STANDARD_ACTION_READ",
-		5: "STANDARD_ACTION_UPDATE",
-		6: "STANDARD_ACTION_DELETE",
 	}
 	Action_StandardAction_value = map[string]int32{
 		"STANDARD_ACTION_UNSPECIFIED": 0,
 		"STANDARD_ACTION_DECRYPT":     1,
 		"STANDARD_ACTION_TRANSMIT":    2,
-		"STANDARD_ACTION_CREATE":      3,
-		"STANDARD_ACTION_READ":        4,
-		"STANDARD_ACTION_UPDATE":      5,
-		"STANDARD_ACTION_DELETE":      6,
 	}
 )
 
@@ -654,11 +641,16 @@ type Action struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
+	// Generated uuid in database
+	Id string `protobuf:"bytes,3,opt,name=id,proto3" json:"id,omitempty"`
+	// Deprecated
+	//
 	// Types that are assignable to Value:
 	//
 	//	*Action_Standard
 	//	*Action_Custom
 	Value    isAction_Value   `protobuf_oneof:"value"`
+	Name     string           `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"`
 	Metadata *common.Metadata `protobuf:"bytes,100,opt,name=metadata,proto3" json:"metadata,omitempty"`
 }
 
@@ -694,6 +686,13 @@ func (*Action) Descriptor() ([]byte, []int) {
 	return file_policy_objects_proto_rawDescGZIP(), []int{3}
 }
 
+func (x *Action) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
 func (m *Action) GetValue() isAction_Value {
 	if m != nil {
 		return m.Value
@@ -715,6 +714,13 @@ func (x *Action) GetCustom() string {
 	return ""
 }
 
+func (x *Action) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
 func (x *Action) GetMetadata() *common.Metadata {
 	if x != nil {
 		return x.Metadata
@@ -727,12 +733,12 @@ type isAction_Value interface {
 }
 
 type Action_Standard struct {
-	// standard CRUD action
+	// Deprecated
 	Standard Action_StandardAction `protobuf:"varint,1,opt,name=standard,proto3,enum=policy.Action_StandardAction,oneof"`
 }
 
 type Action_Custom struct {
-	// distinctly custom action
+	// Deprecated
 	Custom string `protobuf:"bytes,2,opt,name=custom,proto3,oneof"`
 }
 
@@ -1743,271 +1749,267 @@ var file_policy_objects_proto_rawDesc = []byte{
 	0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e,
 	0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
 	0x74, 0x61, 0x4a, 0x04, 0x08, 0x04, 0x10, 0x05, 0x52, 0x07, 0x6d, 0x65, 0x6d, 0x62, 0x65, 0x72,
-	0x73, 0x22, 0xf3, 0x02, 0x0a, 0x06, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x3b, 0x0a, 0x08,
+	0x73, 0x22, 0xa8, 0x02, 0x0a, 0x06, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x0e, 0x0a, 0x02,
+	0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x3b, 0x0a, 0x08,
 	0x73, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1d,
 	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x53,
 	0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x48, 0x00, 0x52,
 	0x08, 0x73, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x12, 0x18, 0x0a, 0x06, 0x63, 0x75, 0x73,
 	0x74, 0x6f, 0x6d, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x06, 0x63, 0x75, 0x73,
-	0x74, 0x6f, 0x6d, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18,
-	0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d,
-	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x22, 0xda, 0x01, 0x0a, 0x0e, 0x53, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x41, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1f, 0x0a, 0x1b, 0x53, 0x54, 0x41, 0x4e, 0x44, 0x41, 0x52, 0x44,
-	0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46,
-	0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x1b, 0x0a, 0x17, 0x53, 0x54, 0x41, 0x4e, 0x44, 0x41, 0x52,
-	0x44, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x44, 0x45, 0x43, 0x52, 0x59, 0x50, 0x54,
-	0x10, 0x01, 0x12, 0x1c, 0x0a, 0x18, 0x53, 0x54, 0x41, 0x4e, 0x44, 0x41, 0x52, 0x44, 0x5f, 0x41,
-	0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x54, 0x52, 0x41, 0x4e, 0x53, 0x4d, 0x49, 0x54, 0x10, 0x02,
-	0x12, 0x1a, 0x0a, 0x16, 0x53, 0x54, 0x41, 0x4e, 0x44, 0x41, 0x52, 0x44, 0x5f, 0x41, 0x43, 0x54,
-	0x49, 0x4f, 0x4e, 0x5f, 0x43, 0x52, 0x45, 0x41, 0x54, 0x45, 0x10, 0x03, 0x12, 0x18, 0x0a, 0x14,
-	0x53, 0x54, 0x41, 0x4e, 0x44, 0x41, 0x52, 0x44, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f,
-	0x52, 0x45, 0x41, 0x44, 0x10, 0x04, 0x12, 0x1a, 0x0a, 0x16, 0x53, 0x54, 0x41, 0x4e, 0x44, 0x41,
-	0x52, 0x44, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x50, 0x44, 0x41, 0x54, 0x45,
-	0x10, 0x05, 0x12, 0x1a, 0x0a, 0x16, 0x53, 0x54, 0x41, 0x4e, 0x44, 0x41, 0x52, 0x44, 0x5f, 0x41,
-	0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x44, 0x45, 0x4c, 0x45, 0x54, 0x45, 0x10, 0x06, 0x42, 0x07,
-	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x81, 0x02, 0x0a, 0x0e, 0x53, 0x75, 0x62, 0x6a,
-	0x65, 0x63, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x36, 0x0a, 0x0f, 0x61, 0x74,
-	0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x56, 0x61, 0x6c,
-	0x75, 0x65, 0x52, 0x0e, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x56, 0x61, 0x6c,
-	0x75, 0x65, 0x12, 0x4f, 0x0a, 0x15, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x63, 0x6f,
-	0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x73, 0x65, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x1b, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65,
-	0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x74, 0x52, 0x13,
-	0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e,
-	0x53, 0x65, 0x74, 0x12, 0x28, 0x0a, 0x07, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x04,
-	0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x07, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x2c, 0x0a,
-	0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0xe9, 0x01, 0x0a, 0x09,
-	0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x4d, 0x0a, 0x1f, 0x73, 0x75, 0x62,
-	0x6a, 0x65, 0x63, 0x74, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x73, 0x65,
-	0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x1c, 0x73, 0x75, 0x62, 0x6a,
-	0x65, 0x63, 0x74, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x53, 0x65, 0x6c, 0x65, 0x63,
-	0x74, 0x6f, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x4b, 0x0a, 0x08, 0x6f, 0x70, 0x65, 0x72,
-	0x61, 0x74, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x22, 0x2e, 0x70, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69,
-	0x6e, 0x67, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x45, 0x6e, 0x75, 0x6d, 0x42, 0x0b,
-	0xba, 0x48, 0x08, 0xc8, 0x01, 0x01, 0x82, 0x01, 0x02, 0x10, 0x01, 0x52, 0x08, 0x6f, 0x70, 0x65,
-	0x72, 0x61, 0x74, 0x6f, 0x72, 0x12, 0x40, 0x0a, 0x17, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74,
-	0x5f, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73,
-	0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01,
-	0x52, 0x15, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61,
-	0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x22, 0xa7, 0x01, 0x0a, 0x0e, 0x43, 0x6f, 0x6e, 0x64,
-	0x69, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x3b, 0x0a, 0x0a, 0x63, 0x6f,
-	0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x11,
-	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f,
-	0x6e, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x0a, 0x63, 0x6f, 0x6e,
-	0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x58, 0x0a, 0x10, 0x62, 0x6f, 0x6f, 0x6c, 0x65,
-	0x61, 0x6e, 0x5f, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0e, 0x32, 0x20, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69,
-	0x74, 0x69, 0x6f, 0x6e, 0x42, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x45,
-	0x6e, 0x75, 0x6d, 0x42, 0x0b, 0xba, 0x48, 0x08, 0xc8, 0x01, 0x01, 0x82, 0x01, 0x02, 0x10, 0x01,
-	0x52, 0x0f, 0x62, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f,
-	0x72, 0x22, 0x59, 0x0a, 0x0a, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x53, 0x65, 0x74, 0x12,
-	0x4b, 0x0a, 0x10, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x67, 0x72, 0x6f,
-	0x75, 0x70, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75,
-	0x70, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x0f, 0x63, 0x6f, 0x6e,
-	0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x22, 0x94, 0x01, 0x0a,
-	0x13, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f,
-	0x6e, 0x53, 0x65, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x02, 0x69, 0x64, 0x12, 0x3f, 0x0a, 0x0c, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f,
-	0x73, 0x65, 0x74, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x70, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x53, 0x65, 0x74, 0x42, 0x08,
-	0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x0b, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63,
-	0x74, 0x53, 0x65, 0x74, 0x73, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e,
-	0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64,
-	0x61, 0x74, 0x61, 0x22, 0x7c, 0x0a, 0x0f, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x50, 0x72,
-	0x6f, 0x70, 0x65, 0x72, 0x74, 0x79, 0x12, 0x42, 0x0a, 0x17, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e,
+	0x74, 0x6f, 0x6d, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d,
+	0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x6c, 0x0a, 0x0e, 0x53, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72,
+	0x64, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1f, 0x0a, 0x1b, 0x53, 0x54, 0x41, 0x4e, 0x44,
+	0x41, 0x52, 0x44, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45,
+	0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x1b, 0x0a, 0x17, 0x53, 0x54, 0x41, 0x4e,
+	0x44, 0x41, 0x52, 0x44, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x44, 0x45, 0x43, 0x52,
+	0x59, 0x50, 0x54, 0x10, 0x01, 0x12, 0x1c, 0x0a, 0x18, 0x53, 0x54, 0x41, 0x4e, 0x44, 0x41, 0x52,
+	0x44, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x54, 0x52, 0x41, 0x4e, 0x53, 0x4d, 0x49,
+	0x54, 0x10, 0x02, 0x42, 0x07, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x81, 0x02, 0x0a,
+	0x0e, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12,
+	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12,
+	0x36, 0x0a, 0x0f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x76, 0x61, 0x6c,
+	0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63,
+	0x79, 0x2e, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0e, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75,
+	0x74, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x4f, 0x0a, 0x15, 0x73, 0x75, 0x62, 0x6a, 0x65,
+	0x63, 0x74, 0x5f, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x73, 0x65, 0x74,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
+	0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e,
+	0x53, 0x65, 0x74, 0x52, 0x13, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x64,
+	0x69, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x74, 0x12, 0x28, 0x0a, 0x07, 0x61, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x07, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0x22, 0xe9, 0x01, 0x0a, 0x09, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x4d,
+	0x0a, 0x1f, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e,
 	0x61, 0x6c, 0x5f, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75,
-	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xba, 0x48, 0x07, 0xc8, 0x01, 0x01, 0x72,
-	0x02, 0x10, 0x01, 0x52, 0x15, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x53, 0x65, 0x6c,
-	0x65, 0x63, 0x74, 0x6f, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x25, 0x0a, 0x0e, 0x65, 0x78,
-	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x0d, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x56, 0x61, 0x6c, 0x75,
-	0x65, 0x22, 0x9b, 0x01, 0x0a, 0x14, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x61,
-	0x70, 0x70, 0x69, 0x6e, 0x67, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x29, 0x0a, 0x0c, 0x6e, 0x61,
-	0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70,
-	0x61, 0x63, 0x65, 0x49, 0x64, 0x12, 0x1a, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x09, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x04, 0x6e, 0x61, 0x6d,
-	0x65, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74,
-	0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22,
-	0xd9, 0x01, 0x0a, 0x0f, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x61, 0x70, 0x70,
-	0x69, 0x6e, 0x67, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x02, 0x69, 0x64, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d,
-	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x12, 0x3e, 0x0a, 0x0f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x5f, 0x76,
-	0x61, 0x6c, 0x75, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x70, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x2e, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01,
-	0x01, 0x52, 0x0e, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x56, 0x61, 0x6c, 0x75,
-	0x65, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x65, 0x72, 0x6d, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09,
-	0x52, 0x05, 0x74, 0x65, 0x72, 0x6d, 0x73, 0x12, 0x32, 0x0a, 0x05, 0x67, 0x72, 0x6f, 0x75, 0x70,
-	0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
-	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x47,
-	0x72, 0x6f, 0x75, 0x70, 0x52, 0x05, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x22, 0x9f, 0x04, 0x0a, 0x0f,
-	0x4b, 0x65, 0x79, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x12,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52,
+	0x1c, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c,
+	0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x4b, 0x0a,
+	0x08, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32,
+	0x22, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74,
+	0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x45,
+	0x6e, 0x75, 0x6d, 0x42, 0x0b, 0xba, 0x48, 0x08, 0xc8, 0x01, 0x01, 0x82, 0x01, 0x02, 0x10, 0x01,
+	0x52, 0x08, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x12, 0x40, 0x0a, 0x17, 0x73, 0x75,
+	0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05,
+	0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x15, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x45, 0x78,
+	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x22, 0xa7, 0x01, 0x0a,
+	0x0e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12,
+	0x3b, 0x0a, 0x0a, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x43, 0x6f, 0x6e,
+	0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01,
+	0x52, 0x0a, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x58, 0x0a, 0x10,
+	0x62, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x5f, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x20, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
+	0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e,
+	0x54, 0x79, 0x70, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x42, 0x0b, 0xba, 0x48, 0x08, 0xc8, 0x01, 0x01,
+	0x82, 0x01, 0x02, 0x10, 0x01, 0x52, 0x0f, 0x62, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x4f, 0x70,
+	0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x22, 0x59, 0x0a, 0x0a, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63,
+	0x74, 0x53, 0x65, 0x74, 0x12, 0x4b, 0x0a, 0x10, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f,
+	0x6e, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16,
+	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f,
+	0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01,
+	0x52, 0x0f, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70,
+	0x73, 0x22, 0x94, 0x01, 0x0a, 0x13, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e,
+	0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x3f, 0x0a, 0x0c, 0x73, 0x75, 0x62,
+	0x6a, 0x65, 0x63, 0x74, 0x5f, 0x73, 0x65, 0x74, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x12, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74,
+	0x53, 0x65, 0x74, 0x42, 0x08, 0xba, 0x48, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x0b, 0x73,
+	0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x53, 0x65, 0x74, 0x73, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63,
+	0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08,
+	0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x7c, 0x0a, 0x0f, 0x53, 0x75, 0x62, 0x6a,
+	0x65, 0x63, 0x74, 0x50, 0x72, 0x6f, 0x70, 0x65, 0x72, 0x74, 0x79, 0x12, 0x42, 0x0a, 0x17, 0x65,
+	0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72,
+	0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xba, 0x48,
+	0x07, 0xc8, 0x01, 0x01, 0x72, 0x02, 0x10, 0x01, 0x52, 0x15, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e,
+	0x61, 0x6c, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12,
+	0x25, 0x0a, 0x0e, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61,
+	0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x9b, 0x01, 0x0a, 0x14, 0x52, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12,
 	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12,
-	0x87, 0x03, 0x0a, 0x03, 0x75, 0x72, 0x69, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0xf4, 0x02,
-	0xba, 0x48, 0xf0, 0x02, 0xba, 0x01, 0xec, 0x02, 0x0a, 0x0a, 0x75, 0x72, 0x69, 0x5f, 0x66, 0x6f,
-	0x72, 0x6d, 0x61, 0x74, 0x12, 0xcf, 0x01, 0x55, 0x52, 0x49, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20,
-	0x62, 0x65, 0x20, 0x61, 0x20, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x20, 0x55, 0x52, 0x4c, 0x20, 0x28,
-	0x65, 0x2e, 0x67, 0x2e, 0x2c, 0x20, 0x27, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x64,
-	0x65, 0x6d, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x27, 0x29, 0x20, 0x66, 0x6f, 0x6c, 0x6c, 0x6f,
-	0x77, 0x65, 0x64, 0x20, 0x62, 0x79, 0x20, 0x61, 0x64, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x61,
-	0x6c, 0x20, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x20, 0x45, 0x61, 0x63, 0x68,
-	0x20, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x73, 0x74,
-	0x61, 0x72, 0x74, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x65, 0x6e, 0x64, 0x20, 0x77, 0x69, 0x74, 0x68,
-	0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63,
-	0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2c, 0x20, 0x63, 0x61, 0x6e, 0x20,
-	0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x2c,
-	0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x63, 0x68,
-	0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x73, 0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x73, 0x6c,
-	0x61, 0x73, 0x68, 0x65, 0x73, 0x2e, 0x1a, 0x8b, 0x01, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61,
-	0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3f, 0x3a, 0x2f,
-	0x2f, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b, 0x61, 0x2d,
-	0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b, 0x30, 0x2c, 0x36, 0x31,
-	0x7d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x28, 0x5c,
-	0x5c, 0x2e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b, 0x61,
+	0x29, 0x0a, 0x0c, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x0b, 0x6e,
+	0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x49, 0x64, 0x12, 0x1a, 0x0a, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x42, 0x06, 0xba, 0x48, 0x03, 0xc8, 0x01, 0x01,
+	0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f,
+	0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x22, 0xd9, 0x01, 0x0a, 0x0f, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d,
+	0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x3e, 0x0a, 0x0f, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62,
+	0x75, 0x74, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x0d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x06,
+	0xba, 0x48, 0x03, 0xc8, 0x01, 0x01, 0x52, 0x0e, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74,
+	0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x65, 0x72, 0x6d, 0x73, 0x18,
+	0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x05, 0x74, 0x65, 0x72, 0x6d, 0x73, 0x12, 0x32, 0x0a, 0x05,
+	0x67, 0x72, 0x6f, 0x75, 0x70, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x70, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4d, 0x61, 0x70,
+	0x70, 0x69, 0x6e, 0x67, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x05, 0x67, 0x72, 0x6f, 0x75, 0x70,
+	0x22, 0x9f, 0x04, 0x0a, 0x0f, 0x4b, 0x65, 0x79, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x53, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x02, 0x69, 0x64, 0x12, 0x87, 0x03, 0x0a, 0x03, 0x75, 0x72, 0x69, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x42, 0xf4, 0x02, 0xba, 0x48, 0xf0, 0x02, 0xba, 0x01, 0xec, 0x02, 0x0a, 0x0a, 0x75,
+	0x72, 0x69, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0xcf, 0x01, 0x55, 0x52, 0x49, 0x20,
+	0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x61, 0x20, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x20,
+	0x55, 0x52, 0x4c, 0x20, 0x28, 0x65, 0x2e, 0x67, 0x2e, 0x2c, 0x20, 0x27, 0x68, 0x74, 0x74, 0x70,
+	0x73, 0x3a, 0x2f, 0x2f, 0x64, 0x65, 0x6d, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x27, 0x29, 0x20,
+	0x66, 0x6f, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x20, 0x62, 0x79, 0x20, 0x61, 0x64, 0x64, 0x69,
+	0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x20, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x2e,
+	0x20, 0x45, 0x61, 0x63, 0x68, 0x20, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x20, 0x6d, 0x75,
+	0x73, 0x74, 0x20, 0x73, 0x74, 0x61, 0x72, 0x74, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x65, 0x6e, 0x64,
+	0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75,
+	0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2c,
+	0x20, 0x63, 0x61, 0x6e, 0x20, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20, 0x68, 0x79, 0x70,
+	0x68, 0x65, 0x6e, 0x73, 0x2c, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72,
+	0x69, 0x63, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x73, 0x2c, 0x20, 0x61,
+	0x6e, 0x64, 0x20, 0x73, 0x6c, 0x61, 0x73, 0x68, 0x65, 0x73, 0x2e, 0x1a, 0x8b, 0x01, 0x74, 0x68,
+	0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x68, 0x74, 0x74,
+	0x70, 0x73, 0x3f, 0x3a, 0x2f, 0x2f, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39,
+	0x5d, 0x28, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d,
+	0x7b, 0x30, 0x2c, 0x36, 0x31, 0x7d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39,
+	0x5d, 0x29, 0x3f, 0x28, 0x5c, 0x5c, 0x2e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d,
+	0x39, 0x5d, 0x28, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d,
+	0x5d, 0x7b, 0x30, 0x2c, 0x36, 0x31, 0x7d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d,
+	0x39, 0x5d, 0x29, 0x3f, 0x29, 0x2a, 0x28, 0x3a, 0x5b, 0x30, 0x2d, 0x39, 0x5d, 0x2b, 0x29, 0x3f,
+	0x28, 0x2f, 0x2e, 0x2a, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x52, 0x03, 0x75, 0x72, 0x69, 0x12, 0x30,
+	0x0a, 0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x11, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x75, 0x62, 0x6c,
+	0x69, 0x63, 0x4b, 0x65, 0x79, 0x52, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79,
+	0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
+	0x6e, 0x61, 0x6d, 0x65, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e,
+	0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x22, 0x97, 0x02, 0x0a, 0x03, 0x4b, 0x65, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x37, 0x0a, 0x09, 0x69, 0x73,
+	0x5f, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
+	0x42, 0x6f, 0x6f, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x08, 0x69, 0x73, 0x41, 0x63, 0x74,
+	0x69, 0x76, 0x65, 0x12, 0x39, 0x0a, 0x0a, 0x77, 0x61, 0x73, 0x5f, 0x6d, 0x61, 0x70, 0x70, 0x65,
+	0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42, 0x6f, 0x6f, 0x6c, 0x56, 0x61,
+	0x6c, 0x75, 0x65, 0x52, 0x09, 0x77, 0x61, 0x73, 0x4d, 0x61, 0x70, 0x70, 0x65, 0x64, 0x12, 0x33,
+	0x0a, 0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x14, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73, 0x50,
+	0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x52, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63,
+	0x4b, 0x65, 0x79, 0x12, 0x29, 0x0a, 0x03, 0x6b, 0x61, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x17, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x65, 0x79, 0x41, 0x63, 0x63,
+	0x65, 0x73, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x03, 0x6b, 0x61, 0x73, 0x12, 0x2c,
+	0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x84, 0x01, 0x0a,
+	0x0c, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x1c, 0x0a,
+	0x03, 0x70, 0x65, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xba, 0x48, 0x07, 0x72,
+	0x05, 0x10, 0x01, 0x18, 0x80, 0x40, 0x52, 0x03, 0x70, 0x65, 0x6d, 0x12, 0x1b, 0x0a, 0x03, 0x6b,
+	0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x09, 0xba, 0x48, 0x06, 0x72, 0x04, 0x10,
+	0x01, 0x18, 0x20, 0x52, 0x03, 0x6b, 0x69, 0x64, 0x12, 0x39, 0x0a, 0x03, 0x61, 0x6c, 0x67, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1b, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b,
+	0x61, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x41, 0x6c, 0x67, 0x45, 0x6e,
+	0x75, 0x6d, 0x42, 0x0a, 0xba, 0x48, 0x07, 0x82, 0x01, 0x04, 0x10, 0x01, 0x20, 0x00, 0x52, 0x03,
+	0x61, 0x6c, 0x67, 0x22, 0x3b, 0x0a, 0x0f, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63,
+	0x4b, 0x65, 0x79, 0x53, 0x65, 0x74, 0x12, 0x28, 0x0a, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x18, 0x01,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61,
+	0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x52, 0x04, 0x6b, 0x65, 0x79, 0x73,
+	0x22, 0xe0, 0x03, 0x0a, 0x09, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x84,
+	0x03, 0x0a, 0x06, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42,
+	0xe9, 0x02, 0xba, 0x48, 0xe5, 0x02, 0xba, 0x01, 0xe1, 0x02, 0x0a, 0x0a, 0x75, 0x72, 0x69, 0x5f,
+	0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0xcf, 0x01, 0x55, 0x52, 0x49, 0x20, 0x6d, 0x75, 0x73,
+	0x74, 0x20, 0x62, 0x65, 0x20, 0x61, 0x20, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x20, 0x55, 0x52, 0x4c,
+	0x20, 0x28, 0x65, 0x2e, 0x67, 0x2e, 0x2c, 0x20, 0x27, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f,
+	0x2f, 0x64, 0x65, 0x6d, 0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x27, 0x29, 0x20, 0x66, 0x6f, 0x6c,
+	0x6c, 0x6f, 0x77, 0x65, 0x64, 0x20, 0x62, 0x79, 0x20, 0x61, 0x64, 0x64, 0x69, 0x74, 0x69, 0x6f,
+	0x6e, 0x61, 0x6c, 0x20, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x20, 0x45, 0x61,
+	0x63, 0x68, 0x20, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20,
+	0x73, 0x74, 0x61, 0x72, 0x74, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x65, 0x6e, 0x64, 0x20, 0x77, 0x69,
+	0x74, 0x68, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72,
+	0x69, 0x63, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2c, 0x20, 0x63, 0x61,
+	0x6e, 0x20, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e,
+	0x73, 0x2c, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20,
+	0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x73, 0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20,
+	0x73, 0x6c, 0x61, 0x73, 0x68, 0x65, 0x73, 0x2e, 0x1a, 0x80, 0x01, 0x74, 0x68, 0x69, 0x73, 0x2e,
+	0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a,
+	0x2f, 0x2f, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b, 0x61,
 	0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b, 0x30, 0x2c, 0x36,
-	0x31, 0x7d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x29,
-	0x2a, 0x28, 0x3a, 0x5b, 0x30, 0x2d, 0x39, 0x5d, 0x2b, 0x29, 0x3f, 0x28, 0x2f, 0x2e, 0x2a, 0x29,
-	0x3f, 0x24, 0x27, 0x29, 0x52, 0x03, 0x75, 0x72, 0x69, 0x12, 0x30, 0x0a, 0x0a, 0x70, 0x75, 0x62,
-	0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x11, 0x2e,
-	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79,
-	0x52, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x12, 0x0a, 0x04, 0x6e,
-	0x61, 0x6d, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12,
-	0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64,
-	0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x97, 0x02,
-	0x0a, 0x03, 0x4b, 0x65, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x37, 0x0a, 0x09, 0x69, 0x73, 0x5f, 0x61, 0x63, 0x74, 0x69,
-	0x76, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42, 0x6f, 0x6f, 0x6c, 0x56,
-	0x61, 0x6c, 0x75, 0x65, 0x52, 0x08, 0x69, 0x73, 0x41, 0x63, 0x74, 0x69, 0x76, 0x65, 0x12, 0x39,
-	0x0a, 0x0a, 0x77, 0x61, 0x73, 0x5f, 0x6d, 0x61, 0x70, 0x70, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42, 0x6f, 0x6f, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x09,
-	0x77, 0x61, 0x73, 0x4d, 0x61, 0x70, 0x70, 0x65, 0x64, 0x12, 0x33, 0x0a, 0x0a, 0x70, 0x75, 0x62,
-	0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e,
-	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63,
-	0x4b, 0x65, 0x79, 0x52, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x29,
-	0x0a, 0x03, 0x6b, 0x61, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x70, 0x6f,
-	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x65, 0x79, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x53, 0x65,
-	0x72, 0x76, 0x65, 0x72, 0x52, 0x03, 0x6b, 0x61, 0x73, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74,
-	0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x63, 0x6f,
-	0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d,
-	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x84, 0x01, 0x0a, 0x0c, 0x4b, 0x61, 0x73, 0x50,
-	0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x1c, 0x0a, 0x03, 0x70, 0x65, 0x6d, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xba, 0x48, 0x07, 0x72, 0x05, 0x10, 0x01, 0x18, 0x80,
-	0x40, 0x52, 0x03, 0x70, 0x65, 0x6d, 0x12, 0x1b, 0x0a, 0x03, 0x6b, 0x69, 0x64, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x42, 0x09, 0xba, 0x48, 0x06, 0x72, 0x04, 0x10, 0x01, 0x18, 0x20, 0x52, 0x03,
-	0x6b, 0x69, 0x64, 0x12, 0x39, 0x0a, 0x03, 0x61, 0x6c, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e,
-	0x32, 0x1b, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62,
-	0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x41, 0x6c, 0x67, 0x45, 0x6e, 0x75, 0x6d, 0x42, 0x0a, 0xba,
-	0x48, 0x07, 0x82, 0x01, 0x04, 0x10, 0x01, 0x20, 0x00, 0x52, 0x03, 0x61, 0x6c, 0x67, 0x22, 0x3b,
-	0x0a, 0x0f, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x53, 0x65,
-	0x74, 0x12, 0x28, 0x0a, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x14, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62, 0x6c,
-	0x69, 0x63, 0x4b, 0x65, 0x79, 0x52, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x22, 0xe0, 0x03, 0x0a, 0x09,
-	0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x84, 0x03, 0x0a, 0x06, 0x72, 0x65,
-	0x6d, 0x6f, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0xe9, 0x02, 0xba, 0x48, 0xe5,
-	0x02, 0xba, 0x01, 0xe1, 0x02, 0x0a, 0x0a, 0x75, 0x72, 0x69, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61,
-	0x74, 0x12, 0xcf, 0x01, 0x55, 0x52, 0x49, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20,
-	0x61, 0x20, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x20, 0x55, 0x52, 0x4c, 0x20, 0x28, 0x65, 0x2e, 0x67,
-	0x2e, 0x2c, 0x20, 0x27, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x64, 0x65, 0x6d, 0x6f,
-	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x27, 0x29, 0x20, 0x66, 0x6f, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64,
-	0x20, 0x62, 0x79, 0x20, 0x61, 0x64, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x20, 0x73,
-	0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x20, 0x45, 0x61, 0x63, 0x68, 0x20, 0x73, 0x65,
-	0x67, 0x6d, 0x65, 0x6e, 0x74, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x73, 0x74, 0x61, 0x72, 0x74,
-	0x20, 0x61, 0x6e, 0x64, 0x20, 0x65, 0x6e, 0x64, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x61, 0x6e,
-	0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x63, 0x68,
-	0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2c, 0x20, 0x63, 0x61, 0x6e, 0x20, 0x63, 0x6f, 0x6e,
-	0x74, 0x61, 0x69, 0x6e, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x2c, 0x20, 0x61, 0x6c,
-	0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61,
-	0x63, 0x74, 0x65, 0x72, 0x73, 0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x73, 0x6c, 0x61, 0x73, 0x68,
-	0x65, 0x73, 0x2e, 0x1a, 0x80, 0x01, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68,
-	0x65, 0x73, 0x28, 0x27, 0x5e, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x5b, 0x61, 0x2d,
-	0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a,
-	0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b, 0x30, 0x2c, 0x36, 0x31, 0x7d, 0x5b, 0x61, 0x2d,
-	0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x28, 0x5c, 0x5c, 0x2e, 0x5b, 0x61,
-	0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d,
-	0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b, 0x30, 0x2c, 0x36, 0x31, 0x7d, 0x5b, 0x61,
-	0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x29, 0x2a, 0x28, 0x2f, 0x2e,
-	0x2a, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x48, 0x00, 0x52, 0x06, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65,
-	0x12, 0x31, 0x0a, 0x06, 0x63, 0x61, 0x63, 0x68, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x17, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62,
-	0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x53, 0x65, 0x74, 0x48, 0x00, 0x52, 0x06, 0x63, 0x61, 0x63,
-	0x68, 0x65, 0x64, 0x42, 0x0c, 0x0a, 0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65,
-	0x79, 0x4a, 0x04, 0x08, 0x02, 0x10, 0x03, 0x52, 0x05, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x2a, 0xb3,
-	0x01, 0x0a, 0x15, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x52, 0x75, 0x6c, 0x65,
-	0x54, 0x79, 0x70, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x12, 0x28, 0x0a, 0x24, 0x41, 0x54, 0x54, 0x52,
-	0x49, 0x42, 0x55, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f,
-	0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44,
-	0x10, 0x00, 0x12, 0x23, 0x0a, 0x1f, 0x41, 0x54, 0x54, 0x52, 0x49, 0x42, 0x55, 0x54, 0x45, 0x5f,
-	0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x41,
-	0x4c, 0x4c, 0x5f, 0x4f, 0x46, 0x10, 0x01, 0x12, 0x23, 0x0a, 0x1f, 0x41, 0x54, 0x54, 0x52, 0x49,
+	0x31, 0x7d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x28,
+	0x5c, 0x5c, 0x2e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b,
+	0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5c, 0x5c, 0x2d, 0x5d, 0x7b, 0x30, 0x2c,
+	0x36, 0x31, 0x7d, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f,
+	0x29, 0x2a, 0x28, 0x2f, 0x2e, 0x2a, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x48, 0x00, 0x52, 0x06, 0x72,
+	0x65, 0x6d, 0x6f, 0x74, 0x65, 0x12, 0x31, 0x0a, 0x06, 0x63, 0x61, 0x63, 0x68, 0x65, 0x64, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x4b,
+	0x61, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x53, 0x65, 0x74, 0x48, 0x00,
+	0x52, 0x06, 0x63, 0x61, 0x63, 0x68, 0x65, 0x64, 0x42, 0x0c, 0x0a, 0x0a, 0x70, 0x75, 0x62, 0x6c,
+	0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x4a, 0x04, 0x08, 0x02, 0x10, 0x03, 0x52, 0x05, 0x6c, 0x6f,
+	0x63, 0x61, 0x6c, 0x2a, 0xb3, 0x01, 0x0a, 0x15, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74,
+	0x65, 0x52, 0x75, 0x6c, 0x65, 0x54, 0x79, 0x70, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x12, 0x28, 0x0a,
+	0x24, 0x41, 0x54, 0x54, 0x52, 0x49, 0x42, 0x55, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f,
+	0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43,
+	0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x23, 0x0a, 0x1f, 0x41, 0x54, 0x54, 0x52, 0x49,
 	0x42, 0x55, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45,
-	0x4e, 0x55, 0x4d, 0x5f, 0x41, 0x4e, 0x59, 0x5f, 0x4f, 0x46, 0x10, 0x02, 0x12, 0x26, 0x0a, 0x22,
+	0x4e, 0x55, 0x4d, 0x5f, 0x41, 0x4c, 0x4c, 0x5f, 0x4f, 0x46, 0x10, 0x01, 0x12, 0x23, 0x0a, 0x1f,
 	0x41, 0x54, 0x54, 0x52, 0x49, 0x42, 0x55, 0x54, 0x45, 0x5f, 0x52, 0x55, 0x4c, 0x45, 0x5f, 0x54,
-	0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x48, 0x49, 0x45, 0x52, 0x41, 0x52, 0x43,
-	0x48, 0x59, 0x10, 0x03, 0x2a, 0xca, 0x01, 0x0a, 0x1a, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74,
-	0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x45,
-	0x6e, 0x75, 0x6d, 0x12, 0x2d, 0x0a, 0x29, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43, 0x54, 0x5f, 0x4d,
-	0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x4f, 0x52, 0x5f,
-	0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44,
-	0x10, 0x00, 0x12, 0x24, 0x0a, 0x20, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43, 0x54, 0x5f, 0x4d, 0x41,
-	0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x4f, 0x52, 0x5f, 0x45,
-	0x4e, 0x55, 0x4d, 0x5f, 0x49, 0x4e, 0x10, 0x01, 0x12, 0x28, 0x0a, 0x24, 0x53, 0x55, 0x42, 0x4a,
+	0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x41, 0x4e, 0x59, 0x5f, 0x4f, 0x46, 0x10,
+	0x02, 0x12, 0x26, 0x0a, 0x22, 0x41, 0x54, 0x54, 0x52, 0x49, 0x42, 0x55, 0x54, 0x45, 0x5f, 0x52,
+	0x55, 0x4c, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x48, 0x49,
+	0x45, 0x52, 0x41, 0x52, 0x43, 0x48, 0x59, 0x10, 0x03, 0x2a, 0xca, 0x01, 0x0a, 0x1a, 0x53, 0x75,
+	0x62, 0x6a, 0x65, 0x63, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x4f, 0x70, 0x65, 0x72,
+	0x61, 0x74, 0x6f, 0x72, 0x45, 0x6e, 0x75, 0x6d, 0x12, 0x2d, 0x0a, 0x29, 0x53, 0x55, 0x42, 0x4a,
 	0x45, 0x43, 0x54, 0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52,
-	0x41, 0x54, 0x4f, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x4e, 0x4f, 0x54, 0x5f, 0x49, 0x4e,
-	0x10, 0x02, 0x12, 0x2d, 0x0a, 0x29, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43, 0x54, 0x5f, 0x4d, 0x41,
-	0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x4f, 0x52, 0x5f, 0x45,
-	0x4e, 0x55, 0x4d, 0x5f, 0x49, 0x4e, 0x5f, 0x43, 0x4f, 0x4e, 0x54, 0x41, 0x49, 0x4e, 0x53, 0x10,
-	0x03, 0x2a, 0x90, 0x01, 0x0a, 0x18, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x42,
-	0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x12, 0x2b,
-	0x0a, 0x27, 0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x42, 0x4f, 0x4f, 0x4c,
-	0x45, 0x41, 0x4e, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e,
-	0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x23, 0x0a, 0x1f, 0x43,
-	0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x42, 0x4f, 0x4f, 0x4c, 0x45, 0x41, 0x4e,
-	0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x41, 0x4e, 0x44, 0x10, 0x01,
-	0x12, 0x22, 0x0a, 0x1e, 0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x42, 0x4f,
+	0x41, 0x54, 0x4f, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43,
+	0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x24, 0x0a, 0x20, 0x53, 0x55, 0x42, 0x4a, 0x45,
+	0x43, 0x54, 0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41,
+	0x54, 0x4f, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x49, 0x4e, 0x10, 0x01, 0x12, 0x28, 0x0a,
+	0x24, 0x53, 0x55, 0x42, 0x4a, 0x45, 0x43, 0x54, 0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47,
+	0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41, 0x54, 0x4f, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x4e,
+	0x4f, 0x54, 0x5f, 0x49, 0x4e, 0x10, 0x02, 0x12, 0x2d, 0x0a, 0x29, 0x53, 0x55, 0x42, 0x4a, 0x45,
+	0x43, 0x54, 0x5f, 0x4d, 0x41, 0x50, 0x50, 0x49, 0x4e, 0x47, 0x5f, 0x4f, 0x50, 0x45, 0x52, 0x41,
+	0x54, 0x4f, 0x52, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x49, 0x4e, 0x5f, 0x43, 0x4f, 0x4e, 0x54,
+	0x41, 0x49, 0x4e, 0x53, 0x10, 0x03, 0x2a, 0x90, 0x01, 0x0a, 0x18, 0x43, 0x6f, 0x6e, 0x64, 0x69,
+	0x74, 0x69, 0x6f, 0x6e, 0x42, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x45,
+	0x6e, 0x75, 0x6d, 0x12, 0x2b, 0x0a, 0x27, 0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e,
+	0x5f, 0x42, 0x4f, 0x4f, 0x4c, 0x45, 0x41, 0x4e, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e,
+	0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00,
+	0x12, 0x23, 0x0a, 0x1f, 0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49, 0x4f, 0x4e, 0x5f, 0x42, 0x4f,
 	0x4f, 0x4c, 0x45, 0x41, 0x4e, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f,
-	0x4f, 0x52, 0x10, 0x02, 0x2a, 0x88, 0x02, 0x0a, 0x13, 0x4b, 0x61, 0x73, 0x50, 0x75, 0x62, 0x6c,
-	0x69, 0x63, 0x4b, 0x65, 0x79, 0x41, 0x6c, 0x67, 0x45, 0x6e, 0x75, 0x6d, 0x12, 0x27, 0x0a, 0x23,
-	0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41,
-	0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46,
-	0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x24, 0x0a, 0x20, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42,
-	0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d,
-	0x5f, 0x52, 0x53, 0x41, 0x5f, 0x32, 0x30, 0x34, 0x38, 0x10, 0x01, 0x12, 0x24, 0x0a, 0x20, 0x4b,
-	0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c,
-	0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x34, 0x30, 0x39, 0x36, 0x10,
-	0x02, 0x12, 0x28, 0x0a, 0x24, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f,
-	0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x45, 0x43, 0x5f,
-	0x53, 0x45, 0x43, 0x50, 0x32, 0x35, 0x36, 0x52, 0x31, 0x10, 0x05, 0x12, 0x28, 0x0a, 0x24, 0x4b,
-	0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c,
-	0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x45, 0x43, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x33, 0x38,
-	0x34, 0x52, 0x31, 0x10, 0x06, 0x12, 0x28, 0x0a, 0x24, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42,
-	0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d,
-	0x5f, 0x45, 0x43, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x35, 0x32, 0x31, 0x52, 0x31, 0x10, 0x07, 0x42,
-	0x82, 0x01, 0x0a, 0x0a, 0x63, 0x6f, 0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x42, 0x0c,
-	0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x2e,
-	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x74,
-	0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xa2, 0x02,
-	0x03, 0x50, 0x58, 0x58, 0xaa, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xca, 0x02, 0x06,
-	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xe2, 0x02, 0x12, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c,
-	0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x06, 0x50, 0x6f,
-	0x6c, 0x69, 0x63, 0x79, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x41, 0x4e, 0x44, 0x10, 0x01, 0x12, 0x22, 0x0a, 0x1e, 0x43, 0x4f, 0x4e, 0x44, 0x49, 0x54, 0x49,
+	0x4f, 0x4e, 0x5f, 0x42, 0x4f, 0x4f, 0x4c, 0x45, 0x41, 0x4e, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f,
+	0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x4f, 0x52, 0x10, 0x02, 0x2a, 0x88, 0x02, 0x0a, 0x13, 0x4b, 0x61,
+	0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x41, 0x6c, 0x67, 0x45, 0x6e, 0x75,
+	0x6d, 0x12, 0x27, 0x0a, 0x23, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f,
+	0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x55, 0x4e, 0x53,
+	0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x24, 0x0a, 0x20, 0x4b, 0x41,
+	0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47,
+	0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x52, 0x53, 0x41, 0x5f, 0x32, 0x30, 0x34, 0x38, 0x10, 0x01,
+	0x12, 0x24, 0x0a, 0x20, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b,
+	0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x52, 0x53, 0x41, 0x5f,
+	0x34, 0x30, 0x39, 0x36, 0x10, 0x02, 0x12, 0x28, 0x0a, 0x24, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55,
+	0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55,
+	0x4d, 0x5f, 0x45, 0x43, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x32, 0x35, 0x36, 0x52, 0x31, 0x10, 0x05,
+	0x12, 0x28, 0x0a, 0x24, 0x4b, 0x41, 0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b,
+	0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47, 0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x45, 0x43, 0x5f, 0x53,
+	0x45, 0x43, 0x50, 0x33, 0x38, 0x34, 0x52, 0x31, 0x10, 0x06, 0x12, 0x28, 0x0a, 0x24, 0x4b, 0x41,
+	0x53, 0x5f, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x41, 0x4c, 0x47,
+	0x5f, 0x45, 0x4e, 0x55, 0x4d, 0x5f, 0x45, 0x43, 0x5f, 0x53, 0x45, 0x43, 0x50, 0x35, 0x32, 0x31,
+	0x52, 0x31, 0x10, 0x07, 0x42, 0x82, 0x01, 0x0a, 0x0a, 0x63, 0x6f, 0x6d, 0x2e, 0x70, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x42, 0x0c, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x50, 0x72, 0x6f, 0x74,
+	0x6f, 0x50, 0x01, 0x5a, 0x2e, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f,
+	0x6f, 0x70, 0x65, 0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d,
+	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0xa2, 0x02, 0x03, 0x50, 0x58, 0x58, 0xaa, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0xca, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xe2, 0x02, 0x12, 0x50, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0xea, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x33,
 }
 
 var (
diff --git a/service/integration/subject_mappings_test.go b/service/integration/subject_mappings_test.go
index e2d40dbc4e..f40c64cf00 100644
--- a/service/integration/subject_mappings_test.go
+++ b/service/integration/subject_mappings_test.go
@@ -48,14 +48,14 @@ var (
 	CustomUpload   = "CUSTOM_UPLOAD"
 
 	fixtureActions = map[string]*policy.Action{
-		"READ": {
+		"DECRYPT": {
 			Value: &policy.Action_Standard{
-				Standard: policy.Action_STANDARD_ACTION_READ,
+				Standard: policy.Action_STANDARD_ACTION_DECRYPT,
 			},
 		},
-		"CREATE": {
+		"TRANSMIT": {
 			Value: &policy.Action_Standard{
-				Standard: policy.Action_STANDARD_ACTION_CREATE,
+				Standard: policy.Action_STANDARD_ACTION_TRANSMIT,
 			},
 		},
 		"CUSTOM_DOWNLOAD": {
diff --git a/service/kas/access/accessPdp.go b/service/kas/access/accessPdp.go
index 5037eed686..81d47abfdd 100644
--- a/service/kas/access/accessPdp.go
+++ b/service/kas/access/accessPdp.go
@@ -64,8 +64,8 @@ func (p *Provider) checkAttributes(ctx context.Context, ras []*authorization.Res
 		DecisionRequests: []*authorization.TokenDecisionRequest{
 			{
 				Actions: []*policy.Action{
-					// TODO: support other actions rather than hardcoding read here
-					{Value: &policy.Action_Standard{Standard: policy.Action_STANDARD_ACTION_READ}},
+					// TODO: actions should come from the request and not be hardcoded
+					{Value: &policy.Action_Standard{Standard: policy.Action_STANDARD_ACTION_DECRYPT}},
 				},
 				Tokens:             []*authorization.Token{ent},
 				ResourceAttributes: ras,
diff --git a/service/policy/objects.proto b/service/policy/objects.proto
index 532e6694e7..3d8e127c8d 100644
--- a/service/policy/objects.proto
+++ b/service/policy/objects.proto
@@ -98,30 +98,30 @@ message Value {
 
 // An action an entity can take
 message Action {
-  // Standard actions supported by the platform
+  // Generated uuid in database
+  string id = 3;
+
   enum StandardAction {
     STANDARD_ACTION_UNSPECIFIED = 0;
 
     // Deprecated
-    // Migrate to `STANDARD_ACTION_READ`
+    // Migrate to 'read' action name
     STANDARD_ACTION_DECRYPT = 1;
 
     // Deprecated
-    // Migrate to `STANDARD_ACTION_CREATE` or a custom action
+    // Migrate to 'create' action name
     STANDARD_ACTION_TRANSMIT = 2;
-
-    STANDARD_ACTION_CREATE = 3;
-    STANDARD_ACTION_READ = 4;
-    STANDARD_ACTION_UPDATE = 5;
-    STANDARD_ACTION_DELETE = 6;
   }
+  // Deprecated
   oneof value {
-    // standard CRUD action
+    // Deprecated
     StandardAction standard = 1;
-    // distinctly custom action
+    // Deprecated
     string custom = 2;
   }
 
+  string name = 4;
+
   common.Metadata metadata = 100;
 }
 
diff --git a/service/policy/subjectmapping/subject_mapping_test.go b/service/policy/subjectmapping/subject_mapping_test.go
index e229e67b2a..659b069710 100644
--- a/service/policy/subjectmapping/subject_mapping_test.go
+++ b/service/policy/subjectmapping/subject_mapping_test.go
@@ -83,7 +83,7 @@ func Test_CreateSubjectMappingRequest_WithExistingSubjectConditionSetID_Succeeds
 		Actions: []*policy.Action{
 			{
 				Value: &policy.Action_Standard{
-					Standard: policy.Action_STANDARD_ACTION_READ,
+					Standard: policy.Action_STANDARD_ACTION_DECRYPT,
 				},
 			},
 		},
diff --git a/service/rttests/rt_test.go b/service/rttests/rt_test.go
index df539de228..f911fcfc4e 100644
--- a/service/rttests/rt_test.go
+++ b/service/rttests/rt_test.go
@@ -289,10 +289,10 @@ func (s *RoundtripSuite) CreateTestData() error {
 			AttributeValueId: attributeID,
 			Actions: []*policy.Action{
 				{Value: &policy.Action_Standard{
-					Standard: policy.Action_STANDARD_ACTION_READ,
+					Standard: policy.Action_STANDARD_ACTION_DECRYPT,
 				}},
 				{Value: &policy.Action_Standard{
-					Standard: policy.Action_STANDARD_ACTION_CREATE,
+					Standard: policy.Action_STANDARD_ACTION_TRANSMIT,
 				}},
 			},
 			NewSubjectConditionSet: &subjectmapping.SubjectConditionSetCreate{

From 02fc6d1d18b574452725b419a88727762849362f Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Thu, 3 Apr 2025 07:58:40 -0700
Subject: [PATCH 024/110] wip

---
 .../0004-standard-action-storage-handling.md  |   2 +-
 service/policy/db/query.sql                   | 106 ++++++++++++++----
 2 files changed, 88 insertions(+), 20 deletions(-)

diff --git a/service/policy/adr/0004-standard-action-storage-handling.md b/service/policy/adr/0004-standard-action-storage-handling.md
index ac9688603d..f7a6ea8dbe 100644
--- a/service/policy/adr/0004-standard-action-storage-handling.md
+++ b/service/policy/adr/0004-standard-action-storage-handling.md
@@ -9,7 +9,7 @@ with Custom Actions (which must be fetched / configured) is challenging.
 
 1. We will store CRUD action names with `is_standard = TRUE` in policy db table.
 2. We will expose `ActionCreate`, `ActionRead`, etc, via SDK constants to make standard actions importable.
-3. Custom actions in PEPs will be retrievable or configrable as needed (as action name strings or policy object action ids).
+3. Custom actions in PEPs will be retrievable or configurable as needed (as action name strings or policy object action ids).
 4. We will avoid significant complexity from normalizing proto enums to stored table rows, and vice versa.
 5. Subject Mappings CRUD, Obligations CRUD, and GetDecisions will support actions by `name` or `id` and
 validate that the action exists in the policy database.
diff --git a/service/policy/db/query.sql b/service/policy/db/query.sql
index 8b4a62ba32..1498d3be5b 100644
--- a/service/policy/db/query.sql
+++ b/service/policy/db/query.sql
@@ -430,7 +430,6 @@ values AS (
 	WHERE av.active = TRUE
 	GROUP BY av.attribute_definition_id
 )
-
 SELECT
 	td.id,
 	td.name,
@@ -850,7 +849,7 @@ RETURNING id;
 -- SUBJECT MAPPINGS
 ----------------------------------------------------------------
 
--- name: ListSubjectMappings :many
+-- name: listSubjectMappings :many
 WITH counted AS (
     SELECT COUNT(sm.id) AS total
     FROM subject_mappings sm
@@ -891,7 +890,7 @@ GROUP BY av.id, sm.id, scs.id, counted.total, fqns.fqn
 LIMIT @limit_
 OFFSET @offset_;
 
--- name: GetSubjectMapping :one
+-- name: getSubjectMapping :one
 SELECT
     sm.id,
     (
@@ -919,7 +918,7 @@ LEFT JOIN subject_condition_set scs ON scs.id = sm.subject_condition_set_id
 WHERE sm.id = $1
 GROUP BY av.id, sm.id, scs.id;
 
--- name: MatchSubjectMappings :many
+-- name: matchSubjectMappings :many
 SELECT
     sm.id,
     (
@@ -951,20 +950,50 @@ WHERE ns.active = true AND ad.active = true and av.active = true AND EXISTS (
 )
 GROUP BY av.id, sm.id, scs.id;
 
--- name: CreateSubjectMapping :one
-INSERT INTO subject_mappings (attribute_value_id, actions, metadata, subject_condition_set_id)
-VALUES ($1, $2, $3, $4)
-RETURNING id;
-
--- name: UpdateSubjectMapping :execrows
-UPDATE subject_mappings
-SET
-    actions = COALESCE(sqlc.narg('actions'), actions),
-    metadata = COALESCE(sqlc.narg('metadata'), metadata),
-    subject_condition_set_id = COALESCE(sqlc.narg('subject_condition_set_id'), subject_condition_set_id)
-WHERE id = $1;
+-- name: createSubjectMapping :one
+WITH inserted_mapping AS (
+    INSERT INTO subject_mappings (
+        attribute_value_id,
+        metadata,
+        subject_condition_set_id
+    )
+    VALUES ($1, $2, $3)
+    RETURNING id
+),
+inserted_actions AS (
+    INSERT INTO subject_mapping_actions (subject_mapping_id, action_id)
+    SELECT 
+        (SELECT id FROM inserted_mapping),
+        unnest(sqlc.arg('action_ids')::uuid[])
+    RETURNING subject_mapping_id
+)
+SELECT id FROM inserted_mapping;
+
+-- name: updateSubjectMapping :execrows
+WITH subject_mapping_update AS (
+    UPDATE subject_mappings
+    SET
+        metadata = COALESCE(sqlc.narg('metadata'), metadata),
+        subject_condition_set_id = COALESCE(sqlc.narg('subject_condition_set_id'), subject_condition_set_id)
+    WHERE id = sqlc.arg('id')
+    RETURNING id
+),
+action_update AS (
+    DELETE FROM subject_mapping_actions
+    WHERE 
+        subject_mapping_id = sqlc.arg('id')
+        AND sqlc.narg('action_ids') IS NOT NULL
+    RETURNING subject_mapping_id
+)
+INSERT INTO subject_mapping_actions (subject_mapping_id, action_id)
+SELECT 
+    sqlc.arg('id'),
+    unnest(sqlc.narg('action_ids')::uuid[])
+WHERE
+    sqlc.narg('action_ids') IS NOT NULL
+    AND EXISTS (SELECT 1 FROM subject_mapping_update);
 
--- name: DeleteSubjectMapping :execrows
+-- name: deleteSubjectMapping :execrows
 DELETE FROM subject_mappings WHERE id = $1;
 
 
@@ -1227,9 +1256,48 @@ WHERE
   (sqlc.narg('id')::uuid IS NULL OR a.id = sqlc.narg('id')::uuid)
   AND (sqlc.narg('name')::text IS NULL OR a.name = sqlc.narg('name')::text);
 
+-- name: createOrListActionsByName :many
+WITH input_actions AS (
+    SELECT unnest(sqlc.arg('action_names')::text[]) AS name
+),
+new_actions AS (
+    INSERT INTO actions (name, is_standard)
+    SELECT 
+        input.name, 
+        FALSE -- custom actions
+    FROM input_actions input
+    WHERE NOT EXISTS (
+        SELECT 1 FROM actions a WHERE LOWER(a.name) = LOWER(input.name)
+    )
+    ON CONFLICT (name) DO NOTHING
+    RETURNING id, name, is_standard, created_at
+),
+all_actions AS (
+    -- Get existing actions that match input names
+    SELECT a.id, a.name, a.is_standard, a.created_at, 
+           TRUE AS pre_existing
+    FROM actions a
+    JOIN input_actions input ON LOWER(a.name) = LOWER(input.name)
+    
+    UNION ALL
+    
+    -- Include newly created actions
+    SELECT id, name, is_standard, created_at,
+           FALSE AS pre_existing
+    FROM new_actions
+)
+SELECT 
+    id,
+    name,
+    is_standard,
+    created_at,
+    pre_existing
+FROM all_actions
+ORDER BY name;
+
 -- name: createCustomAction :one
-INSERT INTO actions (name, is_standard, metadata)
-VALUES ($1, FALSE, $3)
+INSERT INTO actions (name, metadata, is_standard)
+VALUES ($1, $2, FALSE)
 RETURNING id;
 
 -- name: updateCustomAction :execrows

From 406aa4de7794afb667123f7b9241d596ff85e465 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Thu, 3 Apr 2025 08:05:26 -0700
Subject: [PATCH 025/110] fix and gencode

---
 service/policy/db/db.go        |    2 +-
 service/policy/db/models.go    |   24 +-
 service/policy/db/query.sql    |    4 +-
 service/policy/db/query.sql.go | 1144 +++++++++++++++++++++++---------
 4 files changed, 845 insertions(+), 329 deletions(-)

diff --git a/service/policy/db/db.go b/service/policy/db/db.go
index b4a3b78a36..eeee39e428 100644
--- a/service/policy/db/db.go
+++ b/service/policy/db/db.go
@@ -1,6 +1,6 @@
 // Code generated by sqlc. DO NOT EDIT.
 // versions:
-//   sqlc v1.27.0
+//   sqlc v1.28.0
 
 package db
 
diff --git a/service/policy/db/models.go b/service/policy/db/models.go
index eecd59b5d6..d260c8e186 100644
--- a/service/policy/db/models.go
+++ b/service/policy/db/models.go
@@ -1,6 +1,6 @@
 // Code generated by sqlc. DO NOT EDIT.
 // versions:
-//   sqlc v1.27.0
+//   sqlc v1.28.0
 
 package db
 
@@ -55,6 +55,20 @@ func (ns NullAttributeDefinitionRule) Value() (driver.Value, error) {
 	return string(ns.AttributeDefinitionRule), nil
 }
 
+// Table to store actions for use in ABAC decisioning
+type Action struct {
+	// Unique identifier for the action
+	ID string `json:"id"`
+	// Unique name of the action, e.g. read, write, etc.
+	Name string `json:"name"`
+	// Whether the action is standard (proto-enum) or custom (user-defined).
+	IsStandard bool `json:"is_standard"`
+	// Metadata for the action (see protos for structure)
+	Metadata  []byte             `json:"metadata"`
+	CreatedAt pgtype.Timestamptz `json:"created_at"`
+	UpdatedAt pgtype.Timestamptz `json:"updated_at"`
+}
+
 // View to retrieve active public keys mapped to attribute definitions
 type ActiveDefinitionPublicKeysView struct {
 	DefinitionID string `json:"definition_id"`
@@ -278,6 +292,10 @@ type SubjectMapping struct {
 	UpdatedAt pgtype.Timestamptz `json:"updated_at"`
 	// Foreign key to the condition set that entitles the subject entity to the attribute value
 	SubjectConditionSetID pgtype.UUID `json:"subject_condition_set_id"`
-	// Actions that the subject entity can perform on the attribute value (see protos for details)
-	Actions []byte `json:"actions"`
+}
+
+type SubjectMappingAction struct {
+	SubjectMappingID string           `json:"subject_mapping_id"`
+	ActionID         string           `json:"action_id"`
+	CreatedAt        pgtype.Timestamp `json:"created_at"`
 }
diff --git a/service/policy/db/query.sql b/service/policy/db/query.sql
index 1498d3be5b..f61d8f14a2 100644
--- a/service/policy/db/query.sql
+++ b/service/policy/db/query.sql
@@ -973,8 +973,8 @@ SELECT id FROM inserted_mapping;
 WITH subject_mapping_update AS (
     UPDATE subject_mappings
     SET
-        metadata = COALESCE(sqlc.narg('metadata'), metadata),
-        subject_condition_set_id = COALESCE(sqlc.narg('subject_condition_set_id'), subject_condition_set_id)
+        metadata = COALESCE(sqlc.narg('metadata')::jsonb, metadata),
+        subject_condition_set_id = COALESCE(sqlc.narg('subject_condition_set_id')::uuid[], subject_condition_set_id)
     WHERE id = sqlc.arg('id')
     RETURNING id
 ),
diff --git a/service/policy/db/query.sql.go b/service/policy/db/query.sql.go
index 2da4cb5110..b49c753e47 100644
--- a/service/policy/db/query.sql.go
+++ b/service/policy/db/query.sql.go
@@ -1,6 +1,6 @@
 // Code generated by sqlc. DO NOT EDIT.
 // versions:
-//   sqlc v1.27.0
+//   sqlc v1.28.0
 // source: query.sql
 
 package db
@@ -261,36 +261,6 @@ func (q *Queries) CreateSubjectConditionSet(ctx context.Context, arg CreateSubje
 	return id, err
 }
 
-const createSubjectMapping = `-- name: CreateSubjectMapping :one
-INSERT INTO subject_mappings (attribute_value_id, actions, metadata, subject_condition_set_id)
-VALUES ($1, $2, $3, $4)
-RETURNING id
-`
-
-type CreateSubjectMappingParams struct {
-	AttributeValueID      string      `json:"attribute_value_id"`
-	Actions               []byte      `json:"actions"`
-	Metadata              []byte      `json:"metadata"`
-	SubjectConditionSetID pgtype.UUID `json:"subject_condition_set_id"`
-}
-
-// CreateSubjectMapping
-//
-//	INSERT INTO subject_mappings (attribute_value_id, actions, metadata, subject_condition_set_id)
-//	VALUES ($1, $2, $3, $4)
-//	RETURNING id
-func (q *Queries) CreateSubjectMapping(ctx context.Context, arg CreateSubjectMappingParams) (string, error) {
-	row := q.db.QueryRow(ctx, createSubjectMapping,
-		arg.AttributeValueID,
-		arg.Actions,
-		arg.Metadata,
-		arg.SubjectConditionSetID,
-	)
-	var id string
-	err := row.Scan(&id)
-	return id, err
-}
-
 const deleteAllUnmappedSubjectConditionSets = `-- name: DeleteAllUnmappedSubjectConditionSets :many
 DELETE FROM subject_condition_set
 WHERE id NOT IN (SELECT DISTINCT sm.subject_condition_set_id FROM subject_mappings sm)
@@ -427,21 +397,6 @@ func (q *Queries) DeleteSubjectConditionSet(ctx context.Context, id string) (int
 	return result.RowsAffected(), nil
 }
 
-const deleteSubjectMapping = `-- name: DeleteSubjectMapping :execrows
-DELETE FROM subject_mappings WHERE id = $1
-`
-
-// DeleteSubjectMapping
-//
-//	DELETE FROM subject_mappings WHERE id = $1
-func (q *Queries) DeleteSubjectMapping(ctx context.Context, id string) (int64, error) {
-	result, err := q.db.Exec(ctx, deleteSubjectMapping, id)
-	if err != nil {
-		return 0, err
-	}
-	return result.RowsAffected(), nil
-}
-
 const getAttribute = `-- name: GetAttribute :one
 SELECT
     ad.id,
@@ -905,62 +860,6 @@ func (q *Queries) GetSubjectConditionSet(ctx context.Context, id string) (GetSub
 	return i, err
 }
 
-const getSubjectMapping = `-- name: GetSubjectMapping :one
-SELECT
-    sm.id,
-    sm.actions,
-    JSON_STRIP_NULLS(JSON_BUILD_OBJECT('labels', sm.metadata -> 'labels', 'created_at', sm.created_at, 'updated_at', sm.updated_at)) AS metadata,
-    JSON_BUILD_OBJECT(
-        'id', scs.id,
-        'metadata', JSON_STRIP_NULLS(JSON_BUILD_OBJECT('labels', scs.metadata -> 'labels', 'created_at', scs.created_at, 'updated_at', scs.updated_at)),
-        'subject_sets', scs.condition
-    ) AS subject_condition_set,
-    JSON_BUILD_OBJECT('id', av.id,'value', av.value,'active', av.active) AS attribute_value
-FROM subject_mappings sm
-LEFT JOIN attribute_values av ON sm.attribute_value_id = av.id
-LEFT JOIN subject_condition_set scs ON scs.id = sm.subject_condition_set_id
-WHERE sm.id = $1
-GROUP BY av.id, sm.id, scs.id
-`
-
-type GetSubjectMappingRow struct {
-	ID                  string `json:"id"`
-	Actions             []byte `json:"actions"`
-	Metadata            []byte `json:"metadata"`
-	SubjectConditionSet []byte `json:"subject_condition_set"`
-	AttributeValue      []byte `json:"attribute_value"`
-}
-
-// GetSubjectMapping
-//
-//	SELECT
-//	    sm.id,
-//	    sm.actions,
-//	    JSON_STRIP_NULLS(JSON_BUILD_OBJECT('labels', sm.metadata -> 'labels', 'created_at', sm.created_at, 'updated_at', sm.updated_at)) AS metadata,
-//	    JSON_BUILD_OBJECT(
-//	        'id', scs.id,
-//	        'metadata', JSON_STRIP_NULLS(JSON_BUILD_OBJECT('labels', scs.metadata -> 'labels', 'created_at', scs.created_at, 'updated_at', scs.updated_at)),
-//	        'subject_sets', scs.condition
-//	    ) AS subject_condition_set,
-//	    JSON_BUILD_OBJECT('id', av.id,'value', av.value,'active', av.active) AS attribute_value
-//	FROM subject_mappings sm
-//	LEFT JOIN attribute_values av ON sm.attribute_value_id = av.id
-//	LEFT JOIN subject_condition_set scs ON scs.id = sm.subject_condition_set_id
-//	WHERE sm.id = $1
-//	GROUP BY av.id, sm.id, scs.id
-func (q *Queries) GetSubjectMapping(ctx context.Context, id string) (GetSubjectMappingRow, error) {
-	row := q.db.QueryRow(ctx, getSubjectMapping, id)
-	var i GetSubjectMappingRow
-	err := row.Scan(
-		&i.ID,
-		&i.Actions,
-		&i.Metadata,
-		&i.SubjectConditionSet,
-		&i.AttributeValue,
-	)
-	return i, err
-}
-
 const listAttributeValues = `-- name: ListAttributeValues :many
 
 WITH counted AS (
@@ -1176,7 +1075,6 @@ values AS (
 	WHERE av.active = TRUE
 	GROUP BY av.attribute_definition_id
 )
-
 SELECT
 	td.id,
 	td.name,
@@ -1322,7 +1220,6 @@ type ListAttributesByDefOrValueFqnsRow struct {
 //		WHERE av.active = TRUE
 //		GROUP BY av.attribute_definition_id
 //	)
-//
 //	SELECT
 //		td.id,
 //		td.name,
@@ -2310,188 +2207,6 @@ func (q *Queries) ListSubjectConditionSets(ctx context.Context, arg ListSubjectC
 	return items, nil
 }
 
-const listSubjectMappings = `-- name: ListSubjectMappings :many
-
-WITH counted AS (
-    SELECT COUNT(sm.id) AS total
-    FROM subject_mappings sm
-)
-
-SELECT
-    sm.id,
-    sm.actions,
-    JSON_STRIP_NULLS(JSON_BUILD_OBJECT('labels', sm.metadata -> 'labels', 'created_at', sm.created_at, 'updated_at', sm.updated_at)) AS metadata,
-    JSON_BUILD_OBJECT(
-        'id', scs.id,
-        'metadata', JSON_STRIP_NULLS(JSON_BUILD_OBJECT('labels', scs.metadata->'labels', 'created_at', scs.created_at, 'updated_at', scs.updated_at)),
-        'subject_sets', scs.condition
-    ) AS subject_condition_set,
-    JSON_BUILD_OBJECT(
-        'id', av.id,
-        'value', av.value,
-        'active', av.active,
-        'fqn', fqns.fqn
-    ) AS attribute_value,
-    counted.total
-FROM subject_mappings sm
-CROSS JOIN counted
-LEFT JOIN attribute_values av ON sm.attribute_value_id = av.id
-LEFT JOIN attribute_fqns fqns ON av.id = fqns.value_id
-LEFT JOIN subject_condition_set scs ON scs.id = sm.subject_condition_set_id
-GROUP BY av.id, sm.id, scs.id, counted.total, fqns.fqn
-LIMIT $2
-OFFSET $1
-`
-
-type ListSubjectMappingsParams struct {
-	Offset int32 `json:"offset_"`
-	Limit  int32 `json:"limit_"`
-}
-
-type ListSubjectMappingsRow struct {
-	ID                  string `json:"id"`
-	Actions             []byte `json:"actions"`
-	Metadata            []byte `json:"metadata"`
-	SubjectConditionSet []byte `json:"subject_condition_set"`
-	AttributeValue      []byte `json:"attribute_value"`
-	Total               int64  `json:"total"`
-}
-
-// --------------------------------------------------------------
-// SUBJECT MAPPINGS
-// --------------------------------------------------------------
-//
-//	WITH counted AS (
-//	    SELECT COUNT(sm.id) AS total
-//	    FROM subject_mappings sm
-//	)
-//
-//	SELECT
-//	    sm.id,
-//	    sm.actions,
-//	    JSON_STRIP_NULLS(JSON_BUILD_OBJECT('labels', sm.metadata -> 'labels', 'created_at', sm.created_at, 'updated_at', sm.updated_at)) AS metadata,
-//	    JSON_BUILD_OBJECT(
-//	        'id', scs.id,
-//	        'metadata', JSON_STRIP_NULLS(JSON_BUILD_OBJECT('labels', scs.metadata->'labels', 'created_at', scs.created_at, 'updated_at', scs.updated_at)),
-//	        'subject_sets', scs.condition
-//	    ) AS subject_condition_set,
-//	    JSON_BUILD_OBJECT(
-//	        'id', av.id,
-//	        'value', av.value,
-//	        'active', av.active,
-//	        'fqn', fqns.fqn
-//	    ) AS attribute_value,
-//	    counted.total
-//	FROM subject_mappings sm
-//	CROSS JOIN counted
-//	LEFT JOIN attribute_values av ON sm.attribute_value_id = av.id
-//	LEFT JOIN attribute_fqns fqns ON av.id = fqns.value_id
-//	LEFT JOIN subject_condition_set scs ON scs.id = sm.subject_condition_set_id
-//	GROUP BY av.id, sm.id, scs.id, counted.total, fqns.fqn
-//	LIMIT $2
-//	OFFSET $1
-func (q *Queries) ListSubjectMappings(ctx context.Context, arg ListSubjectMappingsParams) ([]ListSubjectMappingsRow, error) {
-	rows, err := q.db.Query(ctx, listSubjectMappings, arg.Offset, arg.Limit)
-	if err != nil {
-		return nil, err
-	}
-	defer rows.Close()
-	var items []ListSubjectMappingsRow
-	for rows.Next() {
-		var i ListSubjectMappingsRow
-		if err := rows.Scan(
-			&i.ID,
-			&i.Actions,
-			&i.Metadata,
-			&i.SubjectConditionSet,
-			&i.AttributeValue,
-			&i.Total,
-		); err != nil {
-			return nil, err
-		}
-		items = append(items, i)
-	}
-	if err := rows.Err(); err != nil {
-		return nil, err
-	}
-	return items, nil
-}
-
-const matchSubjectMappings = `-- name: MatchSubjectMappings :many
-SELECT
-    sm.id,
-    sm.actions,
-    JSON_BUILD_OBJECT(
-        'id', scs.id,
-        'subject_sets', scs.condition
-    ) AS subject_condition_set,
-    JSON_BUILD_OBJECT('id', av.id,'value', av.value,'active', av.active) AS attribute_value
-FROM subject_mappings sm
-LEFT JOIN attribute_values av ON sm.attribute_value_id = av.id
-LEFT JOIN attribute_definitions ad ON av.attribute_definition_id = ad.id
-LEFT JOIN attribute_namespaces ns ON ad.namespace_id = ns.id
-LEFT JOIN subject_condition_set scs ON scs.id = sm.subject_condition_set_id
-WHERE ns.active = true AND ad.active = true and av.active = true AND EXISTS (
-    SELECT 1
-    FROM JSONB_ARRAY_ELEMENTS(scs.condition) AS ss, JSONB_ARRAY_ELEMENTS(ss->'conditionGroups') AS cg, JSONB_ARRAY_ELEMENTS(cg->'conditions') AS each_condition
-    WHERE (each_condition->>'subjectExternalSelectorValue' = ANY($1::TEXT[])) 
-)
-GROUP BY av.id, sm.id, scs.id
-`
-
-type MatchSubjectMappingsRow struct {
-	ID                  string `json:"id"`
-	Actions             []byte `json:"actions"`
-	SubjectConditionSet []byte `json:"subject_condition_set"`
-	AttributeValue      []byte `json:"attribute_value"`
-}
-
-// MatchSubjectMappings
-//
-//	SELECT
-//	    sm.id,
-//	    sm.actions,
-//	    JSON_BUILD_OBJECT(
-//	        'id', scs.id,
-//	        'subject_sets', scs.condition
-//	    ) AS subject_condition_set,
-//	    JSON_BUILD_OBJECT('id', av.id,'value', av.value,'active', av.active) AS attribute_value
-//	FROM subject_mappings sm
-//	LEFT JOIN attribute_values av ON sm.attribute_value_id = av.id
-//	LEFT JOIN attribute_definitions ad ON av.attribute_definition_id = ad.id
-//	LEFT JOIN attribute_namespaces ns ON ad.namespace_id = ns.id
-//	LEFT JOIN subject_condition_set scs ON scs.id = sm.subject_condition_set_id
-//	WHERE ns.active = true AND ad.active = true and av.active = true AND EXISTS (
-//	    SELECT 1
-//	    FROM JSONB_ARRAY_ELEMENTS(scs.condition) AS ss, JSONB_ARRAY_ELEMENTS(ss->'conditionGroups') AS cg, JSONB_ARRAY_ELEMENTS(cg->'conditions') AS each_condition
-//	    WHERE (each_condition->>'subjectExternalSelectorValue' = ANY($1::TEXT[]))
-//	)
-//	GROUP BY av.id, sm.id, scs.id
-func (q *Queries) MatchSubjectMappings(ctx context.Context, selectors []string) ([]MatchSubjectMappingsRow, error) {
-	rows, err := q.db.Query(ctx, matchSubjectMappings, selectors)
-	if err != nil {
-		return nil, err
-	}
-	defer rows.Close()
-	var items []MatchSubjectMappingsRow
-	for rows.Next() {
-		var i MatchSubjectMappingsRow
-		if err := rows.Scan(
-			&i.ID,
-			&i.Actions,
-			&i.SubjectConditionSet,
-			&i.AttributeValue,
-		); err != nil {
-			return nil, err
-		}
-		items = append(items, i)
-	}
-	if err := rows.Err(); err != nil {
-		return nil, err
-	}
-	return items, nil
-}
-
 const removeKeyAccessServerFromAttribute = `-- name: RemoveKeyAccessServerFromAttribute :execrows
 DELETE FROM attribute_definition_key_access_grants
 WHERE attribute_definition_id = $1 AND key_access_server_id = $2
@@ -2825,43 +2540,6 @@ func (q *Queries) UpdateSubjectConditionSet(ctx context.Context, arg UpdateSubje
 	return result.RowsAffected(), nil
 }
 
-const updateSubjectMapping = `-- name: UpdateSubjectMapping :execrows
-UPDATE subject_mappings
-SET
-    actions = COALESCE($2, actions),
-    metadata = COALESCE($3, metadata),
-    subject_condition_set_id = COALESCE($4, subject_condition_set_id)
-WHERE id = $1
-`
-
-type UpdateSubjectMappingParams struct {
-	ID                    string      `json:"id"`
-	Actions               []byte      `json:"actions"`
-	Metadata              []byte      `json:"metadata"`
-	SubjectConditionSetID pgtype.UUID `json:"subject_condition_set_id"`
-}
-
-// UpdateSubjectMapping
-//
-//	UPDATE subject_mappings
-//	SET
-//	    actions = COALESCE($2, actions),
-//	    metadata = COALESCE($3, metadata),
-//	    subject_condition_set_id = COALESCE($4, subject_condition_set_id)
-//	WHERE id = $1
-func (q *Queries) UpdateSubjectMapping(ctx context.Context, arg UpdateSubjectMappingParams) (int64, error) {
-	result, err := q.db.Exec(ctx, updateSubjectMapping,
-		arg.ID,
-		arg.Actions,
-		arg.Metadata,
-		arg.SubjectConditionSetID,
-	)
-	if err != nil {
-		return 0, err
-	}
-	return result.RowsAffected(), nil
-}
-
 const upsertAttributeDefinitionFqn = `-- name: UpsertAttributeDefinitionFqn :many
 WITH new_fqns_cte AS (
     -- get attribute definition fqns
@@ -3273,6 +2951,142 @@ func (q *Queries) assignPublicKeyToNamespace(ctx context.Context, arg assignPubl
 	return result.RowsAffected(), nil
 }
 
+const createCustomAction = `-- name: createCustomAction :one
+INSERT INTO actions (name, metadata, is_standard)
+VALUES ($1, $2, FALSE)
+RETURNING id
+`
+
+type createCustomActionParams struct {
+	Name     string `json:"name"`
+	Metadata []byte `json:"metadata"`
+}
+
+// createCustomAction
+//
+//	INSERT INTO actions (name, metadata, is_standard)
+//	VALUES ($1, $2, FALSE)
+//	RETURNING id
+func (q *Queries) createCustomAction(ctx context.Context, arg createCustomActionParams) (string, error) {
+	row := q.db.QueryRow(ctx, createCustomAction, arg.Name, arg.Metadata)
+	var id string
+	err := row.Scan(&id)
+	return id, err
+}
+
+const createOrListActionsByName = `-- name: createOrListActionsByName :many
+WITH input_actions AS (
+    SELECT unnest($1::text[]) AS name
+),
+new_actions AS (
+    INSERT INTO actions (name, is_standard)
+    SELECT 
+        input.name, 
+        FALSE -- custom actions
+    FROM input_actions input
+    WHERE NOT EXISTS (
+        SELECT 1 FROM actions a WHERE LOWER(a.name) = LOWER(input.name)
+    )
+    ON CONFLICT (name) DO NOTHING
+    RETURNING id, name, is_standard, created_at
+),
+all_actions AS (
+    -- Get existing actions that match input names
+    SELECT a.id, a.name, a.is_standard, a.created_at, 
+           TRUE AS pre_existing
+    FROM actions a
+    JOIN input_actions input ON LOWER(a.name) = LOWER(input.name)
+    
+    UNION ALL
+    
+    -- Include newly created actions
+    SELECT id, name, is_standard, created_at,
+           FALSE AS pre_existing
+    FROM new_actions
+)
+SELECT 
+    id,
+    name,
+    is_standard,
+    created_at,
+    pre_existing
+FROM all_actions
+ORDER BY name
+`
+
+type createOrListActionsByNameRow struct {
+	ID          string             `json:"id"`
+	Name        string             `json:"name"`
+	IsStandard  bool               `json:"is_standard"`
+	CreatedAt   pgtype.Timestamptz `json:"created_at"`
+	PreExisting bool               `json:"pre_existing"`
+}
+
+// createOrListActionsByName
+//
+//	WITH input_actions AS (
+//	    SELECT unnest($1::text[]) AS name
+//	),
+//	new_actions AS (
+//	    INSERT INTO actions (name, is_standard)
+//	    SELECT
+//	        input.name,
+//	        FALSE -- custom actions
+//	    FROM input_actions input
+//	    WHERE NOT EXISTS (
+//	        SELECT 1 FROM actions a WHERE LOWER(a.name) = LOWER(input.name)
+//	    )
+//	    ON CONFLICT (name) DO NOTHING
+//	    RETURNING id, name, is_standard, created_at
+//	),
+//	all_actions AS (
+//	    -- Get existing actions that match input names
+//	    SELECT a.id, a.name, a.is_standard, a.created_at,
+//	           TRUE AS pre_existing
+//	    FROM actions a
+//	    JOIN input_actions input ON LOWER(a.name) = LOWER(input.name)
+//
+//	    UNION ALL
+//
+//	    -- Include newly created actions
+//	    SELECT id, name, is_standard, created_at,
+//	           FALSE AS pre_existing
+//	    FROM new_actions
+//	)
+//	SELECT
+//	    id,
+//	    name,
+//	    is_standard,
+//	    created_at,
+//	    pre_existing
+//	FROM all_actions
+//	ORDER BY name
+func (q *Queries) createOrListActionsByName(ctx context.Context, actionNames []string) ([]createOrListActionsByNameRow, error) {
+	rows, err := q.db.Query(ctx, createOrListActionsByName, actionNames)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []createOrListActionsByNameRow
+	for rows.Next() {
+		var i createOrListActionsByNameRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.Name,
+			&i.IsStandard,
+			&i.CreatedAt,
+			&i.PreExisting,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const createPublicKey = `-- name: createPublicKey :one
 
 INSERT INTO public_keys (key_access_server_id, key_id, alg, public_key, metadata)
@@ -3308,6 +3122,64 @@ func (q *Queries) createPublicKey(ctx context.Context, arg createPublicKeyParams
 	return id, err
 }
 
+const createSubjectMapping = `-- name: createSubjectMapping :one
+WITH inserted_mapping AS (
+    INSERT INTO subject_mappings (
+        attribute_value_id,
+        metadata,
+        subject_condition_set_id
+    )
+    VALUES ($1, $2, $3)
+    RETURNING id
+),
+inserted_actions AS (
+    INSERT INTO subject_mapping_actions (subject_mapping_id, action_id)
+    SELECT 
+        (SELECT id FROM inserted_mapping),
+        unnest($4::uuid[])
+    RETURNING subject_mapping_id
+)
+SELECT id FROM inserted_mapping
+`
+
+type createSubjectMappingParams struct {
+	AttributeValueID      string      `json:"attribute_value_id"`
+	Metadata              []byte      `json:"metadata"`
+	SubjectConditionSetID pgtype.UUID `json:"subject_condition_set_id"`
+	ActionIds             []string    `json:"action_ids"`
+}
+
+// createSubjectMapping
+//
+//	WITH inserted_mapping AS (
+//	    INSERT INTO subject_mappings (
+//	        attribute_value_id,
+//	        metadata,
+//	        subject_condition_set_id
+//	    )
+//	    VALUES ($1, $2, $3)
+//	    RETURNING id
+//	),
+//	inserted_actions AS (
+//	    INSERT INTO subject_mapping_actions (subject_mapping_id, action_id)
+//	    SELECT
+//	        (SELECT id FROM inserted_mapping),
+//	        unnest($4::uuid[])
+//	    RETURNING subject_mapping_id
+//	)
+//	SELECT id FROM inserted_mapping
+func (q *Queries) createSubjectMapping(ctx context.Context, arg createSubjectMappingParams) (string, error) {
+	row := q.db.QueryRow(ctx, createSubjectMapping,
+		arg.AttributeValueID,
+		arg.Metadata,
+		arg.SubjectConditionSetID,
+		arg.ActionIds,
+	)
+	var id string
+	err := row.Scan(&id)
+	return id, err
+}
+
 const deactivatePublicKey = `-- name: deactivatePublicKey :execrows
 UPDATE public_keys SET is_active = FALSE WHERE id = $1
 `
@@ -3323,6 +3195,25 @@ func (q *Queries) deactivatePublicKey(ctx context.Context, id string) (int64, er
 	return result.RowsAffected(), nil
 }
 
+const deleteCustomAction = `-- name: deleteCustomAction :execrows
+DELETE FROM actions
+WHERE id = $1
+  AND is_standard = FALSE
+`
+
+// deleteCustomAction
+//
+//	DELETE FROM actions
+//	WHERE id = $1
+//	  AND is_standard = FALSE
+func (q *Queries) deleteCustomAction(ctx context.Context, id string) (int64, error) {
+	result, err := q.db.Exec(ctx, deleteCustomAction, id)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected(), nil
+}
+
 const deletePublicKey = `-- name: deletePublicKey :execrows
 DELETE FROM public_keys WHERE id = $1
 `
@@ -3338,6 +3229,68 @@ func (q *Queries) deletePublicKey(ctx context.Context, id string) (int64, error)
 	return result.RowsAffected(), nil
 }
 
+const deleteSubjectMapping = `-- name: deleteSubjectMapping :execrows
+DELETE FROM subject_mappings WHERE id = $1
+`
+
+// deleteSubjectMapping
+//
+//	DELETE FROM subject_mappings WHERE id = $1
+func (q *Queries) deleteSubjectMapping(ctx context.Context, id string) (int64, error) {
+	result, err := q.db.Exec(ctx, deleteSubjectMapping, id)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected(), nil
+}
+
+const getAction = `-- name: getAction :one
+SELECT 
+    id,
+    name,
+    is_standard,
+    JSON_STRIP_NULLS(JSON_BUILD_OBJECT('labels', metadata -> 'labels', 'created_at', created_at, 'updated_at', updated_at)) AS metadata
+FROM actions a
+WHERE 
+  ($1::uuid IS NULL OR a.id = $1::uuid)
+  AND ($2::text IS NULL OR a.name = $2::text)
+`
+
+type getActionParams struct {
+	ID   pgtype.UUID `json:"id"`
+	Name pgtype.Text `json:"name"`
+}
+
+type getActionRow struct {
+	ID         string `json:"id"`
+	Name       string `json:"name"`
+	IsStandard bool   `json:"is_standard"`
+	Metadata   []byte `json:"metadata"`
+}
+
+// getAction
+//
+//	SELECT
+//	    id,
+//	    name,
+//	    is_standard,
+//	    JSON_STRIP_NULLS(JSON_BUILD_OBJECT('labels', metadata -> 'labels', 'created_at', created_at, 'updated_at', updated_at)) AS metadata
+//	FROM actions a
+//	WHERE
+//	  ($1::uuid IS NULL OR a.id = $1::uuid)
+//	  AND ($2::text IS NULL OR a.name = $2::text)
+func (q *Queries) getAction(ctx context.Context, arg getActionParams) (getActionRow, error) {
+	row := q.db.QueryRow(ctx, getAction, arg.ID, arg.Name)
+	var i getActionRow
+	err := row.Scan(
+		&i.ID,
+		&i.Name,
+		&i.IsStandard,
+		&i.Metadata,
+	)
+	return i, err
+}
+
 const getPublicKey = `-- name: getPublicKey :one
 SELECT 
     k.id,
@@ -3402,6 +3355,202 @@ func (q *Queries) getPublicKey(ctx context.Context, id string) (getPublicKeyRow,
 	return i, err
 }
 
+const getSubjectMapping = `-- name: getSubjectMapping :one
+SELECT
+    sm.id,
+    (
+        SELECT JSONB_AGG(JSONB_BUILD_OBJECT('id', a.id, 'name', a.name, 'metadata', a.metadata))
+        FROM subject_mapping_actions sma
+        JOIN actions a ON sma.action_id = a.id
+        WHERE sma.subject_mapping_id = sm.id AND a.is_standard = TRUE
+    ) AS standard_actions,
+    (
+        SELECT JSONB_AGG(JSONB_BUILD_OBJECT('id', a.id, 'name', a.name, 'metadata', a.metadata))
+        FROM subject_mapping_actions sma
+        JOIN actions a ON sma.action_id = a.id
+        WHERE sma.subject_mapping_id = sm.id AND a.is_standard = FALSE
+    ) AS custom_actions,
+    JSON_STRIP_NULLS(JSON_BUILD_OBJECT('labels', sm.metadata -> 'labels', 'created_at', sm.created_at, 'updated_at', sm.updated_at)) AS metadata,
+    JSON_BUILD_OBJECT(
+        'id', scs.id,
+        'metadata', JSON_STRIP_NULLS(JSON_BUILD_OBJECT('labels', scs.metadata -> 'labels', 'created_at', scs.created_at, 'updated_at', scs.updated_at)),
+        'subject_sets', scs.condition
+    ) AS subject_condition_set,
+    JSON_BUILD_OBJECT('id', av.id,'value', av.value,'active', av.active) AS attribute_value
+FROM subject_mappings sm
+LEFT JOIN attribute_values av ON sm.attribute_value_id = av.id
+LEFT JOIN subject_condition_set scs ON scs.id = sm.subject_condition_set_id
+WHERE sm.id = $1
+GROUP BY av.id, sm.id, scs.id
+`
+
+type getSubjectMappingRow struct {
+	ID                  string `json:"id"`
+	StandardActions     []byte `json:"standard_actions"`
+	CustomActions       []byte `json:"custom_actions"`
+	Metadata            []byte `json:"metadata"`
+	SubjectConditionSet []byte `json:"subject_condition_set"`
+	AttributeValue      []byte `json:"attribute_value"`
+}
+
+// getSubjectMapping
+//
+//	SELECT
+//	    sm.id,
+//	    (
+//	        SELECT JSONB_AGG(JSONB_BUILD_OBJECT('id', a.id, 'name', a.name, 'metadata', a.metadata))
+//	        FROM subject_mapping_actions sma
+//	        JOIN actions a ON sma.action_id = a.id
+//	        WHERE sma.subject_mapping_id = sm.id AND a.is_standard = TRUE
+//	    ) AS standard_actions,
+//	    (
+//	        SELECT JSONB_AGG(JSONB_BUILD_OBJECT('id', a.id, 'name', a.name, 'metadata', a.metadata))
+//	        FROM subject_mapping_actions sma
+//	        JOIN actions a ON sma.action_id = a.id
+//	        WHERE sma.subject_mapping_id = sm.id AND a.is_standard = FALSE
+//	    ) AS custom_actions,
+//	    JSON_STRIP_NULLS(JSON_BUILD_OBJECT('labels', sm.metadata -> 'labels', 'created_at', sm.created_at, 'updated_at', sm.updated_at)) AS metadata,
+//	    JSON_BUILD_OBJECT(
+//	        'id', scs.id,
+//	        'metadata', JSON_STRIP_NULLS(JSON_BUILD_OBJECT('labels', scs.metadata -> 'labels', 'created_at', scs.created_at, 'updated_at', scs.updated_at)),
+//	        'subject_sets', scs.condition
+//	    ) AS subject_condition_set,
+//	    JSON_BUILD_OBJECT('id', av.id,'value', av.value,'active', av.active) AS attribute_value
+//	FROM subject_mappings sm
+//	LEFT JOIN attribute_values av ON sm.attribute_value_id = av.id
+//	LEFT JOIN subject_condition_set scs ON scs.id = sm.subject_condition_set_id
+//	WHERE sm.id = $1
+//	GROUP BY av.id, sm.id, scs.id
+func (q *Queries) getSubjectMapping(ctx context.Context, id string) (getSubjectMappingRow, error) {
+	row := q.db.QueryRow(ctx, getSubjectMapping, id)
+	var i getSubjectMappingRow
+	err := row.Scan(
+		&i.ID,
+		&i.StandardActions,
+		&i.CustomActions,
+		&i.Metadata,
+		&i.SubjectConditionSet,
+		&i.AttributeValue,
+	)
+	return i, err
+}
+
+const listActions = `-- name: listActions :many
+
+
+
+WITH counted AS (
+    SELECT COUNT(id) AS total FROM actions
+)
+SELECT 
+    (
+        SELECT JSONB_AGG(
+            JSONB_BUILD_OBJECT(
+                'id', id,
+                'name', name,
+                'metadata', JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
+                    'labels', metadata -> 'labels', 
+                    'created_at', created_at, 
+                    'updated_at', updated_at
+                ))
+            )
+        )
+        FROM actions
+        WHERE is_standard = TRUE
+    ) AS standard_actions,
+    (
+        SELECT JSONB_AGG(
+            JSONB_BUILD_OBJECT(
+                'id', id,
+                'name', name,
+                'metadata', JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
+                    'labels', metadata -> 'labels', 
+                    'created_at', created_at, 
+                    'updated_at', updated_at
+                ))
+            )
+        )
+        FROM actions
+        WHERE is_standard = FALSE
+    ) AS custom_actions,
+    (SELECT total FROM counted) AS total
+LIMIT $2 
+OFFSET $1
+`
+
+type listActionsParams struct {
+	Offset int32 `json:"offset_"`
+	Limit  int32 `json:"limit_"`
+}
+
+type listActionsRow struct {
+	StandardActions []byte `json:"standard_actions"`
+	CustomActions   []byte `json:"custom_actions"`
+	Total           int64  `json:"total"`
+}
+
+// --------------------------------------------------------------
+// --------------------------------------------------------------
+// ACTIONS
+// --------------------------------------------------------------
+//
+//	WITH counted AS (
+//	    SELECT COUNT(id) AS total FROM actions
+//	)
+//	SELECT
+//	    (
+//	        SELECT JSONB_AGG(
+//	            JSONB_BUILD_OBJECT(
+//	                'id', id,
+//	                'name', name,
+//	                'metadata', JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
+//	                    'labels', metadata -> 'labels',
+//	                    'created_at', created_at,
+//	                    'updated_at', updated_at
+//	                ))
+//	            )
+//	        )
+//	        FROM actions
+//	        WHERE is_standard = TRUE
+//	    ) AS standard_actions,
+//	    (
+//	        SELECT JSONB_AGG(
+//	            JSONB_BUILD_OBJECT(
+//	                'id', id,
+//	                'name', name,
+//	                'metadata', JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
+//	                    'labels', metadata -> 'labels',
+//	                    'created_at', created_at,
+//	                    'updated_at', updated_at
+//	                ))
+//	            )
+//	        )
+//	        FROM actions
+//	        WHERE is_standard = FALSE
+//	    ) AS custom_actions,
+//	    (SELECT total FROM counted) AS total
+//	LIMIT $2
+//	OFFSET $1
+func (q *Queries) listActions(ctx context.Context, arg listActionsParams) ([]listActionsRow, error) {
+	rows, err := q.db.Query(ctx, listActions, arg.Offset, arg.Limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []listActionsRow
+	for rows.Next() {
+		var i listActionsRow
+		if err := rows.Scan(&i.StandardActions, &i.CustomActions, &i.Total); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const listPublicKeyMappings = `-- name: listPublicKeyMappings :many
 WITH counted AS (
     SELECT COUNT(DISTINCT kas.id) AS total FROM public_keys AS pk
@@ -3791,6 +3940,234 @@ func (q *Queries) listPublicKeys(ctx context.Context, arg listPublicKeysParams)
 	return items, nil
 }
 
+const listSubjectMappings = `-- name: listSubjectMappings :many
+
+WITH counted AS (
+    SELECT COUNT(sm.id) AS total
+    FROM subject_mappings sm
+)
+SELECT
+    sm.id,
+    (
+        SELECT JSONB_AGG(JSONB_BUILD_OBJECT('id', a.id, 'name', a.name, 'metadata', a.metadata))
+        FROM subject_mapping_actions sma
+        JOIN actions a ON sma.action_id = a.id
+        WHERE sma.subject_mapping_id = sm.id AND a.is_standard = TRUE
+    ) AS standard_actions,
+    (
+        SELECT JSONB_AGG(JSONB_BUILD_OBJECT('id', a.id, 'name', a.name, 'metadata', a.metadata))
+        FROM subject_mapping_actions sma
+        JOIN actions a ON sma.action_id = a.id
+        WHERE sma.subject_mapping_id = sm.id AND a.is_standard = FALSE
+    ) AS custom_actions,
+    JSON_STRIP_NULLS(JSON_BUILD_OBJECT('labels', sm.metadata -> 'labels', 'created_at', sm.created_at, 'updated_at', sm.updated_at)) AS metadata,
+    JSON_BUILD_OBJECT(
+        'id', scs.id,
+        'metadata', JSON_STRIP_NULLS(JSON_BUILD_OBJECT('labels', scs.metadata->'labels', 'created_at', scs.created_at, 'updated_at', scs.updated_at)),
+        'subject_sets', scs.condition
+    ) AS subject_condition_set,
+    JSON_BUILD_OBJECT(
+        'id', av.id,
+        'value', av.value,
+        'active', av.active,
+        'fqn', fqns.fqn
+    ) AS attribute_value,
+    counted.total
+FROM subject_mappings sm
+CROSS JOIN counted
+LEFT JOIN attribute_values av ON sm.attribute_value_id = av.id
+LEFT JOIN attribute_fqns fqns ON av.id = fqns.value_id
+LEFT JOIN subject_condition_set scs ON scs.id = sm.subject_condition_set_id
+GROUP BY av.id, sm.id, scs.id, counted.total, fqns.fqn
+LIMIT $2
+OFFSET $1
+`
+
+type listSubjectMappingsParams struct {
+	Offset int32 `json:"offset_"`
+	Limit  int32 `json:"limit_"`
+}
+
+type listSubjectMappingsRow struct {
+	ID                  string `json:"id"`
+	StandardActions     []byte `json:"standard_actions"`
+	CustomActions       []byte `json:"custom_actions"`
+	Metadata            []byte `json:"metadata"`
+	SubjectConditionSet []byte `json:"subject_condition_set"`
+	AttributeValue      []byte `json:"attribute_value"`
+	Total               int64  `json:"total"`
+}
+
+// --------------------------------------------------------------
+// SUBJECT MAPPINGS
+// --------------------------------------------------------------
+//
+//	WITH counted AS (
+//	    SELECT COUNT(sm.id) AS total
+//	    FROM subject_mappings sm
+//	)
+//	SELECT
+//	    sm.id,
+//	    (
+//	        SELECT JSONB_AGG(JSONB_BUILD_OBJECT('id', a.id, 'name', a.name, 'metadata', a.metadata))
+//	        FROM subject_mapping_actions sma
+//	        JOIN actions a ON sma.action_id = a.id
+//	        WHERE sma.subject_mapping_id = sm.id AND a.is_standard = TRUE
+//	    ) AS standard_actions,
+//	    (
+//	        SELECT JSONB_AGG(JSONB_BUILD_OBJECT('id', a.id, 'name', a.name, 'metadata', a.metadata))
+//	        FROM subject_mapping_actions sma
+//	        JOIN actions a ON sma.action_id = a.id
+//	        WHERE sma.subject_mapping_id = sm.id AND a.is_standard = FALSE
+//	    ) AS custom_actions,
+//	    JSON_STRIP_NULLS(JSON_BUILD_OBJECT('labels', sm.metadata -> 'labels', 'created_at', sm.created_at, 'updated_at', sm.updated_at)) AS metadata,
+//	    JSON_BUILD_OBJECT(
+//	        'id', scs.id,
+//	        'metadata', JSON_STRIP_NULLS(JSON_BUILD_OBJECT('labels', scs.metadata->'labels', 'created_at', scs.created_at, 'updated_at', scs.updated_at)),
+//	        'subject_sets', scs.condition
+//	    ) AS subject_condition_set,
+//	    JSON_BUILD_OBJECT(
+//	        'id', av.id,
+//	        'value', av.value,
+//	        'active', av.active,
+//	        'fqn', fqns.fqn
+//	    ) AS attribute_value,
+//	    counted.total
+//	FROM subject_mappings sm
+//	CROSS JOIN counted
+//	LEFT JOIN attribute_values av ON sm.attribute_value_id = av.id
+//	LEFT JOIN attribute_fqns fqns ON av.id = fqns.value_id
+//	LEFT JOIN subject_condition_set scs ON scs.id = sm.subject_condition_set_id
+//	GROUP BY av.id, sm.id, scs.id, counted.total, fqns.fqn
+//	LIMIT $2
+//	OFFSET $1
+func (q *Queries) listSubjectMappings(ctx context.Context, arg listSubjectMappingsParams) ([]listSubjectMappingsRow, error) {
+	rows, err := q.db.Query(ctx, listSubjectMappings, arg.Offset, arg.Limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []listSubjectMappingsRow
+	for rows.Next() {
+		var i listSubjectMappingsRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.StandardActions,
+			&i.CustomActions,
+			&i.Metadata,
+			&i.SubjectConditionSet,
+			&i.AttributeValue,
+			&i.Total,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const matchSubjectMappings = `-- name: matchSubjectMappings :many
+SELECT
+    sm.id,
+    (
+        SELECT JSONB_AGG(JSONB_BUILD_OBJECT('id', a.id, 'name', a.name, 'metadata', a.metadata))
+        FROM subject_mapping_actions sma
+        JOIN actions a ON sma.action_id = a.id
+        WHERE sma.subject_mapping_id = sm.id AND a.is_standard = TRUE
+    ) AS standard_actions,
+    (
+        SELECT JSONB_AGG(JSONB_BUILD_OBJECT('id', a.id, 'name', a.name, 'metadata', a.metadata))
+        FROM subject_mapping_actions sma
+        JOIN actions a ON sma.action_id = a.id
+        WHERE sma.subject_mapping_id = sm.id AND a.is_standard = FALSE
+    ) AS custom_actions,
+    JSON_BUILD_OBJECT(
+        'id', scs.id,
+        'subject_sets', scs.condition
+    ) AS subject_condition_set,
+    JSON_BUILD_OBJECT('id', av.id,'value', av.value,'active', av.active) AS attribute_value
+FROM subject_mappings sm
+LEFT JOIN attribute_values av ON sm.attribute_value_id = av.id
+LEFT JOIN attribute_definitions ad ON av.attribute_definition_id = ad.id
+LEFT JOIN attribute_namespaces ns ON ad.namespace_id = ns.id
+LEFT JOIN subject_condition_set scs ON scs.id = sm.subject_condition_set_id
+WHERE ns.active = true AND ad.active = true and av.active = true AND EXISTS (
+    SELECT 1
+    FROM JSONB_ARRAY_ELEMENTS(scs.condition) AS ss, JSONB_ARRAY_ELEMENTS(ss->'conditionGroups') AS cg, JSONB_ARRAY_ELEMENTS(cg->'conditions') AS each_condition
+    WHERE (each_condition->>'subjectExternalSelectorValue' = ANY($1::TEXT[])) 
+)
+GROUP BY av.id, sm.id, scs.id
+`
+
+type matchSubjectMappingsRow struct {
+	ID                  string `json:"id"`
+	StandardActions     []byte `json:"standard_actions"`
+	CustomActions       []byte `json:"custom_actions"`
+	SubjectConditionSet []byte `json:"subject_condition_set"`
+	AttributeValue      []byte `json:"attribute_value"`
+}
+
+// matchSubjectMappings
+//
+//	SELECT
+//	    sm.id,
+//	    (
+//	        SELECT JSONB_AGG(JSONB_BUILD_OBJECT('id', a.id, 'name', a.name, 'metadata', a.metadata))
+//	        FROM subject_mapping_actions sma
+//	        JOIN actions a ON sma.action_id = a.id
+//	        WHERE sma.subject_mapping_id = sm.id AND a.is_standard = TRUE
+//	    ) AS standard_actions,
+//	    (
+//	        SELECT JSONB_AGG(JSONB_BUILD_OBJECT('id', a.id, 'name', a.name, 'metadata', a.metadata))
+//	        FROM subject_mapping_actions sma
+//	        JOIN actions a ON sma.action_id = a.id
+//	        WHERE sma.subject_mapping_id = sm.id AND a.is_standard = FALSE
+//	    ) AS custom_actions,
+//	    JSON_BUILD_OBJECT(
+//	        'id', scs.id,
+//	        'subject_sets', scs.condition
+//	    ) AS subject_condition_set,
+//	    JSON_BUILD_OBJECT('id', av.id,'value', av.value,'active', av.active) AS attribute_value
+//	FROM subject_mappings sm
+//	LEFT JOIN attribute_values av ON sm.attribute_value_id = av.id
+//	LEFT JOIN attribute_definitions ad ON av.attribute_definition_id = ad.id
+//	LEFT JOIN attribute_namespaces ns ON ad.namespace_id = ns.id
+//	LEFT JOIN subject_condition_set scs ON scs.id = sm.subject_condition_set_id
+//	WHERE ns.active = true AND ad.active = true and av.active = true AND EXISTS (
+//	    SELECT 1
+//	    FROM JSONB_ARRAY_ELEMENTS(scs.condition) AS ss, JSONB_ARRAY_ELEMENTS(ss->'conditionGroups') AS cg, JSONB_ARRAY_ELEMENTS(cg->'conditions') AS each_condition
+//	    WHERE (each_condition->>'subjectExternalSelectorValue' = ANY($1::TEXT[]))
+//	)
+//	GROUP BY av.id, sm.id, scs.id
+func (q *Queries) matchSubjectMappings(ctx context.Context, selectors []string) ([]matchSubjectMappingsRow, error) {
+	rows, err := q.db.Query(ctx, matchSubjectMappings, selectors)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []matchSubjectMappingsRow
+	for rows.Next() {
+		var i matchSubjectMappingsRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.StandardActions,
+			&i.CustomActions,
+			&i.SubjectConditionSet,
+			&i.AttributeValue,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const removePublicKeyFromAttributeDefinition = `-- name: removePublicKeyFromAttributeDefinition :execrows
 DELETE FROM attribute_definition_public_key_map WHERE definition_id = $1 AND key_id = $2
 `
@@ -3851,6 +4228,37 @@ func (q *Queries) removePublicKeyFromNamespace(ctx context.Context, arg removePu
 	return result.RowsAffected(), nil
 }
 
+const updateCustomAction = `-- name: updateCustomAction :execrows
+UPDATE actions
+SET
+    name = COALESCE($2, name),
+    metadata = COALESCE($3, metadata)
+WHERE id = $1
+  AND is_standard = FALSE
+`
+
+type updateCustomActionParams struct {
+	ID       string      `json:"id"`
+	Name     pgtype.Text `json:"name"`
+	Metadata []byte      `json:"metadata"`
+}
+
+// updateCustomAction
+//
+//	UPDATE actions
+//	SET
+//	    name = COALESCE($2, name),
+//	    metadata = COALESCE($3, metadata)
+//	WHERE id = $1
+//	  AND is_standard = FALSE
+func (q *Queries) updateCustomAction(ctx context.Context, arg updateCustomActionParams) (int64, error) {
+	result, err := q.db.Exec(ctx, updateCustomAction, arg.ID, arg.Name, arg.Metadata)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected(), nil
+}
+
 const updatePublicKey = `-- name: updatePublicKey :one
 UPDATE public_keys
 SET
@@ -3888,3 +4296,93 @@ func (q *Queries) updatePublicKey(ctx context.Context, arg updatePublicKeyParams
 	)
 	return i, err
 }
+
+const updateStandardAction = `-- name: updateStandardAction :execrows
+UPDATE actions
+SET metadata = metadata
+WHERE id = $1
+  AND is_standard = TRUE
+`
+
+// updateStandardAction
+//
+//	UPDATE actions
+//	SET metadata = metadata
+//	WHERE id = $1
+//	  AND is_standard = TRUE
+func (q *Queries) updateStandardAction(ctx context.Context, id string) (int64, error) {
+	result, err := q.db.Exec(ctx, updateStandardAction, id)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected(), nil
+}
+
+const updateSubjectMapping = `-- name: updateSubjectMapping :execrows
+WITH subject_mapping_update AS (
+    UPDATE subject_mappings
+    SET
+        metadata = COALESCE($3::jsonb, metadata),
+        subject_condition_set_id = COALESCE($4::uuid[], subject_condition_set_id)
+    WHERE id = $1
+    RETURNING id
+),
+action_update AS (
+    DELETE FROM subject_mapping_actions
+    WHERE 
+        subject_mapping_id = $1
+        AND $2 IS NOT NULL
+    RETURNING subject_mapping_id
+)
+INSERT INTO subject_mapping_actions (subject_mapping_id, action_id)
+SELECT 
+    $1,
+    unnest($2::uuid[])
+WHERE
+    $2 IS NOT NULL
+    AND EXISTS (SELECT 1 FROM subject_mapping_update)
+`
+
+type updateSubjectMappingParams struct {
+	ID                    string   `json:"id"`
+	ActionIds             []string `json:"action_ids"`
+	Metadata              []byte   `json:"metadata"`
+	SubjectConditionSetID []string `json:"subject_condition_set_id"`
+}
+
+// updateSubjectMapping
+//
+//	WITH subject_mapping_update AS (
+//	    UPDATE subject_mappings
+//	    SET
+//	        metadata = COALESCE($3::jsonb, metadata),
+//	        subject_condition_set_id = COALESCE($4::uuid[], subject_condition_set_id)
+//	    WHERE id = $1
+//	    RETURNING id
+//	),
+//	action_update AS (
+//	    DELETE FROM subject_mapping_actions
+//	    WHERE
+//	        subject_mapping_id = $1
+//	        AND $2 IS NOT NULL
+//	    RETURNING subject_mapping_id
+//	)
+//	INSERT INTO subject_mapping_actions (subject_mapping_id, action_id)
+//	SELECT
+//	    $1,
+//	    unnest($2::uuid[])
+//	WHERE
+//	    $2 IS NOT NULL
+//	    AND EXISTS (SELECT 1 FROM subject_mapping_update)
+func (q *Queries) updateSubjectMapping(ctx context.Context, arg updateSubjectMappingParams) (int64, error) {
+	result, err := q.db.Exec(ctx, updateSubjectMapping,
+		arg.ID,
+		arg.ActionIds,
+		arg.Metadata,
+		arg.SubjectConditionSetID,
+	)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected(), nil
+}

From 82a5df7fb6062a71cc851854b064829ac7169b69 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Thu, 3 Apr 2025 08:07:05 -0700
Subject: [PATCH 026/110] fix

---
 service/policy/db/query.sql    |  6 +++---
 service/policy/db/query.sql.go | 20 ++++++++++----------
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/service/policy/db/query.sql b/service/policy/db/query.sql
index f61d8f14a2..016ae8989d 100644
--- a/service/policy/db/query.sql
+++ b/service/policy/db/query.sql
@@ -973,8 +973,8 @@ SELECT id FROM inserted_mapping;
 WITH subject_mapping_update AS (
     UPDATE subject_mappings
     SET
-        metadata = COALESCE(sqlc.narg('metadata')::jsonb, metadata),
-        subject_condition_set_id = COALESCE(sqlc.narg('subject_condition_set_id')::uuid[], subject_condition_set_id)
+        metadata = COALESCE(sqlc.narg('metadata')::JSONB, metadata),
+        subject_condition_set_id = COALESCE(sqlc.narg('subject_condition_set_id')::UUID, subject_condition_set_id)
     WHERE id = sqlc.arg('id')
     RETURNING id
 ),
@@ -988,7 +988,7 @@ action_update AS (
 INSERT INTO subject_mapping_actions (subject_mapping_id, action_id)
 SELECT 
     sqlc.arg('id'),
-    unnest(sqlc.narg('action_ids')::uuid[])
+    unnest(sqlc.narg('action_ids')::UUID[])
 WHERE
     sqlc.narg('action_ids') IS NOT NULL
     AND EXISTS (SELECT 1 FROM subject_mapping_update);
diff --git a/service/policy/db/query.sql.go b/service/policy/db/query.sql.go
index b49c753e47..d47e0d5ef2 100644
--- a/service/policy/db/query.sql.go
+++ b/service/policy/db/query.sql.go
@@ -4322,8 +4322,8 @@ const updateSubjectMapping = `-- name: updateSubjectMapping :execrows
 WITH subject_mapping_update AS (
     UPDATE subject_mappings
     SET
-        metadata = COALESCE($3::jsonb, metadata),
-        subject_condition_set_id = COALESCE($4::uuid[], subject_condition_set_id)
+        metadata = COALESCE($3::JSONB, metadata),
+        subject_condition_set_id = COALESCE($4::UUID, subject_condition_set_id)
     WHERE id = $1
     RETURNING id
 ),
@@ -4337,17 +4337,17 @@ action_update AS (
 INSERT INTO subject_mapping_actions (subject_mapping_id, action_id)
 SELECT 
     $1,
-    unnest($2::uuid[])
+    unnest($2::UUID[])
 WHERE
     $2 IS NOT NULL
     AND EXISTS (SELECT 1 FROM subject_mapping_update)
 `
 
 type updateSubjectMappingParams struct {
-	ID                    string   `json:"id"`
-	ActionIds             []string `json:"action_ids"`
-	Metadata              []byte   `json:"metadata"`
-	SubjectConditionSetID []string `json:"subject_condition_set_id"`
+	ID                    string      `json:"id"`
+	ActionIds             []string    `json:"action_ids"`
+	Metadata              []byte      `json:"metadata"`
+	SubjectConditionSetID pgtype.UUID `json:"subject_condition_set_id"`
 }
 
 // updateSubjectMapping
@@ -4355,8 +4355,8 @@ type updateSubjectMappingParams struct {
 //	WITH subject_mapping_update AS (
 //	    UPDATE subject_mappings
 //	    SET
-//	        metadata = COALESCE($3::jsonb, metadata),
-//	        subject_condition_set_id = COALESCE($4::uuid[], subject_condition_set_id)
+//	        metadata = COALESCE($3::JSONB, metadata),
+//	        subject_condition_set_id = COALESCE($4::UUID, subject_condition_set_id)
 //	    WHERE id = $1
 //	    RETURNING id
 //	),
@@ -4370,7 +4370,7 @@ type updateSubjectMappingParams struct {
 //	INSERT INTO subject_mapping_actions (subject_mapping_id, action_id)
 //	SELECT
 //	    $1,
-//	    unnest($2::uuid[])
+//	    unnest($2::UUID[])
 //	WHERE
 //	    $2 IS NOT NULL
 //	    AND EXISTS (SELECT 1 FROM subject_mapping_update)

From ff78374ecf0e34686b908331e45408e0de17b4bd Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Thu, 3 Apr 2025 08:07:30 -0700
Subject: [PATCH 027/110] lower case sm db queries in sqlc gencode

---
 service/policy/db/subject_mappings.go | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/service/policy/db/subject_mappings.go b/service/policy/db/subject_mappings.go
index 15b8f392a6..2d10ccd707 100644
--- a/service/policy/db/subject_mappings.go
+++ b/service/policy/db/subject_mappings.go
@@ -307,7 +307,7 @@ func (c PolicyDBClient) CreateSubjectMapping(ctx context.Context, s *subjectmapp
 		return nil, err
 	}
 
-	createdID, err := c.Queries.CreateSubjectMapping(ctx, CreateSubjectMappingParams{
+	createdID, err := c.Queries.createSubjectMapping(ctx, createSubjectMappingParams{
 		AttributeValueID:      attributeValueID,
 		Actions:               actionsJSON,
 		Metadata:              metadataJSON,
@@ -329,7 +329,7 @@ func (c PolicyDBClient) CreateSubjectMapping(ctx context.Context, s *subjectmapp
 }
 
 func (c PolicyDBClient) GetSubjectMapping(ctx context.Context, id string) (*policy.SubjectMapping, error) {
-	sm, err := c.Queries.GetSubjectMapping(ctx, id)
+	sm, err := c.Queries.getSubjectMapping(ctx, id)
 	if err != nil {
 		return nil, db.WrapIfKnownInvalidQueryErr(err)
 	}
@@ -371,7 +371,7 @@ func (c PolicyDBClient) ListSubjectMappings(ctx context.Context, r *subjectmappi
 		return nil, db.ErrListLimitTooLarge
 	}
 
-	list, err := c.Queries.ListSubjectMappings(ctx, ListSubjectMappingsParams{
+	list, err := c.Queries.listSubjectMappings(ctx, listSubjectMappingsParams{
 		Limit:  limit,
 		Offset: offset,
 	})
@@ -452,7 +452,7 @@ func (c PolicyDBClient) UpdateSubjectMapping(ctx context.Context, r *subjectmapp
 		}
 	}
 
-	count, err := c.Queries.UpdateSubjectMapping(ctx, UpdateSubjectMappingParams{
+	count, err := c.Queries.updateSubjectMapping(ctx, updateSubjectMappingParams{
 		ID:                    id,
 		Actions:               actionsJSON,
 		Metadata:              metadataJSON,
@@ -477,7 +477,7 @@ func (c PolicyDBClient) UpdateSubjectMapping(ctx context.Context, r *subjectmapp
 
 // Deletes specified subject mapping and returns the id of the deleted
 func (c PolicyDBClient) DeleteSubjectMapping(ctx context.Context, id string) (*policy.SubjectMapping, error) {
-	count, err := c.Queries.DeleteSubjectMapping(ctx, id)
+	count, err := c.Queries.deleteSubjectMapping(ctx, id)
 	if err != nil {
 		return nil, db.WrapIfKnownInvalidQueryErr(err)
 	}
@@ -500,7 +500,7 @@ func (c PolicyDBClient) GetMatchedSubjectMappings(ctx context.Context, propertie
 	for _, sp := range properties {
 		selectors = append(selectors, sp.GetExternalSelectorValue())
 	}
-	list, err := c.Queries.MatchSubjectMappings(ctx, selectors)
+	list, err := c.Queries.matchSubjectMappings(ctx, selectors)
 	if err != nil {
 		return nil, db.WrapIfKnownInvalidQueryErr(err)
 	}

From ae486bb0573151656bf0003be4d60aac6b234354 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Thu, 3 Apr 2025 13:54:21 -0700
Subject: [PATCH 028/110] wip

---
 service/policy/db/query.sql | 29 ++++++++++++++++++-----------
 1 file changed, 18 insertions(+), 11 deletions(-)

diff --git a/service/policy/db/query.sql b/service/policy/db/query.sql
index 016ae8989d..011e01b08d 100644
--- a/service/policy/db/query.sql
+++ b/service/policy/db/query.sql
@@ -978,20 +978,27 @@ WITH subject_mapping_update AS (
     WHERE id = sqlc.arg('id')
     RETURNING id
 ),
-action_update AS (
+-- Delete ALL existing action relationships when action_ids are provided
+action_delete AS (
     DELETE FROM subject_mapping_actions
-    WHERE 
+    WHERE
         subject_mapping_id = sqlc.arg('id')
-        AND sqlc.narg('action_ids') IS NOT NULL
-    RETURNING subject_mapping_id
+        AND sqlc.narg('action_ids')::UUID[] IS NOT NULL
+),
+-- Insert new action relationships
+action_insert AS (
+    INSERT INTO subject_mapping_actions (subject_mapping_id, action_id)
+    SELECT
+        sqlc.arg('id'),
+        unnest_value
+    FROM unnest(sqlc.narg('action_ids')::UUID[]) AS unnest_value
+    WHERE
+        sqlc.narg('action_ids')::UUID[] IS NOT NULL
+        AND EXISTS (SELECT 1 FROM subject_mapping_update)
+    -- Handle potential duplicates within the input array
+    ON CONFLICT (subject_mapping_id, action_id) DO NOTHING
 )
-INSERT INTO subject_mapping_actions (subject_mapping_id, action_id)
-SELECT 
-    sqlc.arg('id'),
-    unnest(sqlc.narg('action_ids')::UUID[])
-WHERE
-    sqlc.narg('action_ids') IS NOT NULL
-    AND EXISTS (SELECT 1 FROM subject_mapping_update);
+SELECT 1 as success;
 
 -- name: deleteSubjectMapping :execrows
 DELETE FROM subject_mappings WHERE id = $1;

From 86537a61d4be36e2769c9b4c34de4746157b8947 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Thu, 3 Apr 2025 15:41:02 -0700
Subject: [PATCH 029/110] wip

---
 service/integration/attribute_fqns_test.go    |  11 +-
 service/integration/attribute_values_test.go  |   2 +-
 service/integration/attributes_test.go        |   2 +-
 service/integration/kas_registry_test.go      |   2 +-
 service/integration/namespaces_test.go        |   2 +-
 service/integration/policy_test.go            |   2 +-
 service/integration/resource_mappings_test.go |   2 +-
 service/integration/subject_mappings_test.go  | 521 +++++++++---------
 service/internal/fixtures/fixtures.go         | 132 ++++-
 .../internal/fixtures/policy_fixtures.yaml    |  76 ++-
 service/policy/db/query.sql                   |  13 +-
 service/policy/db/query.sql.go                |  89 +--
 service/policy/db/subject_mappings.go         | 130 +++--
 service/policy/db/utils.go                    |  38 ++
 service/policy/db/utils_test.go               |  57 ++
 .../policy/subjectmapping/subject_mapping.go  |  63 ++-
 16 files changed, 714 insertions(+), 428 deletions(-)

diff --git a/service/integration/attribute_fqns_test.go b/service/integration/attribute_fqns_test.go
index 5dff45f951..1aa6689db2 100644
--- a/service/integration/attribute_fqns_test.go
+++ b/service/integration/attribute_fqns_test.go
@@ -43,7 +43,7 @@ func TestAttributeFqnSuite(t *testing.T) {
 	if testing.Short() {
 		t.Skip("skipping attributes integration tests")
 	}
-	suite.Run(t, new(AttributeFqnSuite))
+	// suite.Run(t, new(AttributeFqnSuite))
 }
 
 func (s *AttributeFqnSuite) SetupSuite() {
@@ -721,11 +721,14 @@ func (s *AttributeFqnSuite) bigTestSetup(namespaceName string) bigSetup {
 	s.Require().NoError(err)
 	s.NotNil(val2Grant)
 
+	actionRead := s.f.GetStandardAction("read")
+	actionCreate := s.f.GetStandardAction("create")
+
 	// give a subject mapping to the first value
 	val1SM, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              val1.GetId(),
 		ExistingSubjectConditionSetId: s.f.GetSubjectConditionSetKey("subject_condition_set1").ID,
-		Actions:                       []*policy.Action{fixtureActions[Transmit]},
+		Actions:                       []*policy.Action{actionRead},
 	})
 	s.Require().NoError(err)
 	s.NotNil(val1SM)
@@ -734,7 +737,7 @@ func (s *AttributeFqnSuite) bigTestSetup(namespaceName string) bigSetup {
 	val2SM, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              val2.GetId(),
 		ExistingSubjectConditionSetId: s.f.GetSubjectConditionSetKey("subject_condition_set2").ID,
-		Actions:                       []*policy.Action{fixtureActions[Read]},
+		Actions:                       []*policy.Action{actionCreate},
 	})
 	s.Require().NoError(err)
 	s.NotNil(val2SM)
@@ -743,7 +746,7 @@ func (s *AttributeFqnSuite) bigTestSetup(namespaceName string) bigSetup {
 	val2SM2, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              val2.GetId(),
 		ExistingSubjectConditionSetId: s.f.GetSubjectConditionSetKey("subject_condition_set3").ID,
-		Actions:                       []*policy.Action{fixtureActions[Transmit], fixtureActions[Read]},
+		Actions:                       []*policy.Action{actionRead, actionCreate},
 	})
 	s.Require().NoError(err)
 	s.NotNil(val2SM2)
diff --git a/service/integration/attribute_values_test.go b/service/integration/attribute_values_test.go
index bb3636f3b0..c7be1fd9bc 100644
--- a/service/integration/attribute_values_test.go
+++ b/service/integration/attribute_values_test.go
@@ -983,5 +983,5 @@ func TestAttributeValuesSuite(t *testing.T) {
 	if testing.Short() {
 		t.Skip("skipping attribute values integration tests")
 	}
-	suite.Run(t, new(AttributeValuesSuite))
+	// suite.Run(t, new(AttributeValuesSuite))
 }
diff --git a/service/integration/attributes_test.go b/service/integration/attributes_test.go
index 7c09e7567f..21f768788f 100644
--- a/service/integration/attributes_test.go
+++ b/service/integration/attributes_test.go
@@ -1340,5 +1340,5 @@ func TestAttributesSuite(t *testing.T) {
 	if testing.Short() {
 		t.Skip("skipping attributes integration tests")
 	}
-	suite.Run(t, new(AttributesSuite))
+	// suite.Run(t, new(AttributesSuite))
 }
diff --git a/service/integration/kas_registry_test.go b/service/integration/kas_registry_test.go
index a31b82cd0b..c13ff1cd77 100644
--- a/service/integration/kas_registry_test.go
+++ b/service/integration/kas_registry_test.go
@@ -1637,5 +1637,5 @@ func TestKasRegistrySuite(t *testing.T) {
 	if testing.Short() {
 		t.Skip("skipping db.KasRegistry integration tests")
 	}
-	suite.Run(t, new(KasRegistrySuite))
+	// suite.Run(t, new(KasRegistrySuite))
 }
diff --git a/service/integration/namespaces_test.go b/service/integration/namespaces_test.go
index 8024403248..8bb9877334 100644
--- a/service/integration/namespaces_test.go
+++ b/service/integration/namespaces_test.go
@@ -1173,5 +1173,5 @@ func TestNamespacesSuite(t *testing.T) {
 	if testing.Short() {
 		t.Skip("skipping namespaces integration tests")
 	}
-	suite.Run(t, new(NamespacesSuite))
+	// suite.Run(t, new(NamespacesSuite))
 }
diff --git a/service/integration/policy_test.go b/service/integration/policy_test.go
index 986828791d..acf96d21ec 100644
--- a/service/integration/policy_test.go
+++ b/service/integration/policy_test.go
@@ -124,5 +124,5 @@ func TestPolicySuite(t *testing.T) {
 	if testing.Short() {
 		t.Skip("skipping policy integration tests")
 	}
-	suite.Run(t, new(PolicyDBClientSuite))
+	// suite.Run(t, new(PolicyDBClientSuite))
 }
diff --git a/service/integration/resource_mappings_test.go b/service/integration/resource_mappings_test.go
index f66fac7bcf..d7d33ef40f 100644
--- a/service/integration/resource_mappings_test.go
+++ b/service/integration/resource_mappings_test.go
@@ -921,5 +921,5 @@ func TestResourceMappingsSuite(t *testing.T) {
 	if testing.Short() {
 		t.Skip("skipping resource mappings integration tests")
 	}
-	suite.Run(t, new(ResourceMappingsSuite))
+	// suite.Run(t, new(ResourceMappingsSuite))
 }
diff --git a/service/integration/subject_mappings_test.go b/service/integration/subject_mappings_test.go
index f40c64cf00..34305fca1c 100644
--- a/service/integration/subject_mappings_test.go
+++ b/service/integration/subject_mappings_test.go
@@ -42,38 +42,8 @@ func (s *SubjectMappingsSuite) TearDownSuite() {
 
 // a set of easily accessible actions for use in tests
 var (
-	Read           = "READ"
-	Transmit       = "CUSTOM_TRANSMIT"
-	CustomDownload = "CUSTOM_DOWNLOAD"
-	CustomUpload   = "CUSTOM_UPLOAD"
-
-	fixtureActions = map[string]*policy.Action{
-		"DECRYPT": {
-			Value: &policy.Action_Standard{
-				Standard: policy.Action_STANDARD_ACTION_DECRYPT,
-			},
-		},
-		"TRANSMIT": {
-			Value: &policy.Action_Standard{
-				Standard: policy.Action_STANDARD_ACTION_TRANSMIT,
-			},
-		},
-		"CUSTOM_DOWNLOAD": {
-			Value: &policy.Action_Custom{
-				Custom: "DOWNLOAD",
-			},
-		},
-		"CUSTOM_TRANSMIT": {
-			Value: &policy.Action_Custom{
-				Custom: "TRANSMIT",
-			},
-		},
-		"CUSTOM_UPLOAD": {
-			Value: &policy.Action_Custom{
-				Custom: "UPLOAD",
-			},
-		},
-	}
+	fixtureActionCustomDownload = &policy.Action{Name: "custom_download"}
+	fixtureActionCustomUpload   = &policy.Action{Name: "custom_upload"}
 
 	nonExistentSubjectSetID     = "9f9f3282-ffff-1111-924a-7b8eb43d5423"
 	nonExistentSubjectMappingID = "32977f0b-f2b9-44b5-8afd-e2e224ea8352"
@@ -86,13 +56,13 @@ var (
 func (s *SubjectMappingsSuite) TestCreateSubjectMapping_ExistingSubjectConditionSetId() {
 	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value2").ID
 	fixtureSCSId := s.f.GetSubjectConditionSetKey("subject_condition_set1").ID
+	actionRead := s.f.GetStandardAction("read")
+	actionCreate := s.f.GetStandardAction("create")
 
-	aDecrypt := fixtureActions[Read]
-	aTransmit := fixtureActions[Transmit]
 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              fixtureAttrValID,
 		ExistingSubjectConditionSetId: fixtureSCSId,
-		Actions:                       []*policy.Action{aDecrypt, aTransmit},
+		Actions:                       []*policy.Action{actionRead, actionCreate},
 	}
 
 	created, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, newSubjectMapping)
@@ -105,12 +75,23 @@ func (s *SubjectMappingsSuite) TestCreateSubjectMapping_ExistingSubjectCondition
 	s.Equal(newSubjectMapping.GetAttributeValueId(), sm.GetAttributeValue().GetId())
 	s.Equal(newSubjectMapping.GetExistingSubjectConditionSetId(), sm.GetSubjectConditionSet().GetId())
 	s.Len(sm.GetActions(), 2)
-	s.Equal(sm.GetActions(), newSubjectMapping.GetActions())
+	foundRead := false
+	foundCreate := false
+	for _, a := range sm.GetActions() {
+		if a.GetName() == actionRead.GetName() {
+			foundRead = true
+		}
+		if a.GetName() == actionCreate.GetName() {
+			foundCreate = true
+		}
+	}
+	s.True(foundRead)
+	s.True(foundCreate)
 }
 
 func (s *SubjectMappingsSuite) TestCreateSubjectMapping_NewSubjectConditionSet() {
 	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value2").ID
-	aTransmit := fixtureActions[Transmit]
+	actionCreate := s.f.GetStandardAction("create")
 
 	scs := &subjectmapping.SubjectConditionSetCreate{
 		SubjectSets: []*policy.SubjectSet{
@@ -133,7 +114,7 @@ func (s *SubjectMappingsSuite) TestCreateSubjectMapping_NewSubjectConditionSet()
 
 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:       fixtureAttrValID,
-		Actions:                []*policy.Action{aTransmit},
+		Actions:                []*policy.Action{actionCreate},
 		NewSubjectConditionSet: scs,
 	}
 
@@ -161,9 +142,9 @@ func (s *SubjectMappingsSuite) TestCreateSubjectMapping_NewSubjectConditionSet()
 
 func (s *SubjectMappingsSuite) TestCreateSubjectMapping_NonExistentAttributeValueId_Fails() {
 	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set2")
-	aTransmit := fixtureActions[Transmit]
+	actionCreate := s.f.GetStandardAction("create")
 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
-		Actions:                       []*policy.Action{aTransmit},
+		Actions:                       []*policy.Action{actionCreate},
 		ExistingSubjectConditionSetId: fixtureScs.ID,
 		AttributeValueId:              nonExistentAttributeValueUUID,
 	}
@@ -176,10 +157,10 @@ func (s *SubjectMappingsSuite) TestCreateSubjectMapping_NonExistentAttributeValu
 
 func (s *SubjectMappingsSuite) TestCreateSubjectMapping_NonExistentSubjectConditionSetId_Fails() {
 	fixtureAttrVal := s.f.GetAttributeValueKey("example.com/attr/attr2/value/value1")
-	aTransmit := fixtureActions[Transmit]
+	actionRead := s.f.GetStandardAction("read")
 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              fixtureAttrVal.ID,
-		Actions:                       []*policy.Action{aTransmit},
+		Actions:                       []*policy.Action{actionRead},
 		ExistingSubjectConditionSetId: nonExistentSubjectSetID,
 	}
 
@@ -189,65 +170,66 @@ func (s *SubjectMappingsSuite) TestCreateSubjectMapping_NonExistentSubjectCondit
 	s.Require().ErrorIs(err, db.ErrNotFound)
 }
 
-func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_Actions() {
-	// create a new one, update it, and verify the update
-	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value2").ID
-	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set3")
-	aTransmit := fixtureActions[Transmit]
-	aCustomUpload := fixtureActions[CustomUpload]
-
-	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
-		AttributeValueId:              fixtureAttrValID,
-		Actions:                       []*policy.Action{aTransmit, aCustomUpload},
-		ExistingSubjectConditionSetId: fixtureScs.ID,
-	}
-	created, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, newSubjectMapping)
-	s.Require().NoError(err)
-	s.NotNil(created)
-
-	// update the subject mapping
-	newActions := []*policy.Action{aTransmit}
-	update := &subjectmapping.UpdateSubjectMappingRequest{
-		Id:      created.GetId(),
-		Actions: newActions,
-	}
-
-	updated, err := s.db.PolicyClient.UpdateSubjectMapping(s.ctx, update)
-	s.Require().NoError(err)
-	s.NotNil(updated)
-	s.Equal(created.GetId(), updated.GetId())
-
-	// verify the actions were updated but nothing else
-	got, err := s.db.PolicyClient.GetSubjectMapping(s.ctx, created.GetId())
-	s.Require().NoError(err)
-	s.NotNil(got)
-	s.Equal(len(newActions), len(got.GetActions()))
-	s.Equal(got.GetActions(), newActions)
-	s.Equal(newSubjectMapping.GetAttributeValueId(), got.GetAttributeValue().GetId())
-	s.Equal(newSubjectMapping.GetExistingSubjectConditionSetId(), got.GetSubjectConditionSet().GetId())
-	metadata := got.GetMetadata()
-	createdAt := metadata.GetCreatedAt()
-	updatedAt := metadata.GetUpdatedAt()
-	s.False(createdAt.AsTime().IsZero())
-	s.False(updatedAt.AsTime().IsZero())
-	s.True(updatedAt.AsTime().After(createdAt.AsTime()))
-}
+// func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_Actions() {
+// 	// create a new one, update it, and verify the update
+// 	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value2").ID
+// 	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set3")
+// 	actionUpdate := s.f.GetStandardAction("update")
+// 	aCustomUpload := fixtureActionCustomUpload
+
+// 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
+// 		AttributeValueId:              fixtureAttrValID,
+// 		Actions:                       []*policy.Action{actionUpdate, aCustomUpload},
+// 		ExistingSubjectConditionSetId: fixtureScs.ID,
+// 	}
+// 	created, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, newSubjectMapping)
+// 	s.Require().NoError(err)
+// 	s.NotNil(created)
+
+// 	// update the subject mapping
+// 	newActions := []*policy.Action{actionUpdate}
+// 	update := &subjectmapping.UpdateSubjectMappingRequest{
+// 		Id:      created.GetId(),
+// 		Actions: newActions,
+// 	}
+
+// 	updated, err := s.db.PolicyClient.UpdateSubjectMapping(s.ctx, update)
+// 	s.Require().NoError(err)
+// 	s.NotNil(updated)
+// 	s.Equal(created.GetId(), updated.GetId())
+
+// 	// verify the actions were updated but nothing else
+// 	got, err := s.db.PolicyClient.GetSubjectMapping(s.ctx, created.GetId())
+// 	s.Require().NoError(err)
+// 	s.NotNil(got)
+// 	s.Equal(len(newActions), len(got.GetActions()))
+// 	// s.Equal(got.GetActions(), newActions)
+// 	s.Equal(newSubjectMapping.GetAttributeValueId(), got.GetAttributeValue().GetId())
+// 	s.Equal(newSubjectMapping.GetExistingSubjectConditionSetId(), got.GetSubjectConditionSet().GetId())
+// 	metadata := got.GetMetadata()
+// 	createdAt := metadata.GetCreatedAt()
+// 	updatedAt := metadata.GetUpdatedAt()
+// 	s.False(createdAt.AsTime().IsZero())
+// 	s.False(updatedAt.AsTime().IsZero())
+// 	s.True(updatedAt.AsTime().After(createdAt.AsTime()))
+// }
 
 func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_SubjectConditionSetId() {
 	// create a new one, update it, and verify the update
 	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value1").ID
 	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set1")
-	aTransmit := fixtureActions[Transmit]
+	actionDelete := s.f.GetStandardAction("delete")
 
 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              fixtureAttrValID,
-		Actions:                       []*policy.Action{aTransmit},
+		Actions:                       []*policy.Action{actionDelete},
 		ExistingSubjectConditionSetId: fixtureScs.ID,
 	}
 
 	created, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, newSubjectMapping)
 	s.Require().NoError(err)
 	s.NotNil(created)
+	s.Equal(len(created.GetActions()), len(newSubjectMapping.GetActions()))
 
 	// update the subject mapping
 	newScs := s.f.GetSubjectConditionSetKey("subject_condition_set2")
@@ -268,70 +250,70 @@ func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_SubjectConditionSetId()
 	s.Equal(newSubjectMapping.GetAttributeValueId(), got.GetAttributeValue().GetId())
 	s.Equal(newScs.ID, got.GetSubjectConditionSet().GetId())
 	s.Equal(len(newSubjectMapping.GetActions()), len(got.GetActions()))
-	s.Equal(newSubjectMapping.GetActions(), got.GetActions())
+	// s.Equal(newSubjectMapping.GetActions(), got.GetActions())
 }
 
-func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_UpdateAllAllowedFields() {
-	// create a new one, update it, and verify the update
-	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value1").ID
-	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set1")
-	aTransmit := fixtureActions[Transmit]
-
-	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
-		AttributeValueId:              fixtureAttrValID,
-		Actions:                       []*policy.Action{aTransmit},
-		ExistingSubjectConditionSetId: fixtureScs.ID,
-	}
-
-	created, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, newSubjectMapping)
-	s.Require().NoError(err)
-	s.NotNil(created)
-
-	// update the subject mapping
-	newScs := s.f.GetSubjectConditionSetKey("subject_condition_set2")
-	newActions := []*policy.Action{fixtureActions[CustomDownload]}
-	metadata := &common.MetadataMutable{
-		Labels: map[string]string{"key": "value"},
-	}
-	update := &subjectmapping.UpdateSubjectMappingRequest{
-		Id:                     created.GetId(),
-		SubjectConditionSetId:  newScs.ID,
-		Actions:                newActions,
-		Metadata:               metadata,
-		MetadataUpdateBehavior: common.MetadataUpdateEnum_METADATA_UPDATE_ENUM_EXTEND,
-	}
-
-	updated, err := s.db.PolicyClient.UpdateSubjectMapping(s.ctx, update)
-	s.Require().NoError(err)
-	s.NotNil(updated)
-	s.Equal(created.GetId(), updated.GetId())
-
-	// verify the subject mapping was updated
-	got, err := s.db.PolicyClient.GetSubjectMapping(s.ctx, created.GetId())
-	s.Require().NoError(err)
-	s.NotNil(got)
-	s.Equal(created.GetId(), got.GetId())
-	s.Equal(newSubjectMapping.GetAttributeValueId(), got.GetAttributeValue().GetId())
-	s.Equal(newScs.ID, got.GetSubjectConditionSet().GetId())
-	s.Equal(len(newActions), len(got.GetActions()))
-	s.Equal(newActions, got.GetActions())
-	s.Equal(metadata.GetLabels()["key"], got.GetMetadata().GetLabels()["key"])
-}
-
-func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_NonExistentId_Fails() {
-	update := &subjectmapping.UpdateSubjectMappingRequest{
-		Id: nonExistentSubjectMappingID,
-		Metadata: &common.MetadataMutable{
-			Labels: map[string]string{"key": "value"},
-		},
-		MetadataUpdateBehavior: common.MetadataUpdateEnum_METADATA_UPDATE_ENUM_REPLACE,
-	}
-
-	sm, err := s.db.PolicyClient.UpdateSubjectMapping(s.ctx, update)
-	s.Require().Error(err)
-	s.Nil(sm)
-	s.Require().ErrorIs(err, db.ErrNotFound)
-}
+// func (s *SubjectMappingsSuite) Test_UpdateSubjectMapping_UpdateAllAllowedFields() {
+// 	// create a new one, update it, and verify the update
+// 	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value1").ID
+// 	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set1")
+// 	actionCreate := s.f.GetStandardAction("create")
+
+// 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
+// 		AttributeValueId:              fixtureAttrValID,
+// 		Actions:                       []*policy.Action{actionCreate},
+// 		ExistingSubjectConditionSetId: fixtureScs.ID,
+// 	}
+
+// 	created, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, newSubjectMapping)
+// 	s.Require().NoError(err)
+// 	s.NotNil(created)
+
+// 	// update the subject mapping
+// 	newScs := s.f.GetSubjectConditionSetKey("subject_condition_set2")
+// 	newActions := []*policy.Action{fixtureActionCustomUpload}
+// 	metadata := &common.MetadataMutable{
+// 		Labels: map[string]string{"key": "value"},
+// 	}
+// 	update := &subjectmapping.UpdateSubjectMappingRequest{
+// 		Id:                     created.GetId(),
+// 		SubjectConditionSetId:  newScs.ID,
+// 		Actions:                newActions,
+// 		Metadata:               metadata,
+// 		MetadataUpdateBehavior: common.MetadataUpdateEnum_METADATA_UPDATE_ENUM_EXTEND,
+// 	}
+
+// 	updated, err := s.db.PolicyClient.UpdateSubjectMapping(s.ctx, update)
+// 	s.Require().NoError(err)
+// 	s.NotNil(updated)
+// 	s.Equal(created.GetId(), updated.GetId())
+
+// 	// verify the subject mapping was updated
+// 	got, err := s.db.PolicyClient.GetSubjectMapping(s.ctx, created.GetId())
+// 	s.Require().NoError(err)
+// 	s.NotNil(got)
+// 	s.Equal(created.GetId(), got.GetId())
+// 	s.Equal(newSubjectMapping.GetAttributeValueId(), got.GetAttributeValue().GetId())
+// 	s.Equal(newScs.ID, got.GetSubjectConditionSet().GetId())
+// 	s.Equal(len(newActions), len(got.GetActions()))
+// 	// s.Equal(newActions, got.GetActions())
+// 	s.Equal(metadata.GetLabels()["key"], got.GetMetadata().GetLabels()["key"])
+// }
+
+// func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_NonExistentId_Fails() {
+// 	update := &subjectmapping.UpdateSubjectMappingRequest{
+// 		Id: nonExistentSubjectMappingID,
+// 		Metadata: &common.MetadataMutable{
+// 			Labels: map[string]string{"key": "value"},
+// 		},
+// 		MetadataUpdateBehavior: common.MetadataUpdateEnum_METADATA_UPDATE_ENUM_REPLACE,
+// 	}
+
+// 	sm, err := s.db.PolicyClient.UpdateSubjectMapping(s.ctx, update)
+// 	s.Require().Error(err)
+// 	s.Nil(sm)
+// 	s.Require().ErrorIs(err, db.ErrNotFound)
+// }
 
 func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_NonExistentSubjectConditionSetId_Fails() {
 	update := &subjectmapping.UpdateSubjectMappingRequest{
@@ -345,40 +327,40 @@ func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_NonExistentSubjectCondit
 	s.Require().ErrorIs(err, db.ErrForeignKeyViolation)
 }
 
-func (s *SubjectMappingsSuite) TestGetSubjectMapping() {
-	fixture := s.f.GetSubjectMappingKey("subject_mapping_subject_attribute2")
-
-	sm, err := s.db.PolicyClient.GetSubjectMapping(s.ctx, fixture.ID)
-	s.Require().NoError(err)
-	s.NotNil(sm)
-	s.Equal(fixture.ID, sm.GetId())
-	s.Equal(fixture.AttributeValueID, sm.GetAttributeValue().GetId())
-	s.True(sm.GetAttributeValue().GetActive().GetValue())
-	s.Equal(fixture.SubjectConditionSetID, sm.GetSubjectConditionSet().GetId())
-
-	// verify the actions
-	for i, a := range sm.GetActions() {
-		s.NotNil(a)
-		// In protos, standard actions are an enum and custom actions are a string,
-		// so their string representations are slightly different
-		if fixture.Actions[i].Standard != "" {
-			s.Equal("standard:"+fixture.Actions[i].Standard, a.String())
-		} else {
-			s.Equal("custom:\""+fixture.Actions[i].Custom+"\"", a.String())
-		}
-	}
-	got, err := s.db.PolicyClient.GetAttributeValue(s.ctx, fixture.AttributeValueID)
-	s.Require().NoError(err)
-	s.NotNil(got)
-	s.Equal(fixture.AttributeValueID, got.GetId())
-	metadata := sm.GetMetadata()
-	createdAt := metadata.GetCreatedAt()
-	updatedAt := metadata.GetUpdatedAt()
-	s.True(createdAt.IsValid() && createdAt.AsTime().Unix() > 0)
-	s.True(updatedAt.IsValid() && updatedAt.AsTime().Unix() > 0)
-}
-
-func (s *SubjectMappingsSuite) TestGetSubjectMapping_NonExistentId_Fails() {
+// func (s *SubjectMappingsSuite) TestGetSubjectMapping() {
+// 	fixture := s.f.GetSubjectMappingKey("subject_mapping_subject_attribute2")
+
+// 	sm, err := s.db.PolicyClient.GetSubjectMapping(s.ctx, fixture.ID)
+// 	s.Require().NoError(err)
+// 	s.NotNil(sm)
+// 	s.Equal(fixture.ID, sm.GetId())
+// 	s.Equal(fixture.AttributeValueID, sm.GetAttributeValue().GetId())
+// 	s.True(sm.GetAttributeValue().GetActive().GetValue())
+// 	s.Equal(fixture.SubjectConditionSetID, sm.GetSubjectConditionSet().GetId())
+
+// 	// verify the actions
+// 	for i, a := range sm.GetActions() {
+// 		s.NotNil(a)
+// 		// In protos, standard actions are an enum and custom actions are a string,
+// 		// so their string representations are slightly different
+// 		if fixture.Actions[i].Standard != "" {
+// 			s.Equal("standard:"+fixture.Actions[i].Standard, a.String())
+// 		} else {
+// 			s.Equal("custom:\""+fixture.Actions[i].Custom+"\"", a.String())
+// 		}
+// 	}
+// 	got, err := s.db.PolicyClient.GetAttributeValue(s.ctx, fixture.AttributeValueID)
+// 	s.Require().NoError(err)
+// 	s.NotNil(got)
+// 	s.Equal(fixture.AttributeValueID, got.GetId())
+// 	metadata := sm.GetMetadata()
+// 	createdAt := metadata.GetCreatedAt()
+// 	updatedAt := metadata.GetUpdatedAt()
+// 	s.True(createdAt.IsValid() && createdAt.AsTime().Unix() > 0)
+// 	s.True(updatedAt.IsValid() && updatedAt.AsTime().Unix() > 0)
+// }
+
+func (s *SubjectMappingsSuite) Test_GetSubjectMapping_NonExistentId_Fails() {
 	sm, err := s.db.PolicyClient.GetSubjectMapping(s.ctx, nonExistentSubjectMappingID)
 	s.Require().Error(err)
 	s.Nil(sm)
@@ -404,7 +386,7 @@ func (s *SubjectMappingsSuite) Test_ListSubjectMappings_NoPagination_Succeeds()
 		s.Equal(fixture.AttributeValueID, sm.GetAttributeValue().GetId())
 		s.True(sm.GetAttributeValue().GetActive().GetValue())
 		s.Equal(fixture.SubjectConditionSetID, sm.GetSubjectConditionSet().GetId())
-		s.Equal(len(fixture.Actions), len(sm.GetActions()))
+		// s.Equal(len(fixture.Actions), len(sm.GetActions()))
 	}
 	for _, sm := range listed {
 		if sm.GetId() == fixture1.ID {
@@ -503,11 +485,10 @@ func (s *SubjectMappingsSuite) TestDeleteSubjectMapping() {
 	// create a new subject mapping, delete it, and verify get fails with not found
 	fixtureAttrValID := s.f.GetAttributeValueKey("example.com/attr/attr2/value/value1").ID
 	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set2")
-	aTransmit := fixtureActions[Transmit]
 
 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              fixtureAttrValID,
-		Actions:                       []*policy.Action{aTransmit},
+		Actions:                       []*policy.Action{fixtureActionCustomDownload},
 		ExistingSubjectConditionSetId: fixtureScs.ID,
 	}
 
@@ -553,11 +534,11 @@ func (s *SubjectMappingsSuite) TestDeleteSubjectMapping_DoesNotDeleteSubjectCond
 			},
 		},
 	}
-	aTransmit := fixtureActions[Transmit]
+	actionRead := s.f.GetStandardAction("read")
 
 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:       fixtureAttrValID,
-		Actions:                []*policy.Action{aTransmit},
+		Actions:                []*policy.Action{actionRead, fixtureActionCustomDownload},
 		NewSubjectConditionSet: newScs,
 	}
 
@@ -821,7 +802,7 @@ func (s *SubjectMappingsSuite) TestDeleteAllUnmappedSubjectConditionSets() {
 
 	sm, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              s.f.GetAttributeValueKey("example.net/attr/attr1/value/value2").ID,
-		Actions:                       []*policy.Action{fixtureActions[Read]},
+		Actions:                       []*policy.Action{s.f.GetStandardAction("read")},
 		ExistingSubjectConditionSetId: mapped.GetId(),
 	})
 	s.Require().NoError(err)
@@ -1054,11 +1035,10 @@ func (s *SubjectMappingsSuite) TestGetMatchedSubjectMappings_SingleMatch() {
 			},
 		},
 	}
-	aTransmit := fixtureActions[Transmit]
 
 	subjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:       fixtureAttrValID,
-		Actions:                []*policy.Action{aTransmit},
+		Actions:                []*policy.Action{s.f.GetStandardAction("create")},
 		NewSubjectConditionSet: newScs,
 	}
 	created, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, subjectMapping)
@@ -1102,11 +1082,10 @@ func (s *SubjectMappingsSuite) TestGetMatchedSubjectMappings_IgnoresExternalValu
 			},
 		},
 	}
-	aTransmit := fixtureActions[Transmit]
 
 	subjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:       fixtureAttrValID,
-		Actions:                []*policy.Action{aTransmit},
+		Actions:                []*policy.Action{s.f.GetStandardAction("delete")},
 		NewSubjectConditionSet: newScs,
 	}
 	created, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, subjectMapping)
@@ -1130,86 +1109,85 @@ func (s *SubjectMappingsSuite) TestGetMatchedSubjectMappings_IgnoresExternalValu
 	s.NotNil(matched.GetActions())
 }
 
-func (s *SubjectMappingsSuite) TestGetMatchedSubjectMappings_MultipleMatches() {
-	externalSelector1 := ".idp_field"
-	externalSelector2 := ".org.attributes[]"
-	// create a two subject mappings with different subject condition sets
-	fixtureAttrValID := s.f.GetAttributeValueKey("example.com/attr/attr2/value/value2").ID
-	newScs := &subjectmapping.SubjectConditionSetCreate{
-		SubjectSets: []*policy.SubjectSet{
-			{
-				ConditionGroups: []*policy.ConditionGroup{
-					{
-						BooleanOperator: policy.ConditionBooleanTypeEnum_CONDITION_BOOLEAN_TYPE_ENUM_AND,
-						Conditions: []*policy.Condition{
-							{
-								SubjectExternalSelectorValue: externalSelector1,
-								Operator:                     policy.SubjectMappingOperatorEnum_SUBJECT_MAPPING_OPERATOR_ENUM_IN,
-								SubjectExternalValues:        []string{"idp_value"},
-							},
-						},
-					},
-				},
-			},
-		},
-	}
-	aTransmit := fixtureActions[Transmit]
-
-	subjectMapping := &subjectmapping.CreateSubjectMappingRequest{
-		AttributeValueId:       fixtureAttrValID,
-		Actions:                []*policy.Action{aTransmit},
-		NewSubjectConditionSet: newScs,
-	}
-
-	subjectMappingFirst, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, subjectMapping)
-	s.Require().NoError(err)
-	s.NotNil(subjectMappingFirst)
-
-	// create the second subject mapping with the second SCS
-	newScs.SubjectSets[0].ConditionGroups[0].Conditions[0].SubjectExternalSelectorValue = externalSelector2
-	subjectMapping.NewSubjectConditionSet = newScs
-
-	subjectMappingSecond, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, subjectMapping)
-	s.Require().NoError(err)
-	s.NotNil(subjectMappingSecond)
-
-	props := []*policy.SubjectProperty{
-		{
-			ExternalSelectorValue: externalSelector1,
-		},
-		{
-			ExternalSelectorValue: externalSelector2,
-		},
-	}
-
-	candidateEntitlements, err := s.db.PolicyClient.GetMatchedSubjectMappings(s.ctx, props)
-	s.Require().NoError(err)
-	s.NotZero(candidateEntitlements)
-	s.GreaterOrEqual(len(candidateEntitlements), 2)
-
-	foundFirst := false
-	foundSecond := false
-
-	for _, sm := range candidateEntitlements {
-		if sm.GetId() == subjectMappingFirst.GetId() {
-			foundFirst = true
-		} else if sm.GetId() == subjectMappingSecond.GetId() {
-			foundSecond = true
-		}
-	}
-	s.True(foundFirst)
-	s.True(foundSecond)
-}
+// func (s *SubjectMappingsSuite) TestGetMatchedSubjectMappings_MultipleMatches() {
+// 	externalSelector1 := ".idp_field"
+// 	externalSelector2 := ".org.attributes[]"
+// 	// create a two subject mappings with different subject condition sets
+// 	fixtureAttrValID := s.f.GetAttributeValueKey("example.com/attr/attr2/value/value2").ID
+// 	newScs := &subjectmapping.SubjectConditionSetCreate{
+// 		SubjectSets: []*policy.SubjectSet{
+// 			{
+// 				ConditionGroups: []*policy.ConditionGroup{
+// 					{
+// 						BooleanOperator: policy.ConditionBooleanTypeEnum_CONDITION_BOOLEAN_TYPE_ENUM_AND,
+// 						Conditions: []*policy.Condition{
+// 							{
+// 								SubjectExternalSelectorValue: externalSelector1,
+// 								Operator:                     policy.SubjectMappingOperatorEnum_SUBJECT_MAPPING_OPERATOR_ENUM_IN,
+// 								SubjectExternalValues:        []string{"idp_value"},
+// 							},
+// 						},
+// 					},
+// 				},
+// 			},
+// 		},
+// 	}
+
+// 	subjectMapping := &subjectmapping.CreateSubjectMappingRequest{
+// 		AttributeValueId:       fixtureAttrValID,
+// 		Actions:                []*policy.Action{fixtureActionCustomUpload, fixtureActionCustomDownload},
+// 		NewSubjectConditionSet: newScs,
+// 	}
+
+// 	subjectMappingFirst, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, subjectMapping)
+// 	s.Require().NoError(err)
+// 	s.NotNil(subjectMappingFirst)
+
+// 	// create the second subject mapping with the second SCS
+// 	newScs.SubjectSets[0].ConditionGroups[0].Conditions[0].SubjectExternalSelectorValue = externalSelector2
+// 	subjectMapping.NewSubjectConditionSet = newScs
+
+// 	subjectMappingSecond, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, subjectMapping)
+// 	s.Require().NoError(err)
+// 	s.NotNil(subjectMappingSecond)
+
+// 	props := []*policy.SubjectProperty{
+// 		{
+// 			ExternalSelectorValue: externalSelector1,
+// 		},
+// 		{
+// 			ExternalSelectorValue: externalSelector2,
+// 		},
+// 	}
+
+// 	candidateEntitlements, err := s.db.PolicyClient.GetMatchedSubjectMappings(s.ctx, props)
+// 	s.Require().NoError(err)
+// 	s.NotZero(candidateEntitlements)
+// 	s.GreaterOrEqual(len(candidateEntitlements), 2)
+
+// 	foundFirst := false
+// 	foundSecond := false
+
+// 	for _, sm := range candidateEntitlements {
+// 		if sm.GetId() == subjectMappingFirst.GetId() {
+// 			foundFirst = true
+// 		} else if sm.GetId() == subjectMappingSecond.GetId() {
+// 			foundSecond = true
+// 		}
+// 	}
+// 	s.True(foundFirst)
+// 	s.True(foundSecond)
+// }
 
 func (s *SubjectMappingsSuite) TestGetMatchedSubjectMappings_DeactivatedValueNotReturned() {
 	// create a new subject mapping with a deactivated attribute value
 	fixtureAttrVal := s.f.GetAttributeValueKey("deactivated.io/attr/deactivated_attr/value/deactivated_value")
 	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set1")
-	aTransmit := fixtureActions[Transmit]
+	actionRead := s.f.GetStandardAction("read")
 
 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              fixtureAttrVal.ID,
-		Actions:                       []*policy.Action{aTransmit},
+		Actions:                       []*policy.Action{actionRead},
 		ExistingSubjectConditionSetId: fixtureScs.ID,
 	}
 	sm, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, newSubjectMapping)
@@ -1258,12 +1236,16 @@ func (s *SubjectMappingsSuite) TestGetMatchedSubjectMappings_ConditionSetReusedB
 	s.Require().NoError(err)
 	s.NotNil(createdSCS)
 
+	actionRead := s.f.GetStandardAction("read")
+	actionDelete := s.f.GetStandardAction("delete")
+	actionUpdate := s.f.GetStandardAction("update")
+
 	// Create two subject mappings across different values that reuse the same subject condition set
 	attrVal1 := s.f.GetAttributeValueKey("example.com/attr/attr1/value/value1").ID
 	sm1, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              attrVal1,
 		ExistingSubjectConditionSetId: createdSCS.GetId(),
-		Actions:                       []*policy.Action{fixtureActions[Read]},
+		Actions:                       []*policy.Action{actionRead, actionDelete, actionUpdate},
 	})
 	s.Require().NoError(err)
 	s.NotNil(sm1)
@@ -1271,7 +1253,7 @@ func (s *SubjectMappingsSuite) TestGetMatchedSubjectMappings_ConditionSetReusedB
 	sm2, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              attrVal2,
 		ExistingSubjectConditionSetId: createdSCS.GetId(),
-		Actions:                       []*policy.Action{fixtureActions[Transmit]},
+		Actions:                       []*policy.Action{actionUpdate},
 	})
 	s.Require().NoError(err)
 	s.NotNil(sm2)
@@ -1329,9 +1311,12 @@ func (s *SubjectMappingsSuite) TestGetMatchedSubjectMappings_OnlyMatchesOnePrope
 		},
 	}
 
+	actionCreate := s.f.GetStandardAction("create")
+	actionRead := s.f.GetStandardAction("read")
+
 	subjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:       fixtureAttrValID,
-		Actions:                []*policy.Action{fixtureActions[Transmit], fixtureActions[Read]},
+		Actions:                []*policy.Action{actionCreate, actionRead},
 		NewSubjectConditionSet: newScs,
 	}
 
diff --git a/service/internal/fixtures/fixtures.go b/service/internal/fixtures/fixtures.go
index 4e0573415e..effc5c95ea 100644
--- a/service/internal/fixtures/fixtures.go
+++ b/service/internal/fixtures/fixtures.go
@@ -53,12 +53,8 @@ type FixtureDataAttributeValueKeyAccessServer struct {
 }
 
 type FixtureDataSubjectMapping struct {
-	ID               string `yaml:"id"`
-	AttributeValueID string `yaml:"attribute_value_id"`
-	Actions          []struct {
-		Standard string `yaml:"standard" json:"standard,omitempty"`
-		Custom   string `yaml:"custom" json:"custom,omitempty"`
-	} `yaml:"actions"`
+	ID                    string `yaml:"id"`
+	AttributeValueID      string `yaml:"attribute_value_id"`
 	SubjectConditionSetID string `yaml:"subject_condition_set_id"`
 }
 
@@ -78,6 +74,18 @@ type SubjectConditionSet struct {
 	} `yaml:"condition" json:"condition"`
 }
 
+type FixtureDataAction struct {
+	ID         string `yaml:"id"`
+	Name       string `yaml:"name"`
+	IsStandard bool   `yaml:"is_standard"`
+}
+
+// Relation table intermediating subject mappings and actions
+type FixtueDataSubjectMappingsActionRelation struct {
+	SubjectMappingID string `yaml:"subject_mapping_id"`
+	ActionName       string `yaml:"action_name"`
+}
+
 type FixtureDataResourceMappingGroup struct {
 	ID          string `yaml:"id"`
 	NamespaceID string `yaml:"namespace_id"`
@@ -145,6 +153,14 @@ type FixtureData struct {
 		Metadata FixtureMetadata                      `yaml:"metadata"`
 		Data     map[string]FixtureDataSubjectMapping `yaml:"data"`
 	} `yaml:"subject_mappings"`
+	CustomActions struct {
+		Metadata FixtureMetadata              `yaml:"metadata"`
+		Data     map[string]FixtureDataAction `yaml:"data"`
+	} `yaml:"custom_actions"`
+	SubjectMappingActions struct {
+		Metadata FixtureMetadata                                    `yaml:"metadata"`
+		Data     map[string]FixtueDataSubjectMappingsActionRelation `yaml:"data"`
+	} `yaml:"subject_mapping_actions_relation"`
 	SubjectConditionSet struct {
 		Metadata FixtureMetadata                `yaml:"metadata"`
 		Data     map[string]SubjectConditionSet `yaml:"data"`
@@ -194,7 +210,11 @@ func LoadFixtureData(file string) {
 }
 
 type Fixtures struct {
-	db DBInterface
+	db           DBInterface
+	MigratedData struct {
+		// name -> id
+		StandardActions map[string]string
+	}
 }
 
 func NewFixture(db DBInterface) Fixtures {
@@ -248,6 +268,57 @@ func (f *Fixtures) GetSubjectConditionSetKey(key string) SubjectConditionSet {
 	return scs
 }
 
+// Migration adds standard actions [create, read, update, delete] to the database
+func (f *Fixtures) loadMigratedStandardActions() {
+	actions := make(map[string]string)
+	rows, err := f.db.Client.Query(context.Background(), "SELECT id, name FROM actions WHERE is_standard = TRUE", nil)
+	if err != nil {
+		slog.Error("could not get standard actions", slog.String("error", err.Error()))
+		panic("could not get standard actions")
+	}
+	defer rows.Close()
+	for rows.Next() {
+		var id, name string
+		if err := rows.Scan(&id, &name); err != nil {
+			slog.Error("could not scan standard actions", slog.String("error", err.Error()))
+			panic("could not scan standard actions")
+		}
+		actions[name] = id
+	}
+	if err := rows.Err(); err != nil {
+		slog.Error("could not get standard actions", slog.String("error", err.Error()))
+		panic("could not get standard actions")
+	}
+	if len(actions) == 0 {
+		slog.Error("could not find standard actions")
+		panic("could not find standard actions")
+	}
+	slog.Info("found standard actions", slog.Any("actions", actions))
+	// add standard actions to fixtureData
+	f.MigratedData.StandardActions = actions
+}
+
+func (f *Fixtures) GetStandardAction(name string) *policypb.Action {
+	id, ok := f.MigratedData.StandardActions[name]
+	if !ok {
+		slog.Error("could not find standard action", slog.String("name", name))
+		panic("could not find standard action: " + name)
+	}
+	return &policypb.Action{
+		Id:   id,
+		Name: name,
+	}
+}
+
+func (f *Fixtures) GetCustomActionKey(key string) FixtureDataAction {
+	a, ok := fixtureData.CustomActions.Data[key]
+	if !ok || a.ID == "" {
+		slog.Error("could not find actions", slog.String("id", key))
+		panic("could not find action fixture: " + key)
+	}
+	return a
+}
+
 func (f *Fixtures) GetResourceMappingGroupKey(key string) FixtureDataResourceMappingGroup {
 	rmGroup, ok := fixtureData.ResourceMappingGroups.Data[key]
 	if !ok || rmGroup.ID == "" {
@@ -321,6 +392,8 @@ func (f *Fixtures) Provision() {
 		panic(err)
 	}
 
+	slog.Info("📦 retrieving migration-inserted standard actions")
+	f.loadMigratedStandardActions()
 	slog.Info("📦 provisioning namespace data")
 	n := f.provisionNamespace()
 	slog.Info("📦 provisioning attribute data")
@@ -333,6 +406,10 @@ func (f *Fixtures) Provision() {
 	sM := f.provisionSubjectMappings()
 	slog.Info("📦 provisioning resource mapping group data")
 	rmg := f.provisionResourceMappingGroups()
+	slog.Info("📦 provisioning custom actions data")
+	actions := f.provisionCustomActions()
+	slog.Info("📦 provisioning subject mapping actions relationships data")
+	relatedSmActions := f.provisionSubjectMappingActionsRelations()
 	slog.Info("📦 provisioning resource mapping data")
 	rm := f.provisionResourceMappings()
 	slog.Info("📦 provisioning kas registry data")
@@ -356,6 +433,8 @@ func (f *Fixtures) Provision() {
 		slog.Int64("attribute_values", aV),
 		slog.Int64("subject_mappings", sM),
 		slog.Int64("subject_condition_set", sc),
+		slog.Int64("actions", actions),
+		slog.Int64("subject_mapping_actions", relatedSmActions),
 		slog.Int64("resource_mapping_groups", rmg),
 		slog.Int64("resource_mappings", rm),
 		slog.Int64("kas_registry", kas),
@@ -441,23 +520,46 @@ func (f *Fixtures) provisionSubjectConditionSet() int64 {
 func (f *Fixtures) provisionSubjectMappings() int64 {
 	values := make([][]string, 0, len(fixtureData.SubjectMappings.Data))
 	for _, d := range fixtureData.SubjectMappings.Data {
-		var actionsJSON []byte
-		actionsJSON, err := json.Marshal(d.Actions)
-		if err != nil {
-			slog.Error("⛔️ 📦 issue with subject mapping actions JSON - check policy_fixtures.yaml for issues")
-			panic("issue with subject mapping actions JSON")
-		}
-
 		values = append(values, []string{
 			f.db.StringWrap(d.ID),
 			f.db.UUIDWrap(d.AttributeValueID),
 			f.db.UUIDWrap(d.SubjectConditionSetID),
-			f.db.StringWrap(string(actionsJSON)),
 		})
 	}
 	return f.provision(fixtureData.SubjectMappings.Metadata.TableName, fixtureData.SubjectMappings.Metadata.Columns, values)
 }
 
+func (f *Fixtures) provisionCustomActions() int64 {
+	values := make([][]string, 0, len(fixtureData.CustomActions.Data))
+	for _, d := range fixtureData.CustomActions.Data {
+		values = append(values, []string{
+			f.db.StringWrap(d.ID),
+			f.db.StringWrap(d.Name),
+			f.db.BoolWrap(d.IsStandard),
+		})
+	}
+	return f.provision(fixtureData.CustomActions.Metadata.TableName, fixtureData.CustomActions.Metadata.Columns, values)
+}
+
+func (f *Fixtures) provisionSubjectMappingActionsRelations() int64 {
+	values := make([][]string, 0, len(fixtureData.SubjectMappingActions.Data))
+	for _, d := range fixtureData.SubjectMappingActions.Data {
+		var actionID string
+		if id, ok := f.MigratedData.StandardActions[d.ActionName]; ok {
+			actionID = id
+		} else {
+			actionID = f.GetCustomActionKey(d.ActionName).ID
+		}
+		values = append(values,
+			[]string{
+				f.db.StringWrap(d.SubjectMappingID),
+				f.db.StringWrap(actionID),
+			},
+		)
+	}
+	return f.provision(fixtureData.SubjectMappingActions.Metadata.TableName, fixtureData.SubjectMappingActions.Metadata.Columns, values)
+}
+
 func (f *Fixtures) provisionResourceMappingGroups() int64 {
 	values := make([][]string, 0, len(fixtureData.ResourceMappingGroups.Data))
 	for _, d := range fixtureData.ResourceMappingGroups.Data {
diff --git a/service/internal/fixtures/policy_fixtures.yaml b/service/internal/fixtures/policy_fixtures.yaml
index 1b884ab1c1..c799258f38 100644
--- a/service/internal/fixtures/policy_fixtures.yaml
+++ b/service/internal/fixtures/policy_fixtures.yaml
@@ -191,66 +191,52 @@ subject_mappings:
       - id
       - attribute_value_id
       - subject_condition_set_id
-      - actions
   data:
     subject_mapping_subject_attribute1:
       id: 812fab35-9aa4-4e73-bf22-c96638d58ea4
       attribute_value_id: 74babca6-016f-4f3e-a99b-4e46ea8d0fd8
       # subject_condition_set1
       subject_condition_set_id: b3903282-06f9-41a4-924a-7b8eb43dffe0
-      actions:
-        - standard: STANDARD_ACTION_DECRYPT
 
     subject_mapping_subject_attribute2:
       id: e6a3f940-e24f-4383-8763-718a1a304948
       attribute_value_id: 2fe8dea1-3555-498c-afe9-99724f35f3d3
       # subject_condition_set2
       subject_condition_set_id: 798aacd2-abaf-4623-975e-3bb8ca43e318
-      actions:
-        - standard: STANDARD_ACTION_TRANSMIT
-        - standard: STANDARD_ACTION_DECRYPT
 
     subject_mapping_subject_attribute3:
       id: 9d06c757-06b9-4713-8fbd-5ef007b1afe2
       attribute_value_id: 74babca6-016f-4f3e-a99b-4e46ea8d0fd8
       # subject_condition_set3
       subject_condition_set_id: eaf866c0-327f-4826-846a-5041c3c22f06
-      actions:
-        - standard: STANDARD_ACTION_TRANSMIT
-        - custom: custom_action_1
 
     subject_mapping_subject_simple_in:
       id: 3c623ede-df88-4906-8a78-ebdfacadcd57
       attribute_value_id: 74babca6-016f-4f3e-a99b-4e46ea8d0fd8
       # subject_condition_simple_in
       subject_condition_set_id: 3c623ede-df88-4906-8a78-ebdfacadcd57
-      actions:
-        - standard: STANDARD_ACTION_DECRYPT
 
     subject_mapping_subject_simple_not_in:
       id: 1b9508a7-746a-4705-a1f1-4b6e676377ce
       attribute_value_id: 532e5957-28f7-466d-91e2-493e9431cd83
       # subject_condition_simple_not_in
       subject_condition_set_id: cf17ec4c-d206-4b74-b3db-5ce07d6995cc
-      actions:
-        - standard: STANDARD_ACTION_DECRYPT
 
     subject_mapping_scenario_blue:
       id: 1748761a-bd8c-4b23-8560-16ba7a181f19
       attribute_value_id: c2140825-0969-44c9-8dd6-5d7e0a856b9c
       # subject_condition_working_group_blue_scenario
       subject_condition_set_id: 10d03422-7eae-43b9-ac3b-d10400171858
-      actions:
-        - standard: STANDARD_ACTION_DECRYPT
+
 
     subject_mapping_sdk_attribute1:
       id: bc28cacb-1687-4c87-9c63-eae55e271320
       attribute_value_id: 74babca6-016f-4f3e-a99b-4e46ea8d0fd8
       # subject_condition_sdk_client
       subject_condition_set_id: 86621a00-b63e-42e9-bea5-40ba52d98ede
-      actions:
-        - standard: STANDARD_ACTION_TRANSMIT
-        - standard: STANDARD_ACTION_DECRYPT
+      # actions:
+      #   - standard: create
+      #   - standard: read
 
 subject_condition_set:
   metadata:
@@ -374,6 +360,60 @@ subject_condition_set:
                     subject_external_values:
                       - opentdf-sdk
 
+##
+# Actions
+#
+# Note: Standard Actions [create, read, update, delete] inserted by migration
+##
+custom_actions:
+  metadata:
+    table_name: actions
+    columns:
+      - id
+      - name
+      - is_standard
+  data:
+    custom_action_1:
+      id: e3e3df5f-02c8-4a41-88af-1c7436a43722
+      name: custom_action_1
+      is_standard: false
+    other_special_action:
+      id: ef31bac8-7d9b-46c4-8dbb-5965df87b824
+      name: other-special-action
+      is_standard: false
+
+subject_mapping_actions_relation:
+  metadata:
+    table_name: subject_mapping_actions
+    columns:
+      - subject_mapping_id
+      - action_id
+  data:
+    subject_mapping_subject_attribute1_read:
+      subject_mapping_id: 812fab35-9aa4-4e73-bf22-c96638d58ea4
+      action_name: read
+    subject_mapping_subject_attribute2_read:
+      subject_mapping_id: e6a3f940-e24f-4383-8763-718a1a304948
+      action_name: read
+    subject_mapping_subject_attribute2_create:
+      subject_mapping_id: e6a3f940-e24f-4383-8763-718a1a304948
+      action_name: create
+    subject_mapping_subject_attribute3_create:
+      subject_mapping_id: 9d06c757-06b9-4713-8fbd-5ef007b1afe2
+      action_name: create
+    subject_mapping_subject_attribute3_custom_action_1:
+      subject_mapping_id: 9d06c757-06b9-4713-8fbd-5ef007b1afe2
+      action_name: custom_action_1
+    subject_mapping_subject_simple_in_read:
+      subject_mapping_id: 3c623ede-df88-4906-8a78-ebdfacadcd57
+      action_name: read
+    subject_mapping_subject_simple_not_in_read:
+      subject_mapping_id: 1b9508a7-746a-4705-a1f1-4b6e676377ce
+      action_name: read
+    subject_mapping_scenario_blue_read:
+      subject_mapping_id: 1748761a-bd8c-4b23-8560-16ba7a181f19
+      action_name: read
+
 ##
 # Resource Mapping Groups
 #
diff --git a/service/policy/db/query.sql b/service/policy/db/query.sql
index 011e01b08d..747c8692e5 100644
--- a/service/policy/db/query.sql
+++ b/service/policy/db/query.sql
@@ -970,12 +970,17 @@ inserted_actions AS (
 SELECT id FROM inserted_mapping;
 
 -- name: updateSubjectMapping :execrows
-WITH subject_mapping_update AS (
-    UPDATE subject_mappings
+WITH existence_check AS (
+    SELECT 1 
+    FROM subject_mappings sm
+    WHERE sm.id = sqlc.arg('id')
+),
+subject_mapping_update AS (
+    UPDATE subject_mappings sm
     SET
         metadata = COALESCE(sqlc.narg('metadata')::JSONB, metadata),
         subject_condition_set_id = COALESCE(sqlc.narg('subject_condition_set_id')::UUID, subject_condition_set_id)
-    WHERE id = sqlc.arg('id')
+    WHERE sm.id = sqlc.arg('id')
     RETURNING id
 ),
 -- Delete ALL existing action relationships when action_ids are provided
@@ -998,7 +1003,7 @@ action_insert AS (
     -- Handle potential duplicates within the input array
     ON CONFLICT (subject_mapping_id, action_id) DO NOTHING
 )
-SELECT 1 as success;
+SELECT EXISTS (SELECT 1 FROM existence_check) as success;
 
 -- name: deleteSubjectMapping :execrows
 DELETE FROM subject_mappings WHERE id = $1;
diff --git a/service/policy/db/query.sql.go b/service/policy/db/query.sql.go
index d47e0d5ef2..fd765f7807 100644
--- a/service/policy/db/query.sql.go
+++ b/service/policy/db/query.sql.go
@@ -4319,67 +4319,88 @@ func (q *Queries) updateStandardAction(ctx context.Context, id string) (int64, e
 }
 
 const updateSubjectMapping = `-- name: updateSubjectMapping :execrows
-WITH subject_mapping_update AS (
-    UPDATE subject_mappings
+WITH existence_check AS (
+    SELECT 1 
+    FROM subject_mappings sm
+    WHERE sm.id = $1
+),
+subject_mapping_update AS (
+    UPDATE subject_mappings sm
     SET
-        metadata = COALESCE($3::JSONB, metadata),
-        subject_condition_set_id = COALESCE($4::UUID, subject_condition_set_id)
-    WHERE id = $1
+        metadata = COALESCE($2::JSONB, metadata),
+        subject_condition_set_id = COALESCE($3::UUID, subject_condition_set_id)
+    WHERE sm.id = $1
     RETURNING id
 ),
-action_update AS (
+action_delete AS (
     DELETE FROM subject_mapping_actions
-    WHERE 
+    WHERE
         subject_mapping_id = $1
-        AND $2 IS NOT NULL
-    RETURNING subject_mapping_id
+        AND $4::UUID[] IS NOT NULL
+),
+action_insert AS (
+    INSERT INTO subject_mapping_actions (subject_mapping_id, action_id)
+    SELECT
+        $1,
+        unnest_value
+    FROM unnest($4::UUID[]) AS unnest_value
+    WHERE
+        $4::UUID[] IS NOT NULL
+        AND EXISTS (SELECT 1 FROM subject_mapping_update)
+    -- Handle potential duplicates within the input array
+    ON CONFLICT (subject_mapping_id, action_id) DO NOTHING
 )
-INSERT INTO subject_mapping_actions (subject_mapping_id, action_id)
-SELECT 
-    $1,
-    unnest($2::UUID[])
-WHERE
-    $2 IS NOT NULL
-    AND EXISTS (SELECT 1 FROM subject_mapping_update)
+SELECT EXISTS (SELECT 1 FROM existence_check) as success
 `
 
 type updateSubjectMappingParams struct {
 	ID                    string      `json:"id"`
-	ActionIds             []string    `json:"action_ids"`
 	Metadata              []byte      `json:"metadata"`
 	SubjectConditionSetID pgtype.UUID `json:"subject_condition_set_id"`
+	ActionIds             []string    `json:"action_ids"`
 }
 
-// updateSubjectMapping
+// Delete ALL existing action relationships when action_ids are provided
+// Insert new action relationships
 //
-//	WITH subject_mapping_update AS (
-//	    UPDATE subject_mappings
+//	WITH existence_check AS (
+//	    SELECT 1
+//	    FROM subject_mappings sm
+//	    WHERE sm.id = $1
+//	),
+//	subject_mapping_update AS (
+//	    UPDATE subject_mappings sm
 //	    SET
-//	        metadata = COALESCE($3::JSONB, metadata),
-//	        subject_condition_set_id = COALESCE($4::UUID, subject_condition_set_id)
-//	    WHERE id = $1
+//	        metadata = COALESCE($2::JSONB, metadata),
+//	        subject_condition_set_id = COALESCE($3::UUID, subject_condition_set_id)
+//	    WHERE sm.id = $1
 //	    RETURNING id
 //	),
-//	action_update AS (
+//	action_delete AS (
 //	    DELETE FROM subject_mapping_actions
 //	    WHERE
 //	        subject_mapping_id = $1
-//	        AND $2 IS NOT NULL
-//	    RETURNING subject_mapping_id
+//	        AND $4::UUID[] IS NOT NULL
+//	),
+//	action_insert AS (
+//	    INSERT INTO subject_mapping_actions (subject_mapping_id, action_id)
+//	    SELECT
+//	        $1,
+//	        unnest_value
+//	    FROM unnest($4::UUID[]) AS unnest_value
+//	    WHERE
+//	        $4::UUID[] IS NOT NULL
+//	        AND EXISTS (SELECT 1 FROM subject_mapping_update)
+//	    -- Handle potential duplicates within the input array
+//	    ON CONFLICT (subject_mapping_id, action_id) DO NOTHING
 //	)
-//	INSERT INTO subject_mapping_actions (subject_mapping_id, action_id)
-//	SELECT
-//	    $1,
-//	    unnest($2::UUID[])
-//	WHERE
-//	    $2 IS NOT NULL
-//	    AND EXISTS (SELECT 1 FROM subject_mapping_update)
+//	SELECT EXISTS (SELECT 1 FROM existence_check) as success
 func (q *Queries) updateSubjectMapping(ctx context.Context, arg updateSubjectMappingParams) (int64, error) {
 	result, err := q.db.Exec(ctx, updateSubjectMapping,
 		arg.ID,
-		arg.ActionIds,
 		arg.Metadata,
 		arg.SubjectConditionSetID,
+		arg.ActionIds,
 	)
 	if err != nil {
 		return 0, err
diff --git a/service/policy/db/subject_mappings.go b/service/policy/db/subject_mappings.go
index 2d10ccd707..823faea4bf 100644
--- a/service/policy/db/subject_mappings.go
+++ b/service/policy/db/subject_mappings.go
@@ -48,39 +48,6 @@ func unmarshalSubjectSetsProto(conditionJSON []byte) ([]*policy.SubjectSet, erro
 	return ss, nil
 }
 
-// Helper to marshal Actions into JSON (stored as JSONB in the database column)
-func marshalActionsProto(actions []*policy.Action) ([]byte, error) {
-	var raw []json.RawMessage
-	for _, a := range actions {
-		b, err := protojson.Marshal(a)
-		if err != nil {
-			return nil, err
-		}
-		raw = append(raw, b)
-	}
-	return json.Marshal(raw)
-}
-
-func unmarshalActionsProto(actionsJSON []byte, actions *[]*policy.Action) error {
-	var raw []json.RawMessage
-
-	if actionsJSON != nil {
-		if err := json.Unmarshal(actionsJSON, &raw); err != nil {
-			return fmt.Errorf("failed to unmarshal actions array [%s]: %w", string(actionsJSON), err)
-		}
-
-		for _, r := range raw {
-			a := policy.Action{}
-			if err := protojson.Unmarshal(r, &a); err != nil {
-				return fmt.Errorf("failed to unmarshal action [%s]: %w", string(r), err)
-			}
-			*actions = append(*actions, &a)
-		}
-	}
-
-	return nil
-}
-
 /*
 	Subject Condition Sets
 */
@@ -274,42 +241,71 @@ func (c PolicyDBClient) DeleteAllUnmappedSubjectConditionSets(ctx context.Contex
 func (c PolicyDBClient) CreateSubjectMapping(ctx context.Context, s *subjectmapping.CreateSubjectMappingRequest) (*policy.SubjectMapping, error) {
 	actions := s.GetActions()
 	attributeValueID := s.GetAttributeValueId()
-
 	var (
-		scs *policy.SubjectConditionSet
 		err error
+		scs *policy.SubjectConditionSet
 	)
 
-	// Prefer existing id over new creation per documented proto behavior.
+	// Actions are required on Subject Mappings
+	if len(actions) == 0 {
+		return nil, db.WrapIfKnownInvalidQueryErr(
+			errors.Join(db.ErrMissingValue, errors.New("actions are required when creating a subject mapping")),
+		)
+	}
+	actionIDs := make([]string, 0)
+	actionNames := make([]string, 0)
+	// Check for provided existing Action IDs and existing/new Action Names
+	for _, a := range actions {
+		if a.GetId() != "" {
+			actionIDs = append(actionIDs, a.GetId())
+		} else if a.GetName() != "" {
+			actionNames = append(actionNames, a.GetName())
+		} else {
+			return nil, db.WrapIfKnownInvalidQueryErr(
+				errors.Join(db.ErrMissingValue, errors.New("action id or name is required when creating a subject mapping")),
+			)
+		}
+	}
+	// Create or list Actions for those provided by name
+	if len(actionNames) > 0 {
+		createdOrListedActions, err := c.createOrListActionsByName(ctx, actionNames)
+		if err != nil {
+			return nil, db.WrapIfKnownInvalidQueryErr(
+				errors.Join(db.ErrMissingValue, fmt.Errorf("failed to create or list action names [%v]: %w", actionNames, err)),
+			)
+		}
+		for _, a := range createdOrListedActions {
+			actionIDs = append(actionIDs, a.ID)
+		}
+	}
+	fmt.Println("action ids", actionIDs)
+	fmt.Println("action names", actionNames)
+
+	// Subject Condition Sets may be existing or new, and protos document preference for existing SCS IDs when both provided
 	switch {
 	case s.GetExistingSubjectConditionSetId() != "":
 		scs, err = c.GetSubjectConditionSet(ctx, s.GetExistingSubjectConditionSetId())
 		if err != nil {
-			return nil, err
+			return nil, db.WrapIfKnownInvalidQueryErr(err)
 		}
 	case s.GetNewSubjectConditionSet() != nil:
 		// create the new subject condition set
 		scs, err = c.CreateSubjectConditionSet(ctx, s.GetNewSubjectConditionSet())
 		if err != nil {
-			return nil, err
+			return nil, db.WrapIfKnownInvalidQueryErr(err)
 		}
 	default:
-		return nil, errors.Join(db.ErrMissingValue, errors.New("either an existing Subject Condition Set ID or a new Subject Condition Set is required when creating a subject mapping"))
+		return nil, db.WrapIfKnownInvalidQueryErr(errors.Join(db.ErrMissingValue, errors.New("either an existing Subject Condition Set ID or a new Subject Condition Set is required when creating a subject mapping")))
 	}
 
 	metadataJSON, metadata, err := db.MarshalCreateMetadata(s.GetMetadata())
 	if err != nil {
-		return nil, err
-	}
-
-	actionsJSON, err := marshalActionsProto(actions)
-	if err != nil {
-		return nil, err
+		return nil, db.WrapIfKnownInvalidQueryErr(err)
 	}
 
 	createdID, err := c.Queries.createSubjectMapping(ctx, createSubjectMappingParams{
 		AttributeValueID:      attributeValueID,
-		Actions:               actionsJSON,
+		ActionIds:             actionIDs,
 		Metadata:              metadataJSON,
 		SubjectConditionSetID: pgtypeUUID(scs.GetId()),
 	})
@@ -326,6 +322,7 @@ func (c PolicyDBClient) CreateSubjectMapping(ctx context.Context, s *subjectmapp
 		Actions:             actions,
 		Metadata:            metadata,
 	}, nil
+
 }
 
 func (c PolicyDBClient) GetSubjectMapping(ctx context.Context, id string) (*policy.SubjectMapping, error) {
@@ -345,9 +342,10 @@ func (c PolicyDBClient) GetSubjectMapping(ctx context.Context, id string) (*poli
 	}
 
 	a := []*policy.Action{}
-	if err = unmarshalActionsProto(sm.Actions, &a); err != nil {
+	if err = unmarshalAllActionsProto(sm.StandardActions, sm.CustomActions, &a); err != nil {
 		return nil, err
 	}
+	fmt.Println("got actions", a)
 
 	scs := policy.SubjectConditionSet{}
 	if err = unmarshalSubjectConditionSet(sm.SubjectConditionSet, &scs); err != nil {
@@ -392,7 +390,7 @@ func (c PolicyDBClient) ListSubjectMappings(ctx context.Context, r *subjectmappi
 		}
 
 		a := []*policy.Action{}
-		if err = unmarshalActionsProto(sm.Actions, &a); err != nil {
+		if err = unmarshalAllActionsProto(sm.StandardActions, sm.CustomActions, &a); err != nil {
 			return nil, err
 		}
 
@@ -444,23 +442,45 @@ func (c PolicyDBClient) UpdateSubjectMapping(ctx context.Context, r *subjectmapp
 		return nil, err
 	}
 
-	var actionsJSON []byte
-	if actions != nil {
-		actionsJSON, err = marshalActionsProto(actions)
-		if err != nil {
-			return nil, err
+	actionIDs := make([]string, 0)
+	if len(actions) > 0 {
+		actionNames := make([]string, 0)
+		// Check for provided existing Action IDs and existing/new Action Names
+		for _, a := range actions {
+			if a.GetId() != "" {
+				actionIDs = append(actionIDs, a.GetId())
+			} else if a.GetName() != "" {
+				actionNames = append(actionNames, a.GetName())
+			} else {
+				return nil, db.WrapIfKnownInvalidQueryErr(
+					errors.Join(db.ErrMissingValue, errors.New("action id or name is required when updating a subject mapping's actions")),
+				)
+			}
+		}
+		// Create or list Actions for those provided by name
+		if len(actionNames) > 0 {
+			createdOrListedActions, err := c.createOrListActionsByName(ctx, actionNames)
+			if err != nil {
+				return nil, db.WrapIfKnownInvalidQueryErr(
+					errors.Join(db.ErrMissingValue, fmt.Errorf("failed to create or list action names [%v]: %w", actionNames, err)),
+				)
+			}
+			for _, a := range createdOrListedActions {
+				actionIDs = append(actionIDs, a.ID)
+			}
 		}
 	}
 
 	count, err := c.Queries.updateSubjectMapping(ctx, updateSubjectMappingParams{
 		ID:                    id,
-		Actions:               actionsJSON,
+		ActionIds:             actionIDs,
 		Metadata:              metadataJSON,
 		SubjectConditionSetID: pgtypeUUID(subjectConditionSetID),
 	})
 	if err != nil {
 		return nil, db.WrapIfKnownInvalidQueryErr(err)
 	}
+	fmt.Println("count", count)
 	if count == 0 {
 		return nil, db.ErrNotFound
 	}
@@ -513,7 +533,7 @@ func (c PolicyDBClient) GetMatchedSubjectMappings(ctx context.Context, propertie
 		}
 
 		a := []*policy.Action{}
-		if err = unmarshalActionsProto(sm.Actions, &a); err != nil {
+		if err = unmarshalAllActionsProto(sm.StandardActions, sm.CustomActions, &a); err != nil {
 			return nil, err
 		}
 
diff --git a/service/policy/db/utils.go b/service/policy/db/utils.go
index c0f4784c13..a4c18ba1b4 100644
--- a/service/policy/db/utils.go
+++ b/service/policy/db/utils.go
@@ -1,6 +1,7 @@
 package db
 
 import (
+	"encoding/json"
 	"fmt"
 
 	"github.com/google/uuid"
@@ -58,6 +59,43 @@ func unmarshalSubjectConditionSet(subjectConditionSetJSON []byte, scs *policy.Su
 	return nil
 }
 
+func unmarshalAllActionsProto(stdActionsJSON []byte, customActionsJSON []byte, actions *[]*policy.Action) error {
+	var (
+		stdActions    = new([]*policy.Action)
+		customActions = new([]*policy.Action)
+	)
+	if err := unmarshalActionsProto(stdActionsJSON, stdActions); err != nil {
+		return fmt.Errorf("failed to unmarshal standard actions array [%s]: %w", string(stdActionsJSON), err)
+	}
+	if err := unmarshalActionsProto(customActionsJSON, customActions); err != nil {
+		return fmt.Errorf("failed to unmarshal custom actions array [%s]: %w", string(customActionsJSON), err)
+	}
+	*actions = append(*actions, *stdActions...)
+	*actions = append(*actions, *customActions...)
+
+	return nil
+}
+
+func unmarshalActionsProto(actionsJSON []byte, actions *[]*policy.Action) error {
+	var raw []json.RawMessage
+
+	if actionsJSON != nil {
+		if err := json.Unmarshal(actionsJSON, &raw); err != nil {
+			return fmt.Errorf("failed to unmarshal actions array [%s]: %w", string(actionsJSON), err)
+		}
+
+		for _, r := range raw {
+			a := policy.Action{}
+			if err := protojson.Unmarshal(r, &a); err != nil {
+				return fmt.Errorf("failed to unmarshal action [%s]: %w", string(r), err)
+			}
+			*actions = append(*actions, &a)
+		}
+	}
+
+	return nil
+}
+
 func pgtypeUUID(s string) pgtype.UUID {
 	u, err := uuid.Parse(s)
 
diff --git a/service/policy/db/utils_test.go b/service/policy/db/utils_test.go
index 8cc720a421..60a9a79e5d 100644
--- a/service/policy/db/utils_test.go
+++ b/service/policy/db/utils_test.go
@@ -3,6 +3,7 @@ package db
 import (
 	"testing"
 
+	"github.com/opentdf/platform/protocol/go/policy"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -90,3 +91,59 @@ func Test_GetNextOffset(t *testing.T) {
 		assert.Equal(t, test.expected, result, test.scenario)
 	}
 }
+
+func Test_UnmarshalAllActionsProto(t *testing.T) {
+	tests := []struct {
+		name              string
+		stdActionsJSON    []byte
+		customActionsJSON []byte
+		wantLen           int
+	}{
+		{
+			name:              "Only Standard Actions",
+			stdActionsJSON:    []byte(`[{"id":"std1", "name":"Standard One"}, {"id":"std2", "name":"Standard Two"}]`),
+			customActionsJSON: []byte(`[]`),
+			wantLen:           2,
+		},
+		{
+			name:              "Only Custom Actions",
+			stdActionsJSON:    []byte(`[]`),
+			customActionsJSON: []byte(`[{"id":"custom1", "name":"Custom One"}, {"id":"custom2", "name":"Custom Two"}]`),
+			wantLen:           2,
+		},
+		{
+			name:              "Both Standard and Custom Actions",
+			stdActionsJSON:    []byte(`[{"id":"std1", "name":"Standard One"}, {"id":"std2", "name":"Standard Two"}]`),
+			customActionsJSON: []byte(`[{"id":"custom1", "name":"Custom One"}, {"id":"custom2", "name":"Custom Two"}]`),
+			wantLen:           4,
+		},
+		{
+			name:              "Empty Actions",
+			stdActionsJSON:    []byte(`[]`),
+			customActionsJSON: []byte(`[]`),
+			wantLen:           0,
+		},
+		{
+			name:              "Nil Actions",
+			stdActionsJSON:    nil,
+			customActionsJSON: nil,
+			wantLen:           0,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			actions := []*policy.Action{}
+
+			err := unmarshalAllActionsProto(tt.stdActionsJSON, tt.customActionsJSON, &actions)
+
+			if err != nil {
+				t.Errorf("unmarshalAllActionsProto() unexpected error = %v", err)
+			}
+
+			if len(actions) != tt.wantLen {
+				t.Errorf("unmarshalAllActionsProto() len(actions) = %v, wantLen %v", len(actions), tt.wantLen)
+			}
+		})
+	}
+}
diff --git a/service/policy/subjectmapping/subject_mapping.go b/service/policy/subjectmapping/subject_mapping.go
index bc7a4b1bcf..8369958c89 100644
--- a/service/policy/subjectmapping/subject_mapping.go
+++ b/service/policy/subjectmapping/subject_mapping.go
@@ -57,17 +57,25 @@ func (s SubjectMappingService) CreateSubjectMapping(ctx context.Context,
 		ObjectType: audit.ObjectTypeSubjectMapping,
 	}
 
-	subjectMapping, err := s.dbClient.CreateSubjectMapping(ctx, req.Msg)
+	// SM Creation may involve action creation or SCS creation, so utilize a transaction
+	err := s.dbClient.RunInTx(ctx, func(txClient *policydb.PolicyDBClient) error {
+		subjectMapping, err := s.dbClient.CreateSubjectMapping(ctx, req.Msg)
+		if err != nil {
+			s.logger.Audit.PolicyCRUDFailure(ctx, auditParams)
+			return err
+		}
+
+		auditParams.ObjectID = subjectMapping.GetId()
+		auditParams.Original = subjectMapping
+		s.logger.Audit.PolicyCRUDSuccess(ctx, auditParams)
+
+		rsp.SubjectMapping = subjectMapping
+
+		return nil
+	})
 	if err != nil {
-		s.logger.Audit.PolicyCRUDFailure(ctx, auditParams)
 		return nil, db.StatusifyError(err, db.ErrTextCreationFailed, slog.String("subjectMapping", req.Msg.String()))
 	}
-
-	auditParams.ObjectID = subjectMapping.GetId()
-	auditParams.Original = subjectMapping
-	s.logger.Audit.PolicyCRUDSuccess(ctx, auditParams)
-
-	rsp.SubjectMapping = subjectMapping
 	return connect.NewResponse(rsp), nil
 }
 
@@ -113,24 +121,31 @@ func (s SubjectMappingService) UpdateSubjectMapping(ctx context.Context,
 		ObjectID:   subjectMappingID,
 	}
 
-	original, err := s.dbClient.GetSubjectMapping(ctx, subjectMappingID)
-	if err != nil {
-		s.logger.Audit.PolicyCRUDFailure(ctx, auditParams)
-		return nil, db.StatusifyError(err, db.ErrTextGetRetrievalFailed, slog.String("id", subjectMappingID))
-	}
+	// SM Update may involve action update or SCS update, so utilize a transaction
+	err := s.dbClient.RunInTx(ctx, func(txClient *policydb.PolicyDBClient) error {
+		original, err := s.dbClient.GetSubjectMapping(ctx, subjectMappingID)
+		if err != nil {
+			s.logger.Audit.PolicyCRUDFailure(ctx, auditParams)
+			return db.StatusifyError(err, db.ErrTextGetRetrievalFailed, slog.String("id", subjectMappingID))
+		}
+
+		updated, err := s.dbClient.UpdateSubjectMapping(ctx, req.Msg)
+		if err != nil {
+			s.logger.Audit.PolicyCRUDFailure(ctx, auditParams)
+			return db.StatusifyError(err, db.ErrTextUpdateFailed, slog.String("id", req.Msg.GetId()), slog.String("subjectMapping fields", req.Msg.String()))
+		}
+
+		auditParams.Original = original
+		auditParams.Updated = updated
+		s.logger.Audit.PolicyCRUDSuccess(ctx, auditParams)
 
-	updated, err := s.dbClient.UpdateSubjectMapping(ctx, req.Msg)
+		rsp.SubjectMapping = &policy.SubjectMapping{
+			Id: subjectMappingID,
+		}
+		return nil
+	})
 	if err != nil {
-		s.logger.Audit.PolicyCRUDFailure(ctx, auditParams)
-		return nil, db.StatusifyError(err, db.ErrTextUpdateFailed, slog.String("id", req.Msg.GetId()), slog.String("subjectMapping fields", req.Msg.String()))
-	}
-
-	auditParams.Original = original
-	auditParams.Updated = updated
-	s.logger.Audit.PolicyCRUDSuccess(ctx, auditParams)
-
-	rsp.SubjectMapping = &policy.SubjectMapping{
-		Id: subjectMappingID,
+		return nil, err
 	}
 	return connect.NewResponse(rsp), nil
 }

From b1aaa0a5454cd0487325e1d58e829b3f2e2122f8 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Thu, 3 Apr 2025 16:05:29 -0700
Subject: [PATCH 030/110] fix

---
 service/policy/db/subject_mappings.go | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/service/policy/db/subject_mappings.go b/service/policy/db/subject_mappings.go
index 823faea4bf..e45e520435 100644
--- a/service/policy/db/subject_mappings.go
+++ b/service/policy/db/subject_mappings.go
@@ -278,8 +278,6 @@ func (c PolicyDBClient) CreateSubjectMapping(ctx context.Context, s *subjectmapp
 			actionIDs = append(actionIDs, a.ID)
 		}
 	}
-	fmt.Println("action ids", actionIDs)
-	fmt.Println("action names", actionNames)
 
 	// Subject Condition Sets may be existing or new, and protos document preference for existing SCS IDs when both provided
 	switch {
@@ -345,7 +343,6 @@ func (c PolicyDBClient) GetSubjectMapping(ctx context.Context, id string) (*poli
 	if err = unmarshalAllActionsProto(sm.StandardActions, sm.CustomActions, &a); err != nil {
 		return nil, err
 	}
-	fmt.Println("got actions", a)
 
 	scs := policy.SubjectConditionSet{}
 	if err = unmarshalSubjectConditionSet(sm.SubjectConditionSet, &scs); err != nil {
@@ -442,6 +439,12 @@ func (c PolicyDBClient) UpdateSubjectMapping(ctx context.Context, r *subjectmapp
 		return nil, err
 	}
 
+	updateParams := updateSubjectMappingParams{
+		ID:                    id,
+		Metadata:              metadataJSON,
+		SubjectConditionSetID: pgtypeUUID(subjectConditionSetID),
+	}
+
 	actionIDs := make([]string, 0)
 	if len(actions) > 0 {
 		actionNames := make([]string, 0)
@@ -469,18 +472,13 @@ func (c PolicyDBClient) UpdateSubjectMapping(ctx context.Context, r *subjectmapp
 				actionIDs = append(actionIDs, a.ID)
 			}
 		}
+		updateParams.ActionIds = actionIDs
 	}
 
-	count, err := c.Queries.updateSubjectMapping(ctx, updateSubjectMappingParams{
-		ID:                    id,
-		ActionIds:             actionIDs,
-		Metadata:              metadataJSON,
-		SubjectConditionSetID: pgtypeUUID(subjectConditionSetID),
-	})
+	count, err := c.Queries.updateSubjectMapping(ctx, updateParams)
 	if err != nil {
 		return nil, db.WrapIfKnownInvalidQueryErr(err)
 	}
-	fmt.Println("count", count)
 	if count == 0 {
 		return nil, db.ErrNotFound
 	}

From b1a973b45a3effb6426f7babf0ccba55b9c49899 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Thu, 3 Apr 2025 16:54:29 -0700
Subject: [PATCH 031/110] fix

---
 service/integration/subject_mappings_test.go | 112 +++++++--------
 service/policy/db/query.sql                  |  70 ++++-----
 service/policy/db/query.sql.go               | 141 ++++++++++---------
 service/policy/db/subject_mappings.go        |  16 ++-
 4 files changed, 174 insertions(+), 165 deletions(-)

diff --git a/service/integration/subject_mappings_test.go b/service/integration/subject_mappings_test.go
index 34305fca1c..d6d4eef099 100644
--- a/service/integration/subject_mappings_test.go
+++ b/service/integration/subject_mappings_test.go
@@ -175,11 +175,10 @@ func (s *SubjectMappingsSuite) TestCreateSubjectMapping_NonExistentSubjectCondit
 // 	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value2").ID
 // 	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set3")
 // 	actionUpdate := s.f.GetStandardAction("update")
-// 	aCustomUpload := fixtureActionCustomUpload
 
 // 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 // 		AttributeValueId:              fixtureAttrValID,
-// 		Actions:                       []*policy.Action{actionUpdate, aCustomUpload},
+// 		Actions:                       []*policy.Action{actionUpdate, fixtureActionCustomUpload},
 // 		ExistingSubjectConditionSetId: fixtureScs.ID,
 // 	}
 // 	created, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, newSubjectMapping)
@@ -187,10 +186,9 @@ func (s *SubjectMappingsSuite) TestCreateSubjectMapping_NonExistentSubjectCondit
 // 	s.NotNil(created)
 
 // 	// update the subject mapping
-// 	newActions := []*policy.Action{actionUpdate}
 // 	update := &subjectmapping.UpdateSubjectMappingRequest{
 // 		Id:      created.GetId(),
-// 		Actions: newActions,
+// 		Actions: []*policy.Action{actionUpdate},
 // 	}
 
 // 	updated, err := s.db.PolicyClient.UpdateSubjectMapping(s.ctx, update)
@@ -202,7 +200,7 @@ func (s *SubjectMappingsSuite) TestCreateSubjectMapping_NonExistentSubjectCondit
 // 	got, err := s.db.PolicyClient.GetSubjectMapping(s.ctx, created.GetId())
 // 	s.Require().NoError(err)
 // 	s.NotNil(got)
-// 	s.Equal(len(newActions), len(got.GetActions()))
+// 	s.Equal(len(update.GetActions()), len(got.GetActions()))
 // 	// s.Equal(got.GetActions(), newActions)
 // 	s.Equal(newSubjectMapping.GetAttributeValueId(), got.GetAttributeValue().GetId())
 // 	s.Equal(newSubjectMapping.GetExistingSubjectConditionSetId(), got.GetSubjectConditionSet().GetId())
@@ -253,67 +251,63 @@ func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_SubjectConditionSetId()
 	// s.Equal(newSubjectMapping.GetActions(), got.GetActions())
 }
 
-// func (s *SubjectMappingsSuite) Test_UpdateSubjectMapping_UpdateAllAllowedFields() {
-// 	// create a new one, update it, and verify the update
-// 	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value1").ID
-// 	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set1")
-// 	actionCreate := s.f.GetStandardAction("create")
+func (s *SubjectMappingsSuite) Test_UpdateSubjectMapping_UpdateAllAllowedFields() {
+	// create a new one, update it, and verify the update
+	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value1").ID
+	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set1")
+	actionCreate := s.f.GetStandardAction("create")
 
-// 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
-// 		AttributeValueId:              fixtureAttrValID,
-// 		Actions:                       []*policy.Action{actionCreate},
-// 		ExistingSubjectConditionSetId: fixtureScs.ID,
-// 	}
+	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
+		AttributeValueId:              fixtureAttrValID,
+		Actions:                       []*policy.Action{actionCreate},
+		ExistingSubjectConditionSetId: fixtureScs.ID,
+	}
 
-// 	created, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, newSubjectMapping)
-// 	s.Require().NoError(err)
-// 	s.NotNil(created)
+	created, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, newSubjectMapping)
+	s.Require().NoError(err)
+	s.NotNil(created)
 
-// 	// update the subject mapping
-// 	newScs := s.f.GetSubjectConditionSetKey("subject_condition_set2")
-// 	newActions := []*policy.Action{fixtureActionCustomUpload}
-// 	metadata := &common.MetadataMutable{
-// 		Labels: map[string]string{"key": "value"},
-// 	}
-// 	update := &subjectmapping.UpdateSubjectMappingRequest{
-// 		Id:                     created.GetId(),
-// 		SubjectConditionSetId:  newScs.ID,
-// 		Actions:                newActions,
-// 		Metadata:               metadata,
-// 		MetadataUpdateBehavior: common.MetadataUpdateEnum_METADATA_UPDATE_ENUM_EXTEND,
-// 	}
+	// update the subject mapping
+	newScs := s.f.GetSubjectConditionSetKey("subject_condition_set2")
+	newActions := []*policy.Action{fixtureActionCustomUpload}
+	metadata := &common.MetadataMutable{
+		Labels: map[string]string{"key": "value"},
+	}
+	update := &subjectmapping.UpdateSubjectMappingRequest{
+		Id:                     created.GetId(),
+		SubjectConditionSetId:  newScs.ID,
+		Actions:                newActions,
+		Metadata:               metadata,
+		MetadataUpdateBehavior: common.MetadataUpdateEnum_METADATA_UPDATE_ENUM_EXTEND,
+	}
 
-// 	updated, err := s.db.PolicyClient.UpdateSubjectMapping(s.ctx, update)
-// 	s.Require().NoError(err)
-// 	s.NotNil(updated)
-// 	s.Equal(created.GetId(), updated.GetId())
+	updated, err := s.db.PolicyClient.UpdateSubjectMapping(s.ctx, update)
+	s.Require().NoError(err)
+	s.NotNil(updated)
+	s.Equal(created.GetId(), updated.GetId())
 
-// 	// verify the subject mapping was updated
-// 	got, err := s.db.PolicyClient.GetSubjectMapping(s.ctx, created.GetId())
-// 	s.Require().NoError(err)
-// 	s.NotNil(got)
-// 	s.Equal(created.GetId(), got.GetId())
-// 	s.Equal(newSubjectMapping.GetAttributeValueId(), got.GetAttributeValue().GetId())
-// 	s.Equal(newScs.ID, got.GetSubjectConditionSet().GetId())
-// 	s.Equal(len(newActions), len(got.GetActions()))
-// 	// s.Equal(newActions, got.GetActions())
-// 	s.Equal(metadata.GetLabels()["key"], got.GetMetadata().GetLabels()["key"])
-// }
+	// verify the subject mapping was updated
+	got, err := s.db.PolicyClient.GetSubjectMapping(s.ctx, created.GetId())
+	s.Require().NoError(err)
+	s.NotNil(got)
+	s.Equal(created.GetId(), got.GetId())
+	s.Equal(newSubjectMapping.GetAttributeValueId(), got.GetAttributeValue().GetId())
+	s.Equal(newScs.ID, got.GetSubjectConditionSet().GetId())
+	s.Equal(len(newActions), len(got.GetActions()))
+	// s.Equal(newActions, got.GetActions())
+	s.Equal(metadata.GetLabels()["key"], got.GetMetadata().GetLabels()["key"])
+}
 
-// func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_NonExistentId_Fails() {
-// 	update := &subjectmapping.UpdateSubjectMappingRequest{
-// 		Id: nonExistentSubjectMappingID,
-// 		Metadata: &common.MetadataMutable{
-// 			Labels: map[string]string{"key": "value"},
-// 		},
-// 		MetadataUpdateBehavior: common.MetadataUpdateEnum_METADATA_UPDATE_ENUM_REPLACE,
-// 	}
+func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_NonExistentId_Fails() {
+	update := &subjectmapping.UpdateSubjectMappingRequest{
+		Id: nonExistentSubjectMappingID,
+	}
 
-// 	sm, err := s.db.PolicyClient.UpdateSubjectMapping(s.ctx, update)
-// 	s.Require().Error(err)
-// 	s.Nil(sm)
-// 	s.Require().ErrorIs(err, db.ErrNotFound)
-// }
+	sm, err := s.db.PolicyClient.UpdateSubjectMapping(s.ctx, update)
+	s.Require().Error(err)
+	s.Nil(sm)
+	s.Require().ErrorIs(err, db.ErrNotFound)
+}
 
 func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_NonExistentSubjectConditionSetId_Fails() {
 	update := &subjectmapping.UpdateSubjectMappingRequest{
diff --git a/service/policy/db/query.sql b/service/policy/db/query.sql
index 747c8692e5..f8fe7a05ea 100644
--- a/service/policy/db/query.sql
+++ b/service/policy/db/query.sql
@@ -970,40 +970,42 @@ inserted_actions AS (
 SELECT id FROM inserted_mapping;
 
 -- name: updateSubjectMapping :execrows
-WITH existence_check AS (
-    SELECT 1 
-    FROM subject_mappings sm
-    WHERE sm.id = sqlc.arg('id')
-),
-subject_mapping_update AS (
-    UPDATE subject_mappings sm
-    SET
-        metadata = COALESCE(sqlc.narg('metadata')::JSONB, metadata),
-        subject_condition_set_id = COALESCE(sqlc.narg('subject_condition_set_id')::UUID, subject_condition_set_id)
-    WHERE sm.id = sqlc.arg('id')
-    RETURNING id
-),
--- Delete ALL existing action relationships when action_ids are provided
-action_delete AS (
-    DELETE FROM subject_mapping_actions
-    WHERE
-        subject_mapping_id = sqlc.arg('id')
-        AND sqlc.narg('action_ids')::UUID[] IS NOT NULL
-),
--- Insert new action relationships
-action_insert AS (
-    INSERT INTO subject_mapping_actions (subject_mapping_id, action_id)
-    SELECT
-        sqlc.arg('id'),
-        unnest_value
-    FROM unnest(sqlc.narg('action_ids')::UUID[]) AS unnest_value
-    WHERE
-        sqlc.narg('action_ids')::UUID[] IS NOT NULL
-        AND EXISTS (SELECT 1 FROM subject_mapping_update)
-    -- Handle potential duplicates within the input array
-    ON CONFLICT (subject_mapping_id, action_id) DO NOTHING
-)
-SELECT EXISTS (SELECT 1 FROM existence_check) as success;
+WITH
+	subject_mapping_update AS (
+		UPDATE subject_mappings
+		SET
+			metadata = COALESCE(sqlc.narg('metadata')::JSONB, metadata),
+			subject_condition_set_id = COALESCE(sqlc.narg('subject_condition_set_id')::UUID, subject_condition_set_id)
+		WHERE id = sqlc.arg('id')
+		RETURNING id
+	),
+	action_delete AS (
+		DELETE FROM subject_mapping_actions
+		WHERE
+			subject_mapping_id = sqlc.arg('id')
+			AND sqlc.narg('action_ids')::UUID[] IS NOT NULL
+	),
+	action_insert AS (
+		INSERT INTO
+			subject_mapping_actions (subject_mapping_id, action_id)
+		SELECT
+			sqlc.arg('id'),
+			unnest_value
+		FROM unnest(sqlc.narg('action_ids')::UUID[]) AS unnest_value
+		WHERE sqlc.narg('action_ids')::UUID[] IS NOT NULL
+		ON CONFLICT (subject_mapping_id, action_id) DO NOTHING
+	),
+	update_count AS (
+		SELECT COUNT(*) AS cnt
+		FROM subject_mapping_update
+	)
+SELECT
+-- Divide by error occurs if id was not found (CTE bypasses typical count failure)
+	1 / CASE WHEN ( 
+            SELECT cnt FROM update_count
+		) = 0 THEN 0
+		ELSE 1
+	END;
 
 -- name: deleteSubjectMapping :execrows
 DELETE FROM subject_mappings WHERE id = $1;
diff --git a/service/policy/db/query.sql.go b/service/policy/db/query.sql.go
index fd765f7807..23bb9d724c 100644
--- a/service/policy/db/query.sql.go
+++ b/service/policy/db/query.sql.go
@@ -4319,87 +4319,92 @@ func (q *Queries) updateStandardAction(ctx context.Context, id string) (int64, e
 }
 
 const updateSubjectMapping = `-- name: updateSubjectMapping :execrows
-WITH existence_check AS (
-    SELECT 1 
-    FROM subject_mappings sm
-    WHERE sm.id = $1
-),
-subject_mapping_update AS (
-    UPDATE subject_mappings sm
-    SET
-        metadata = COALESCE($2::JSONB, metadata),
-        subject_condition_set_id = COALESCE($3::UUID, subject_condition_set_id)
-    WHERE sm.id = $1
-    RETURNING id
-),
-action_delete AS (
-    DELETE FROM subject_mapping_actions
-    WHERE
-        subject_mapping_id = $1
-        AND $4::UUID[] IS NOT NULL
-),
-action_insert AS (
-    INSERT INTO subject_mapping_actions (subject_mapping_id, action_id)
-    SELECT
-        $1,
-        unnest_value
-    FROM unnest($4::UUID[]) AS unnest_value
-    WHERE
-        $4::UUID[] IS NOT NULL
-        AND EXISTS (SELECT 1 FROM subject_mapping_update)
-    -- Handle potential duplicates within the input array
-    ON CONFLICT (subject_mapping_id, action_id) DO NOTHING
-)
-SELECT EXISTS (SELECT 1 FROM existence_check) as success
+WITH
+	subject_mapping_update AS (
+		UPDATE subject_mappings
+		SET
+			metadata = COALESCE($1::JSONB, metadata),
+			subject_condition_set_id = COALESCE($2::UUID, subject_condition_set_id)
+		WHERE id = $3
+		RETURNING id
+	),
+	action_delete AS (
+		DELETE FROM subject_mapping_actions
+		WHERE
+			subject_mapping_id = $3
+			AND $4::UUID[] IS NOT NULL
+	),
+	action_insert AS (
+		INSERT INTO
+			subject_mapping_actions (subject_mapping_id, action_id)
+		SELECT
+			$3,
+			unnest_value
+		FROM unnest($4::UUID[]) AS unnest_value
+		WHERE $4::UUID[] IS NOT NULL
+		ON CONFLICT (subject_mapping_id, action_id) DO NOTHING
+	),
+	update_count AS (
+		SELECT COUNT(*) AS cnt
+		FROM subject_mapping_update
+	)
+SELECT
+	1 / CASE WHEN ( 
+            SELECT cnt FROM update_count
+		) = 0 THEN 0
+		ELSE 1
+	END
 `
 
 type updateSubjectMappingParams struct {
-	ID                    string      `json:"id"`
 	Metadata              []byte      `json:"metadata"`
 	SubjectConditionSetID pgtype.UUID `json:"subject_condition_set_id"`
+	ID                    string      `json:"id"`
 	ActionIds             []string    `json:"action_ids"`
 }
 
-// Delete ALL existing action relationships when action_ids are provided
-// Insert new action relationships
+// Divide by error occurs if id was not found (CTE bypasses typical count failure)
 //
-//	WITH existence_check AS (
-//	    SELECT 1
-//	    FROM subject_mappings sm
-//	    WHERE sm.id = $1
-//	),
-//	subject_mapping_update AS (
-//	    UPDATE subject_mappings sm
-//	    SET
-//	        metadata = COALESCE($2::JSONB, metadata),
-//	        subject_condition_set_id = COALESCE($3::UUID, subject_condition_set_id)
-//	    WHERE sm.id = $1
-//	    RETURNING id
-//	),
-//	action_delete AS (
-//	    DELETE FROM subject_mapping_actions
-//	    WHERE
-//	        subject_mapping_id = $1
-//	        AND $4::UUID[] IS NOT NULL
-//	),
-//	action_insert AS (
-//	    INSERT INTO subject_mapping_actions (subject_mapping_id, action_id)
-//	    SELECT
-//	        $1,
-//	        unnest_value
-//	    FROM unnest($4::UUID[]) AS unnest_value
-//	    WHERE
-//	        $4::UUID[] IS NOT NULL
-//	        AND EXISTS (SELECT 1 FROM subject_mapping_update)
-//	    -- Handle potential duplicates within the input array
-//	    ON CONFLICT (subject_mapping_id, action_id) DO NOTHING
-//	)
-//	SELECT EXISTS (SELECT 1 FROM existence_check) as success
+//	WITH
+//		subject_mapping_update AS (
+//			UPDATE subject_mappings
+//			SET
+//				metadata = COALESCE($1::JSONB, metadata),
+//				subject_condition_set_id = COALESCE($2::UUID, subject_condition_set_id)
+//			WHERE id = $3
+//			RETURNING id
+//		),
+//		action_delete AS (
+//			DELETE FROM subject_mapping_actions
+//			WHERE
+//				subject_mapping_id = $3
+//				AND $4::UUID[] IS NOT NULL
+//		),
+//		action_insert AS (
+//			INSERT INTO
+//				subject_mapping_actions (subject_mapping_id, action_id)
+//			SELECT
+//				$3,
+//				unnest_value
+//			FROM unnest($4::UUID[]) AS unnest_value
+//			WHERE $4::UUID[] IS NOT NULL
+//			ON CONFLICT (subject_mapping_id, action_id) DO NOTHING
+//		),
+//		update_count AS (
+//			SELECT COUNT(*) AS cnt
+//			FROM subject_mapping_update
+//		)
+//	SELECT
+//		1 / CASE WHEN (
+//	            SELECT cnt FROM update_count
+//			) = 0 THEN 0
+//			ELSE 1
+//		END
 func (q *Queries) updateSubjectMapping(ctx context.Context, arg updateSubjectMappingParams) (int64, error) {
 	result, err := q.db.Exec(ctx, updateSubjectMapping,
-		arg.ID,
 		arg.Metadata,
 		arg.SubjectConditionSetID,
+		arg.ID,
 		arg.ActionIds,
 	)
 	if err != nil {
diff --git a/service/policy/db/subject_mappings.go b/service/policy/db/subject_mappings.go
index e45e520435..c968410849 100644
--- a/service/policy/db/subject_mappings.go
+++ b/service/policy/db/subject_mappings.go
@@ -5,7 +5,10 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"strings"
 
+	"github.com/jackc/pgerrcode"
+	"github.com/jackc/pgx/v5"
 	"github.com/opentdf/platform/protocol/go/common"
 	"github.com/opentdf/platform/protocol/go/policy"
 	"github.com/opentdf/platform/protocol/go/policy/subjectmapping"
@@ -328,6 +331,10 @@ func (c PolicyDBClient) GetSubjectMapping(ctx context.Context, id string) (*poli
 	if err != nil {
 		return nil, db.WrapIfKnownInvalidQueryErr(err)
 	}
+	// ID was not found and we received an empty result set
+	if sm.ID == "" {
+		return nil, db.ErrNotFound
+	}
 
 	metadata := &common.Metadata{}
 	if err = unmarshalMetadata(sm.Metadata, metadata); err != nil {
@@ -475,13 +482,14 @@ func (c PolicyDBClient) UpdateSubjectMapping(ctx context.Context, r *subjectmapp
 		updateParams.ActionIds = actionIDs
 	}
 
-	count, err := c.Queries.updateSubjectMapping(ctx, updateParams)
+	_, err = c.Queries.updateSubjectMapping(ctx, updateParams)
 	if err != nil {
+		// CTE behavior requires custom handling with divide by zero to detect 0 count
+		if strings.Contains(err.Error(), pgerrcode.DivisionByZero) {
+			err = pgx.ErrNoRows
+		}
 		return nil, db.WrapIfKnownInvalidQueryErr(err)
 	}
-	if count == 0 {
-		return nil, db.ErrNotFound
-	}
 
 	return &policy.SubjectMapping{
 		Id:       id,

From 63a18062aaa4f2c2180dd84cc9fe5e44502b5cdb Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 4 Apr 2025 12:29:04 -0700
Subject: [PATCH 032/110] fix

---
 service/integration/subject_mappings_test.go | 328 +++++++++++--------
 service/policy/db/query.sql                  |  75 +++--
 service/policy/db/query.sql.go               | 150 +++++----
 service/policy/db/subject_mappings.go        |   4 +-
 4 files changed, 315 insertions(+), 242 deletions(-)

diff --git a/service/integration/subject_mappings_test.go b/service/integration/subject_mappings_test.go
index d6d4eef099..4382d84e32 100644
--- a/service/integration/subject_mappings_test.go
+++ b/service/integration/subject_mappings_test.go
@@ -170,47 +170,73 @@ func (s *SubjectMappingsSuite) TestCreateSubjectMapping_NonExistentSubjectCondit
 	s.Require().ErrorIs(err, db.ErrNotFound)
 }
 
-// func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_Actions() {
-// 	// create a new one, update it, and verify the update
-// 	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value2").ID
-// 	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set3")
-// 	actionUpdate := s.f.GetStandardAction("update")
-
-// 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
-// 		AttributeValueId:              fixtureAttrValID,
-// 		Actions:                       []*policy.Action{actionUpdate, fixtureActionCustomUpload},
-// 		ExistingSubjectConditionSetId: fixtureScs.ID,
-// 	}
-// 	created, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, newSubjectMapping)
-// 	s.Require().NoError(err)
-// 	s.NotNil(created)
-
-// 	// update the subject mapping
-// 	update := &subjectmapping.UpdateSubjectMappingRequest{
-// 		Id:      created.GetId(),
-// 		Actions: []*policy.Action{actionUpdate},
-// 	}
-
-// 	updated, err := s.db.PolicyClient.UpdateSubjectMapping(s.ctx, update)
-// 	s.Require().NoError(err)
-// 	s.NotNil(updated)
-// 	s.Equal(created.GetId(), updated.GetId())
-
-// 	// verify the actions were updated but nothing else
-// 	got, err := s.db.PolicyClient.GetSubjectMapping(s.ctx, created.GetId())
-// 	s.Require().NoError(err)
-// 	s.NotNil(got)
-// 	s.Equal(len(update.GetActions()), len(got.GetActions()))
-// 	// s.Equal(got.GetActions(), newActions)
-// 	s.Equal(newSubjectMapping.GetAttributeValueId(), got.GetAttributeValue().GetId())
-// 	s.Equal(newSubjectMapping.GetExistingSubjectConditionSetId(), got.GetSubjectConditionSet().GetId())
-// 	metadata := got.GetMetadata()
-// 	createdAt := metadata.GetCreatedAt()
-// 	updatedAt := metadata.GetUpdatedAt()
-// 	s.False(createdAt.AsTime().IsZero())
-// 	s.False(updatedAt.AsTime().IsZero())
-// 	s.True(updatedAt.AsTime().After(createdAt.AsTime()))
-// }
+func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_Actions() {
+	// create a new one SM with actions, update it with different actions, and verify the update
+	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value2").ID
+	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set3")
+	actionUpdate := s.f.GetStandardAction("update")
+	actionDelete := s.f.GetStandardAction("delete")
+
+	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
+		AttributeValueId:              fixtureAttrValID,
+		Actions:                       []*policy.Action{actionUpdate, fixtureActionCustomUpload},
+		ExistingSubjectConditionSetId: fixtureScs.ID,
+	}
+	created, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, newSubjectMapping)
+	s.Require().NoError(err)
+	s.NotNil(created)
+
+	got, err := s.db.PolicyClient.GetSubjectMapping(s.ctx, created.GetId())
+	s.Require().NoError(err)
+	s.NotNil(got)
+	s.Equal(len(newSubjectMapping.GetActions()), len(got.GetActions()))
+
+	// update the subject mapping by removing one of the original actions
+	update := &subjectmapping.UpdateSubjectMappingRequest{
+		Id:      created.GetId(),
+		Actions: []*policy.Action{actionUpdate},
+	}
+
+	updated, err := s.db.PolicyClient.UpdateSubjectMapping(s.ctx, update)
+	s.Require().NoError(err)
+	s.NotNil(updated)
+	s.Equal(created.GetId(), updated.GetId())
+
+	// verify one action was dropped with no other changes
+	got, err = s.db.PolicyClient.GetSubjectMapping(s.ctx, created.GetId())
+	s.Require().NoError(err)
+	s.NotNil(got)
+	// actions
+	s.Equal(len(update.GetActions()), len(got.GetActions()))
+	s.Equal(actionUpdate.GetName(), got.GetActions()[0].GetName())
+	// attr value
+	s.Equal(newSubjectMapping.GetAttributeValueId(), got.GetAttributeValue().GetId())
+	// scs
+	s.Equal(newSubjectMapping.GetExistingSubjectConditionSetId(), got.GetSubjectConditionSet().GetId())
+	// metadata
+	metadata := got.GetMetadata()
+	createdAt := metadata.GetCreatedAt()
+	updatedAt := metadata.GetUpdatedAt()
+	s.False(createdAt.AsTime().IsZero())
+	s.False(updatedAt.AsTime().IsZero())
+	s.True(updatedAt.AsTime().After(createdAt.AsTime()))
+
+	// update with an action not in the current
+	update = &subjectmapping.UpdateSubjectMappingRequest{
+		Id:      created.GetId(),
+		Actions: []*policy.Action{actionDelete},
+	}
+	updated, err = s.db.PolicyClient.UpdateSubjectMapping(s.ctx, update)
+	s.Require().NoError(err)
+	s.NotNil(updated)
+
+	// verify the action was added
+	got, err = s.db.PolicyClient.GetSubjectMapping(s.ctx, created.GetId())
+	s.Require().NoError(err)
+	s.NotNil(got)
+	s.Equal(len(update.GetActions()), len(got.GetActions()))
+	s.Equal(actionDelete.GetName(), got.GetActions()[0].GetName())
+}
 
 func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_SubjectConditionSetId() {
 	// create a new one, update it, and verify the update
@@ -321,38 +347,42 @@ func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_NonExistentSubjectCondit
 	s.Require().ErrorIs(err, db.ErrForeignKeyViolation)
 }
 
-// func (s *SubjectMappingsSuite) TestGetSubjectMapping() {
-// 	fixture := s.f.GetSubjectMappingKey("subject_mapping_subject_attribute2")
-
-// 	sm, err := s.db.PolicyClient.GetSubjectMapping(s.ctx, fixture.ID)
-// 	s.Require().NoError(err)
-// 	s.NotNil(sm)
-// 	s.Equal(fixture.ID, sm.GetId())
-// 	s.Equal(fixture.AttributeValueID, sm.GetAttributeValue().GetId())
-// 	s.True(sm.GetAttributeValue().GetActive().GetValue())
-// 	s.Equal(fixture.SubjectConditionSetID, sm.GetSubjectConditionSet().GetId())
-
-// 	// verify the actions
-// 	for i, a := range sm.GetActions() {
-// 		s.NotNil(a)
-// 		// In protos, standard actions are an enum and custom actions are a string,
-// 		// so their string representations are slightly different
-// 		if fixture.Actions[i].Standard != "" {
-// 			s.Equal("standard:"+fixture.Actions[i].Standard, a.String())
-// 		} else {
-// 			s.Equal("custom:\""+fixture.Actions[i].Custom+"\"", a.String())
-// 		}
-// 	}
-// 	got, err := s.db.PolicyClient.GetAttributeValue(s.ctx, fixture.AttributeValueID)
-// 	s.Require().NoError(err)
-// 	s.NotNil(got)
-// 	s.Equal(fixture.AttributeValueID, got.GetId())
-// 	metadata := sm.GetMetadata()
-// 	createdAt := metadata.GetCreatedAt()
-// 	updatedAt := metadata.GetUpdatedAt()
-// 	s.True(createdAt.IsValid() && createdAt.AsTime().Unix() > 0)
-// 	s.True(updatedAt.IsValid() && updatedAt.AsTime().Unix() > 0)
-// }
+func (s *SubjectMappingsSuite) TestGetSubjectMapping() {
+	fixture := s.f.GetSubjectMappingKey("subject_mapping_subject_attribute2")
+
+	sm, err := s.db.PolicyClient.GetSubjectMapping(s.ctx, fixture.ID)
+	s.Require().NoError(err)
+	s.NotNil(sm)
+	s.Equal(fixture.ID, sm.GetId())
+	s.Equal(fixture.AttributeValueID, sm.GetAttributeValue().GetId())
+	s.True(sm.GetAttributeValue().GetActive().GetValue())
+	s.Equal(fixture.SubjectConditionSetID, sm.GetSubjectConditionSet().GetId())
+
+	foundRead := false
+	foundCreate := false
+	// verify the actions
+	for _, a := range sm.GetActions() {
+		s.NotNil(a)
+		if a.GetName() == "read" {
+			foundRead = true
+		}
+		if a.GetName() == "create" {
+			foundCreate = true
+		}
+	}
+	s.True(foundRead)
+	s.True(foundCreate)
+
+	got, err := s.db.PolicyClient.GetAttributeValue(s.ctx, fixture.AttributeValueID)
+	s.Require().NoError(err)
+	s.NotNil(got)
+	s.Equal(fixture.AttributeValueID, got.GetId())
+	metadata := sm.GetMetadata()
+	createdAt := metadata.GetCreatedAt()
+	updatedAt := metadata.GetUpdatedAt()
+	s.True(createdAt.IsValid() && createdAt.AsTime().Unix() > 0)
+	s.True(updatedAt.IsValid() && updatedAt.AsTime().Unix() > 0)
+}
 
 func (s *SubjectMappingsSuite) Test_GetSubjectMapping_NonExistentId_Fails() {
 	sm, err := s.db.PolicyClient.GetSubjectMapping(s.ctx, nonExistentSubjectMappingID)
@@ -1103,75 +1133,89 @@ func (s *SubjectMappingsSuite) TestGetMatchedSubjectMappings_IgnoresExternalValu
 	s.NotNil(matched.GetActions())
 }
 
-// func (s *SubjectMappingsSuite) TestGetMatchedSubjectMappings_MultipleMatches() {
-// 	externalSelector1 := ".idp_field"
-// 	externalSelector2 := ".org.attributes[]"
-// 	// create a two subject mappings with different subject condition sets
-// 	fixtureAttrValID := s.f.GetAttributeValueKey("example.com/attr/attr2/value/value2").ID
-// 	newScs := &subjectmapping.SubjectConditionSetCreate{
-// 		SubjectSets: []*policy.SubjectSet{
-// 			{
-// 				ConditionGroups: []*policy.ConditionGroup{
-// 					{
-// 						BooleanOperator: policy.ConditionBooleanTypeEnum_CONDITION_BOOLEAN_TYPE_ENUM_AND,
-// 						Conditions: []*policy.Condition{
-// 							{
-// 								SubjectExternalSelectorValue: externalSelector1,
-// 								Operator:                     policy.SubjectMappingOperatorEnum_SUBJECT_MAPPING_OPERATOR_ENUM_IN,
-// 								SubjectExternalValues:        []string{"idp_value"},
-// 							},
-// 						},
-// 					},
-// 				},
-// 			},
-// 		},
-// 	}
-
-// 	subjectMapping := &subjectmapping.CreateSubjectMappingRequest{
-// 		AttributeValueId:       fixtureAttrValID,
-// 		Actions:                []*policy.Action{fixtureActionCustomUpload, fixtureActionCustomDownload},
-// 		NewSubjectConditionSet: newScs,
-// 	}
-
-// 	subjectMappingFirst, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, subjectMapping)
-// 	s.Require().NoError(err)
-// 	s.NotNil(subjectMappingFirst)
-
-// 	// create the second subject mapping with the second SCS
-// 	newScs.SubjectSets[0].ConditionGroups[0].Conditions[0].SubjectExternalSelectorValue = externalSelector2
-// 	subjectMapping.NewSubjectConditionSet = newScs
-
-// 	subjectMappingSecond, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, subjectMapping)
-// 	s.Require().NoError(err)
-// 	s.NotNil(subjectMappingSecond)
-
-// 	props := []*policy.SubjectProperty{
-// 		{
-// 			ExternalSelectorValue: externalSelector1,
-// 		},
-// 		{
-// 			ExternalSelectorValue: externalSelector2,
-// 		},
-// 	}
-
-// 	candidateEntitlements, err := s.db.PolicyClient.GetMatchedSubjectMappings(s.ctx, props)
-// 	s.Require().NoError(err)
-// 	s.NotZero(candidateEntitlements)
-// 	s.GreaterOrEqual(len(candidateEntitlements), 2)
-
-// 	foundFirst := false
-// 	foundSecond := false
-
-// 	for _, sm := range candidateEntitlements {
-// 		if sm.GetId() == subjectMappingFirst.GetId() {
-// 			foundFirst = true
-// 		} else if sm.GetId() == subjectMappingSecond.GetId() {
-// 			foundSecond = true
-// 		}
-// 	}
-// 	s.True(foundFirst)
-// 	s.True(foundSecond)
-// }
+func (s *SubjectMappingsSuite) TestGetMatchedSubjectMappings_MultipleMatches() {
+	externalSelector1 := ".idp_field"
+	externalSelector2 := ".org.attributes[]"
+	// create a two subject mappings with different subject condition sets
+	fixtureAttrValID := s.f.GetAttributeValueKey("example.com/attr/attr2/value/value2").ID
+	newScs := &subjectmapping.SubjectConditionSetCreate{
+		SubjectSets: []*policy.SubjectSet{
+			{
+				ConditionGroups: []*policy.ConditionGroup{
+					{
+						BooleanOperator: policy.ConditionBooleanTypeEnum_CONDITION_BOOLEAN_TYPE_ENUM_AND,
+						Conditions: []*policy.Condition{
+							{
+								SubjectExternalSelectorValue: externalSelector1,
+								Operator:                     policy.SubjectMappingOperatorEnum_SUBJECT_MAPPING_OPERATOR_ENUM_IN,
+								SubjectExternalValues:        []string{"idp_value"},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	subjectMapping := &subjectmapping.CreateSubjectMappingRequest{
+		AttributeValueId:       fixtureAttrValID,
+		Actions:                []*policy.Action{fixtureActionCustomUpload, fixtureActionCustomDownload},
+		NewSubjectConditionSet: newScs,
+	}
+
+	subjectMappingFirst, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, subjectMapping)
+	s.Require().NoError(err)
+	s.NotNil(subjectMappingFirst)
+
+	// create the second subject mapping with the second SCS
+	newScs.SubjectSets[0].ConditionGroups[0].Conditions[0].SubjectExternalSelectorValue = externalSelector2
+	subjectMapping.NewSubjectConditionSet = newScs
+
+	subjectMappingSecond, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, subjectMapping)
+	s.Require().NoError(err)
+	s.NotNil(subjectMappingSecond)
+
+	props := []*policy.SubjectProperty{
+		{
+			ExternalSelectorValue: externalSelector1,
+		},
+		{
+			ExternalSelectorValue: externalSelector2,
+		},
+	}
+
+	candidateEntitlements, err := s.db.PolicyClient.GetMatchedSubjectMappings(s.ctx, props)
+	s.Require().NoError(err)
+	s.NotZero(candidateEntitlements)
+	s.GreaterOrEqual(len(candidateEntitlements), 2)
+
+	foundFirstSM := false
+	foundSecondSM := false
+	for _, sm := range candidateEntitlements {
+		if sm.GetId() == subjectMappingFirst.GetId() {
+			foundFirstSM = true
+		} else if sm.GetId() == subjectMappingSecond.GetId() {
+			foundSecondSM = true
+		}
+		foundUpload := false
+		foundDownload := false
+		for _, a := range sm.GetActions() {
+			s.NotEmpty(a.GetId())
+			s.NotEmpty(a.GetName())
+			if a.GetName() == fixtureActionCustomUpload.GetName() {
+				foundUpload = true
+			}
+			if a.GetName() == fixtureActionCustomDownload.GetName() {
+				foundDownload = true
+			}
+		}
+		s.True(foundUpload)
+		s.True(foundDownload)
+	}
+
+	s.True(foundFirstSM)
+	s.True(foundSecondSM)
+}
 
 func (s *SubjectMappingsSuite) TestGetMatchedSubjectMappings_DeactivatedValueNotReturned() {
 	// create a new subject mapping with a deactivated attribute value
diff --git a/service/policy/db/query.sql b/service/policy/db/query.sql
index f8fe7a05ea..9fe92ebe31 100644
--- a/service/policy/db/query.sql
+++ b/service/policy/db/query.sql
@@ -971,41 +971,50 @@ SELECT id FROM inserted_mapping;
 
 -- name: updateSubjectMapping :execrows
 WITH
-	subject_mapping_update AS (
-		UPDATE subject_mappings
-		SET
-			metadata = COALESCE(sqlc.narg('metadata')::JSONB, metadata),
-			subject_condition_set_id = COALESCE(sqlc.narg('subject_condition_set_id')::UUID, subject_condition_set_id)
-		WHERE id = sqlc.arg('id')
-		RETURNING id
-	),
-	action_delete AS (
-		DELETE FROM subject_mapping_actions
-		WHERE
-			subject_mapping_id = sqlc.arg('id')
-			AND sqlc.narg('action_ids')::UUID[] IS NOT NULL
-	),
-	action_insert AS (
-		INSERT INTO
-			subject_mapping_actions (subject_mapping_id, action_id)
-		SELECT
-			sqlc.arg('id'),
-			unnest_value
-		FROM unnest(sqlc.narg('action_ids')::UUID[]) AS unnest_value
-		WHERE sqlc.narg('action_ids')::UUID[] IS NOT NULL
-		ON CONFLICT (subject_mapping_id, action_id) DO NOTHING
-	),
-	update_count AS (
-		SELECT COUNT(*) AS cnt
-		FROM subject_mapping_update
-	)
+    subject_mapping_update AS (
+        UPDATE subject_mappings
+        SET
+            metadata = COALESCE(sqlc.narg('metadata')::JSONB, metadata),
+            subject_condition_set_id = COALESCE(sqlc.narg('subject_condition_set_id')::UUID, subject_condition_set_id)
+        WHERE id = sqlc.arg('id')
+        RETURNING id
+    ),
+    -- Delete any actions that are NOT in the new list
+    action_delete AS (
+        DELETE FROM subject_mapping_actions
+        WHERE
+            subject_mapping_id = sqlc.arg('id')
+            AND sqlc.narg('action_ids')::UUID[] IS NOT NULL
+            AND action_id NOT IN (SELECT unnest(sqlc.narg('action_ids')::UUID[]))
+        RETURNING action_id
+    ),
+    -- Insert actions that are not already related to the mapping
+    action_insert AS (
+        INSERT INTO
+            subject_mapping_actions (subject_mapping_id, action_id)
+        SELECT
+            sqlc.arg('id'),
+            a
+        FROM unnest(sqlc.narg('action_ids')::UUID[]) AS a
+        WHERE 
+            sqlc.narg('action_ids')::UUID[] IS NOT NULL
+            AND NOT EXISTS (
+                SELECT 1 
+                FROM subject_mapping_actions 
+                WHERE subject_mapping_id = sqlc.arg('id') AND action_id = a
+            )
+        RETURNING action_id
+    ),
+    update_count AS (
+        SELECT COUNT(*) AS cnt
+        FROM subject_mapping_update
+    )
 SELECT
--- Divide by error occurs if id was not found (CTE bypasses typical count failure)
-	1 / CASE WHEN ( 
+    1 / CASE WHEN (
             SELECT cnt FROM update_count
-		) = 0 THEN 0
-		ELSE 1
-	END;
+        ) = 0 THEN 0
+        ELSE 1
+    END;
 
 -- name: deleteSubjectMapping :execrows
 DELETE FROM subject_mappings WHERE id = $1;
diff --git a/service/policy/db/query.sql.go b/service/policy/db/query.sql.go
index 23bb9d724c..55800cdef9 100644
--- a/service/policy/db/query.sql.go
+++ b/service/policy/db/query.sql.go
@@ -4320,40 +4320,50 @@ func (q *Queries) updateStandardAction(ctx context.Context, id string) (int64, e
 
 const updateSubjectMapping = `-- name: updateSubjectMapping :execrows
 WITH
-	subject_mapping_update AS (
-		UPDATE subject_mappings
-		SET
-			metadata = COALESCE($1::JSONB, metadata),
-			subject_condition_set_id = COALESCE($2::UUID, subject_condition_set_id)
-		WHERE id = $3
-		RETURNING id
-	),
-	action_delete AS (
-		DELETE FROM subject_mapping_actions
-		WHERE
-			subject_mapping_id = $3
-			AND $4::UUID[] IS NOT NULL
-	),
-	action_insert AS (
-		INSERT INTO
-			subject_mapping_actions (subject_mapping_id, action_id)
-		SELECT
-			$3,
-			unnest_value
-		FROM unnest($4::UUID[]) AS unnest_value
-		WHERE $4::UUID[] IS NOT NULL
-		ON CONFLICT (subject_mapping_id, action_id) DO NOTHING
-	),
-	update_count AS (
-		SELECT COUNT(*) AS cnt
-		FROM subject_mapping_update
-	)
+    subject_mapping_update AS (
+        UPDATE subject_mappings
+        SET
+            metadata = COALESCE($1::JSONB, metadata),
+            subject_condition_set_id = COALESCE($2::UUID, subject_condition_set_id)
+        WHERE id = $3
+        RETURNING id
+    ),
+    -- Only delete actions that are NOT in the new list
+    action_delete AS (
+        DELETE FROM subject_mapping_actions
+        WHERE
+            subject_mapping_id = $3
+            AND $4::UUID[] IS NOT NULL
+            AND action_id NOT IN (SELECT unnest($4::UUID[]))
+        RETURNING action_id
+    ),
+    -- Only insert actions that don't already exist
+    action_insert AS (
+        INSERT INTO
+            subject_mapping_actions (subject_mapping_id, action_id)
+        SELECT
+            $3,
+            a
+        FROM unnest($4::UUID[]) AS a
+        WHERE 
+            $4::UUID[] IS NOT NULL
+            AND NOT EXISTS (
+                SELECT 1 
+                FROM subject_mapping_actions 
+                WHERE subject_mapping_id = $3 AND action_id = a
+            )
+        RETURNING action_id
+    ),
+    update_count AS (
+        SELECT COUNT(*) AS cnt
+        FROM subject_mapping_update
+    )
 SELECT
-	1 / CASE WHEN ( 
+    1 / CASE WHEN (
             SELECT cnt FROM update_count
-		) = 0 THEN 0
-		ELSE 1
-	END
+        ) = 0 THEN 0
+        ELSE 1
+    END
 `
 
 type updateSubjectMappingParams struct {
@@ -4363,43 +4373,53 @@ type updateSubjectMappingParams struct {
 	ActionIds             []string    `json:"action_ids"`
 }
 
-// Divide by error occurs if id was not found (CTE bypasses typical count failure)
+// updateSubjectMapping
 //
 //	WITH
-//		subject_mapping_update AS (
-//			UPDATE subject_mappings
-//			SET
-//				metadata = COALESCE($1::JSONB, metadata),
-//				subject_condition_set_id = COALESCE($2::UUID, subject_condition_set_id)
-//			WHERE id = $3
-//			RETURNING id
-//		),
-//		action_delete AS (
-//			DELETE FROM subject_mapping_actions
-//			WHERE
-//				subject_mapping_id = $3
-//				AND $4::UUID[] IS NOT NULL
-//		),
-//		action_insert AS (
-//			INSERT INTO
-//				subject_mapping_actions (subject_mapping_id, action_id)
-//			SELECT
-//				$3,
-//				unnest_value
-//			FROM unnest($4::UUID[]) AS unnest_value
-//			WHERE $4::UUID[] IS NOT NULL
-//			ON CONFLICT (subject_mapping_id, action_id) DO NOTHING
-//		),
-//		update_count AS (
-//			SELECT COUNT(*) AS cnt
-//			FROM subject_mapping_update
-//		)
+//	    subject_mapping_update AS (
+//	        UPDATE subject_mappings
+//	        SET
+//	            metadata = COALESCE($1::JSONB, metadata),
+//	            subject_condition_set_id = COALESCE($2::UUID, subject_condition_set_id)
+//	        WHERE id = $3
+//	        RETURNING id
+//	    ),
+//	    -- Only delete actions that are NOT in the new list
+//	    action_delete AS (
+//	        DELETE FROM subject_mapping_actions
+//	        WHERE
+//	            subject_mapping_id = $3
+//	            AND $4::UUID[] IS NOT NULL
+//	            AND action_id NOT IN (SELECT unnest($4::UUID[]))
+//	        RETURNING action_id
+//	    ),
+//	    -- Only insert actions that don't already exist
+//	    action_insert AS (
+//	        INSERT INTO
+//	            subject_mapping_actions (subject_mapping_id, action_id)
+//	        SELECT
+//	            $3,
+//	            a
+//	        FROM unnest($4::UUID[]) AS a
+//	        WHERE
+//	            $4::UUID[] IS NOT NULL
+//	            AND NOT EXISTS (
+//	                SELECT 1
+//	                FROM subject_mapping_actions
+//	                WHERE subject_mapping_id = $3 AND action_id = a
+//	            )
+//	        RETURNING action_id
+//	    ),
+//	    update_count AS (
+//	        SELECT COUNT(*) AS cnt
+//	        FROM subject_mapping_update
+//	    )
 //	SELECT
-//		1 / CASE WHEN (
+//	    1 / CASE WHEN (
 //	            SELECT cnt FROM update_count
-//			) = 0 THEN 0
-//			ELSE 1
-//		END
+//	        ) = 0 THEN 0
+//	        ELSE 1
+//	    END
 func (q *Queries) updateSubjectMapping(ctx context.Context, arg updateSubjectMappingParams) (int64, error) {
 	result, err := q.db.Exec(ctx, updateSubjectMapping,
 		arg.Metadata,
diff --git a/service/policy/db/subject_mappings.go b/service/policy/db/subject_mappings.go
index c968410849..2ad2abf017 100644
--- a/service/policy/db/subject_mappings.go
+++ b/service/policy/db/subject_mappings.go
@@ -452,8 +452,8 @@ func (c PolicyDBClient) UpdateSubjectMapping(ctx context.Context, r *subjectmapp
 		SubjectConditionSetID: pgtypeUUID(subjectConditionSetID),
 	}
 
-	actionIDs := make([]string, 0)
-	if len(actions) > 0 {
+	if actions != nil {
+		actionIDs := make([]string, 0)
 		actionNames := make([]string, 0)
 		// Check for provided existing Action IDs and existing/new Action Names
 		for _, a := range actions {

From c518f458f67f19597b7df79659bd18f813552b4d Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 4 Apr 2025 12:29:50 -0700
Subject: [PATCH 033/110] run suites again

---
 service/integration/attribute_values_test.go  | 2 +-
 service/integration/attributes_test.go        | 2 +-
 service/integration/kas_registry_test.go      | 2 +-
 service/integration/namespaces_test.go        | 2 +-
 service/integration/policy_test.go            | 2 +-
 service/integration/resource_mappings_test.go | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/service/integration/attribute_values_test.go b/service/integration/attribute_values_test.go
index c7be1fd9bc..bb3636f3b0 100644
--- a/service/integration/attribute_values_test.go
+++ b/service/integration/attribute_values_test.go
@@ -983,5 +983,5 @@ func TestAttributeValuesSuite(t *testing.T) {
 	if testing.Short() {
 		t.Skip("skipping attribute values integration tests")
 	}
-	// suite.Run(t, new(AttributeValuesSuite))
+	suite.Run(t, new(AttributeValuesSuite))
 }
diff --git a/service/integration/attributes_test.go b/service/integration/attributes_test.go
index 21f768788f..7c09e7567f 100644
--- a/service/integration/attributes_test.go
+++ b/service/integration/attributes_test.go
@@ -1340,5 +1340,5 @@ func TestAttributesSuite(t *testing.T) {
 	if testing.Short() {
 		t.Skip("skipping attributes integration tests")
 	}
-	// suite.Run(t, new(AttributesSuite))
+	suite.Run(t, new(AttributesSuite))
 }
diff --git a/service/integration/kas_registry_test.go b/service/integration/kas_registry_test.go
index c13ff1cd77..a31b82cd0b 100644
--- a/service/integration/kas_registry_test.go
+++ b/service/integration/kas_registry_test.go
@@ -1637,5 +1637,5 @@ func TestKasRegistrySuite(t *testing.T) {
 	if testing.Short() {
 		t.Skip("skipping db.KasRegistry integration tests")
 	}
-	// suite.Run(t, new(KasRegistrySuite))
+	suite.Run(t, new(KasRegistrySuite))
 }
diff --git a/service/integration/namespaces_test.go b/service/integration/namespaces_test.go
index 8bb9877334..8024403248 100644
--- a/service/integration/namespaces_test.go
+++ b/service/integration/namespaces_test.go
@@ -1173,5 +1173,5 @@ func TestNamespacesSuite(t *testing.T) {
 	if testing.Short() {
 		t.Skip("skipping namespaces integration tests")
 	}
-	// suite.Run(t, new(NamespacesSuite))
+	suite.Run(t, new(NamespacesSuite))
 }
diff --git a/service/integration/policy_test.go b/service/integration/policy_test.go
index acf96d21ec..986828791d 100644
--- a/service/integration/policy_test.go
+++ b/service/integration/policy_test.go
@@ -124,5 +124,5 @@ func TestPolicySuite(t *testing.T) {
 	if testing.Short() {
 		t.Skip("skipping policy integration tests")
 	}
-	// suite.Run(t, new(PolicyDBClientSuite))
+	suite.Run(t, new(PolicyDBClientSuite))
 }
diff --git a/service/integration/resource_mappings_test.go b/service/integration/resource_mappings_test.go
index d7d33ef40f..f66fac7bcf 100644
--- a/service/integration/resource_mappings_test.go
+++ b/service/integration/resource_mappings_test.go
@@ -921,5 +921,5 @@ func TestResourceMappingsSuite(t *testing.T) {
 	if testing.Short() {
 		t.Skip("skipping resource mappings integration tests")
 	}
-	// suite.Run(t, new(ResourceMappingsSuite))
+	suite.Run(t, new(ResourceMappingsSuite))
 }

From b91046a9e2d8d2a48c6d6c7c2a8f83cbb001aa98 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 4 Apr 2025 12:36:48 -0700
Subject: [PATCH 034/110] fix subject mapping retrieval in lookup by fqn

---
 service/integration/attribute_fqns_test.go |   2 +-
 service/policy/db/attributes.go            |   2 +-
 service/policy/db/query.sql                |  17 +-
 service/policy/db/query.sql.go             | 764 +++++++++++----------
 4 files changed, 412 insertions(+), 373 deletions(-)

diff --git a/service/integration/attribute_fqns_test.go b/service/integration/attribute_fqns_test.go
index 1aa6689db2..8902a88481 100644
--- a/service/integration/attribute_fqns_test.go
+++ b/service/integration/attribute_fqns_test.go
@@ -43,7 +43,7 @@ func TestAttributeFqnSuite(t *testing.T) {
 	if testing.Short() {
 		t.Skip("skipping attributes integration tests")
 	}
-	// suite.Run(t, new(AttributeFqnSuite))
+	suite.Run(t, new(AttributeFqnSuite))
 }
 
 func (s *AttributeFqnSuite) SetupSuite() {
diff --git a/service/policy/db/attributes.go b/service/policy/db/attributes.go
index 087ae74615..4b8115b96f 100644
--- a/service/policy/db/attributes.go
+++ b/service/policy/db/attributes.go
@@ -283,7 +283,7 @@ func (c PolicyDBClient) GetAttribute(ctx context.Context, identifier any) (*poli
 }
 
 func (c PolicyDBClient) ListAttributesByFqns(ctx context.Context, fqns []string) ([]*policy.Attribute, error) {
-	list, err := c.Queries.ListAttributesByDefOrValueFqns(ctx, fqns)
+	list, err := c.Queries.listAttributesByDefOrValueFqns(ctx, fqns)
 	if err != nil {
 		return nil, db.WrapIfKnownInvalidQueryErr(err)
 	}
diff --git a/service/policy/db/query.sql b/service/policy/db/query.sql
index 9fe92ebe31..0e1793985b 100644
--- a/service/policy/db/query.sql
+++ b/service/policy/db/query.sql
@@ -314,7 +314,7 @@ GROUP BY ad.id, n.name, counted.total
 LIMIT @limit_ 
 OFFSET @offset_; 
 
--- name: ListAttributesByDefOrValueFqns :many
+-- name: listAttributesByDefOrValueFqns :many
 -- get the attribute definition for the provided value or definition fqn
 WITH target_definition AS (
     SELECT DISTINCT
@@ -393,7 +393,20 @@ value_subject_mappings AS (
 		JSON_AGG(
             JSON_BUILD_OBJECT(
                 'id', sm.id,
-                'actions', sm.actions,
+                'actions', (
+                    SELECT COALESCE(
+                        JSON_AGG(
+                            JSON_BUILD_OBJECT(
+                                'id', a.id,
+                                'name', a.name
+                            )
+                        ) FILTER (WHERE a.id IS NOT NULL),
+                        '[]'::JSON
+                    )
+                    FROM subject_mapping_actions sma
+                    LEFT JOIN actions a ON sma.action_id = a.id
+                    WHERE sma.subject_mapping_id = sm.id
+                ),
                 'subject_condition_set', JSON_BUILD_OBJECT(
                     'id', scs.id,
                     'subject_sets', scs.condition
diff --git a/service/policy/db/query.sql.go b/service/policy/db/query.sql.go
index 55800cdef9..d82b5111b3 100644
--- a/service/policy/db/query.sql.go
+++ b/service/policy/db/query.sql.go
@@ -960,311 +960,6 @@ func (q *Queries) ListAttributeValues(ctx context.Context, arg ListAttributeValu
 	return items, nil
 }
 
-const listAttributesByDefOrValueFqns = `-- name: ListAttributesByDefOrValueFqns :many
-WITH target_definition AS (
-    SELECT DISTINCT
-        ad.id,
-        ad.namespace_id,
-        ad.name,
-        ad.rule,
-        ad.active,
-        ad.values_order,
-        JSONB_AGG(
-	        DISTINCT JSONB_BUILD_OBJECT(
-	            'id', kas.id,
-	            'uri', kas.uri,
-                'name', kas.name,
-	            'public_key', kas.public_key
-	        )
-	    ) FILTER (WHERE kas.id IS NOT NULL) AS grants,
-        k.keys AS keys
-    FROM attribute_fqns fqns
-    INNER JOIN attribute_definitions ad ON fqns.attribute_id = ad.id
-    LEFT JOIN attribute_definition_key_access_grants adkag ON ad.id = adkag.attribute_definition_id
-    LEFT JOIN key_access_servers kas ON adkag.key_access_server_id = kas.id
-    LEFT JOIN active_definition_public_keys_view k ON ad.id = k.definition_id
-    WHERE fqns.fqn = ANY($1::TEXT[]) 
-        AND ad.active = TRUE
-    GROUP BY ad.id, k.keys
-),
-namespaces AS (
-	SELECT
-		n.id,
-		JSON_BUILD_OBJECT(
-			'id', n.id,
-			'name', n.name,
-			'active', n.active,
-	        'fqn', fqns.fqn,
-	        'grants', JSONB_AGG(
-	            DISTINCT JSONB_BUILD_OBJECT(
-	                'id', kas.id,
-	                'uri', kas.uri,
-                    'name', kas.name,
-	                'public_key', kas.public_key
-	            )
-	        ) FILTER (WHERE kas.id IS NOT NULL),
-            'keys', k.keys
-    	) AS namespace
-	FROM target_definition td
-	INNER JOIN attribute_namespaces n ON td.namespace_id = n.id
-	INNER JOIN attribute_fqns fqns ON n.id = fqns.namespace_id
-	LEFT JOIN attribute_namespace_key_access_grants ankag ON n.id = ankag.namespace_id
-	LEFT JOIN key_access_servers kas ON ankag.key_access_server_id = kas.id
-    LEFT JOIN active_namespace_public_keys_view k ON n.id = k.namespace_id
-	WHERE n.active = TRUE
-		AND (fqns.attribute_id IS NULL AND fqns.value_id IS NULL)
-	GROUP BY n.id, fqns.fqn, k.keys
-),
-value_grants AS (
-	SELECT
-		av.id,
-		JSON_AGG(
-			DISTINCT JSONB_BUILD_OBJECT(
-				'id', kas.id,
-                'uri', kas.uri,
-                'name', kas.name,
-                'public_key', kas.public_key
-            )
-		) FILTER (WHERE kas.id IS NOT NULL) AS grants
-	FROM target_definition td
-	LEFT JOIN attribute_values av on td.id = av.attribute_definition_id
-	LEFT JOIN attribute_value_key_access_grants avkag ON av.id = avkag.attribute_value_id
-	LEFT JOIN key_access_servers kas ON avkag.key_access_server_id = kas.id
-	GROUP BY av.id
-),
-value_subject_mappings AS (
-	SELECT
-		av.id,
-		JSON_AGG(
-            JSON_BUILD_OBJECT(
-                'id', sm.id,
-                'actions', sm.actions,
-                'subject_condition_set', JSON_BUILD_OBJECT(
-                    'id', scs.id,
-                    'subject_sets', scs.condition
-                )
-            )
-        ) FILTER (WHERE sm.id IS NOT NULL) AS sub_maps
-	FROM target_definition td
-	LEFT JOIN attribute_values av ON td.id = av.attribute_definition_id
-	LEFT JOIN subject_mappings sm ON av.id = sm.attribute_value_id
-	LEFT JOIN subject_condition_set scs ON sm.subject_condition_set_id = scs.id
-	GROUP BY av.id
-),
-values AS (
-    SELECT
-		av.attribute_definition_id,
-		JSON_AGG(
-	        JSON_BUILD_OBJECT(
-	            'id', av.id,
-	            'value', av.value,
-	            'active', av.active,
-	            'fqn', fqns.fqn,
-	            'grants', avg.grants,
-	            'subject_mappings', avsm.sub_maps,
-                'keys', k.keys
-	        -- enforce order of values in response
-	        ) ORDER BY ARRAY_POSITION(td.values_order, av.id)
-	    ) AS values
-	FROM target_definition td
-	LEFT JOIN attribute_values av ON td.id = av.attribute_definition_id
-	LEFT JOIN attribute_fqns fqns ON av.id = fqns.value_id
-	LEFT JOIN value_grants avg ON av.id = avg.id
-	LEFT JOIN value_subject_mappings avsm ON av.id = avsm.id
-    LEFT JOIN active_value_public_keys_view k ON av.id = k.value_id                        
-	WHERE av.active = TRUE
-	GROUP BY av.attribute_definition_id
-)
-SELECT
-	td.id,
-	td.name,
-    td.rule,
-	td.active,
-	n.namespace,
-	fqns.fqn,
-	values.values,
-	td.grants,
-    td.keys
-FROM target_definition td
-INNER JOIN attribute_fqns fqns ON td.id = fqns.attribute_id
-INNER JOIN namespaces n ON td.namespace_id = n.id
-LEFT JOIN values ON td.id = values.attribute_definition_id
-WHERE fqns.value_id IS NULL
-`
-
-type ListAttributesByDefOrValueFqnsRow struct {
-	ID        string                  `json:"id"`
-	Name      string                  `json:"name"`
-	Rule      AttributeDefinitionRule `json:"rule"`
-	Active    bool                    `json:"active"`
-	Namespace []byte                  `json:"namespace"`
-	Fqn       string                  `json:"fqn"`
-	Values    []byte                  `json:"values"`
-	Grants    []byte                  `json:"grants"`
-	Keys      []byte                  `json:"keys"`
-}
-
-// get the attribute definition for the provided value or definition fqn
-//
-//	WITH target_definition AS (
-//	    SELECT DISTINCT
-//	        ad.id,
-//	        ad.namespace_id,
-//	        ad.name,
-//	        ad.rule,
-//	        ad.active,
-//	        ad.values_order,
-//	        JSONB_AGG(
-//		        DISTINCT JSONB_BUILD_OBJECT(
-//		            'id', kas.id,
-//		            'uri', kas.uri,
-//	                'name', kas.name,
-//		            'public_key', kas.public_key
-//		        )
-//		    ) FILTER (WHERE kas.id IS NOT NULL) AS grants,
-//	        k.keys AS keys
-//	    FROM attribute_fqns fqns
-//	    INNER JOIN attribute_definitions ad ON fqns.attribute_id = ad.id
-//	    LEFT JOIN attribute_definition_key_access_grants adkag ON ad.id = adkag.attribute_definition_id
-//	    LEFT JOIN key_access_servers kas ON adkag.key_access_server_id = kas.id
-//	    LEFT JOIN active_definition_public_keys_view k ON ad.id = k.definition_id
-//	    WHERE fqns.fqn = ANY($1::TEXT[])
-//	        AND ad.active = TRUE
-//	    GROUP BY ad.id, k.keys
-//	),
-//	namespaces AS (
-//		SELECT
-//			n.id,
-//			JSON_BUILD_OBJECT(
-//				'id', n.id,
-//				'name', n.name,
-//				'active', n.active,
-//		        'fqn', fqns.fqn,
-//		        'grants', JSONB_AGG(
-//		            DISTINCT JSONB_BUILD_OBJECT(
-//		                'id', kas.id,
-//		                'uri', kas.uri,
-//	                    'name', kas.name,
-//		                'public_key', kas.public_key
-//		            )
-//		        ) FILTER (WHERE kas.id IS NOT NULL),
-//	            'keys', k.keys
-//	    	) AS namespace
-//		FROM target_definition td
-//		INNER JOIN attribute_namespaces n ON td.namespace_id = n.id
-//		INNER JOIN attribute_fqns fqns ON n.id = fqns.namespace_id
-//		LEFT JOIN attribute_namespace_key_access_grants ankag ON n.id = ankag.namespace_id
-//		LEFT JOIN key_access_servers kas ON ankag.key_access_server_id = kas.id
-//	    LEFT JOIN active_namespace_public_keys_view k ON n.id = k.namespace_id
-//		WHERE n.active = TRUE
-//			AND (fqns.attribute_id IS NULL AND fqns.value_id IS NULL)
-//		GROUP BY n.id, fqns.fqn, k.keys
-//	),
-//	value_grants AS (
-//		SELECT
-//			av.id,
-//			JSON_AGG(
-//				DISTINCT JSONB_BUILD_OBJECT(
-//					'id', kas.id,
-//	                'uri', kas.uri,
-//	                'name', kas.name,
-//	                'public_key', kas.public_key
-//	            )
-//			) FILTER (WHERE kas.id IS NOT NULL) AS grants
-//		FROM target_definition td
-//		LEFT JOIN attribute_values av on td.id = av.attribute_definition_id
-//		LEFT JOIN attribute_value_key_access_grants avkag ON av.id = avkag.attribute_value_id
-//		LEFT JOIN key_access_servers kas ON avkag.key_access_server_id = kas.id
-//		GROUP BY av.id
-//	),
-//	value_subject_mappings AS (
-//		SELECT
-//			av.id,
-//			JSON_AGG(
-//	            JSON_BUILD_OBJECT(
-//	                'id', sm.id,
-//	                'actions', sm.actions,
-//	                'subject_condition_set', JSON_BUILD_OBJECT(
-//	                    'id', scs.id,
-//	                    'subject_sets', scs.condition
-//	                )
-//	            )
-//	        ) FILTER (WHERE sm.id IS NOT NULL) AS sub_maps
-//		FROM target_definition td
-//		LEFT JOIN attribute_values av ON td.id = av.attribute_definition_id
-//		LEFT JOIN subject_mappings sm ON av.id = sm.attribute_value_id
-//		LEFT JOIN subject_condition_set scs ON sm.subject_condition_set_id = scs.id
-//		GROUP BY av.id
-//	),
-//	values AS (
-//	    SELECT
-//			av.attribute_definition_id,
-//			JSON_AGG(
-//		        JSON_BUILD_OBJECT(
-//		            'id', av.id,
-//		            'value', av.value,
-//		            'active', av.active,
-//		            'fqn', fqns.fqn,
-//		            'grants', avg.grants,
-//		            'subject_mappings', avsm.sub_maps,
-//	                'keys', k.keys
-//		        -- enforce order of values in response
-//		        ) ORDER BY ARRAY_POSITION(td.values_order, av.id)
-//		    ) AS values
-//		FROM target_definition td
-//		LEFT JOIN attribute_values av ON td.id = av.attribute_definition_id
-//		LEFT JOIN attribute_fqns fqns ON av.id = fqns.value_id
-//		LEFT JOIN value_grants avg ON av.id = avg.id
-//		LEFT JOIN value_subject_mappings avsm ON av.id = avsm.id
-//	    LEFT JOIN active_value_public_keys_view k ON av.id = k.value_id
-//		WHERE av.active = TRUE
-//		GROUP BY av.attribute_definition_id
-//	)
-//	SELECT
-//		td.id,
-//		td.name,
-//	    td.rule,
-//		td.active,
-//		n.namespace,
-//		fqns.fqn,
-//		values.values,
-//		td.grants,
-//	    td.keys
-//	FROM target_definition td
-//	INNER JOIN attribute_fqns fqns ON td.id = fqns.attribute_id
-//	INNER JOIN namespaces n ON td.namespace_id = n.id
-//	LEFT JOIN values ON td.id = values.attribute_definition_id
-//	WHERE fqns.value_id IS NULL
-func (q *Queries) ListAttributesByDefOrValueFqns(ctx context.Context, fqns []string) ([]ListAttributesByDefOrValueFqnsRow, error) {
-	rows, err := q.db.Query(ctx, listAttributesByDefOrValueFqns, fqns)
-	if err != nil {
-		return nil, err
-	}
-	defer rows.Close()
-	var items []ListAttributesByDefOrValueFqnsRow
-	for rows.Next() {
-		var i ListAttributesByDefOrValueFqnsRow
-		if err := rows.Scan(
-			&i.ID,
-			&i.Name,
-			&i.Rule,
-			&i.Active,
-			&i.Namespace,
-			&i.Fqn,
-			&i.Values,
-			&i.Grants,
-			&i.Keys,
-		); err != nil {
-			return nil, err
-		}
-		items = append(items, i)
-	}
-	if err := rows.Err(); err != nil {
-		return nil, err
-	}
-	return items, nil
-}
-
 const listAttributesDetail = `-- name: ListAttributesDetail :many
 
 WITH counted AS (
@@ -3469,78 +3164,409 @@ SELECT
                     'updated_at', updated_at
                 ))
             )
-        )
-        FROM actions
-        WHERE is_standard = FALSE
-    ) AS custom_actions,
-    (SELECT total FROM counted) AS total
-LIMIT $2 
-OFFSET $1
+        )
+        FROM actions
+        WHERE is_standard = FALSE
+    ) AS custom_actions,
+    (SELECT total FROM counted) AS total
+LIMIT $2 
+OFFSET $1
+`
+
+type listActionsParams struct {
+	Offset int32 `json:"offset_"`
+	Limit  int32 `json:"limit_"`
+}
+
+type listActionsRow struct {
+	StandardActions []byte `json:"standard_actions"`
+	CustomActions   []byte `json:"custom_actions"`
+	Total           int64  `json:"total"`
+}
+
+// --------------------------------------------------------------
+// --------------------------------------------------------------
+// ACTIONS
+// --------------------------------------------------------------
+//
+//	WITH counted AS (
+//	    SELECT COUNT(id) AS total FROM actions
+//	)
+//	SELECT
+//	    (
+//	        SELECT JSONB_AGG(
+//	            JSONB_BUILD_OBJECT(
+//	                'id', id,
+//	                'name', name,
+//	                'metadata', JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
+//	                    'labels', metadata -> 'labels',
+//	                    'created_at', created_at,
+//	                    'updated_at', updated_at
+//	                ))
+//	            )
+//	        )
+//	        FROM actions
+//	        WHERE is_standard = TRUE
+//	    ) AS standard_actions,
+//	    (
+//	        SELECT JSONB_AGG(
+//	            JSONB_BUILD_OBJECT(
+//	                'id', id,
+//	                'name', name,
+//	                'metadata', JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
+//	                    'labels', metadata -> 'labels',
+//	                    'created_at', created_at,
+//	                    'updated_at', updated_at
+//	                ))
+//	            )
+//	        )
+//	        FROM actions
+//	        WHERE is_standard = FALSE
+//	    ) AS custom_actions,
+//	    (SELECT total FROM counted) AS total
+//	LIMIT $2
+//	OFFSET $1
+func (q *Queries) listActions(ctx context.Context, arg listActionsParams) ([]listActionsRow, error) {
+	rows, err := q.db.Query(ctx, listActions, arg.Offset, arg.Limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []listActionsRow
+	for rows.Next() {
+		var i listActionsRow
+		if err := rows.Scan(&i.StandardActions, &i.CustomActions, &i.Total); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listAttributesByDefOrValueFqns = `-- name: listAttributesByDefOrValueFqns :many
+WITH target_definition AS (
+    SELECT DISTINCT
+        ad.id,
+        ad.namespace_id,
+        ad.name,
+        ad.rule,
+        ad.active,
+        ad.values_order,
+        JSONB_AGG(
+	        DISTINCT JSONB_BUILD_OBJECT(
+	            'id', kas.id,
+	            'uri', kas.uri,
+                'name', kas.name,
+	            'public_key', kas.public_key
+	        )
+	    ) FILTER (WHERE kas.id IS NOT NULL) AS grants,
+        k.keys AS keys
+    FROM attribute_fqns fqns
+    INNER JOIN attribute_definitions ad ON fqns.attribute_id = ad.id
+    LEFT JOIN attribute_definition_key_access_grants adkag ON ad.id = adkag.attribute_definition_id
+    LEFT JOIN key_access_servers kas ON adkag.key_access_server_id = kas.id
+    LEFT JOIN active_definition_public_keys_view k ON ad.id = k.definition_id
+    WHERE fqns.fqn = ANY($1::TEXT[]) 
+        AND ad.active = TRUE
+    GROUP BY ad.id, k.keys
+),
+namespaces AS (
+	SELECT
+		n.id,
+		JSON_BUILD_OBJECT(
+			'id', n.id,
+			'name', n.name,
+			'active', n.active,
+	        'fqn', fqns.fqn,
+	        'grants', JSONB_AGG(
+	            DISTINCT JSONB_BUILD_OBJECT(
+	                'id', kas.id,
+	                'uri', kas.uri,
+                    'name', kas.name,
+	                'public_key', kas.public_key
+	            )
+	        ) FILTER (WHERE kas.id IS NOT NULL),
+            'keys', k.keys
+    	) AS namespace
+	FROM target_definition td
+	INNER JOIN attribute_namespaces n ON td.namespace_id = n.id
+	INNER JOIN attribute_fqns fqns ON n.id = fqns.namespace_id
+	LEFT JOIN attribute_namespace_key_access_grants ankag ON n.id = ankag.namespace_id
+	LEFT JOIN key_access_servers kas ON ankag.key_access_server_id = kas.id
+    LEFT JOIN active_namespace_public_keys_view k ON n.id = k.namespace_id
+	WHERE n.active = TRUE
+		AND (fqns.attribute_id IS NULL AND fqns.value_id IS NULL)
+	GROUP BY n.id, fqns.fqn, k.keys
+),
+value_grants AS (
+	SELECT
+		av.id,
+		JSON_AGG(
+			DISTINCT JSONB_BUILD_OBJECT(
+				'id', kas.id,
+                'uri', kas.uri,
+                'name', kas.name,
+                'public_key', kas.public_key
+            )
+		) FILTER (WHERE kas.id IS NOT NULL) AS grants
+	FROM target_definition td
+	LEFT JOIN attribute_values av on td.id = av.attribute_definition_id
+	LEFT JOIN attribute_value_key_access_grants avkag ON av.id = avkag.attribute_value_id
+	LEFT JOIN key_access_servers kas ON avkag.key_access_server_id = kas.id
+	GROUP BY av.id
+),
+value_subject_mappings AS (
+	SELECT
+		av.id,
+		JSON_AGG(
+            JSON_BUILD_OBJECT(
+                'id', sm.id,
+                'actions', (
+                    SELECT COALESCE(
+                        JSON_AGG(
+                            JSON_BUILD_OBJECT(
+                                'id', a.id,
+                                'name', a.name
+                            )
+                        ) FILTER (WHERE a.id IS NOT NULL),
+                        '[]'::JSON
+                    )
+                    FROM subject_mapping_actions sma
+                    LEFT JOIN actions a ON sma.action_id = a.id
+                    WHERE sma.subject_mapping_id = sm.id
+                ),
+                'subject_condition_set', JSON_BUILD_OBJECT(
+                    'id', scs.id,
+                    'subject_sets', scs.condition
+                )
+            )
+        ) FILTER (WHERE sm.id IS NOT NULL) AS sub_maps
+	FROM target_definition td
+	LEFT JOIN attribute_values av ON td.id = av.attribute_definition_id
+	LEFT JOIN subject_mappings sm ON av.id = sm.attribute_value_id
+	LEFT JOIN subject_condition_set scs ON sm.subject_condition_set_id = scs.id
+	GROUP BY av.id
+),
+values AS (
+    SELECT
+		av.attribute_definition_id,
+		JSON_AGG(
+	        JSON_BUILD_OBJECT(
+	            'id', av.id,
+	            'value', av.value,
+	            'active', av.active,
+	            'fqn', fqns.fqn,
+	            'grants', avg.grants,
+	            'subject_mappings', avsm.sub_maps,
+                'keys', k.keys
+	        -- enforce order of values in response
+	        ) ORDER BY ARRAY_POSITION(td.values_order, av.id)
+	    ) AS values
+	FROM target_definition td
+	LEFT JOIN attribute_values av ON td.id = av.attribute_definition_id
+	LEFT JOIN attribute_fqns fqns ON av.id = fqns.value_id
+	LEFT JOIN value_grants avg ON av.id = avg.id
+	LEFT JOIN value_subject_mappings avsm ON av.id = avsm.id
+    LEFT JOIN active_value_public_keys_view k ON av.id = k.value_id                        
+	WHERE av.active = TRUE
+	GROUP BY av.attribute_definition_id
+)
+SELECT
+	td.id,
+	td.name,
+    td.rule,
+	td.active,
+	n.namespace,
+	fqns.fqn,
+	values.values,
+	td.grants,
+    td.keys
+FROM target_definition td
+INNER JOIN attribute_fqns fqns ON td.id = fqns.attribute_id
+INNER JOIN namespaces n ON td.namespace_id = n.id
+LEFT JOIN values ON td.id = values.attribute_definition_id
+WHERE fqns.value_id IS NULL
 `
 
-type listActionsParams struct {
-	Offset int32 `json:"offset_"`
-	Limit  int32 `json:"limit_"`
-}
-
-type listActionsRow struct {
-	StandardActions []byte `json:"standard_actions"`
-	CustomActions   []byte `json:"custom_actions"`
-	Total           int64  `json:"total"`
+type listAttributesByDefOrValueFqnsRow struct {
+	ID        string                  `json:"id"`
+	Name      string                  `json:"name"`
+	Rule      AttributeDefinitionRule `json:"rule"`
+	Active    bool                    `json:"active"`
+	Namespace []byte                  `json:"namespace"`
+	Fqn       string                  `json:"fqn"`
+	Values    []byte                  `json:"values"`
+	Grants    []byte                  `json:"grants"`
+	Keys      []byte                  `json:"keys"`
 }
 
-// --------------------------------------------------------------
-// --------------------------------------------------------------
-// ACTIONS
-// --------------------------------------------------------------
+// get the attribute definition for the provided value or definition fqn
 //
-//	WITH counted AS (
-//	    SELECT COUNT(id) AS total FROM actions
-//	)
-//	SELECT
-//	    (
-//	        SELECT JSONB_AGG(
-//	            JSONB_BUILD_OBJECT(
-//	                'id', id,
-//	                'name', name,
-//	                'metadata', JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
-//	                    'labels', metadata -> 'labels',
-//	                    'created_at', created_at,
-//	                    'updated_at', updated_at
-//	                ))
+//	WITH target_definition AS (
+//	    SELECT DISTINCT
+//	        ad.id,
+//	        ad.namespace_id,
+//	        ad.name,
+//	        ad.rule,
+//	        ad.active,
+//	        ad.values_order,
+//	        JSONB_AGG(
+//		        DISTINCT JSONB_BUILD_OBJECT(
+//		            'id', kas.id,
+//		            'uri', kas.uri,
+//	                'name', kas.name,
+//		            'public_key', kas.public_key
+//		        )
+//		    ) FILTER (WHERE kas.id IS NOT NULL) AS grants,
+//	        k.keys AS keys
+//	    FROM attribute_fqns fqns
+//	    INNER JOIN attribute_definitions ad ON fqns.attribute_id = ad.id
+//	    LEFT JOIN attribute_definition_key_access_grants adkag ON ad.id = adkag.attribute_definition_id
+//	    LEFT JOIN key_access_servers kas ON adkag.key_access_server_id = kas.id
+//	    LEFT JOIN active_definition_public_keys_view k ON ad.id = k.definition_id
+//	    WHERE fqns.fqn = ANY($1::TEXT[])
+//	        AND ad.active = TRUE
+//	    GROUP BY ad.id, k.keys
+//	),
+//	namespaces AS (
+//		SELECT
+//			n.id,
+//			JSON_BUILD_OBJECT(
+//				'id', n.id,
+//				'name', n.name,
+//				'active', n.active,
+//		        'fqn', fqns.fqn,
+//		        'grants', JSONB_AGG(
+//		            DISTINCT JSONB_BUILD_OBJECT(
+//		                'id', kas.id,
+//		                'uri', kas.uri,
+//	                    'name', kas.name,
+//		                'public_key', kas.public_key
+//		            )
+//		        ) FILTER (WHERE kas.id IS NOT NULL),
+//	            'keys', k.keys
+//	    	) AS namespace
+//		FROM target_definition td
+//		INNER JOIN attribute_namespaces n ON td.namespace_id = n.id
+//		INNER JOIN attribute_fqns fqns ON n.id = fqns.namespace_id
+//		LEFT JOIN attribute_namespace_key_access_grants ankag ON n.id = ankag.namespace_id
+//		LEFT JOIN key_access_servers kas ON ankag.key_access_server_id = kas.id
+//	    LEFT JOIN active_namespace_public_keys_view k ON n.id = k.namespace_id
+//		WHERE n.active = TRUE
+//			AND (fqns.attribute_id IS NULL AND fqns.value_id IS NULL)
+//		GROUP BY n.id, fqns.fqn, k.keys
+//	),
+//	value_grants AS (
+//		SELECT
+//			av.id,
+//			JSON_AGG(
+//				DISTINCT JSONB_BUILD_OBJECT(
+//					'id', kas.id,
+//	                'uri', kas.uri,
+//	                'name', kas.name,
+//	                'public_key', kas.public_key
 //	            )
-//	        )
-//	        FROM actions
-//	        WHERE is_standard = TRUE
-//	    ) AS standard_actions,
-//	    (
-//	        SELECT JSONB_AGG(
-//	            JSONB_BUILD_OBJECT(
-//	                'id', id,
-//	                'name', name,
-//	                'metadata', JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
-//	                    'labels', metadata -> 'labels',
-//	                    'created_at', created_at,
-//	                    'updated_at', updated_at
-//	                ))
+//			) FILTER (WHERE kas.id IS NOT NULL) AS grants
+//		FROM target_definition td
+//		LEFT JOIN attribute_values av on td.id = av.attribute_definition_id
+//		LEFT JOIN attribute_value_key_access_grants avkag ON av.id = avkag.attribute_value_id
+//		LEFT JOIN key_access_servers kas ON avkag.key_access_server_id = kas.id
+//		GROUP BY av.id
+//	),
+//	value_subject_mappings AS (
+//		SELECT
+//			av.id,
+//			JSON_AGG(
+//	            JSON_BUILD_OBJECT(
+//	                'id', sm.id,
+//	                'actions', (
+//	                    SELECT COALESCE(
+//	                        JSON_AGG(
+//	                            JSON_BUILD_OBJECT(
+//	                                'id', a.id,
+//	                                'name', a.name
+//	                            )
+//	                        ) FILTER (WHERE a.id IS NOT NULL),
+//	                        '[]'::JSON
+//	                    )
+//	                    FROM subject_mapping_actions sma
+//	                    LEFT JOIN actions a ON sma.action_id = a.id
+//	                    WHERE sma.subject_mapping_id = sm.id
+//	                ),
+//	                'subject_condition_set', JSON_BUILD_OBJECT(
+//	                    'id', scs.id,
+//	                    'subject_sets', scs.condition
+//	                )
 //	            )
-//	        )
-//	        FROM actions
-//	        WHERE is_standard = FALSE
-//	    ) AS custom_actions,
-//	    (SELECT total FROM counted) AS total
-//	LIMIT $2
-//	OFFSET $1
-func (q *Queries) listActions(ctx context.Context, arg listActionsParams) ([]listActionsRow, error) {
-	rows, err := q.db.Query(ctx, listActions, arg.Offset, arg.Limit)
+//	        ) FILTER (WHERE sm.id IS NOT NULL) AS sub_maps
+//		FROM target_definition td
+//		LEFT JOIN attribute_values av ON td.id = av.attribute_definition_id
+//		LEFT JOIN subject_mappings sm ON av.id = sm.attribute_value_id
+//		LEFT JOIN subject_condition_set scs ON sm.subject_condition_set_id = scs.id
+//		GROUP BY av.id
+//	),
+//	values AS (
+//	    SELECT
+//			av.attribute_definition_id,
+//			JSON_AGG(
+//		        JSON_BUILD_OBJECT(
+//		            'id', av.id,
+//		            'value', av.value,
+//		            'active', av.active,
+//		            'fqn', fqns.fqn,
+//		            'grants', avg.grants,
+//		            'subject_mappings', avsm.sub_maps,
+//	                'keys', k.keys
+//		        -- enforce order of values in response
+//		        ) ORDER BY ARRAY_POSITION(td.values_order, av.id)
+//		    ) AS values
+//		FROM target_definition td
+//		LEFT JOIN attribute_values av ON td.id = av.attribute_definition_id
+//		LEFT JOIN attribute_fqns fqns ON av.id = fqns.value_id
+//		LEFT JOIN value_grants avg ON av.id = avg.id
+//		LEFT JOIN value_subject_mappings avsm ON av.id = avsm.id
+//	    LEFT JOIN active_value_public_keys_view k ON av.id = k.value_id
+//		WHERE av.active = TRUE
+//		GROUP BY av.attribute_definition_id
+//	)
+//	SELECT
+//		td.id,
+//		td.name,
+//	    td.rule,
+//		td.active,
+//		n.namespace,
+//		fqns.fqn,
+//		values.values,
+//		td.grants,
+//	    td.keys
+//	FROM target_definition td
+//	INNER JOIN attribute_fqns fqns ON td.id = fqns.attribute_id
+//	INNER JOIN namespaces n ON td.namespace_id = n.id
+//	LEFT JOIN values ON td.id = values.attribute_definition_id
+//	WHERE fqns.value_id IS NULL
+func (q *Queries) listAttributesByDefOrValueFqns(ctx context.Context, fqns []string) ([]listAttributesByDefOrValueFqnsRow, error) {
+	rows, err := q.db.Query(ctx, listAttributesByDefOrValueFqns, fqns)
 	if err != nil {
 		return nil, err
 	}
 	defer rows.Close()
-	var items []listActionsRow
+	var items []listAttributesByDefOrValueFqnsRow
 	for rows.Next() {
-		var i listActionsRow
-		if err := rows.Scan(&i.StandardActions, &i.CustomActions, &i.Total); err != nil {
+		var i listAttributesByDefOrValueFqnsRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.Name,
+			&i.Rule,
+			&i.Active,
+			&i.Namespace,
+			&i.Fqn,
+			&i.Values,
+			&i.Grants,
+			&i.Keys,
+		); err != nil {
 			return nil, err
 		}
 		items = append(items, i)
@@ -4328,7 +4354,7 @@ WITH
         WHERE id = $3
         RETURNING id
     ),
-    -- Only delete actions that are NOT in the new list
+    -- Delete any actions that are NOT in the new list
     action_delete AS (
         DELETE FROM subject_mapping_actions
         WHERE
@@ -4337,7 +4363,7 @@ WITH
             AND action_id NOT IN (SELECT unnest($4::UUID[]))
         RETURNING action_id
     ),
-    -- Only insert actions that don't already exist
+    -- Insert actions that are not already related to the mapping
     action_insert AS (
         INSERT INTO
             subject_mapping_actions (subject_mapping_id, action_id)
@@ -4384,7 +4410,7 @@ type updateSubjectMappingParams struct {
 //	        WHERE id = $3
 //	        RETURNING id
 //	    ),
-//	    -- Only delete actions that are NOT in the new list
+//	    -- Delete any actions that are NOT in the new list
 //	    action_delete AS (
 //	        DELETE FROM subject_mapping_actions
 //	        WHERE
@@ -4393,7 +4419,7 @@ type updateSubjectMappingParams struct {
 //	            AND action_id NOT IN (SELECT unnest($4::UUID[]))
 //	        RETURNING action_id
 //	    ),
-//	    -- Only insert actions that don't already exist
+//	    -- Insert actions that are not already related to the mapping
 //	    action_insert AS (
 //	        INSERT INTO
 //	            subject_mapping_actions (subject_mapping_id, action_id)

From 9b264848e702ec8dc0345b96a381bef051632db8 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 4 Apr 2025 12:47:02 -0700
Subject: [PATCH 035/110] improve test

---
 service/integration/attribute_fqns_test.go | 29 ++++++++++++++++++++--
 1 file changed, 27 insertions(+), 2 deletions(-)

diff --git a/service/integration/attribute_fqns_test.go b/service/integration/attribute_fqns_test.go
index 8902a88481..dadd9992b1 100644
--- a/service/integration/attribute_fqns_test.go
+++ b/service/integration/attribute_fqns_test.go
@@ -728,7 +728,7 @@ func (s *AttributeFqnSuite) bigTestSetup(namespaceName string) bigSetup {
 	val1SM, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              val1.GetId(),
 		ExistingSubjectConditionSetId: s.f.GetSubjectConditionSetKey("subject_condition_set1").ID,
-		Actions:                       []*policy.Action{actionRead},
+		Actions:                       []*policy.Action{actionRead, fixtureActionCustomUpload},
 	})
 	s.Require().NoError(err)
 	s.NotNil(val1SM)
@@ -887,7 +887,19 @@ func (s *AttributeFqnSuite) TestGetAttributeByFqn_SubjectMappingsOnAllValues() {
 	s.Len(val1.GetSubjectMappings(), 1)
 	val1SM := val1.GetSubjectMappings()[0]
 	s.Equal(s.f.GetSubjectConditionSetKey("subject_condition_set1").ID, val1SM.GetSubjectConditionSet().GetId())
-	s.Len(val1SM.GetActions(), 1)
+	s.Len(val1SM.GetActions(), 2)
+	foundRead := false
+	foundUpload := false
+	for _, action := range val1SM.GetActions() {
+		if action.GetId() == s.f.GetStandardAction("read").Id {
+			foundRead = true
+		}
+		if action.GetName() == fixtureActionCustomUpload.GetName() {
+			foundUpload = true
+		}
+	}
+	s.True(foundRead)
+	s.True(foundUpload)
 
 	// ensure the second value has both expected subject mappings
 	val2 := got.GetValues()[1]
@@ -895,10 +907,23 @@ func (s *AttributeFqnSuite) TestGetAttributeByFqn_SubjectMappingsOnAllValues() {
 	val2SM := val2.GetSubjectMappings()[0]
 	s.Equal(s.f.GetSubjectConditionSetKey("subject_condition_set2").ID, val2SM.GetSubjectConditionSet().GetId())
 	s.Len(val2SM.GetActions(), 1)
+	s.Equal(val2SM.GetActions()[0].GetName(), s.f.GetStandardAction("create").Name)
 
 	val2SM2 := val2.GetSubjectMappings()[1]
 	s.Equal(s.f.GetSubjectConditionSetKey("subject_condition_set3").ID, val2SM2.GetSubjectConditionSet().GetId())
 	s.Len(val2SM2.GetActions(), 2)
+	foundRead = false
+	foundCreate := false
+	for _, action := range val2SM2.GetActions() {
+		if action.GetId() == s.f.GetStandardAction("read").Id {
+			foundRead = true
+		}
+		if action.GetId() == s.f.GetStandardAction("create").Id {
+			foundCreate = true
+		}
+	}
+	s.True(foundRead)
+	s.True(foundCreate)
 }
 
 // Test multiple get attributes by multiple fqns

From 098c75fa54fe0b365d75d363e60321300c9db2c9 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 4 Apr 2025 12:54:51 -0700
Subject: [PATCH 036/110] lint fixes

---
 service/integration/attribute_fqns_test.go | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/service/integration/attribute_fqns_test.go b/service/integration/attribute_fqns_test.go
index dadd9992b1..9e085ea67f 100644
--- a/service/integration/attribute_fqns_test.go
+++ b/service/integration/attribute_fqns_test.go
@@ -891,7 +891,7 @@ func (s *AttributeFqnSuite) TestGetAttributeByFqn_SubjectMappingsOnAllValues() {
 	foundRead := false
 	foundUpload := false
 	for _, action := range val1SM.GetActions() {
-		if action.GetId() == s.f.GetStandardAction("read").Id {
+		if action.GetId() == s.f.GetStandardAction("read").GetId() {
 			foundRead = true
 		}
 		if action.GetName() == fixtureActionCustomUpload.GetName() {
@@ -907,7 +907,7 @@ func (s *AttributeFqnSuite) TestGetAttributeByFqn_SubjectMappingsOnAllValues() {
 	val2SM := val2.GetSubjectMappings()[0]
 	s.Equal(s.f.GetSubjectConditionSetKey("subject_condition_set2").ID, val2SM.GetSubjectConditionSet().GetId())
 	s.Len(val2SM.GetActions(), 1)
-	s.Equal(val2SM.GetActions()[0].GetName(), s.f.GetStandardAction("create").Name)
+	s.Equal(val2SM.GetActions()[0].GetName(), s.f.GetStandardAction("create").GetName())
 
 	val2SM2 := val2.GetSubjectMappings()[1]
 	s.Equal(s.f.GetSubjectConditionSetKey("subject_condition_set3").ID, val2SM2.GetSubjectConditionSet().GetId())
@@ -915,10 +915,10 @@ func (s *AttributeFqnSuite) TestGetAttributeByFqn_SubjectMappingsOnAllValues() {
 	foundRead = false
 	foundCreate := false
 	for _, action := range val2SM2.GetActions() {
-		if action.GetId() == s.f.GetStandardAction("read").Id {
+		if action.GetId() == s.f.GetStandardAction("read").GetId() {
 			foundRead = true
 		}
-		if action.GetId() == s.f.GetStandardAction("create").Id {
+		if action.GetId() == s.f.GetStandardAction("create").GetId() {
 			foundCreate = true
 		}
 	}

From 250e40b370b659d98e7198cc201ffac43b27480e Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 4 Apr 2025 14:54:15 -0700
Subject: [PATCH 037/110] stub actions integration test suite

---
 service/integration/actions_test.go | 40 +++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 service/integration/actions_test.go

diff --git a/service/integration/actions_test.go b/service/integration/actions_test.go
new file mode 100644
index 0000000000..b43a23a6fe
--- /dev/null
+++ b/service/integration/actions_test.go
@@ -0,0 +1,40 @@
+package integration
+
+import (
+	"context"
+	"log/slog"
+	"testing"
+
+	"github.com/opentdf/platform/service/internal/fixtures"
+	"github.com/stretchr/testify/suite"
+)
+
+type ActionsSuite struct {
+	suite.Suite
+	f   fixtures.Fixtures
+	db  fixtures.DBInterface
+	ctx context.Context //nolint:containedctx // context is used in the test suite
+}
+
+func (s *ActionsSuite) SetupSuite() {
+	slog.Info("setting up db.Actions test suite")
+	s.ctx = context.Background()
+	c := *Config
+
+	c.DB.Schema = "test_opentdf_actions"
+	s.db = fixtures.NewDBInterface(c)
+	s.f = fixtures.NewFixture(s.db)
+	s.f.Provision()
+}
+
+func (s *ActionsSuite) TearDownSuite() {
+	slog.Info("tearing down db.Actions test suite")
+	s.f.TearDown()
+}
+
+func TestActionsSuite(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping actions integration tests")
+	}
+	suite.Run(t, new(ActionsSuite))
+}

From cc4666afa5636e68a4d04090e663f1bc9c216071 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 4 Apr 2025 15:28:51 -0700
Subject: [PATCH 038/110] wip

---
 service/policy/db/actions.go | 118 +++++++++++++++++++++++++++++++++++
 1 file changed, 118 insertions(+)
 create mode 100644 service/policy/db/actions.go

diff --git a/service/policy/db/actions.go b/service/policy/db/actions.go
new file mode 100644
index 0000000000..650acad7db
--- /dev/null
+++ b/service/policy/db/actions.go
@@ -0,0 +1,118 @@
+package db
+
+import (
+	"context"
+
+	"github.com/opentdf/platform/protocol/go/common"
+	"github.com/opentdf/platform/protocol/go/policy"
+	"github.com/opentdf/platform/protocol/go/policy/actions"
+	"github.com/opentdf/platform/service/pkg/db"
+	"google.golang.org/protobuf/encoding/protojson"
+)
+
+func (c PolicyDBClient) GetAction(ctx context.Context, req *actions.GetActionRequest) (*actions.GetActionResponse, error) {
+	getActionParams := getActionParams{}
+	if req.GetId() != "" {
+		getActionParams.ID = pgtypeUUID(req.GetId())
+	} else if req.GetName() != "" {
+		getActionParams.Name = pgtypeText(req.GetName())
+	} else {
+		return nil, db.ErrSelectIdentifierInvalid
+	}
+
+	got, err := c.Queries.getAction(ctx, getActionParams)
+	if err != nil {
+		return nil, db.WrapIfKnownInvalidQueryErr(err)
+	}
+
+	metadata := &common.Metadata{}
+	if err := protojson.Unmarshal(got.Metadata, metadata); err != nil {
+		return nil, db.WrapIfKnownInvalidQueryErr(err)
+	}
+
+	return &actions.GetActionResponse{
+		Action: &policy.Action{
+			Id:       got.ID,
+			Name:     got.Name,
+			Metadata: metadata,
+		},
+	}, nil
+}
+
+func (c PolicyDBClient) ListActions(ctx context.Context, req *actions.ListActionsRequest) (*actions.ListActionsResponse, error) {
+	listActionParams := listActionsParams{}
+
+	// Execute the query
+	got, err := c.Queries.listActions(ctx, listActionParams)
+	if err != nil {
+		return nil, db.WrapIfKnownInvalidQueryErr(err)
+	}
+
+	// Map the results to the response
+	var actionsList []*policy.Action
+	for _, action := range got {
+		metadata := &common.Metadata{}
+		if err := protojson.Unmarshal(action.Metadata, metadata); err != nil {
+			return nil, db.WrapIfKnownInvalidQueryErr(err)
+		}
+		actionsList = append(actionsList, &policy.Action{
+			Id:       action.ID,
+			Name:     action.Name,
+			Metadata: metadata,
+		})
+	}
+
+	return &actions.ListActionsResponse{
+		Actions: actionsList,
+	}, nil
+}
+
+func (c PolicyDBClient) CreateAction(ctx context.Context, req *actions.CreateActionRequest) (*actions.CreateActionResponse, error) {
+	// Define parameters for the query
+	createParams := createCustomActionParams{
+		ID:       pgtypeUUID(req.GetAction().GetId()),
+		Name:     pgtypeText(req.GetAction().GetName()),
+		Metadata: protojson.Marshal(req.GetAction().GetMetadata()),
+	}
+
+	// Execute the query
+	created, err := c.Queries.createCustomAction(ctx, createParams)
+	if err != nil {
+		return nil, db.WrapIfKnownInvalidQueryErr(err)
+	}
+
+	return &actions.CreateActionResponse{}, nil
+}
+
+func (c PolicyDBClient) UpdateAction(ctx context.Context, req *actions.UpdateActionRequest) (*actions.UpdateActionResponse, error) {
+	// Define parameters for the query
+	updateParams := updateCustomActionParams{
+		ID:       pgtypeUUID(req.GetAction().GetId()),
+		Name:     pgtypeText(req.GetAction().GetName()),
+		Metadata: protojson.Marshal(req.GetAction().GetMetadata()),
+	}
+
+	// Execute the query
+	updated, err := c.Queries.updateCustomAction(ctx, updateParams)
+	if err != nil {
+		return nil, db.WrapIfKnownInvalidQueryErr(err)
+	}
+
+	return &actions.UpdateActionResponse{}, nil
+}
+
+func (c PolicyDBClient) DeleteAction(ctx context.Context, req *actions.DeleteActionRequest) (*actions.DeleteActionResponse, error) {
+	count, err := c.Queries.deleteCustomAction(ctx, req.GetId())
+	if err != nil {
+		return nil, db.WrapIfKnownInvalidQueryErr(err)
+	}
+	if count == 0 {
+		return nil, db.ErrNotFound
+	}
+
+	return &actions.DeleteActionResponse{
+		Action: &policy.Action{
+			Id: req.GetId(),
+		},
+	}, nil
+}

From 5e00695e8c7a7b2d37f13f405ae8d5f19ffc3052 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 7 Apr 2025 15:19:50 -0700
Subject: [PATCH 039/110] fix list actions which was not considering
 limit/offset in query

---
 service/policy/db/actions.go   | 134 +++++++++++++++++++++++----------
 service/policy/db/query.sql    |  42 +++--------
 service/policy/db/query.sql.go | 100 +++++++++---------------
 3 files changed, 138 insertions(+), 138 deletions(-)

diff --git a/service/policy/db/actions.go b/service/policy/db/actions.go
index 650acad7db..4019f02a33 100644
--- a/service/policy/db/actions.go
+++ b/service/policy/db/actions.go
@@ -10,7 +10,7 @@ import (
 	"google.golang.org/protobuf/encoding/protojson"
 )
 
-func (c PolicyDBClient) GetAction(ctx context.Context, req *actions.GetActionRequest) (*actions.GetActionResponse, error) {
+func (c PolicyDBClient) GetAction(ctx context.Context, req *actions.GetActionRequest) (*policy.Action, error) {
 	getActionParams := getActionParams{}
 	if req.GetId() != "" {
 		getActionParams.ID = pgtypeUUID(req.GetId())
@@ -30,78 +30,132 @@ func (c PolicyDBClient) GetAction(ctx context.Context, req *actions.GetActionReq
 		return nil, db.WrapIfKnownInvalidQueryErr(err)
 	}
 
-	return &actions.GetActionResponse{
-		Action: &policy.Action{
-			Id:       got.ID,
-			Name:     got.Name,
-			Metadata: metadata,
-		},
+	return &policy.Action{
+		Id:       got.ID,
+		Name:     got.Name,
+		Metadata: metadata,
 	}, nil
 }
 
 func (c PolicyDBClient) ListActions(ctx context.Context, req *actions.ListActionsRequest) (*actions.ListActionsResponse, error) {
-	listActionParams := listActionsParams{}
+	limit, offset := c.getRequestedLimitOffset(req.GetPagination())
 
-	// Execute the query
-	got, err := c.Queries.listActions(ctx, listActionParams)
+	list, err := c.Queries.listActions(ctx, listActionsParams{
+		Limit:  limit,
+		Offset: offset,
+	})
 	if err != nil {
 		return nil, db.WrapIfKnownInvalidQueryErr(err)
 	}
 
-	// Map the results to the response
-	var actionsList []*policy.Action
-	for _, action := range got {
+	var (
+		actionsStandard []*policy.Action
+		actionsCustom   []*policy.Action
+	)
+	for _, a := range list {
 		metadata := &common.Metadata{}
-		if err := protojson.Unmarshal(action.Metadata, metadata); err != nil {
-			return nil, db.WrapIfKnownInvalidQueryErr(err)
+		if err := unmarshalMetadata(a.Metadata, metadata); err != nil {
+			return nil, err
 		}
-		actionsList = append(actionsList, &policy.Action{
-			Id:       action.ID,
-			Name:     action.Name,
+		action := &policy.Action{
+			Id:       a.ID,
+			Name:     a.Name,
 			Metadata: metadata,
-		})
+		}
+		if a.IsStandard {
+			actionsStandard = append(actionsStandard, action)
+		} else {
+			actionsCustom = append(actionsCustom, action)
+		}
+	}
+
+	var total int32
+	var nextOffset int32
+	if len(list) > 0 {
+		total = int32(list[0].Total)
+		nextOffset = getNextOffset(offset, limit, total)
 	}
 
 	return &actions.ListActionsResponse{
-		Actions: actionsList,
+		ActionsStandard: actionsStandard,
+		ActionsCustom:   actionsCustom,
+		Pagination: &policy.PageResponse{
+			CurrentOffset: offset,
+			NextOffset:    nextOffset,
+			Total:         total,
+		},
 	}, nil
 }
 
-func (c PolicyDBClient) CreateAction(ctx context.Context, req *actions.CreateActionRequest) (*actions.CreateActionResponse, error) {
-	// Define parameters for the query
+func (c PolicyDBClient) CreateAction(ctx context.Context, req *actions.CreateActionRequest) (*policy.Action, error) {
+	metadataJSON, _, err := db.MarshalCreateMetadata(req.GetMetadata())
+	if err != nil {
+		return nil, err
+	}
 	createParams := createCustomActionParams{
-		ID:       pgtypeUUID(req.GetAction().GetId()),
-		Name:     pgtypeText(req.GetAction().GetName()),
-		Metadata: protojson.Marshal(req.GetAction().GetMetadata()),
+		Name:     req.GetName(),
+		Metadata: metadataJSON,
 	}
 
-	// Execute the query
-	created, err := c.Queries.createCustomAction(ctx, createParams)
+	createdID, err := c.Queries.createCustomAction(ctx, createParams)
 	if err != nil {
 		return nil, db.WrapIfKnownInvalidQueryErr(err)
 	}
 
-	return &actions.CreateActionResponse{}, nil
+	return c.GetAction(ctx, &actions.GetActionRequest{
+		Identifier: &actions.GetActionRequest_Id{
+			Id: createdID,
+		},
+	})
 }
 
-func (c PolicyDBClient) UpdateAction(ctx context.Context, req *actions.UpdateActionRequest) (*actions.UpdateActionResponse, error) {
-	// Define parameters for the query
+func (c PolicyDBClient) UpdateAction(ctx context.Context, req *actions.UpdateActionRequest) (*policy.Action, error) {
+	// if extend we need to merge the metadata
+	metadataJSON, metadata, err := db.MarshalUpdateMetadata(req.GetMetadata(), req.GetMetadataUpdateBehavior(), func() (*common.Metadata, error) {
+		a, err := c.GetAction(ctx, &actions.GetActionRequest{
+			Identifier: &actions.GetActionRequest_Id{
+				Id: req.GetId(),
+			},
+		})
+		if err != nil {
+			return nil, err
+		}
+		if a.GetMetadata() == nil {
+			return nil, nil //nolint:nilnil // no metadata does not mean no error
+		}
+		return a.GetMetadata(), nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	// Update what fields were patched to update
 	updateParams := updateCustomActionParams{
-		ID:       pgtypeUUID(req.GetAction().GetId()),
-		Name:     pgtypeText(req.GetAction().GetName()),
-		Metadata: protojson.Marshal(req.GetAction().GetMetadata()),
+		ID: req.GetId(),
+	}
+	if metadataJSON != nil {
+		updateParams.Metadata = metadataJSON
+	}
+	if req.GetName() != "" {
+		updateParams.Name = pgtypeText(req.GetName())
 	}
 
-	// Execute the query
-	updated, err := c.Queries.updateCustomAction(ctx, updateParams)
+	count, err := c.Queries.updateCustomAction(ctx, updateParams)
 	if err != nil {
 		return nil, db.WrapIfKnownInvalidQueryErr(err)
 	}
+	if count == 0 {
+		return nil, db.ErrNotFound
+	}
 
-	return &actions.UpdateActionResponse{}, nil
+	return &policy.Action{
+		Id:       req.GetId(),
+		Name:     req.GetName(),
+		Metadata: metadata,
+	}, nil
 }
 
-func (c PolicyDBClient) DeleteAction(ctx context.Context, req *actions.DeleteActionRequest) (*actions.DeleteActionResponse, error) {
+func (c PolicyDBClient) DeleteAction(ctx context.Context, req *actions.DeleteActionRequest) (*policy.Action, error) {
 	count, err := c.Queries.deleteCustomAction(ctx, req.GetId())
 	if err != nil {
 		return nil, db.WrapIfKnownInvalidQueryErr(err)
@@ -110,9 +164,7 @@ func (c PolicyDBClient) DeleteAction(ctx context.Context, req *actions.DeleteAct
 		return nil, db.ErrNotFound
 	}
 
-	return &actions.DeleteActionResponse{
-		Action: &policy.Action{
-			Id: req.GetId(),
-		},
+	return &policy.Action{
+		Id: req.GetId(),
 	}, nil
 }
diff --git a/service/policy/db/query.sql b/service/policy/db/query.sql
index 0e1793985b..f7ab2bbddc 100644
--- a/service/policy/db/query.sql
+++ b/service/policy/db/query.sql
@@ -1247,37 +1247,17 @@ WITH counted AS (
     SELECT COUNT(id) AS total FROM actions
 )
 SELECT 
-    (
-        SELECT JSONB_AGG(
-            JSONB_BUILD_OBJECT(
-                'id', id,
-                'name', name,
-                'metadata', JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
-                    'labels', metadata -> 'labels', 
-                    'created_at', created_at, 
-                    'updated_at', updated_at
-                ))
-            )
-        )
-        FROM actions
-        WHERE is_standard = TRUE
-    ) AS standard_actions,
-    (
-        SELECT JSONB_AGG(
-            JSONB_BUILD_OBJECT(
-                'id', id,
-                'name', name,
-                'metadata', JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
-                    'labels', metadata -> 'labels', 
-                    'created_at', created_at, 
-                    'updated_at', updated_at
-                ))
-            )
-        )
-        FROM actions
-        WHERE is_standard = FALSE
-    ) AS custom_actions,
-    (SELECT total FROM counted) AS total
+    a.id,
+    a.name,
+    JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
+        'labels', a.metadata -> 'labels', 
+        'created_at', a.created_at, 
+        'updated_at', a.updated_at
+    )) as metadata,
+    a.is_standard,
+    counted.total
+FROM actions a
+CROSS JOIN counted
 LIMIT @limit_ 
 OFFSET @offset_;
 
diff --git a/service/policy/db/query.sql.go b/service/policy/db/query.sql.go
index d82b5111b3..cfe172b60e 100644
--- a/service/policy/db/query.sql.go
+++ b/service/policy/db/query.sql.go
@@ -3138,37 +3138,17 @@ WITH counted AS (
     SELECT COUNT(id) AS total FROM actions
 )
 SELECT 
-    (
-        SELECT JSONB_AGG(
-            JSONB_BUILD_OBJECT(
-                'id', id,
-                'name', name,
-                'metadata', JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
-                    'labels', metadata -> 'labels', 
-                    'created_at', created_at, 
-                    'updated_at', updated_at
-                ))
-            )
-        )
-        FROM actions
-        WHERE is_standard = TRUE
-    ) AS standard_actions,
-    (
-        SELECT JSONB_AGG(
-            JSONB_BUILD_OBJECT(
-                'id', id,
-                'name', name,
-                'metadata', JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
-                    'labels', metadata -> 'labels', 
-                    'created_at', created_at, 
-                    'updated_at', updated_at
-                ))
-            )
-        )
-        FROM actions
-        WHERE is_standard = FALSE
-    ) AS custom_actions,
-    (SELECT total FROM counted) AS total
+    a.id,
+    a.name,
+    JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
+        'labels', a.metadata -> 'labels', 
+        'created_at', a.created_at, 
+        'updated_at', a.updated_at
+    )) as metadata,
+    a.is_standard,
+    counted.total
+FROM actions a
+CROSS JOIN counted
 LIMIT $2 
 OFFSET $1
 `
@@ -3179,9 +3159,11 @@ type listActionsParams struct {
 }
 
 type listActionsRow struct {
-	StandardActions []byte `json:"standard_actions"`
-	CustomActions   []byte `json:"custom_actions"`
-	Total           int64  `json:"total"`
+	ID         string `json:"id"`
+	Name       string `json:"name"`
+	Metadata   []byte `json:"metadata"`
+	IsStandard bool   `json:"is_standard"`
+	Total      int64  `json:"total"`
 }
 
 // --------------------------------------------------------------
@@ -3193,37 +3175,17 @@ type listActionsRow struct {
 //	    SELECT COUNT(id) AS total FROM actions
 //	)
 //	SELECT
-//	    (
-//	        SELECT JSONB_AGG(
-//	            JSONB_BUILD_OBJECT(
-//	                'id', id,
-//	                'name', name,
-//	                'metadata', JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
-//	                    'labels', metadata -> 'labels',
-//	                    'created_at', created_at,
-//	                    'updated_at', updated_at
-//	                ))
-//	            )
-//	        )
-//	        FROM actions
-//	        WHERE is_standard = TRUE
-//	    ) AS standard_actions,
-//	    (
-//	        SELECT JSONB_AGG(
-//	            JSONB_BUILD_OBJECT(
-//	                'id', id,
-//	                'name', name,
-//	                'metadata', JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
-//	                    'labels', metadata -> 'labels',
-//	                    'created_at', created_at,
-//	                    'updated_at', updated_at
-//	                ))
-//	            )
-//	        )
-//	        FROM actions
-//	        WHERE is_standard = FALSE
-//	    ) AS custom_actions,
-//	    (SELECT total FROM counted) AS total
+//	    a.id,
+//	    a.name,
+//	    JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
+//	        'labels', a.metadata -> 'labels',
+//	        'created_at', a.created_at,
+//	        'updated_at', a.updated_at
+//	    )) as metadata,
+//	    a.is_standard,
+//	    counted.total
+//	FROM actions a
+//	CROSS JOIN counted
 //	LIMIT $2
 //	OFFSET $1
 func (q *Queries) listActions(ctx context.Context, arg listActionsParams) ([]listActionsRow, error) {
@@ -3235,7 +3197,13 @@ func (q *Queries) listActions(ctx context.Context, arg listActionsParams) ([]lis
 	var items []listActionsRow
 	for rows.Next() {
 		var i listActionsRow
-		if err := rows.Scan(&i.StandardActions, &i.CustomActions, &i.Total); err != nil {
+		if err := rows.Scan(
+			&i.ID,
+			&i.Name,
+			&i.Metadata,
+			&i.IsStandard,
+			&i.Total,
+		); err != nil {
 			return nil, err
 		}
 		items = append(items, i)

From c26a6c6fb917399f479feec53aa298d2484cd12d Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Tue, 8 Apr 2025 13:05:26 -0700
Subject: [PATCH 040/110] create sm with nonexistent action ID fails

---
 service/integration/subject_mappings_test.go | 25 +++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/service/integration/subject_mappings_test.go b/service/integration/subject_mappings_test.go
index 4382d84e32..235df1ba65 100644
--- a/service/integration/subject_mappings_test.go
+++ b/service/integration/subject_mappings_test.go
@@ -14,7 +14,10 @@ import (
 	"google.golang.org/protobuf/proto"
 )
 
-const nonExistentAttributeValueUUID = "78909865-8888-9999-9999-000000000000"
+const (
+	nonExistentAttributeValueUUID = "78909865-8888-9999-9999-000000000000"
+	nonExistingActionUUID         = "5dff18c8-1192-4f2e-aa21-2d793c9d97b2"
+)
 
 type SubjectMappingsSuite struct {
 	suite.Suite
@@ -170,6 +173,26 @@ func (s *SubjectMappingsSuite) TestCreateSubjectMapping_NonExistentSubjectCondit
 	s.Require().ErrorIs(err, db.ErrNotFound)
 }
 
+func (s *SubjectMappingsSuite) TestCreateSubjectMapping_NonExistentActionId_Fails() {
+	fixtureAttrVal := s.f.GetAttributeValueKey("example.com/attr/attr2/value/value1")
+	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set3")
+
+	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
+		AttributeValueId: fixtureAttrVal.ID,
+		Actions: []*policy.Action{
+			{
+				Id: nonExistingActionUUID,
+			},
+		},
+		ExistingSubjectConditionSetId: fixtureScs.ID,
+	}
+
+	created, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, newSubjectMapping)
+	s.Require().Error(err)
+	s.Nil(created)
+	s.Require().ErrorIs(err, db.ErrForeignKeyViolation)
+}
+
 func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_Actions() {
 	// create a new one SM with actions, update it with different actions, and verify the update
 	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value2").ID

From 0610352edac047ea7e81dd4dcd35618ac076b11d Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Tue, 8 Apr 2025 13:54:54 -0700
Subject: [PATCH 041/110] fix list actions query

---
 service/policy/db/query.sql    | 2 +-
 service/policy/db/query.sql.go | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/service/policy/db/query.sql b/service/policy/db/query.sql
index f7ab2bbddc..b7fcd4fd73 100644
--- a/service/policy/db/query.sql
+++ b/service/policy/db/query.sql
@@ -1249,7 +1249,7 @@ WITH counted AS (
 SELECT 
     a.id,
     a.name,
-    JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
+    JSON_STRIP_NULLS(JSON_BUILD_OBJECT(
         'labels', a.metadata -> 'labels', 
         'created_at', a.created_at, 
         'updated_at', a.updated_at
diff --git a/service/policy/db/query.sql.go b/service/policy/db/query.sql.go
index cfe172b60e..024333b76d 100644
--- a/service/policy/db/query.sql.go
+++ b/service/policy/db/query.sql.go
@@ -3140,7 +3140,7 @@ WITH counted AS (
 SELECT 
     a.id,
     a.name,
-    JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
+    JSON_STRIP_NULLS(JSON_BUILD_OBJECT(
         'labels', a.metadata -> 'labels', 
         'created_at', a.created_at, 
         'updated_at', a.updated_at
@@ -3177,7 +3177,7 @@ type listActionsRow struct {
 //	SELECT
 //	    a.id,
 //	    a.name,
-//	    JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
+//	    JSON_STRIP_NULLS(JSON_BUILD_OBJECT(
 //	        'labels', a.metadata -> 'labels',
 //	        'created_at', a.created_at,
 //	        'updated_at', a.updated_at

From b4350366c2eda7ee69e0e1bd75e07fa1315ca357 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Tue, 8 Apr 2025 13:55:05 -0700
Subject: [PATCH 042/110] lower case action names

---
 service/policy/db/actions.go | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/service/policy/db/actions.go b/service/policy/db/actions.go
index 4019f02a33..82e86c6779 100644
--- a/service/policy/db/actions.go
+++ b/service/policy/db/actions.go
@@ -2,6 +2,7 @@ package db
 
 import (
 	"context"
+	"strings"
 
 	"github.com/opentdf/platform/protocol/go/common"
 	"github.com/opentdf/platform/protocol/go/policy"
@@ -15,7 +16,7 @@ func (c PolicyDBClient) GetAction(ctx context.Context, req *actions.GetActionReq
 	if req.GetId() != "" {
 		getActionParams.ID = pgtypeUUID(req.GetId())
 	} else if req.GetName() != "" {
-		getActionParams.Name = pgtypeText(req.GetName())
+		getActionParams.Name = pgtypeText(strings.ToLower(req.GetName()))
 	} else {
 		return nil, db.ErrSelectIdentifierInvalid
 	}
@@ -40,6 +41,11 @@ func (c PolicyDBClient) GetAction(ctx context.Context, req *actions.GetActionReq
 func (c PolicyDBClient) ListActions(ctx context.Context, req *actions.ListActionsRequest) (*actions.ListActionsResponse, error) {
 	limit, offset := c.getRequestedLimitOffset(req.GetPagination())
 
+	maxLimit := c.listCfg.limitMax
+	if maxLimit > 0 && limit > maxLimit {
+		return nil, db.ErrListLimitTooLarge
+	}
+
 	list, err := c.Queries.listActions(ctx, listActionsParams{
 		Limit:  limit,
 		Offset: offset,
@@ -93,7 +99,7 @@ func (c PolicyDBClient) CreateAction(ctx context.Context, req *actions.CreateAct
 		return nil, err
 	}
 	createParams := createCustomActionParams{
-		Name:     req.GetName(),
+		Name:     strings.ToLower(req.GetName()),
 		Metadata: metadataJSON,
 	}
 
@@ -137,7 +143,7 @@ func (c PolicyDBClient) UpdateAction(ctx context.Context, req *actions.UpdateAct
 		updateParams.Metadata = metadataJSON
 	}
 	if req.GetName() != "" {
-		updateParams.Name = pgtypeText(req.GetName())
+		updateParams.Name = pgtypeText(strings.ToLower(req.GetName()))
 	}
 
 	count, err := c.Queries.updateCustomAction(ctx, updateParams)

From 10322a504529078ea0d45267245690df6d31a69e Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Tue, 8 Apr 2025 13:55:20 -0700
Subject: [PATCH 043/110] more tests

---
 service/integration/actions_test.go | 205 ++++++++++++++++++++++++++++
 1 file changed, 205 insertions(+)

diff --git a/service/integration/actions_test.go b/service/integration/actions_test.go
index b43a23a6fe..608db0e11c 100644
--- a/service/integration/actions_test.go
+++ b/service/integration/actions_test.go
@@ -3,9 +3,14 @@ package integration
 import (
 	"context"
 	"log/slog"
+	"strings"
 	"testing"
 
+	"github.com/opentdf/platform/protocol/go/common"
+	"github.com/opentdf/platform/protocol/go/policy"
+	"github.com/opentdf/platform/protocol/go/policy/actions"
 	"github.com/opentdf/platform/service/internal/fixtures"
+	"github.com/opentdf/platform/service/pkg/db"
 	"github.com/stretchr/testify/suite"
 )
 
@@ -32,6 +37,206 @@ func (s *ActionsSuite) TearDownSuite() {
 	s.f.TearDown()
 }
 
+func (s *ActionsSuite) Test_ListActions_NoPagination_Succeeds() {
+	fixtureCustomAction1 := s.f.GetCustomActionKey("custom_action_1")
+	fixtureCustomAction2 := s.f.GetCustomActionKey("other_special_action")
+
+	list, err := s.db.PolicyClient.ListActions(s.ctx, &actions.ListActionsRequest{})
+	s.NotNil(list)
+	s.Require().NoError(err)
+
+	foundCustomAction1 := false
+	foundCustomAction2 := false
+	foundRead := false
+	foundCreate := false
+	foundUpdate := false
+	foundDelete := false
+
+	for _, action := range list.GetActionsCustom() {
+		switch action.Name {
+		case fixtureCustomAction1.Name:
+			foundCustomAction1 = true
+		case fixtureCustomAction2.Name:
+			foundCustomAction2 = true
+		}
+	}
+	for _, action := range list.GetActionsStandard() {
+		switch action.Name {
+		case "read":
+			foundRead = true
+		case "create":
+			foundCreate = true
+		case "update":
+			foundUpdate = true
+		case "delete":
+			foundDelete = true
+		}
+	}
+	s.True(foundCustomAction1)
+	s.True(foundCustomAction2)
+	s.True(foundRead)
+	s.True(foundCreate)
+	s.True(foundUpdate)
+	s.True(foundDelete)
+}
+
+func (s *ActionsSuite) Test_ListActions_Pagination_Succeeds() {
+	list, err := s.db.PolicyClient.ListActions(s.ctx, &actions.ListActionsRequest{})
+	s.NotNil(list)
+	s.Require().NoError(err)
+	total := list.GetPagination().GetTotal()
+
+	higherOffsetThanListCount := total + 1
+	list, err = s.db.PolicyClient.ListActions(s.ctx, &actions.ListActionsRequest{
+		Pagination: &policy.PageRequest{
+			Offset: higherOffsetThanListCount,
+		},
+	})
+	s.NotNil(list)
+	s.Require().NoError(err)
+	s.Equal(int32(0), list.GetPagination().GetNextOffset())
+	s.Equal(higherOffsetThanListCount, list.GetPagination().GetCurrentOffset())
+
+	list, err = s.db.PolicyClient.ListActions(s.ctx, &actions.ListActionsRequest{
+		Pagination: &policy.PageRequest{
+			Offset: 0,
+			Limit:  total - 1,
+		},
+	})
+	s.NotNil(list)
+	s.Require().NoError(err)
+	s.Equal(int32(total), list.GetPagination().GetTotal())
+	s.Equal(int32(0), list.GetPagination().GetCurrentOffset())
+	s.Equal(int32(total-1), list.GetPagination().GetNextOffset())
+}
+
+func (s *ActionsSuite) Test_ListActions_LimitLargerThanConfigured_Fails() {
+	list, err := s.db.PolicyClient.ListActions(s.ctx, &actions.ListActionsRequest{
+		Pagination: &policy.PageRequest{
+			Limit: s.db.LimitMax + 1,
+		},
+	})
+	s.Nil(list)
+	s.Require().Error(err)
+	s.Require().ErrorIs(err, db.ErrListLimitTooLarge)
+}
+
+func (s *ActionsSuite) Test_GetAction_Id_Succeeds() {
+	fixtureCustomAction1 := s.f.GetCustomActionKey("custom_action_1")
+	actionRead := s.f.GetStandardAction("read")
+
+	action, err := s.db.PolicyClient.GetAction(s.ctx, &actions.GetActionRequest{
+		Identifier: &actions.GetActionRequest_Id{
+			Id: fixtureCustomAction1.ID,
+		},
+	})
+	s.NotNil(action)
+	s.Require().NoError(err)
+
+	s.Equal(fixtureCustomAction1.ID, action.GetId())
+	s.Equal(fixtureCustomAction1.Name, action.GetName())
+	s.NotNil(action.GetMetadata())
+
+	action, err = s.db.PolicyClient.GetAction(s.ctx, &actions.GetActionRequest{
+		Identifier: &actions.GetActionRequest_Id{
+			Id: actionRead.Id,
+		},
+	})
+	s.NotNil(action)
+	s.Require().NoError(err)
+	s.Equal(actionRead.Id, action.GetId())
+	s.Equal(actionRead.Name, action.GetName())
+	s.NotNil(action.GetMetadata())
+}
+
+func (s *ActionsSuite) Test_GetAction_Name_Succeeds() {
+	customAction := s.f.GetCustomActionKey("other_special_action")
+	actionCreate := s.f.GetStandardAction("create")
+	action, err := s.db.PolicyClient.GetAction(s.ctx, &actions.GetActionRequest{
+		Identifier: &actions.GetActionRequest_Name{
+			Name: customAction.Name,
+		},
+	})
+	s.NotNil(action)
+	s.Require().NoError(err)
+	s.Equal(customAction.ID, action.GetId())
+	s.Equal(customAction.Name, action.GetName())
+	s.NotNil(action.GetMetadata())
+
+	action, err = s.db.PolicyClient.GetAction(s.ctx, &actions.GetActionRequest{
+		Identifier: &actions.GetActionRequest_Name{
+			Name: actionCreate.Name,
+		},
+	})
+	s.NotNil(action)
+	s.Require().NoError(err)
+	s.Equal(actionCreate.Name, action.GetName())
+	s.Equal(actionCreate.Id, action.GetId())
+	s.NotNil(action.GetMetadata())
+}
+
+func (s *ActionsSuite) Test_GetAction_NonExistent_Fails() {
+	action, err := s.db.PolicyClient.GetAction(s.ctx, &actions.GetActionRequest{
+		Identifier: &actions.GetActionRequest_Id{
+			Id: nonExistingActionUUID,
+		},
+	})
+	s.Nil(action)
+	s.Require().Error(err)
+	s.Require().ErrorIs(err, db.ErrNotFound)
+
+	action, err = s.db.PolicyClient.GetAction(s.ctx, &actions.GetActionRequest{
+		Identifier: &actions.GetActionRequest_Name{
+			Name: "totally_unknown_action",
+		},
+	})
+	s.Nil(action)
+	s.Require().Error(err)
+	s.Require().ErrorIs(err, db.ErrNotFound)
+}
+
+func (s *ActionsSuite) Test_CreateAction_Succeeds() {
+	newName := "new_custom_action_createaction"
+	action, err := s.db.PolicyClient.CreateAction(s.ctx, &actions.CreateActionRequest{
+		Name: newName,
+		Metadata: &common.MetadataMutable{
+			Labels: map[string]string{
+				"label1": "value1",
+				"label2": "value2",
+			},
+		},
+	})
+	s.NotNil(action)
+	s.Require().NoError(err)
+	s.NotEqual("", action.GetId())
+	s.Equal(newName, action.GetName())
+	s.NotNil(action.GetMetadata())
+	s.Equal("value1", action.GetMetadata().GetLabels()["label1"])
+	s.Equal("value2", action.GetMetadata().GetLabels()["label2"])
+}
+
+func (s *ActionsSuite) Test_CreateAction_Conflict_Fails() {
+	fixtureCustomAction := s.f.GetCustomActionKey("custom_action_1")
+	action, err := s.db.PolicyClient.CreateAction(s.ctx, &actions.CreateActionRequest{
+		Name: fixtureCustomAction.Name,
+	},
+	)
+	s.Nil(action)
+	s.Require().Error(err)
+	s.Require().ErrorIs(err, db.ErrUniqueConstraintViolation)
+}
+
+func (s *ActionsSuite) Test_CreateAction_NormalizesToLowerCase() {
+	newName := "New_Custom_Action_CreateAction_UPPER"
+	action, err := s.db.PolicyClient.CreateAction(s.ctx, &actions.CreateActionRequest{
+		Name: newName,
+	},
+	)
+	s.NotNil(action)
+	s.Require().NoError(err)
+	s.Equal(strings.ToLower(newName), action.GetName())
+}
+
 func TestActionsSuite(t *testing.T) {
 	if testing.Short() {
 		t.Skip("skipping actions integration tests")

From 7446ff770205b4d83c2865c1c0a6cb483acb0f1c Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Tue, 8 Apr 2025 14:05:35 -0700
Subject: [PATCH 044/110] another sm test around actions

---
 service/integration/subject_mappings_test.go | 30 ++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/service/integration/subject_mappings_test.go b/service/integration/subject_mappings_test.go
index 235df1ba65..e7eeb7c187 100644
--- a/service/integration/subject_mappings_test.go
+++ b/service/integration/subject_mappings_test.go
@@ -260,6 +260,36 @@ func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_Actions() {
 	s.Equal(len(update.GetActions()), len(got.GetActions()))
 	s.Equal(actionDelete.GetName(), got.GetActions()[0].GetName())
 }
+func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_Actions_NonExistentActionID_Fails() {
+	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value1").ID
+	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set2")
+	actionRead := s.f.GetStandardAction("read")
+
+	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
+		AttributeValueId:              fixtureAttrValID,
+		Actions:                       []*policy.Action{actionRead},
+		ExistingSubjectConditionSetId: fixtureScs.ID,
+	}
+	created, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, newSubjectMapping)
+	s.Require().NoError(err)
+	s.NotNil(created)
+
+	got, err := s.db.PolicyClient.GetSubjectMapping(s.ctx, created.GetId())
+	s.Require().NoError(err)
+	s.NotNil(got)
+	s.Equal(len(newSubjectMapping.GetActions()), len(got.GetActions()))
+
+	// update with a non-existent action
+	update := &subjectmapping.UpdateSubjectMappingRequest{
+		Id:      created.GetId(),
+		Actions: []*policy.Action{{Id: nonExistingActionUUID}},
+	}
+
+	updated, err := s.db.PolicyClient.UpdateSubjectMapping(s.ctx, update)
+	s.Nil(updated)
+	s.Require().Error(err)
+	s.Require().ErrorIs(err, db.ErrForeignKeyViolation)
+}
 
 func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_SubjectConditionSetId() {
 	// create a new one, update it, and verify the update

From 7eb526f63125f0fb42af3adb6e702c4feef67276 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Tue, 8 Apr 2025 14:20:00 -0700
Subject: [PATCH 045/110] more tests

---
 service/integration/actions_test.go          | 64 ++++++++++++++++++++
 service/integration/subject_mappings_test.go | 62 ++++++++++++++++++-
 service/policy/db/subject_mappings.go        |  4 +-
 3 files changed, 125 insertions(+), 5 deletions(-)

diff --git a/service/integration/actions_test.go b/service/integration/actions_test.go
index 608db0e11c..3edd61d7bc 100644
--- a/service/integration/actions_test.go
+++ b/service/integration/actions_test.go
@@ -237,6 +237,70 @@ func (s *ActionsSuite) Test_CreateAction_NormalizesToLowerCase() {
 	s.Equal(strings.ToLower(newName), action.GetName())
 }
 
+func (s *ActionsSuite) Test_UpdateAction_Succeeds() {
+	newAction, err := s.db.PolicyClient.CreateAction(s.ctx, &actions.CreateActionRequest{
+		Name: "new_custom_action_updateaction",
+		Metadata: &common.MetadataMutable{
+			Labels: map[string]string{
+				"original": "original_value",
+			},
+		},
+	})
+	s.NotNil(newAction)
+	s.Require().NoError(err)
+	s.NotEqual("", newAction.GetId())
+	s.Equal("new_custom_action_updateaction", newAction.GetName())
+
+	differentName := "new_custom_action_updateaction_renamed"
+	updatedAction, err := s.db.PolicyClient.UpdateAction(s.ctx, &actions.UpdateActionRequest{
+		Id:   newAction.GetId(),
+		Name: differentName,
+		Metadata: &common.MetadataMutable{
+			Labels: map[string]string{
+				"original": "replaced",
+			},
+		},
+		MetadataUpdateBehavior: common.MetadataUpdateEnum_METADATA_UPDATE_ENUM_REPLACE,
+	})
+	s.NotNil(updatedAction)
+	s.Require().NoError(err)
+
+	got, err := s.db.PolicyClient.GetAction(s.ctx, &actions.GetActionRequest{
+		Identifier: &actions.GetActionRequest_Id{
+			Id: updatedAction.GetId(),
+		},
+	})
+	s.NotNil(got)
+	s.Require().NoError(err)
+	s.Equal(differentName, got.GetName())
+	s.Equal("replaced", got.GetMetadata().GetLabels()["original"])
+}
+func (s *ActionsSuite) Test_UpdateAction_NormalizesToLowerCase() {
+	newAction, err := s.db.PolicyClient.CreateAction(s.ctx, &actions.CreateActionRequest{
+		Name: "testing_update_action_casing",
+	})
+	s.NotNil(newAction)
+	s.Require().NoError(err)
+	s.NotEqual("", newAction.GetId())
+	s.Equal("testing_update_action_casing", newAction.GetName())
+
+	differentName := "UppER_CasE_Change"
+	updatedAction, err := s.db.PolicyClient.UpdateAction(s.ctx, &actions.UpdateActionRequest{
+		Id:   newAction.GetId(),
+		Name: differentName,
+	})
+	s.NotNil(updatedAction)
+	s.Require().NoError(err)
+
+	got, err := s.db.PolicyClient.GetAction(s.ctx, &actions.GetActionRequest{
+		Identifier: &actions.GetActionRequest_Id{
+			Id: updatedAction.GetId(),
+		},
+	})
+	s.NotNil(got)
+	s.Require().NoError(err)
+	s.Equal(strings.ToLower(differentName), got.GetName())
+}
 func TestActionsSuite(t *testing.T) {
 	if testing.Short() {
 		t.Skip("skipping actions integration tests")
diff --git a/service/integration/subject_mappings_test.go b/service/integration/subject_mappings_test.go
index e7eeb7c187..3ce4da0aec 100644
--- a/service/integration/subject_mappings_test.go
+++ b/service/integration/subject_mappings_test.go
@@ -3,6 +3,7 @@ package integration
 import (
 	"context"
 	"log/slog"
+	"strings"
 	"testing"
 
 	"github.com/opentdf/platform/protocol/go/common"
@@ -193,6 +194,48 @@ func (s *SubjectMappingsSuite) TestCreateSubjectMapping_NonExistentActionId_Fail
 	s.Require().ErrorIs(err, db.ErrForeignKeyViolation)
 }
 
+func (s *SubjectMappingsSuite) TestCreateSubjectMapping_BrandNewActionNames_Succeeds() {
+	fixtureAttrVal := s.f.GetAttributeValueKey("example.com/attr/attr1/value/value2")
+	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set1")
+	newNameOne := "NewAction-Testing-SMCreate-1"
+	newNameTwo := "NewAction_Testing_SMCreate_2"
+
+	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
+		AttributeValueId: fixtureAttrVal.ID,
+		Actions: []*policy.Action{
+			{
+				Name: newNameOne,
+			},
+			{
+				Name: newNameTwo,
+			},
+		},
+		ExistingSubjectConditionSetId: fixtureScs.ID,
+	}
+
+	created, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, newSubjectMapping)
+	s.NotNil(created)
+	s.Require().NoError(err)
+
+	got, err := s.db.PolicyClient.GetSubjectMapping(s.ctx, created.GetId())
+	s.Require().NoError(err)
+	s.NotNil(got)
+
+	foundNewActionOne := false
+	foundNewActionTwo := false
+	for _, a := range got.GetActions() {
+		if a.GetName() == strings.ToLower(newNameOne) {
+			foundNewActionOne = true
+		}
+		if a.GetName() == strings.ToLower(newNameTwo) {
+			foundNewActionTwo = true
+		}
+		s.NotEqual("", a.GetId())
+	}
+	s.True(foundNewActionOne)
+	s.True(foundNewActionTwo)
+}
+
 func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_Actions() {
 	// create a new one SM with actions, update it with different actions, and verify the update
 	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value2").ID
@@ -244,10 +287,11 @@ func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_Actions() {
 	s.False(updatedAt.AsTime().IsZero())
 	s.True(updatedAt.AsTime().After(createdAt.AsTime()))
 
-	// update with an action not in the current
+	// update with actions not in the current
+	newActionName := "NewAction-Testing-SM-UPDATE"
 	update = &subjectmapping.UpdateSubjectMappingRequest{
 		Id:      created.GetId(),
-		Actions: []*policy.Action{actionDelete},
+		Actions: []*policy.Action{actionDelete, {Name: newActionName}},
 	}
 	updated, err = s.db.PolicyClient.UpdateSubjectMapping(s.ctx, update)
 	s.Require().NoError(err)
@@ -258,8 +302,20 @@ func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_Actions() {
 	s.Require().NoError(err)
 	s.NotNil(got)
 	s.Equal(len(update.GetActions()), len(got.GetActions()))
-	s.Equal(actionDelete.GetName(), got.GetActions()[0].GetName())
+	foundDelete := false
+	foundNewAction := false
+	for _, a := range got.GetActions() {
+		if a.GetName() == actionDelete.GetName() {
+			foundDelete = true
+		}
+		if a.GetName() == strings.ToLower(newActionName) {
+			foundNewAction = true
+		}
+	}
+	s.True(foundDelete)
+	s.True(foundNewAction)
 }
+
 func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_Actions_NonExistentActionID_Fails() {
 	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value1").ID
 	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set2")
diff --git a/service/policy/db/subject_mappings.go b/service/policy/db/subject_mappings.go
index 2ad2abf017..03a8f699ce 100644
--- a/service/policy/db/subject_mappings.go
+++ b/service/policy/db/subject_mappings.go
@@ -262,7 +262,7 @@ func (c PolicyDBClient) CreateSubjectMapping(ctx context.Context, s *subjectmapp
 		if a.GetId() != "" {
 			actionIDs = append(actionIDs, a.GetId())
 		} else if a.GetName() != "" {
-			actionNames = append(actionNames, a.GetName())
+			actionNames = append(actionNames, strings.ToLower(a.GetName()))
 		} else {
 			return nil, db.WrapIfKnownInvalidQueryErr(
 				errors.Join(db.ErrMissingValue, errors.New("action id or name is required when creating a subject mapping")),
@@ -460,7 +460,7 @@ func (c PolicyDBClient) UpdateSubjectMapping(ctx context.Context, r *subjectmapp
 			if a.GetId() != "" {
 				actionIDs = append(actionIDs, a.GetId())
 			} else if a.GetName() != "" {
-				actionNames = append(actionNames, a.GetName())
+				actionNames = append(actionNames, strings.ToLower(a.GetName()))
 			} else {
 				return nil, db.WrapIfKnownInvalidQueryErr(
 					errors.Join(db.ErrMissingValue, errors.New("action id or name is required when updating a subject mapping's actions")),

From 1e831d3884d915200c2f4b89ff2881e603c76e50 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Wed, 9 Apr 2025 07:56:58 -0700
Subject: [PATCH 046/110] spelling

---
 .../0004-standard-action-storage-handling.md  | 24 +++++++++----------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/service/policy/adr/0004-standard-action-storage-handling.md b/service/policy/adr/0004-standard-action-storage-handling.md
index f7a6ea8dbe..2c52d85179 100644
--- a/service/policy/adr/0004-standard-action-storage-handling.md
+++ b/service/policy/adr/0004-standard-action-storage-handling.md
@@ -8,10 +8,10 @@ with Custom Actions (which must be fetched / configured) is challenging.
 ## Chosen Option: Standard Actions will be storage-driven and exported SDK constants
 
 1. We will store CRUD action names with `is_standard = TRUE` in policy db table.
-2. We will expose `ActionCreate`, `ActionRead`, etc, via SDK constants to make standard actions importable.
-3. Custom actions in PEPs will be retrievable or configurable as needed (as action name strings or policy object action ids).
+2. We will expose `ActionCreate`, `ActionRead`, etc., via SDK constants to make standard actions importable.
+3. Custom actions in PEPs will be retrievable or configurable as needed (as action name strings or policy object action IDs).
 4. We will avoid significant complexity from normalizing proto enums to stored table rows, and vice versa.
-5. Subject Mappings CRUD, Obligations CRUD, and GetDecisions will support actions by `name` or `id` and
+5. Subject Mappings CRUD, Obligations CRUD, and `GetDecisions` will support actions by `name` or `id` and
 validate that the action exists in the policy database.
 6. We will deprecate the existing standard action enums and suggest use of SDK constants.
 
@@ -20,19 +20,19 @@ validate that the action exists in the policy database.
 ### Enhance existing StandardAction proto enum and normalize when stored in actions table
 1. Standard Actions are proto-defined and normalized into the db (STANDARD_ACTION_ENUM_CREATE => 'create') with is_standard = TRUE.
 2. Admins can write metadata labels for standard actions, but they're otherwise immutable.
-3. This becomes quite complex in Subject Mappings CRUD, Obligations CRUD, and GetDecisions with need to support:
-    1. custom action by id
+3. This becomes quite complex in Subject Mappings CRUD, Obligations CRUD, and `GetDecisions` with need to support:
+    1. custom action by ID
     2. custom action by stored, normalized name
-    3. standard action by stored id (to be normalized to proto in API layer)
+    3. standard action by stored ID (to be normalized to proto in API layer)
     4. standard action by stored, normalized name (to be normalized to proto in API layer)
     5. proto enum for standard action (to be normalized to a stored name in DB layer)
 
 ### Enhance existing StandardAction proto enum but do not store in actions table
 1. Standard Actions are proto-only.
 2. Custom Actions are stored in db table.
-3. Subject Mappings column for standard_actions (marshaled protos), and relation table for custom actions (by id).
-4. Simpler Subject Mappings CRUD, Obligations CRUD, and GetDecisions:
-    1. custom action by id
+3. Subject Mappings column for standard_actions (marshaled protos), and relation table for custom actions (by ID).
+4. Simpler Subject Mappings CRUD, Obligations CRUD, and `GetDecisions`:
+    1. custom action by ID
     2. custom action by stored, normalized name
     3. proto enum for standard action
 
@@ -40,8 +40,8 @@ validate that the action exists in the policy database.
 1. Standard Actions become read-only "create, read, update, delete" rows in db table (with column is_standard = TRUE).
 2. Custom Actions are fully writable with unique names and column is_standard = FALSE.
 3. Old proto enums are deprecated.
-4. Simpler Subject Mappings CRUD, Obligations CRUD, and GetDecisions:
-    1. action by id
+4. Simpler Subject Mappings CRUD, Obligations CRUD, and `GetDecisions`:
+    1. action by ID
     2. action by name
-    3. SDKs can still export constants like ActionCreate, ActionRead, etc
+    3. SDKs can still export constants like ActionCreate, ActionRead, etc.
 

From 9f607f10cf453b6f27a39d96522794ece999e9a9 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Wed, 9 Apr 2025 11:12:35 -0700
Subject: [PATCH 047/110] define standard actions type

---
 service/integration/attribute_fqns_test.go   |  6 +--
 service/integration/subject_mappings_test.go | 39 +++++++++---------
 service/policy/db/actions.go                 | 43 ++++++++++++++++++++
 3 files changed, 65 insertions(+), 23 deletions(-)

diff --git a/service/integration/attribute_fqns_test.go b/service/integration/attribute_fqns_test.go
index 9e085ea67f..b26eec0b29 100644
--- a/service/integration/attribute_fqns_test.go
+++ b/service/integration/attribute_fqns_test.go
@@ -14,6 +14,7 @@ import (
 	"github.com/opentdf/platform/protocol/go/policy/subjectmapping"
 	"github.com/opentdf/platform/service/internal/fixtures"
 	"github.com/opentdf/platform/service/pkg/db"
+	policydb "github.com/opentdf/platform/service/policy/db"
 	"github.com/stretchr/testify/suite"
 	"google.golang.org/protobuf/proto"
 )
@@ -721,9 +722,8 @@ func (s *AttributeFqnSuite) bigTestSetup(namespaceName string) bigSetup {
 	s.Require().NoError(err)
 	s.NotNil(val2Grant)
 
-	actionRead := s.f.GetStandardAction("read")
-	actionCreate := s.f.GetStandardAction("create")
-
+	actionRead := s.f.GetStandardAction(policydb.ActionRead.String())
+	actionCreate := s.f.GetStandardAction(policydb.ActionCreate.String())
 	// give a subject mapping to the first value
 	val1SM, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              val1.GetId(),
diff --git a/service/integration/subject_mappings_test.go b/service/integration/subject_mappings_test.go
index 3ce4da0aec..2041f6f1cf 100644
--- a/service/integration/subject_mappings_test.go
+++ b/service/integration/subject_mappings_test.go
@@ -11,6 +11,7 @@ import (
 	"github.com/opentdf/platform/protocol/go/policy/subjectmapping"
 	"github.com/opentdf/platform/service/internal/fixtures"
 	"github.com/opentdf/platform/service/pkg/db"
+	policydb "github.com/opentdf/platform/service/policy/db"
 	"github.com/stretchr/testify/suite"
 	"google.golang.org/protobuf/proto"
 )
@@ -60,9 +61,8 @@ var (
 func (s *SubjectMappingsSuite) TestCreateSubjectMapping_ExistingSubjectConditionSetId() {
 	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value2").ID
 	fixtureSCSId := s.f.GetSubjectConditionSetKey("subject_condition_set1").ID
-	actionRead := s.f.GetStandardAction("read")
-	actionCreate := s.f.GetStandardAction("create")
-
+	actionRead := s.f.GetStandardAction(policydb.ActionRead.String())
+	actionCreate := s.f.GetStandardAction(policydb.ActionCreate.String())
 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              fixtureAttrValID,
 		ExistingSubjectConditionSetId: fixtureSCSId,
@@ -95,8 +95,7 @@ func (s *SubjectMappingsSuite) TestCreateSubjectMapping_ExistingSubjectCondition
 
 func (s *SubjectMappingsSuite) TestCreateSubjectMapping_NewSubjectConditionSet() {
 	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value2").ID
-	actionCreate := s.f.GetStandardAction("create")
-
+	actionCreate := s.f.GetStandardAction(policydb.ActionCreate.String())
 	scs := &subjectmapping.SubjectConditionSetCreate{
 		SubjectSets: []*policy.SubjectSet{
 			{
@@ -146,7 +145,8 @@ func (s *SubjectMappingsSuite) TestCreateSubjectMapping_NewSubjectConditionSet()
 
 func (s *SubjectMappingsSuite) TestCreateSubjectMapping_NonExistentAttributeValueId_Fails() {
 	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set2")
-	actionCreate := s.f.GetStandardAction("create")
+	actionCreate := s.f.GetStandardAction(policydb.ActionCreate.String())
+
 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		Actions:                       []*policy.Action{actionCreate},
 		ExistingSubjectConditionSetId: fixtureScs.ID,
@@ -161,7 +161,7 @@ func (s *SubjectMappingsSuite) TestCreateSubjectMapping_NonExistentAttributeValu
 
 func (s *SubjectMappingsSuite) TestCreateSubjectMapping_NonExistentSubjectConditionSetId_Fails() {
 	fixtureAttrVal := s.f.GetAttributeValueKey("example.com/attr/attr2/value/value1")
-	actionRead := s.f.GetStandardAction("read")
+	actionRead := s.f.GetStandardAction(policydb.ActionRead.String())
 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              fixtureAttrVal.ID,
 		Actions:                       []*policy.Action{actionRead},
@@ -240,8 +240,8 @@ func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_Actions() {
 	// create a new one SM with actions, update it with different actions, and verify the update
 	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value2").ID
 	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set3")
-	actionUpdate := s.f.GetStandardAction("update")
-	actionDelete := s.f.GetStandardAction("delete")
+	actionUpdate := s.f.GetStandardAction(policydb.ActionUpdate.String())
+	actionDelete := s.f.GetStandardAction(policydb.ActionDelete.String())
 
 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              fixtureAttrValID,
@@ -319,7 +319,7 @@ func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_Actions() {
 func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_Actions_NonExistentActionID_Fails() {
 	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value1").ID
 	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set2")
-	actionRead := s.f.GetStandardAction("read")
+	actionRead := s.f.GetStandardAction(policydb.ActionRead.String())
 
 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              fixtureAttrValID,
@@ -351,7 +351,7 @@ func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_SubjectConditionSetId()
 	// create a new one, update it, and verify the update
 	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value1").ID
 	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set1")
-	actionDelete := s.f.GetStandardAction("delete")
+	actionDelete := s.f.GetStandardAction(policydb.ActionDelete.String())
 
 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              fixtureAttrValID,
@@ -390,8 +390,7 @@ func (s *SubjectMappingsSuite) Test_UpdateSubjectMapping_UpdateAllAllowedFields(
 	// create a new one, update it, and verify the update
 	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value1").ID
 	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set1")
-	actionCreate := s.f.GetStandardAction("create")
-
+	actionCreate := s.f.GetStandardAction(policydb.ActionCreate.String())
 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              fixtureAttrValID,
 		Actions:                       []*policy.Action{actionCreate},
@@ -667,7 +666,7 @@ func (s *SubjectMappingsSuite) TestDeleteSubjectMapping_DoesNotDeleteSubjectCond
 			},
 		},
 	}
-	actionRead := s.f.GetStandardAction("read")
+	actionRead := s.f.GetStandardAction(policydb.ActionRead.String())
 
 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:       fixtureAttrValID,
@@ -1330,7 +1329,7 @@ func (s *SubjectMappingsSuite) TestGetMatchedSubjectMappings_DeactivatedValueNot
 	// create a new subject mapping with a deactivated attribute value
 	fixtureAttrVal := s.f.GetAttributeValueKey("deactivated.io/attr/deactivated_attr/value/deactivated_value")
 	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set1")
-	actionRead := s.f.GetStandardAction("read")
+	actionRead := s.f.GetStandardAction(policydb.ActionRead.String())
 
 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              fixtureAttrVal.ID,
@@ -1383,9 +1382,9 @@ func (s *SubjectMappingsSuite) TestGetMatchedSubjectMappings_ConditionSetReusedB
 	s.Require().NoError(err)
 	s.NotNil(createdSCS)
 
-	actionRead := s.f.GetStandardAction("read")
-	actionDelete := s.f.GetStandardAction("delete")
-	actionUpdate := s.f.GetStandardAction("update")
+	actionRead := s.f.GetStandardAction(policydb.ActionRead.String())
+	actionDelete := s.f.GetStandardAction(policydb.ActionDelete.String())
+	actionUpdate := s.f.GetStandardAction(policydb.ActionUpdate.String())
 
 	// Create two subject mappings across different values that reuse the same subject condition set
 	attrVal1 := s.f.GetAttributeValueKey("example.com/attr/attr1/value/value1").ID
@@ -1458,8 +1457,8 @@ func (s *SubjectMappingsSuite) TestGetMatchedSubjectMappings_OnlyMatchesOnePrope
 		},
 	}
 
-	actionCreate := s.f.GetStandardAction("create")
-	actionRead := s.f.GetStandardAction("read")
+	actionCreate := s.f.GetStandardAction(policydb.ActionCreate.String())
+	actionRead := s.f.GetStandardAction(policydb.ActionRead.String())
 
 	subjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:       fixtureAttrValID,
diff --git a/service/policy/db/actions.go b/service/policy/db/actions.go
index 82e86c6779..880560809c 100644
--- a/service/policy/db/actions.go
+++ b/service/policy/db/actions.go
@@ -2,6 +2,8 @@ package db
 
 import (
 	"context"
+	"errors"
+	"fmt"
 	"strings"
 
 	"github.com/opentdf/platform/protocol/go/common"
@@ -11,6 +13,29 @@ import (
 	"google.golang.org/protobuf/encoding/protojson"
 )
 
+type ActionStandard string
+
+const (
+	ActionCreate ActionStandard = "create"
+	ActionRead   ActionStandard = "read"
+	ActionUpdate ActionStandard = "update"
+	ActionDelete ActionStandard = "delete"
+)
+
+// Add a validation method
+func (a ActionStandard) IsValid() bool {
+    switch a {
+    case ActionCreate, ActionRead, ActionUpdate, ActionDelete:
+        return true
+    }
+    return false
+}
+
+// If needed, implement the Stringer interface explicitly
+func (a ActionStandard) String() string {
+    return string(a)
+}
+
 func (c PolicyDBClient) GetAction(ctx context.Context, req *actions.GetActionRequest) (*policy.Action, error) {
 	getActionParams := getActionParams{}
 	if req.GetId() != "" {
@@ -166,7 +191,25 @@ func (c PolicyDBClient) DeleteAction(ctx context.Context, req *actions.DeleteAct
 	if err != nil {
 		return nil, db.WrapIfKnownInvalidQueryErr(err)
 	}
+	// if did not delete, was either not found or was a standard action
 	if count == 0 {
+		got, err := c.GetAction(ctx, &actions.GetActionRequest{
+			Identifier: &actions.GetActionRequest_Id{
+				Id: req.GetId(),
+			},
+		})
+		// not found
+		if err != nil && errors.Is(err, db.ErrNotFound) {
+			return nil, err
+		}
+		// standard action
+		name := got.GetName()
+		if name == string(ActionCreate) ||
+			name == string(ActionRead) ||
+			name == string(ActionUpdate) ||
+			name == string(ActionDelete) {
+			return nil, fmt.Errorf("cannot delete standard action %s: %w", name, db.ErrRestrictViolation)
+		}
 		return nil, db.ErrNotFound
 	}
 

From 3c3059f6361b97dce4f39beb8faf76c717669ff3 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Wed, 9 Apr 2025 11:13:50 -0700
Subject: [PATCH 048/110] more tests

---
 service/integration/actions_test.go | 84 ++++++++++++++++++++++++++---
 1 file changed, 77 insertions(+), 7 deletions(-)

diff --git a/service/integration/actions_test.go b/service/integration/actions_test.go
index 3edd61d7bc..cc24a396c5 100644
--- a/service/integration/actions_test.go
+++ b/service/integration/actions_test.go
@@ -11,6 +11,7 @@ import (
 	"github.com/opentdf/platform/protocol/go/policy/actions"
 	"github.com/opentdf/platform/service/internal/fixtures"
 	"github.com/opentdf/platform/service/pkg/db"
+	policydb "github.com/opentdf/platform/service/policy/db"
 	"github.com/stretchr/testify/suite"
 )
 
@@ -61,14 +62,14 @@ func (s *ActionsSuite) Test_ListActions_NoPagination_Succeeds() {
 		}
 	}
 	for _, action := range list.GetActionsStandard() {
-		switch action.Name {
-		case "read":
+		switch policydb.ActionStandard(action.Name) {
+		case policydb.ActionRead:
 			foundRead = true
-		case "create":
+		case policydb.ActionCreate:
 			foundCreate = true
-		case "update":
+		case policydb.ActionUpdate:
 			foundUpdate = true
-		case "delete":
+		case policydb.ActionDelete:
 			foundDelete = true
 		}
 	}
@@ -123,7 +124,7 @@ func (s *ActionsSuite) Test_ListActions_LimitLargerThanConfigured_Fails() {
 
 func (s *ActionsSuite) Test_GetAction_Id_Succeeds() {
 	fixtureCustomAction1 := s.f.GetCustomActionKey("custom_action_1")
-	actionRead := s.f.GetStandardAction("read")
+	actionRead := s.f.GetStandardAction(policydb.ActionRead.String())
 
 	action, err := s.db.PolicyClient.GetAction(s.ctx, &actions.GetActionRequest{
 		Identifier: &actions.GetActionRequest_Id{
@@ -151,7 +152,7 @@ func (s *ActionsSuite) Test_GetAction_Id_Succeeds() {
 
 func (s *ActionsSuite) Test_GetAction_Name_Succeeds() {
 	customAction := s.f.GetCustomActionKey("other_special_action")
-	actionCreate := s.f.GetStandardAction("create")
+	actionCreate := s.f.GetStandardAction(policydb.ActionCreate.String())
 	action, err := s.db.PolicyClient.GetAction(s.ctx, &actions.GetActionRequest{
 		Identifier: &actions.GetActionRequest_Name{
 			Name: customAction.Name,
@@ -275,6 +276,7 @@ func (s *ActionsSuite) Test_UpdateAction_Succeeds() {
 	s.Equal(differentName, got.GetName())
 	s.Equal("replaced", got.GetMetadata().GetLabels()["original"])
 }
+
 func (s *ActionsSuite) Test_UpdateAction_NormalizesToLowerCase() {
 	newAction, err := s.db.PolicyClient.CreateAction(s.ctx, &actions.CreateActionRequest{
 		Name: "testing_update_action_casing",
@@ -301,6 +303,74 @@ func (s *ActionsSuite) Test_UpdateAction_NormalizesToLowerCase() {
 	s.Require().NoError(err)
 	s.Equal(strings.ToLower(differentName), got.GetName())
 }
+
+func (s *ActionsSuite) Test_UpdateAction_Conflict_Fails() {
+	fixtureCustomAction := s.f.GetCustomActionKey("custom_action_1")
+	fixtureCustomAction2 := s.f.GetCustomActionKey("other_special_action")
+	action, err := s.db.PolicyClient.UpdateAction(s.ctx, &actions.UpdateActionRequest{
+		Id:   fixtureCustomAction.ID,
+		Name: fixtureCustomAction2.Name,
+	})
+	s.Nil(action)
+	s.Require().Error(err)
+	s.Require().ErrorIs(err, db.ErrUniqueConstraintViolation)
+}
+
+func (s *ActionsSuite) Test_UpdateAction_NonExistent_Fails() {
+	action, err := s.db.PolicyClient.UpdateAction(s.ctx, &actions.UpdateActionRequest{
+		Id:   nonExistingActionUUID,
+		Name: "new_name_nonexistent",
+	})
+	s.Nil(action)
+	s.Require().Error(err)
+	s.Require().ErrorIs(err, db.ErrNotFound)
+}
+
+func (s *ActionsSuite) Test_DeleteAction_Succeeds() {
+	created, err := s.db.PolicyClient.CreateAction(s.ctx, &actions.CreateActionRequest{
+		Name: "new_custom_action_deleteaction",
+	})
+	s.NotNil(created)
+	s.Require().NoError(err)
+	s.NotEqual("", created.GetId())
+
+	deleted, err := s.db.PolicyClient.DeleteAction(s.ctx, &actions.DeleteActionRequest{
+		Id: created.GetId(),
+	})
+	s.NotNil(deleted)
+	s.Require().NoError(err)
+	s.Equal(created.GetId(), deleted.GetId())
+
+	got, err := s.db.PolicyClient.GetAction(s.ctx, &actions.GetActionRequest{
+		Identifier: &actions.GetActionRequest_Id{
+			Id: created.GetId(),
+		},
+	})
+	s.Nil(got)
+	s.Require().Error(err)
+	s.Require().ErrorIs(err, db.ErrNotFound)
+}
+
+func (s *ActionsSuite) Test_DeleteAction_NonExistent_Fails() {
+	action, err := s.db.PolicyClient.DeleteAction(s.ctx, &actions.DeleteActionRequest{
+		Id: nonExistingActionUUID,
+	})
+	s.Nil(action)
+	s.Require().Error(err)
+	s.Require().ErrorIs(err, db.ErrNotFound)
+}
+
+func (s *ActionsSuite) Test_DeleteAction_StandardAction_Fails() {
+	actionRead := s.f.GetStandardAction(policydb.ActionRead.String())
+	action, err := s.db.PolicyClient.DeleteAction(s.ctx, &actions.DeleteActionRequest{
+		Id: actionRead.Id,
+	})
+	s.Nil(action)
+	s.Require().Error(err)
+	s.Require().ErrorIs(err, db.ErrRestrictViolation)
+	s.Contains(err.Error(), actionRead.Name)
+}
+
 func TestActionsSuite(t *testing.T) {
 	if testing.Short() {
 		t.Skip("skipping actions integration tests")

From 3b4935c863c990973c31c31b8bb3b0f71ae9db77 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Wed, 9 Apr 2025 11:17:09 -0700
Subject: [PATCH 049/110] remove updateStandardAction query

---
 service/policy/db/query.sql    |  6 ------
 service/policy/db/query.sql.go | 21 ---------------------
 2 files changed, 27 deletions(-)

diff --git a/service/policy/db/query.sql b/service/policy/db/query.sql
index b7fcd4fd73..7f60de31bc 100644
--- a/service/policy/db/query.sql
+++ b/service/policy/db/query.sql
@@ -1324,12 +1324,6 @@ SET
 WHERE id = $1
   AND is_standard = FALSE;
 
--- name: updateStandardAction :execrows
-UPDATE actions
-SET metadata = metadata
-WHERE id = $1
-  AND is_standard = TRUE;
-
 -- name: deleteCustomAction :execrows
 DELETE FROM actions
 WHERE id = $1
diff --git a/service/policy/db/query.sql.go b/service/policy/db/query.sql.go
index 024333b76d..7e7213575c 100644
--- a/service/policy/db/query.sql.go
+++ b/service/policy/db/query.sql.go
@@ -4291,27 +4291,6 @@ func (q *Queries) updatePublicKey(ctx context.Context, arg updatePublicKeyParams
 	return i, err
 }
 
-const updateStandardAction = `-- name: updateStandardAction :execrows
-UPDATE actions
-SET metadata = metadata
-WHERE id = $1
-  AND is_standard = TRUE
-`
-
-// updateStandardAction
-//
-//	UPDATE actions
-//	SET metadata = metadata
-//	WHERE id = $1
-//	  AND is_standard = TRUE
-func (q *Queries) updateStandardAction(ctx context.Context, id string) (int64, error) {
-	result, err := q.db.Exec(ctx, updateStandardAction, id)
-	if err != nil {
-		return 0, err
-	}
-	return result.RowsAffected(), nil
-}
-
 const updateSubjectMapping = `-- name: updateSubjectMapping :execrows
 WITH
     subject_mapping_update AS (

From 9d667b300796bc700e5e07a44da6ce3c990b31d2 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Wed, 9 Apr 2025 11:50:38 -0700
Subject: [PATCH 050/110] fix sm update query

---
 service/policy/db/query.sql           | 14 +++++---------
 service/policy/db/query.sql.go        | 22 +++++++---------------
 service/policy/db/subject_mappings.go | 12 +++++++-----
 3 files changed, 19 insertions(+), 29 deletions(-)

diff --git a/service/policy/db/query.sql b/service/policy/db/query.sql
index 7f60de31bc..b85a28e176 100644
--- a/service/policy/db/query.sql
+++ b/service/policy/db/query.sql
@@ -1009,11 +1009,11 @@ WITH
             sqlc.arg('id'),
             a
         FROM unnest(sqlc.narg('action_ids')::UUID[]) AS a
-        WHERE 
+        WHERE
             sqlc.narg('action_ids')::UUID[] IS NOT NULL
             AND NOT EXISTS (
-                SELECT 1 
-                FROM subject_mapping_actions 
+                SELECT 1
+                FROM subject_mapping_actions
                 WHERE subject_mapping_id = sqlc.arg('id') AND action_id = a
             )
         RETURNING action_id
@@ -1022,12 +1022,8 @@ WITH
         SELECT COUNT(*) AS cnt
         FROM subject_mapping_update
     )
-SELECT
-    1 / CASE WHEN (
-            SELECT cnt FROM update_count
-        ) = 0 THEN 0
-        ELSE 1
-    END;
+SELECT cnt
+FROM update_count;
 
 -- name: deleteSubjectMapping :execrows
 DELETE FROM subject_mappings WHERE id = $1;
diff --git a/service/policy/db/query.sql.go b/service/policy/db/query.sql.go
index 7e7213575c..84102abbc1 100644
--- a/service/policy/db/query.sql.go
+++ b/service/policy/db/query.sql.go
@@ -4318,11 +4318,11 @@ WITH
             $3,
             a
         FROM unnest($4::UUID[]) AS a
-        WHERE 
+        WHERE
             $4::UUID[] IS NOT NULL
             AND NOT EXISTS (
-                SELECT 1 
-                FROM subject_mapping_actions 
+                SELECT 1
+                FROM subject_mapping_actions
                 WHERE subject_mapping_id = $3 AND action_id = a
             )
         RETURNING action_id
@@ -4331,12 +4331,8 @@ WITH
         SELECT COUNT(*) AS cnt
         FROM subject_mapping_update
     )
-SELECT
-    1 / CASE WHEN (
-            SELECT cnt FROM update_count
-        ) = 0 THEN 0
-        ELSE 1
-    END
+SELECT cnt
+FROM update_count
 `
 
 type updateSubjectMappingParams struct {
@@ -4387,12 +4383,8 @@ type updateSubjectMappingParams struct {
 //	        SELECT COUNT(*) AS cnt
 //	        FROM subject_mapping_update
 //	    )
-//	SELECT
-//	    1 / CASE WHEN (
-//	            SELECT cnt FROM update_count
-//	        ) = 0 THEN 0
-//	        ELSE 1
-//	    END
+//	SELECT cnt
+//	FROM update_count
 func (q *Queries) updateSubjectMapping(ctx context.Context, arg updateSubjectMappingParams) (int64, error) {
 	result, err := q.db.Exec(ctx, updateSubjectMapping,
 		arg.Metadata,
diff --git a/service/policy/db/subject_mappings.go b/service/policy/db/subject_mappings.go
index 03a8f699ce..ec01eff465 100644
--- a/service/policy/db/subject_mappings.go
+++ b/service/policy/db/subject_mappings.go
@@ -434,13 +434,15 @@ func (c PolicyDBClient) UpdateSubjectMapping(ctx context.Context, r *subjectmapp
 	id := r.GetId()
 	subjectConditionSetID := r.GetSubjectConditionSetId()
 	actions := r.GetActions()
+
+	before, err := c.GetSubjectMapping(ctx, id)
+	if err != nil || before == nil {
+		return nil, db.WrapIfKnownInvalidQueryErr(err)
+	}
+
 	// if extend we need to merge the metadata
 	metadataJSON, metadata, err := db.MarshalUpdateMetadata(r.GetMetadata(), r.GetMetadataUpdateBehavior(), func() (*common.Metadata, error) {
-		a, err := c.GetSubjectMapping(ctx, id)
-		if err != nil {
-			return nil, err
-		}
-		return a.GetMetadata(), nil
+		return before.GetMetadata(), nil
 	})
 	if err != nil {
 		return nil, err

From 13ef076b02cfcad116eb819c2fc4484d03e9156c Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Wed, 9 Apr 2025 12:40:08 -0700
Subject: [PATCH 051/110] make action update name optional

---
 protocol/go/policy/actions/actions.pb.go | 154 ++++++++++++-----------
 service/policy/actions/actions.proto     |   8 +-
 2 files changed, 83 insertions(+), 79 deletions(-)

diff --git a/protocol/go/policy/actions/actions.pb.go b/protocol/go/policy/actions/actions.pb.go
index 5c2a43fb28..f46f2b6c77 100644
--- a/protocol/go/policy/actions/actions.pb.go
+++ b/protocol/go/policy/actions/actions.pb.go
@@ -685,89 +685,91 @@ var file_policy_actions_actions_proto_rawDesc = []byte{
 	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06,
 	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70,
 	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x22, 0xdd, 0x03, 0x0a, 0x13, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41,
+	0x74, 0x69, 0x6f, 0x6e, 0x22, 0xfa, 0x03, 0x0a, 0x13, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41,
 	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02,
 	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0,
-	0x01, 0x01, 0x52, 0x02, 0x69, 0x64, 0x12, 0xa0, 0x02, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x8b, 0x02, 0xba, 0x48, 0x87, 0x02, 0xba, 0x01, 0xfc, 0x01,
-	0x0a, 0x12, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x66, 0x6f,
-	0x72, 0x6d, 0x61, 0x74, 0x12, 0xa8, 0x01, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61,
-	0x6d, 0x65, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c,
-	0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x20, 0x73, 0x74, 0x72, 0x69, 0x6e,
-	0x67, 0x2c, 0x20, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x69, 0x6e, 0x67, 0x20, 0x68, 0x79, 0x70, 0x68,
-	0x65, 0x6e, 0x73, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x75, 0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f,
-	0x72, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74, 0x20, 0x6e, 0x6f, 0x74, 0x20, 0x61, 0x73, 0x20, 0x74,
-	0x68, 0x65, 0x20, 0x66, 0x69, 0x72, 0x73, 0x74, 0x20, 0x6f, 0x72, 0x20, 0x6c, 0x61, 0x73, 0x74,
-	0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x2e, 0x20, 0x54, 0x68, 0x65, 0x20,
-	0x73, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61,
-	0x6d, 0x65, 0x20, 0x69, 0x73, 0x20, 0x6e, 0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64,
-	0x20, 0x74, 0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a,
-	0x3b, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e,
-	0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61,
-	0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a,
-	0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x72, 0x05, 0x10, 0x01,
-	0x18, 0xfd, 0x01, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74,
-	0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f,
-	0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4d, 0x75, 0x74,
-	0x61, 0x62, 0x6c, 0x65, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x54,
-	0x0a, 0x18, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x75, 0x70, 0x64, 0x61, 0x74,
-	0x65, 0x5f, 0x62, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x18, 0x65, 0x20, 0x01, 0x28, 0x0e,
-	0x32, 0x1a, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x52, 0x16, 0x6d, 0x65,
-	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x42, 0x65, 0x68, 0x61,
-	0x76, 0x69, 0x6f, 0x72, 0x22, 0x3e, 0x0a, 0x14, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06,
-	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x22, 0x2f, 0x0a, 0x13, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02, 0x69,
-	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01,
-	0x01, 0x52, 0x02, 0x69, 0x64, 0x22, 0x3e, 0x0a, 0x14, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a,
-	0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e,
-	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x32, 0xd4, 0x03, 0x0a, 0x0d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x52, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x41, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x20, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
-	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0b, 0x4c,
-	0x69, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x22, 0x2e, 0x70, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74,
-	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23,
-	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e,
-	0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61,
-	0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
+	0x01, 0x01, 0x52, 0x02, 0x69, 0x64, 0x12, 0xbd, 0x02, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0xa8, 0x02, 0xba, 0x48, 0xa4, 0x02, 0xba, 0x01, 0x98, 0x02,
+	0x0a, 0x1b, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0xa8, 0x01,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x6d, 0x75, 0x73, 0x74,
+	0x20, 0x62, 0x65, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65,
+	0x72, 0x69, 0x63, 0x20, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x2c, 0x20, 0x61, 0x6c, 0x6c, 0x6f,
+	0x77, 0x69, 0x6e, 0x67, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x20, 0x61, 0x6e, 0x64,
+	0x20, 0x75, 0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f, 0x72, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74,
+	0x20, 0x6e, 0x6f, 0x74, 0x20, 0x61, 0x73, 0x20, 0x74, 0x68, 0x65, 0x20, 0x66, 0x69, 0x72, 0x73,
+	0x74, 0x20, 0x6f, 0x72, 0x20, 0x6c, 0x61, 0x73, 0x74, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63,
+	0x74, 0x65, 0x72, 0x2e, 0x20, 0x54, 0x68, 0x65, 0x20, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20,
+	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x69, 0x73, 0x20, 0x6e,
+	0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64, 0x20, 0x74, 0x6f, 0x20, 0x6c, 0x6f, 0x77,
+	0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a, 0x4e, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x74,
+	0x68, 0x69, 0x73, 0x29, 0x20, 0x3d, 0x3d, 0x20, 0x30, 0x20, 0x7c, 0x7c, 0x20, 0x74, 0x68, 0x69,
+	0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d, 0x7a,
+	0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d,
+	0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30,
+	0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29, 0xc8, 0x01, 0x00, 0x72, 0x03, 0x18, 0xfd, 0x01,
+	0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f,
+	0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4d, 0x75, 0x74, 0x61, 0x62, 0x6c,
+	0x65, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x54, 0x0a, 0x18, 0x6d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x62,
+	0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x18, 0x65, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e,
+	0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x55,
+	0x70, 0x64, 0x61, 0x74, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x52, 0x16, 0x6d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x42, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f,
+	0x72, 0x22, 0x3e, 0x0a, 0x14, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x22, 0x2f, 0x0a, 0x13, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x52, 0x02,
+	0x69, 0x64, 0x22, 0x3e, 0x0a, 0x14, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x32, 0xd4, 0x03, 0x0a, 0x0d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x12, 0x52, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x12, 0x20, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x22, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x70, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73,
+	0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
 	0x6f, 0x6e, 0x12, 0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
 	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41,
+	0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41,
 	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12,
-	0x5b, 0x0a, 0x0c, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12,
+	0x5b, 0x0a, 0x0c, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12,
 	0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71,
+	0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71,
 	0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0xb3, 0x01, 0x0a,
-	0x12, 0x63, 0x6f, 0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x42, 0x0c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x50, 0x72, 0x6f, 0x74,
-	0x6f, 0x50, 0x01, 0x5a, 0x36, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f,
-	0x6f, 0x70, 0x65, 0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d,
-	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x2f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xa2, 0x02, 0x03, 0x50, 0x41,
-	0x58, 0xaa, 0x02, 0x0e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0xca, 0x02, 0x0e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0xe2, 0x02, 0x1a, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
-	0xea, 0x02, 0x0f, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x3a, 0x3a, 0x41, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c,
+	0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x2e, 0x70,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x44, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0xb3, 0x01, 0x0a, 0x12, 0x63, 0x6f,
+	0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
+	0x42, 0x0c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01,
+	0x5a, 0x36, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65,
+	0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x2f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xa2, 0x02, 0x03, 0x50, 0x41, 0x58, 0xaa, 0x02,
+	0x0e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xca,
+	0x02, 0x0e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
+	0xe2, 0x02, 0x1a, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x0f,
+	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x3a, 0x3a, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x62,
+	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/service/policy/actions/actions.proto b/service/policy/actions/actions.proto
index 244d2c1f1d..cbbd312815 100644
--- a/service/policy/actions/actions.proto
+++ b/service/policy/actions/actions.proto
@@ -83,16 +83,18 @@ message UpdateActionRequest {
   // Optional
   // Custom actions only: replaces the existing action name
   string name = 2 [
-    (buf.validate.field).string.min_len = 1,
+    (buf.validate.field).required = false,
     (buf.validate.field).string.max_len = 253,
     (buf.validate.field).cel = {
-      id: "action_name_format"
+      id: "optional_action_name_format"
       message:
         "Action name must be an alphanumeric string, "
         "allowing hyphens and underscores but not as the "
         "first or last character. The stored action name "
         "is normalized to lower case."
-      expression: "this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$')"
+      expression:
+        "size(this) == 0 || "
+        "this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$')"
     }
   ];
 

From 88820561481f252119b42d5c61444b87a36f7efd Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Thu, 10 Apr 2025 12:01:59 -0700
Subject: [PATCH 052/110] feat(policy): actions service RPCs should roundtrip
 to db layer

---
 service/logger/audit/constants.go       |   3 +
 service/policy/actions/actions.go       | 127 ++++++++++++++++++++++--
 service/policy/namespaces/namespaces.go |   1 -
 service/policy/policy.go                |   2 +
 4 files changed, 121 insertions(+), 12 deletions(-)

diff --git a/service/logger/audit/constants.go b/service/logger/audit/constants.go
index 0fa834d387..076166f569 100644
--- a/service/logger/audit/constants.go
+++ b/service/logger/audit/constants.go
@@ -21,6 +21,7 @@ const (
 	ObjectTypeEntityObject
 	ObjectTypeResourceMappingGroup
 	ObjectTypePublicKey
+	ObjectTypeAction
 )
 
 func (ot ObjectType) String() string {
@@ -38,6 +39,8 @@ func (ot ObjectType) String() string {
 		"key_object",
 		"entity_object",
 		"resource_mapping_group",
+		"public_key",
+		"action",
 	}[ot]
 }
 
diff --git a/service/policy/actions/actions.go b/service/policy/actions/actions.go
index 418dd6e8bb..3ca8f0a8d4 100644
--- a/service/policy/actions/actions.go
+++ b/service/policy/actions/actions.go
@@ -2,12 +2,14 @@ package actions
 
 import (
 	"context"
-	"errors"
+	"log/slog"
 
 	"connectrpc.com/connect"
 	"github.com/opentdf/platform/protocol/go/policy/actions"
 	"github.com/opentdf/platform/protocol/go/policy/actions/actionsconnect"
 	"github.com/opentdf/platform/service/logger"
+	"github.com/opentdf/platform/service/logger/audit"
+	"github.com/opentdf/platform/service/pkg/db"
 	"github.com/opentdf/platform/service/pkg/serviceregistry"
 
 	policyconfig "github.com/opentdf/platform/service/policy/config"
@@ -39,22 +41,125 @@ func NewRegistration(ns string, dbRegister serviceregistry.DBRegister) *servicer
 	}
 }
 
-func (a *ActionsService) GetAction(context.Context, *connect.Request[actions.GetActionRequest]) (*connect.Response[actions.GetActionResponse], error) {
-	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("GetAction is not implemented"))
+func (a *ActionsService) GetAction(ctx context.Context, req *connect.Request[actions.GetActionRequest]) (*connect.Response[actions.GetActionResponse], error) {
+	rsp := &actions.GetActionResponse{}
+
+	var loggableIdentifier slog.Attr
+	if req.Msg.GetId() != "" {
+		loggableIdentifier = slog.String("id", req.Msg.GetId())
+	} else {
+		loggableIdentifier = slog.String("name", req.Msg.GetName())
+	}
+
+	a.logger.DebugContext(ctx, "getting action", loggableIdentifier)
+
+	action, err := a.dbClient.GetAction(ctx, req.Msg)
+	if err != nil {
+		return nil, db.StatusifyError(err, db.ErrTextGetRetrievalFailed, loggableIdentifier)
+	}
+	rsp.Action = action
+
+	return connect.NewResponse(rsp), nil
 }
 
-func (a *ActionsService) ListActions(context.Context, *connect.Request[actions.ListActionsRequest]) (*connect.Response[actions.ListActionsResponse], error) {
-	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("ListActions is not implemented"))
+func (a *ActionsService) ListActions(ctx context.Context, req *connect.Request[actions.ListActionsRequest]) (*connect.Response[actions.ListActionsResponse], error) {
+	a.logger.DebugContext(ctx, "listing actions")
+	rsp, err := a.dbClient.ListActions(ctx, req.Msg)
+	if err != nil {
+		return nil, db.StatusifyError(err, db.ErrTextListRetrievalFailed)
+	}
+	a.logger.DebugContext(ctx, "listed actions")
+	return connect.NewResponse(rsp), nil
 }
 
-func (a *ActionsService) CreateAction(context.Context, *connect.Request[actions.CreateActionRequest]) (*connect.Response[actions.CreateActionResponse], error) {
-	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("CreateAction is not implemented"))
+func (a *ActionsService) CreateAction(ctx context.Context, req *connect.Request[actions.CreateActionRequest]) (*connect.Response[actions.CreateActionResponse], error) {
+	a.logger.DebugContext(ctx, "creating action", slog.String("name", req.Msg.GetName()))
+	auditParams := audit.PolicyEventParams{
+		ActionType: audit.ActionTypeCreate,
+		ObjectType: audit.ObjectTypeAction,
+	}
+	rsp := &actions.CreateActionResponse{}
+
+	err := a.dbClient.RunInTx(ctx, func(txClient *policydb.PolicyDBClient) error {
+		action, err := txClient.CreateAction(ctx, req.Msg)
+		if err != nil {
+			a.logger.Audit.PolicyCRUDFailure(ctx, auditParams)
+			return err
+		}
+
+		auditParams.ObjectID = action.GetId()
+		auditParams.Original = action
+		a.logger.Audit.PolicyCRUDSuccess(ctx, auditParams)
+
+		rsp.Action = action
+		return nil
+	})
+	if err != nil {
+		return nil, db.StatusifyError(err, db.ErrTextCreationFailed, slog.String("action", req.Msg.String()))
+	}
+	return connect.NewResponse(rsp), nil
 }
 
-func (a *ActionsService) UpdateAction(context.Context, *connect.Request[actions.UpdateActionRequest]) (*connect.Response[actions.UpdateActionResponse], error) {
-	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("UpdateAction is not implemented"))
+func (a *ActionsService) UpdateAction(ctx context.Context, req *connect.Request[actions.UpdateActionRequest]) (*connect.Response[actions.UpdateActionResponse], error) {
+	actionID := req.Msg.GetId()
+	a.logger.DebugContext(ctx, "updating action", slog.String("id", actionID))
+	rsp := &actions.UpdateActionResponse{}
+
+	auditParams := audit.PolicyEventParams{
+		ActionType: audit.ActionTypeUpdate,
+		ObjectType: audit.ObjectTypeAction,
+		ObjectID:   actionID,
+	}
+
+	err := a.dbClient.RunInTx(ctx, func(txClient *policydb.PolicyDBClient) error {
+		original, err := txClient.GetAction(ctx, &actions.GetActionRequest{
+			Identifier: &actions.GetActionRequest_Id{
+				Id: actionID,
+			},
+		})
+		if err != nil {
+			a.logger.Audit.PolicyCRUDFailure(ctx, auditParams)
+			return db.StatusifyError(err, db.ErrTextGetRetrievalFailed, slog.String("id", actionID))
+		}
+
+		updated, err := txClient.UpdateAction(ctx, req.Msg)
+		if err != nil {
+			a.logger.Audit.PolicyCRUDFailure(ctx, auditParams)
+			return db.StatusifyError(err, db.ErrTextUpdateFailed, slog.String("id", actionID))
+		}
+
+		auditParams.Original = original
+		auditParams.Updated = updated
+		a.logger.Audit.PolicyCRUDSuccess(ctx, auditParams)
+
+		rsp.Action = updated
+		return nil
+	})
+	if err != nil {
+		return nil, db.StatusifyError(err, db.ErrTextUpdateFailed, slog.String("id", actionID))
+	}
+
+	return connect.NewResponse(rsp), nil
 }
 
-func (a *ActionsService) DeleteAction(context.Context, *connect.Request[actions.DeleteActionRequest]) (*connect.Response[actions.DeleteActionResponse], error) {
-	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("DeleteAction is not implemented"))
+func (a *ActionsService) DeleteAction(ctx context.Context, req *connect.Request[actions.DeleteActionRequest]) (*connect.Response[actions.DeleteActionResponse], error) {
+	rsp := &actions.DeleteActionResponse{}
+	actionID := req.Msg.GetId()
+
+	auditParams := audit.PolicyEventParams{
+		ActionType: audit.ActionTypeDelete,
+		ObjectType: audit.ObjectTypeAction,
+		ObjectID:   actionID,
+	}
+	a.logger.DebugContext(ctx, "deleting action", slog.String("id", actionID))
+
+	_, err := a.dbClient.DeleteAction(ctx, req.Msg)
+	if err != nil {
+		a.logger.Audit.PolicyCRUDFailure(ctx, auditParams)
+		return nil, db.StatusifyError(err, db.ErrTextDeletionFailed, slog.String("id", actionID))
+	}
+
+	a.logger.Audit.PolicyCRUDSuccess(ctx, auditParams)
+
+	return connect.NewResponse(rsp), nil
 }
diff --git a/service/policy/namespaces/namespaces.go b/service/policy/namespaces/namespaces.go
index a34918bed8..72c266e9ac 100644
--- a/service/policy/namespaces/namespaces.go
+++ b/service/policy/namespaces/namespaces.go
@@ -99,7 +99,6 @@ func (ns NamespacesService) GetNamespace(ctx context.Context, req *connect.Reque
 
 func (ns NamespacesService) CreateNamespace(ctx context.Context, req *connect.Request[namespaces.CreateNamespaceRequest]) (*connect.Response[namespaces.CreateNamespaceResponse], error) {
 	ns.logger.Debug("creating new namespace", slog.String("name", req.Msg.GetName()))
-
 	auditParams := audit.PolicyEventParams{
 		ActionType: audit.ActionTypeCreate,
 		ObjectType: audit.ObjectTypeNamespace,
diff --git a/service/policy/policy.go b/service/policy/policy.go
index 69db81e86b..99d1e437bc 100644
--- a/service/policy/policy.go
+++ b/service/policy/policy.go
@@ -4,6 +4,7 @@ import (
 	"embed"
 
 	"github.com/opentdf/platform/service/pkg/serviceregistry"
+	"github.com/opentdf/platform/service/policy/actions"
 	"github.com/opentdf/platform/service/policy/attributes"
 	"github.com/opentdf/platform/service/policy/db/migrations"
 	"github.com/opentdf/platform/service/policy/kasregistry"
@@ -34,6 +35,7 @@ func NewRegistrations() []serviceregistry.IService {
 		subjectmapping.NewRegistration(namespace, dbRegister),
 		kasregistry.NewRegistration(namespace, dbRegister),
 		unsafe.NewRegistration(namespace, dbRegister),
+		actions.NewRegistration(namespace, dbRegister),
 	}...)
 	return registrations
 }

From e196a860ad00d3f95c0acfb5eb783f50984b45f5 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 11 Apr 2025 11:39:10 -0700
Subject: [PATCH 053/110] lint fixes

---
 service/policy/db/subject_mappings.go            | 15 +++++++++------
 service/policy/subjectmapping/subject_mapping.go |  6 +++---
 2 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/service/policy/db/subject_mappings.go b/service/policy/db/subject_mappings.go
index 2ad2abf017..42673f4356 100644
--- a/service/policy/db/subject_mappings.go
+++ b/service/policy/db/subject_mappings.go
@@ -259,11 +259,12 @@ func (c PolicyDBClient) CreateSubjectMapping(ctx context.Context, s *subjectmapp
 	actionNames := make([]string, 0)
 	// Check for provided existing Action IDs and existing/new Action Names
 	for _, a := range actions {
-		if a.GetId() != "" {
+		switch {
+		case a.GetId() != "":
 			actionIDs = append(actionIDs, a.GetId())
-		} else if a.GetName() != "" {
+		case a.GetName() != "":
 			actionNames = append(actionNames, a.GetName())
-		} else {
+		default:
 			return nil, db.WrapIfKnownInvalidQueryErr(
 				errors.Join(db.ErrMissingValue, errors.New("action id or name is required when creating a subject mapping")),
 			)
@@ -457,16 +458,18 @@ func (c PolicyDBClient) UpdateSubjectMapping(ctx context.Context, r *subjectmapp
 		actionNames := make([]string, 0)
 		// Check for provided existing Action IDs and existing/new Action Names
 		for _, a := range actions {
-			if a.GetId() != "" {
+			switch {
+			case a.GetId() != "":
 				actionIDs = append(actionIDs, a.GetId())
-			} else if a.GetName() != "" {
+			case a.GetName() != "":
 				actionNames = append(actionNames, a.GetName())
-			} else {
+			default:
 				return nil, db.WrapIfKnownInvalidQueryErr(
 					errors.Join(db.ErrMissingValue, errors.New("action id or name is required when updating a subject mapping's actions")),
 				)
 			}
 		}
+
 		// Create or list Actions for those provided by name
 		if len(actionNames) > 0 {
 			createdOrListedActions, err := c.createOrListActionsByName(ctx, actionNames)
diff --git a/service/policy/subjectmapping/subject_mapping.go b/service/policy/subjectmapping/subject_mapping.go
index 8369958c89..58d6399d0f 100644
--- a/service/policy/subjectmapping/subject_mapping.go
+++ b/service/policy/subjectmapping/subject_mapping.go
@@ -59,7 +59,7 @@ func (s SubjectMappingService) CreateSubjectMapping(ctx context.Context,
 
 	// SM Creation may involve action creation or SCS creation, so utilize a transaction
 	err := s.dbClient.RunInTx(ctx, func(txClient *policydb.PolicyDBClient) error {
-		subjectMapping, err := s.dbClient.CreateSubjectMapping(ctx, req.Msg)
+		subjectMapping, err := txClient.CreateSubjectMapping(ctx, req.Msg)
 		if err != nil {
 			s.logger.Audit.PolicyCRUDFailure(ctx, auditParams)
 			return err
@@ -123,13 +123,13 @@ func (s SubjectMappingService) UpdateSubjectMapping(ctx context.Context,
 
 	// SM Update may involve action update or SCS update, so utilize a transaction
 	err := s.dbClient.RunInTx(ctx, func(txClient *policydb.PolicyDBClient) error {
-		original, err := s.dbClient.GetSubjectMapping(ctx, subjectMappingID)
+		original, err := txClient.GetSubjectMapping(ctx, subjectMappingID)
 		if err != nil {
 			s.logger.Audit.PolicyCRUDFailure(ctx, auditParams)
 			return db.StatusifyError(err, db.ErrTextGetRetrievalFailed, slog.String("id", subjectMappingID))
 		}
 
-		updated, err := s.dbClient.UpdateSubjectMapping(ctx, req.Msg)
+		updated, err := txClient.UpdateSubjectMapping(ctx, req.Msg)
 		if err != nil {
 			s.logger.Audit.PolicyCRUDFailure(ctx, auditParams)
 			return db.StatusifyError(err, db.ErrTextUpdateFailed, slog.String("id", req.Msg.GetId()), slog.String("subjectMapping fields", req.Msg.String()))

From 78e1d1d27b2d4d3069de4b51dd5a97578d079904 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 11 Apr 2025 11:44:10 -0700
Subject: [PATCH 054/110] lint fixes

---
 service/policy/actions/actions_test.go | 71 +++++++++++++-------------
 1 file changed, 35 insertions(+), 36 deletions(-)

diff --git a/service/policy/actions/actions_test.go b/service/policy/actions/actions_test.go
index 3d4abf8a89..9737a9a737 100644
--- a/service/policy/actions/actions_test.go
+++ b/service/policy/actions/actions_test.go
@@ -8,7 +8,6 @@ import (
 	"github.com/opentdf/platform/protocol/go/common"
 	"github.com/opentdf/platform/protocol/go/policy"
 	"github.com/opentdf/platform/protocol/go/policy/actions"
-	"github.com/stretchr/testify/require"
 	"github.com/stretchr/testify/suite"
 )
 
@@ -70,8 +69,8 @@ func (s *ActionSuite) Test_CreateActionRequest_Fails() {
 				Name: test.name,
 			}
 			err := s.v.Validate(req)
-			require.Error(s.T(), err)
-			require.Contains(s.T(), err.Error(), test.expectedErrMsg)
+			s.Require().Error(err)
+			s.Require().Contains(err.Error(), test.expectedErrMsg)
 		})
 	}
 
@@ -80,8 +79,8 @@ func (s *ActionSuite) Test_CreateActionRequest_Fails() {
 		Name: "",
 	}
 	err := s.v.Validate(req)
-	require.Error(s.T(), err)
-	require.Contains(s.T(), err.Error(), errMessageMinLen)
+	s.Require().Error(err)
+	s.Require().Contains(err.Error(), errMessageMinLen)
 }
 
 func (s *ActionSuite) Test_CreateActionRequest_Succeeds() {
@@ -91,7 +90,7 @@ func (s *ActionSuite) Test_CreateActionRequest_Succeeds() {
 				Name: name,
 			}
 			err := s.v.Validate(req)
-			require.NoError(s.T(), err)
+			s.Require().NoError(err)
 		})
 	}
 
@@ -103,7 +102,7 @@ func (s *ActionSuite) Test_CreateActionRequest_Succeeds() {
 		},
 	}
 	err := s.v.Validate(req)
-	require.NoError(s.T(), err)
+	s.Require().NoError(err)
 }
 
 func (s *ActionSuite) Test_GetAction_Succeeds() {
@@ -113,7 +112,7 @@ func (s *ActionSuite) Test_GetAction_Succeeds() {
 		},
 	}
 	err := s.v.Validate(req)
-	require.NoError(s.T(), err)
+	s.Require().NoError(err)
 
 	for _, name := range validNames {
 		s.Run(name, func() {
@@ -123,7 +122,7 @@ func (s *ActionSuite) Test_GetAction_Succeeds() {
 				},
 			}
 			err := s.v.Validate(req)
-			require.NoError(s.T(), err)
+			s.Require().NoError(err)
 		})
 	}
 }
@@ -135,24 +134,24 @@ func (s *ActionSuite) Test_GetAction_Fails() {
 		},
 	}
 	err := s.v.Validate(req)
-	require.Error(s.T(), err)
-	require.Contains(s.T(), err.Error(), errMessageUUID)
+	s.Require().Error(err)
+	s.Require().Contains(err.Error(), errMessageUUID)
 
 	req = &actions.GetActionRequest{}
 	err = s.v.Validate(req)
-	require.Error(s.T(), err)
-	require.Contains(s.T(), err.Error(), errMessageRequired)
+	s.Require().Error(err)
+	s.Require().Contains(err.Error(), errMessageRequired)
 
 	for _, test := range invalidNameTests {
 		s.Run(test.name, func() {
-			req := &actions.GetActionRequest{
+			req = &actions.GetActionRequest{
 				Identifier: &actions.GetActionRequest_Name{
 					Name: test.name,
 				},
 			}
 			err := s.v.Validate(req)
-			require.Error(s.T(), err)
-			require.Contains(s.T(), err.Error(), test.expectedErrMsg)
+			s.Require().Error(err)
+			s.Require().Contains(err.Error(), test.expectedErrMsg)
 		})
 	}
 
@@ -163,8 +162,8 @@ func (s *ActionSuite) Test_GetAction_Fails() {
 		},
 	}
 	err = s.v.Validate(req)
-	require.Error(s.T(), err)
-	require.Contains(s.T(), err.Error(), errMessageMinLen)
+	s.Require().Error(err)
+	s.Require().Contains(err.Error(), errMessageMinLen)
 }
 
 func (s *ActionSuite) Test_ListActions_Succeeds() {
@@ -174,15 +173,15 @@ func (s *ActionSuite) Test_ListActions_Succeeds() {
 		},
 	}
 	err := s.v.Validate(reqPaginated)
-	require.NoError(s.T(), err)
+	s.Require().NoError(err)
 
 	reqPaginated.Pagination.Offset = 100
 	err = s.v.Validate(reqPaginated)
-	require.NoError(s.T(), err)
+	s.Require().NoError(err)
 
 	reqNoPagination := &actions.ListActionsRequest{}
 	err = s.v.Validate(reqNoPagination)
-	require.NoError(s.T(), err)
+	s.Require().NoError(err)
 }
 
 func (s *ActionSuite) Test_UpdateActionRequest_Succeeds() {
@@ -193,13 +192,13 @@ func (s *ActionSuite) Test_UpdateActionRequest_Succeeds() {
 		},
 	}
 	err := s.v.Validate(req)
-	require.NoError(s.T(), err)
+	s.Require().NoError(err)
 
 	for _, name := range validNames {
 		s.Run(name, func() {
 			req.Name = name
 			err := s.v.Validate(req)
-			require.NoError(s.T(), err)
+			s.Require().NoError(err)
 		})
 	}
 
@@ -208,7 +207,7 @@ func (s *ActionSuite) Test_UpdateActionRequest_Succeeds() {
 		Name: "no-metadata",
 	}
 	err = s.v.Validate(req)
-	require.NoError(s.T(), err)
+	s.Require().NoError(err)
 }
 
 func (s *ActionSuite) Test_UpdateActionRequest_Fails() {
@@ -216,18 +215,18 @@ func (s *ActionSuite) Test_UpdateActionRequest_Fails() {
 		Id: "",
 	}
 	err := s.v.Validate(req)
-	require.Error(s.T(), err)
-	require.Contains(s.T(), err.Error(), errMessageUUID)
+	s.Require().Error(err)
+	s.Require().Contains(err.Error(), errMessageUUID)
 
 	for _, test := range invalidNameTests {
 		s.Run(test.name, func() {
-			req := &actions.UpdateActionRequest{
+			req = &actions.UpdateActionRequest{
 				Id:   validUUID,
 				Name: test.name,
 			}
 			err := s.v.Validate(req)
-			require.Error(s.T(), err)
-			require.Contains(s.T(), err.Error(), test.expectedErrMsg)
+			s.Require().Error(err)
+			s.Require().Contains(err.Error(), test.expectedErrMsg)
 		})
 	}
 }
@@ -237,7 +236,7 @@ func (s *ActionSuite) Test_DeleteActionRequest_Succeeds() {
 		Id: validUUID,
 	}
 	err := s.v.Validate(req)
-	require.NoError(s.T(), err)
+	s.Require().NoError(err)
 }
 
 func (s *ActionSuite) Test_DeleteActionRequest_Fails() {
@@ -245,18 +244,18 @@ func (s *ActionSuite) Test_DeleteActionRequest_Fails() {
 		Id: "",
 	}
 	err := s.v.Validate(req)
-	require.Error(s.T(), err)
-	require.Contains(s.T(), err.Error(), errMessageUUID)
+	s.Require().Error(err)
+	s.Require().Contains(err.Error(), errMessageUUID)
 
 	req = &actions.DeleteActionRequest{}
 	err = s.v.Validate(req)
-	require.Error(s.T(), err)
-	require.Contains(s.T(), err.Error(), errMessageUUID)
+	s.Require().Error(err)
+	s.Require().Contains(err.Error(), errMessageUUID)
 
 	req = &actions.DeleteActionRequest{
 		Id: "custom_action_name_used_as_id",
 	}
 	err = s.v.Validate(req)
-	require.Error(s.T(), err)
-	require.Contains(s.T(), err.Error(), errMessageUUID)
+	s.Require().Error(err)
+	s.Require().Contains(err.Error(), errMessageUUID)
 }

From 8c7f6bb87decde237b608b7b87c33d8a4b1389a3 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 11 Apr 2025 11:48:05 -0700
Subject: [PATCH 055/110] lint fix

---
 service/policy/actions/actions_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/service/policy/actions/actions_test.go b/service/policy/actions/actions_test.go
index 9737a9a737..a8972f951c 100644
--- a/service/policy/actions/actions_test.go
+++ b/service/policy/actions/actions_test.go
@@ -116,7 +116,7 @@ func (s *ActionSuite) Test_GetAction_Succeeds() {
 
 	for _, name := range validNames {
 		s.Run(name, func() {
-			req := &actions.GetActionRequest{
+			req = &actions.GetActionRequest{
 				Identifier: &actions.GetActionRequest_Name{
 					Name: name,
 				},

From e94278c0a7df252cac74b4155a2127b7914a31bf Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 11 Apr 2025 13:03:23 -0700
Subject: [PATCH 056/110] bump migration timestamp

---
 ...0_add_actions_table.md => 20250411000000_add_actions_table.md} | 0
 ...add_actions_table.sql => 20250411000000_add_actions_table.sql} | 0
 2 files changed, 0 insertions(+), 0 deletions(-)
 rename service/policy/db/migrations/{20250401000000_add_actions_table.md => 20250411000000_add_actions_table.md} (100%)
 rename service/policy/db/migrations/{20250401000000_add_actions_table.sql => 20250411000000_add_actions_table.sql} (100%)

diff --git a/service/policy/db/migrations/20250401000000_add_actions_table.md b/service/policy/db/migrations/20250411000000_add_actions_table.md
similarity index 100%
rename from service/policy/db/migrations/20250401000000_add_actions_table.md
rename to service/policy/db/migrations/20250411000000_add_actions_table.md
diff --git a/service/policy/db/migrations/20250401000000_add_actions_table.sql b/service/policy/db/migrations/20250411000000_add_actions_table.sql
similarity index 100%
rename from service/policy/db/migrations/20250401000000_add_actions_table.sql
rename to service/policy/db/migrations/20250411000000_add_actions_table.sql

From 4873b73c156eb32b7e97441e8dbfb86e9a5ea92f Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 11 Apr 2025 13:23:19 -0700
Subject: [PATCH 057/110] test custom rules

---
 docs/grpc/index.html                     |  59 +++++
 docs/openapi/policy/rules.swagger.json   |  46 ++++
 protocol/go/policy/actions/actions.pb.go | 283 ++++++++++-------------
 protocol/go/policy/rules.pb.go           | 159 +++++++++++++
 service/policy/actions/actions.proto     |  29 +--
 service/policy/rules.proto               |  26 +++
 6 files changed, 419 insertions(+), 183 deletions(-)
 create mode 100644 docs/openapi/policy/rules.swagger.json
 create mode 100644 protocol/go/policy/rules.pb.go
 create mode 100644 service/policy/rules.proto

diff --git a/docs/grpc/index.html b/docs/grpc/index.html
index d448c9ecb4..09f1c984c7 100644
--- a/docs/grpc/index.html
+++ b/docs/grpc/index.html
@@ -513,6 +513,25 @@ <h2>Table of Contents</h2>
           </li>
         
           
+          <li>
+            <a href="#policy%2frules.proto">policy/rules.proto</a>
+            <ul>
+              
+              
+              
+                <li>
+                  <a href="#policy%2frules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                </li>
+              
+                <li>
+                  <a href="#policy%2frules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                </li>
+              
+              
+            </ul>
+          </li>
+        
+          
           <li>
             <a href="#policy%2fselectors.proto">policy/selectors.proto</a>
             <ul>
@@ -4324,6 +4343,46 @@ <h4>Methods with idempotency_level option</h4>
         
     
       
+      <div class="file-heading">
+        <h2 id="policy/rules.proto">policy/rules.proto</h2><a href="#title">Top</a>
+      </div>
+      <p></p>
+
+      
+
+      
+
+      
+        <h3 id="policy/rules.proto-extensions">File-level Extensions</h3>
+        <table class="extension-table">
+          <thead>
+            <tr><td>Extension</td><td>Type</td><td>Base</td><td>Number</td><td>Description</td></tr>
+          </thead>
+          <tbody>
+            
+              <tr>
+                <td>common_object_name_optional</td>
+                <td><a href="#bool">bool</a></td>
+                <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
+                <td>80048953</td>
+                <td><p></p></td>
+              </tr>
+            
+              <tr>
+                <td>common_object_name_required</td>
+                <td><a href="#bool">bool</a></td>
+                <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
+                <td>80048952</td>
+                <td><p></p></td>
+              </tr>
+            
+          </tbody>
+        </table>
+      
+
+      
+    
+      
       <div class="file-heading">
         <h2 id="policy/selectors.proto">policy/selectors.proto</h2><a href="#title">Top</a>
       </div>
diff --git a/docs/openapi/policy/rules.swagger.json b/docs/openapi/policy/rules.swagger.json
new file mode 100644
index 0000000000..7eeba4114d
--- /dev/null
+++ b/docs/openapi/policy/rules.swagger.json
@@ -0,0 +1,46 @@
+{
+  "swagger": "2.0",
+  "info": {
+    "title": "policy/rules.proto",
+    "version": "version not set"
+  },
+  "consumes": [
+    "application/json"
+  ],
+  "produces": [
+    "application/json"
+  ],
+  "paths": {},
+  "definitions": {
+    "protobufAny": {
+      "type": "object",
+      "properties": {
+        "@type": {
+          "type": "string",
+          "description": "A URL/resource name that uniquely identifies the type of the serialized\nprotocol buffer message. This string must contain at least\none \"/\" character. The last segment of the URL's path must represent\nthe fully qualified name of the type (as in\n`path/google.protobuf.Duration`). The name should be in a canonical form\n(e.g., leading \".\" is not accepted).\n\nIn practice, teams usually precompile into the binary all types that they\nexpect it to use in the context of Any. However, for URLs which use the\nscheme `http`, `https`, or no scheme, one can optionally set up a type\nserver that maps type URLs to message definitions as follows:\n\n* If no scheme is provided, `https` is assumed.\n* An HTTP GET on the URL must yield a [google.protobuf.Type][]\n  value in binary format, or produce an error.\n* Applications are allowed to cache lookup results based on the\n  URL, or have them precompiled into a binary to avoid any\n  lookup. Therefore, binary compatibility needs to be preserved\n  on changes to types. (Use versioned type names to manage\n  breaking changes.)\n\nNote: this functionality is not currently available in the official\nprotobuf release, and it is not used for type URLs beginning with\ntype.googleapis.com. As of May 2023, there are no widely used type server\nimplementations and no plans to implement one.\n\nSchemes other than `http`, `https` (or the empty scheme) might be\nused with implementation specific semantics."
+        }
+      },
+      "additionalProperties": {},
+      "description": "`Any` contains an arbitrary serialized protocol buffer message along with a\nURL that describes the type of the serialized message.\n\nProtobuf library provides support to pack/unpack Any values in the form\nof utility functions or additional generated methods of the Any type.\n\nExample 1: Pack and unpack a message in C++.\n\n    Foo foo = ...;\n    Any any;\n    any.PackFrom(foo);\n    ...\n    if (any.UnpackTo(\u0026foo)) {\n      ...\n    }\n\nExample 2: Pack and unpack a message in Java.\n\n    Foo foo = ...;\n    Any any = Any.pack(foo);\n    ...\n    if (any.is(Foo.class)) {\n      foo = any.unpack(Foo.class);\n    }\n    // or ...\n    if (any.isSameTypeAs(Foo.getDefaultInstance())) {\n      foo = any.unpack(Foo.getDefaultInstance());\n    }\n\n Example 3: Pack and unpack a message in Python.\n\n    foo = Foo(...)\n    any = Any()\n    any.Pack(foo)\n    ...\n    if any.Is(Foo.DESCRIPTOR):\n      any.Unpack(foo)\n      ...\n\n Example 4: Pack and unpack a message in Go\n\n     foo := \u0026pb.Foo{...}\n     any, err := anypb.New(foo)\n     if err != nil {\n       ...\n     }\n     ...\n     foo := \u0026pb.Foo{}\n     if err := any.UnmarshalTo(foo); err != nil {\n       ...\n     }\n\nThe pack methods provided by protobuf library will by default use\n'type.googleapis.com/full.type.name' as the type URL and the unpack\nmethods only use the fully qualified type name after the last '/'\nin the type URL, for example \"foo.bar.com/x/y.z\" will yield type\nname \"y.z\".\n\nJSON\n====\nThe JSON representation of an `Any` value uses the regular\nrepresentation of the deserialized, embedded message, with an\nadditional field `@type` which contains the type URL. Example:\n\n    package google.profile;\n    message Person {\n      string first_name = 1;\n      string last_name = 2;\n    }\n\n    {\n      \"@type\": \"type.googleapis.com/google.profile.Person\",\n      \"firstName\": \u003cstring\u003e,\n      \"lastName\": \u003cstring\u003e\n    }\n\nIf the embedded message type is well-known and has a custom JSON\nrepresentation, that representation will be embedded adding a field\n`value` which holds the custom JSON in addition to the `@type`\nfield. Example (for message [google.protobuf.Duration][]):\n\n    {\n      \"@type\": \"type.googleapis.com/google.protobuf.Duration\",\n      \"value\": \"1.212s\"\n    }"
+    },
+    "rpcStatus": {
+      "type": "object",
+      "properties": {
+        "code": {
+          "type": "integer",
+          "format": "int32"
+        },
+        "message": {
+          "type": "string"
+        },
+        "details": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "$ref": "#/definitions/protobufAny"
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/protocol/go/policy/actions/actions.pb.go b/protocol/go/policy/actions/actions.pb.go
index f46f2b6c77..2ae024ab43 100644
--- a/protocol/go/policy/actions/actions.pb.go
+++ b/protocol/go/policy/actions/actions.pb.go
@@ -609,167 +609,136 @@ var file_policy_actions_actions_proto_rawDesc = []byte{
 	0x69, 0x64, 0x61, 0x74, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x13, 0x63, 0x6f, 0x6d,
 	0x6d, 0x6f, 0x6e, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
 	0x1a, 0x14, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x16, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x73,
-	0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xe8,
-	0x02, 0x0a, 0x10, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42,
-	0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x48, 0x00, 0x52, 0x02, 0x69, 0x64, 0x12,
-	0xa2, 0x02, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x8b,
-	0x02, 0xba, 0x48, 0x87, 0x02, 0xba, 0x01, 0xfc, 0x01, 0x0a, 0x12, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0xa8, 0x01,
-	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x6d, 0x75, 0x73, 0x74,
-	0x20, 0x62, 0x65, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65,
-	0x72, 0x69, 0x63, 0x20, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x2c, 0x20, 0x61, 0x6c, 0x6c, 0x6f,
-	0x77, 0x69, 0x6e, 0x67, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x20, 0x61, 0x6e, 0x64,
-	0x20, 0x75, 0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f, 0x72, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74,
-	0x20, 0x6e, 0x6f, 0x74, 0x20, 0x61, 0x73, 0x20, 0x74, 0x68, 0x65, 0x20, 0x66, 0x69, 0x72, 0x73,
-	0x74, 0x20, 0x6f, 0x72, 0x20, 0x6c, 0x61, 0x73, 0x74, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63,
-	0x74, 0x65, 0x72, 0x2e, 0x20, 0x54, 0x68, 0x65, 0x20, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20,
-	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x69, 0x73, 0x20, 0x6e,
-	0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64, 0x20, 0x74, 0x6f, 0x20, 0x6c, 0x6f, 0x77,
-	0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a, 0x3b, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d,
-	0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a,
-	0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d,
-	0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d,
-	0x29, 0x3f, 0x24, 0x27, 0x29, 0x72, 0x05, 0x10, 0x01, 0x18, 0xfd, 0x01, 0x48, 0x00, 0x52, 0x04,
-	0x6e, 0x61, 0x6d, 0x65, 0x42, 0x13, 0x0a, 0x0a, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69,
-	0x65, 0x72, 0x12, 0x05, 0xba, 0x48, 0x02, 0x08, 0x01, 0x22, 0x7e, 0x0a, 0x11, 0x47, 0x65, 0x74,
-	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26,
-	0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e,
-	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06,
-	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x41, 0x0a, 0x10, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63,
-	0x74, 0x5f, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x16, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63,
-	0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x0f, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63,
-	0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x22, 0x49, 0x0a, 0x12, 0x4c, 0x69, 0x73,
-	0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x33, 0x0a, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x0a, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x61, 0x67,
-	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x52, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x22, 0xbd, 0x01, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x39, 0x0a, 0x10,
-	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x5f, 0x73, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64,
-	0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
-	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x53,
-	0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x12, 0x35, 0x0a, 0x0e, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x5f, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x12, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x72,
+	0x75, 0x6c, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x16, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x2f, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x22, 0x66, 0x0a, 0x10, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x48, 0x00, 0x52, 0x02,
+	0x69, 0x64, 0x12, 0x21, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x42, 0x0b, 0xba, 0x48, 0x08, 0x72, 0x06, 0xc8, 0xb3, 0xae, 0xb1, 0x02, 0x01, 0x48, 0x00, 0x52,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x42, 0x13, 0x0a, 0x0a, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66,
+	0x69, 0x65, 0x72, 0x12, 0x05, 0xba, 0x48, 0x02, 0x08, 0x01, 0x22, 0x7e, 0x0a, 0x11, 0x47, 0x65,
+	0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x26, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
 	0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
-	0x0d, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x12, 0x34,
-	0x0a, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x0a, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x14, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x61, 0x67, 0x65,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x52, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61,
-	0x74, 0x69, 0x6f, 0x6e, 0x22, 0xed, 0x02, 0x0a, 0x13, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0xa0, 0x02, 0x0a,
-	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x8b, 0x02, 0xba, 0x48,
-	0x87, 0x02, 0xba, 0x01, 0xfc, 0x01, 0x0a, 0x12, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e,
-	0x61, 0x6d, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0xa8, 0x01, 0x41, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65,
-	0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63,
-	0x20, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x2c, 0x20, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x69, 0x6e,
-	0x67, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x75, 0x6e,
-	0x64, 0x65, 0x72, 0x73, 0x63, 0x6f, 0x72, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74, 0x20, 0x6e, 0x6f,
-	0x74, 0x20, 0x61, 0x73, 0x20, 0x74, 0x68, 0x65, 0x20, 0x66, 0x69, 0x72, 0x73, 0x74, 0x20, 0x6f,
-	0x72, 0x20, 0x6c, 0x61, 0x73, 0x74, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72,
-	0x2e, 0x20, 0x54, 0x68, 0x65, 0x20, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20, 0x61, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x69, 0x73, 0x20, 0x6e, 0x6f, 0x72, 0x6d,
-	0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64, 0x20, 0x74, 0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20,
-	0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a, 0x3b, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63,
-	0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39,
-	0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d,
-	0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24,
-	0x27, 0x29, 0x72, 0x05, 0x10, 0x01, 0x18, 0xfd, 0x01, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12,
-	0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64,
-	0x61, 0x74, 0x61, 0x4d, 0x75, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61,
-	0x64, 0x61, 0x74, 0x61, 0x22, 0x3e, 0x0a, 0x14, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06,
-	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x22, 0xfa, 0x03, 0x0a, 0x13, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02,
-	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0,
-	0x01, 0x01, 0x52, 0x02, 0x69, 0x64, 0x12, 0xbd, 0x02, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0xa8, 0x02, 0xba, 0x48, 0xa4, 0x02, 0xba, 0x01, 0x98, 0x02,
-	0x0a, 0x1b, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0xa8, 0x01,
-	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x6d, 0x75, 0x73, 0x74,
-	0x20, 0x62, 0x65, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65,
-	0x72, 0x69, 0x63, 0x20, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x2c, 0x20, 0x61, 0x6c, 0x6c, 0x6f,
-	0x77, 0x69, 0x6e, 0x67, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x20, 0x61, 0x6e, 0x64,
-	0x20, 0x75, 0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f, 0x72, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74,
-	0x20, 0x6e, 0x6f, 0x74, 0x20, 0x61, 0x73, 0x20, 0x74, 0x68, 0x65, 0x20, 0x66, 0x69, 0x72, 0x73,
-	0x74, 0x20, 0x6f, 0x72, 0x20, 0x6c, 0x61, 0x73, 0x74, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63,
-	0x74, 0x65, 0x72, 0x2e, 0x20, 0x54, 0x68, 0x65, 0x20, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20,
-	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x69, 0x73, 0x20, 0x6e,
-	0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64, 0x20, 0x74, 0x6f, 0x20, 0x6c, 0x6f, 0x77,
-	0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a, 0x4e, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x74,
-	0x68, 0x69, 0x73, 0x29, 0x20, 0x3d, 0x3d, 0x20, 0x30, 0x20, 0x7c, 0x7c, 0x20, 0x74, 0x68, 0x69,
-	0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d, 0x7a,
-	0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d,
-	0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30,
-	0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29, 0xc8, 0x01, 0x00, 0x72, 0x03, 0x18, 0xfd, 0x01,
-	0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f,
-	0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4d, 0x75, 0x74, 0x61, 0x62, 0x6c,
-	0x65, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x54, 0x0a, 0x18, 0x6d,
-	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x62,
-	0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x18, 0x65, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e,
-	0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x55,
-	0x70, 0x64, 0x61, 0x74, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x52, 0x16, 0x6d, 0x65, 0x74, 0x61, 0x64,
-	0x61, 0x74, 0x61, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x42, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f,
-	0x72, 0x22, 0x3e, 0x0a, 0x14, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x22, 0x2f, 0x0a, 0x13, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x52, 0x02,
-	0x69, 0x64, 0x22, 0x3e, 0x0a, 0x14, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
+	0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x41, 0x0a, 0x10, 0x73, 0x75, 0x62, 0x6a, 0x65,
+	0x63, 0x74, 0x5f, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x16, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65,
+	0x63, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x0f, 0x73, 0x75, 0x62, 0x6a, 0x65,
+	0x63, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x22, 0x49, 0x0a, 0x12, 0x4c, 0x69,
+	0x73, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x33, 0x0a, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x0a,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x61,
+	0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x52, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0xbd, 0x01, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x39, 0x0a,
+	0x10, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x5f, 0x73, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72,
+	0x64, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
+	0x53, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x12, 0x35, 0x0a, 0x0e, 0x61, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x5f, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x52, 0x0d, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x12,
+	0x34, 0x0a, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x0a, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x61, 0x67,
+	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x52, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x6b, 0x0a, 0x13, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1f, 0x0a, 0x04,
+	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0b, 0xba, 0x48, 0x08, 0x72,
+	0x06, 0xc0, 0xb3, 0xae, 0xb1, 0x02, 0x01, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a,
+	0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x17, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0x4d, 0x75, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x22, 0x3e, 0x0a, 0x14, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
 	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63,
 	0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c,
 	0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x32, 0xd4, 0x03, 0x0a, 0x0d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x72,
-	0x76, 0x69, 0x63, 0x65, 0x12, 0x52, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x12, 0x20, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74,
-	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x22, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x70, 0x6f,
-	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73,
-	0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x12, 0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12,
-	0x5b, 0x0a, 0x0c, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12,
-	0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c,
-	0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x2e, 0x70,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x44, 0x65,
-	0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0xb3, 0x01, 0x0a, 0x12, 0x63, 0x6f,
-	0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x42, 0x0c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01,
-	0x5a, 0x36, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65,
-	0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x2f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xa2, 0x02, 0x03, 0x50, 0x41, 0x58, 0xaa, 0x02,
-	0x0e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xca,
-	0x02, 0x0e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0xe2, 0x02, 0x1a, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x73, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x0f,
-	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x3a, 0x3a, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x62,
-	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x6f, 0x6e, 0x22, 0xfa, 0x03, 0x0a, 0x13, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01,
+	0x52, 0x02, 0x69, 0x64, 0x12, 0xbd, 0x02, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x42, 0xa8, 0x02, 0xba, 0x48, 0xa4, 0x02, 0xba, 0x01, 0x98, 0x02, 0x0a, 0x1b,
+	0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f,
+	0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0xa8, 0x01, 0x41, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62,
+	0x65, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69,
+	0x63, 0x20, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x2c, 0x20, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x69,
+	0x6e, 0x67, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x75,
+	0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f, 0x72, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74, 0x20, 0x6e,
+	0x6f, 0x74, 0x20, 0x61, 0x73, 0x20, 0x74, 0x68, 0x65, 0x20, 0x66, 0x69, 0x72, 0x73, 0x74, 0x20,
+	0x6f, 0x72, 0x20, 0x6c, 0x61, 0x73, 0x74, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65,
+	0x72, 0x2e, 0x20, 0x54, 0x68, 0x65, 0x20, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20, 0x61, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x69, 0x73, 0x20, 0x6e, 0x6f, 0x72,
+	0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64, 0x20, 0x74, 0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72,
+	0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a, 0x4e, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69,
+	0x73, 0x29, 0x20, 0x3d, 0x3d, 0x20, 0x30, 0x20, 0x7c, 0x7c, 0x20, 0x74, 0x68, 0x69, 0x73, 0x2e,
+	0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d,
+	0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30,
+	0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39,
+	0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29, 0xc8, 0x01, 0x00, 0x72, 0x03, 0x18, 0xfd, 0x01, 0x52, 0x04,
+	0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e,
+	0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4d, 0x75, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x52,
+	0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x54, 0x0a, 0x18, 0x6d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x62, 0x65, 0x68,
+	0x61, 0x76, 0x69, 0x6f, 0x72, 0x18, 0x65, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e, 0x63, 0x6f,
+	0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x55, 0x70, 0x64,
+	0x61, 0x74, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x52, 0x16, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x42, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x22,
+	0x3e, 0x0a, 0x14, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22,
+	0x2f, 0x0a, 0x13, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x52, 0x02, 0x69, 0x64,
+	0x22, 0x3e, 0x0a, 0x14, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63,
+	0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x32, 0xd4, 0x03, 0x0a, 0x0d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x12, 0x52, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12,
+	0x20, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
+	0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x21, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x22, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00,
+	0x12, 0x5b, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x12, 0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b, 0x0a,
+	0x0c, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x2e,
+	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x55,
+	0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x44, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x2e, 0x70, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x44, 0x65, 0x6c, 0x65,
+	0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
+	0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0xb3, 0x01, 0x0a, 0x12, 0x63, 0x6f, 0x6d, 0x2e,
+	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x42, 0x0c,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x36,
+	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x74,
+	0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x61,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xa2, 0x02, 0x03, 0x50, 0x41, 0x58, 0xaa, 0x02, 0x0e, 0x50,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xca, 0x02, 0x0e,
+	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xe2, 0x02,
+	0x1a, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x5c,
+	0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x0f, 0x50, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x3a, 0x3a, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x62, 0x06, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/protocol/go/policy/rules.pb.go b/protocol/go/policy/rules.pb.go
new file mode 100644
index 0000000000..6750f79bc2
--- /dev/null
+++ b/protocol/go/policy/rules.pb.go
@@ -0,0 +1,159 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.33.0
+// 	protoc        (unknown)
+// source: policy/rules.proto
+
+package policy
+
+import (
+	validate "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+var file_policy_rules_proto_extTypes = []protoimpl.ExtensionInfo{
+	{
+		ExtendedType:  (*validate.StringRules)(nil),
+		ExtensionType: (*bool)(nil),
+		Field:         80048952,
+		Name:          "policy.common_object_name_required",
+		Tag:           "varint,80048952,opt,name=common_object_name_required",
+		Filename:      "policy/rules.proto",
+	},
+	{
+		ExtendedType:  (*validate.StringRules)(nil),
+		ExtensionType: (*bool)(nil),
+		Field:         80048953,
+		Name:          "policy.common_object_name_optional",
+		Tag:           "varint,80048953,opt,name=common_object_name_optional",
+		Filename:      "policy/rules.proto",
+	},
+}
+
+// Extension fields to validate.StringRules.
+var (
+	// optional bool common_object_name_required = 80048952;
+	E_CommonObjectNameRequired = &file_policy_rules_proto_extTypes[0]
+	// optional bool common_object_name_optional = 80048953;
+	E_CommonObjectNameOptional = &file_policy_rules_proto_extTypes[1]
+)
+
+var File_policy_rules_proto protoreflect.FileDescriptor
+
+var file_policy_rules_proto_rawDesc = []byte{
+	0x0a, 0x12, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x72, 0x75, 0x6c, 0x65, 0x73, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x12, 0x06, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x1a, 0x1b, 0x62, 0x75,
+	0x66, 0x2f, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2f, 0x76, 0x61, 0x6c, 0x69, 0x64,
+	0x61, 0x74, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x3a, 0xc3, 0x03, 0x0a, 0x1b, 0x63, 0x6f,
+	0x6d, 0x6d, 0x6f, 0x6e, 0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65,
+	0x5f, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x12, 0x19, 0x2e, 0x62, 0x75, 0x66, 0x2e,
+	0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2e, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x52,
+	0x75, 0x6c, 0x65, 0x73, 0x18, 0xb8, 0xe6, 0x95, 0x26, 0x20, 0x01, 0x28, 0x08, 0x42, 0xe5, 0x02,
+	0xc2, 0x48, 0xe1, 0x02, 0x0a, 0xde, 0x02, 0x0a, 0x22, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x2e,
+	0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x6e, 0x61,
+	0x6d, 0x65, 0x2e, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x12, 0xd4, 0x01, 0x46, 0x69,
+	0x65, 0x6c, 0x64, 0x20, 0x69, 0x73, 0x20, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x2c,
+	0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x2c, 0x20, 0x6f,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x6c, 0x79, 0x20, 0x69, 0x6e, 0x63, 0x6c, 0x75, 0x64,
+	0x69, 0x6e, 0x67, 0x20, 0x75, 0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f, 0x72, 0x65, 0x73, 0x20,
+	0x61, 0x6e, 0x64, 0x20, 0x64, 0x61, 0x73, 0x68, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74, 0x20, 0x6e,
+	0x6f, 0x74, 0x20, 0x70, 0x72, 0x65, 0x63, 0x65, 0x64, 0x69, 0x6e, 0x67, 0x20, 0x6f, 0x72, 0x20,
+	0x74, 0x72, 0x61, 0x69, 0x6c, 0x69, 0x6e, 0x67, 0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x6d, 0x75,
+	0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x62, 0x65, 0x74, 0x77, 0x65, 0x65, 0x6e, 0x20, 0x30, 0x20,
+	0x61, 0x6e, 0x64, 0x20, 0x32, 0x35, 0x34, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65,
+	0x72, 0x73, 0x20, 0x69, 0x6e, 0x20, 0x6c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x2e, 0x20, 0x53, 0x74,
+	0x6f, 0x72, 0x65, 0x64, 0x20, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x20, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x20, 0x77, 0x69, 0x6c, 0x6c, 0x20, 0x62, 0x65, 0x20, 0x6e, 0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69,
+	0x7a, 0x65, 0x64, 0x20, 0x74, 0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20, 0x63, 0x61, 0x73,
+	0x65, 0x2e, 0x1a, 0x61, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3e,
+	0x20, 0x30, 0x20, 0x26, 0x26, 0x20, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x29,
+	0x20, 0x3c, 0x20, 0x32, 0x35, 0x34, 0x20, 0x26, 0x26, 0x20, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d,
+	0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a,
+	0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d,
+	0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d,
+	0x29, 0x3f, 0x24, 0x27, 0x29, 0x52, 0x18, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x4f, 0x62, 0x6a,
+	0x65, 0x63, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x52, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x3a,
+	0xba, 0x03, 0x0a, 0x1b, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63,
+	0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x12,
+	0x19, 0x2e, 0x62, 0x75, 0x66, 0x2e, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2e, 0x53,
+	0x74, 0x72, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x18, 0xb9, 0xe6, 0x95, 0x26, 0x20,
+	0x01, 0x28, 0x08, 0x42, 0xdc, 0x02, 0xc2, 0x48, 0xd8, 0x02, 0x0a, 0xd5, 0x02, 0x0a, 0x22, 0x73,
+	0x74, 0x72, 0x69, 0x6e, 0x67, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x5f, 0x6f, 0x62, 0x6a,
+	0x65, 0x63, 0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x2e, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61,
+	0x6c, 0x12, 0xd9, 0x01, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x20, 0x69, 0x73, 0x20, 0x6f, 0x70, 0x74,
+	0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x69, 0x66, 0x20, 0x70, 0x72,
+	0x6f, 0x76, 0x69, 0x64, 0x65, 0x64, 0x2c, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d,
+	0x65, 0x72, 0x69, 0x63, 0x2c, 0x20, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x69, 0x6e, 0x67, 0x20, 0x75,
+	0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f, 0x72, 0x65, 0x73, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x64,
+	0x61, 0x73, 0x68, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74, 0x20, 0x6e, 0x6f, 0x74, 0x20, 0x70, 0x72,
+	0x65, 0x63, 0x65, 0x64, 0x69, 0x6e, 0x67, 0x20, 0x6f, 0x72, 0x20, 0x74, 0x72, 0x61, 0x69, 0x6c,
+	0x69, 0x6e, 0x67, 0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65,
+	0x20, 0x62, 0x65, 0x74, 0x77, 0x65, 0x65, 0x6e, 0x20, 0x30, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x32,
+	0x35, 0x34, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x73, 0x20, 0x69, 0x6e,
+	0x20, 0x6c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x2e, 0x20, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20,
+	0x66, 0x69, 0x65, 0x6c, 0x64, 0x20, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x20, 0x77, 0x69, 0x6c, 0x6c,
+	0x20, 0x62, 0x65, 0x20, 0x6e, 0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64, 0x20, 0x74,
+	0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a, 0x53, 0x73,
+	0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3e, 0x20, 0x30, 0x20, 0x3f, 0x20,
+	0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b,
+	0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61, 0x2d,
+	0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x41,
+	0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x20, 0x3a, 0x20, 0x74, 0x72,
+	0x75, 0x65, 0x52, 0x18, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74,
+	0x4e, 0x61, 0x6d, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x42, 0x80, 0x01, 0x0a,
+	0x0a, 0x63, 0x6f, 0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x42, 0x0a, 0x52, 0x75, 0x6c,
+	0x65, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x2e, 0x67, 0x69, 0x74, 0x68, 0x75,
+	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c,
+	0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f,
+	0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xa2, 0x02, 0x03, 0x50, 0x58, 0x58, 0xaa,
+	0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xca, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63,
+	0x79, 0xe2, 0x02, 0x12, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+}
+
+var file_policy_rules_proto_goTypes = []interface{}{
+	(*validate.StringRules)(nil), // 0: buf.validate.StringRules
+}
+var file_policy_rules_proto_depIdxs = []int32{
+	0, // 0: policy.common_object_name_required:extendee -> buf.validate.StringRules
+	0, // 1: policy.common_object_name_optional:extendee -> buf.validate.StringRules
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	0, // [0:2] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_policy_rules_proto_init() }
+func file_policy_rules_proto_init() {
+	if File_policy_rules_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_policy_rules_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   0,
+			NumExtensions: 2,
+			NumServices:   0,
+		},
+		GoTypes:           file_policy_rules_proto_goTypes,
+		DependencyIndexes: file_policy_rules_proto_depIdxs,
+		ExtensionInfos:    file_policy_rules_proto_extTypes,
+	}.Build()
+	File_policy_rules_proto = out.File
+	file_policy_rules_proto_rawDesc = nil
+	file_policy_rules_proto_goTypes = nil
+	file_policy_rules_proto_depIdxs = nil
+}
diff --git a/service/policy/actions/actions.proto b/service/policy/actions/actions.proto
index cbbd312815..7c704d1849 100644
--- a/service/policy/actions/actions.proto
+++ b/service/policy/actions/actions.proto
@@ -5,6 +5,7 @@ package policy.actions;
 import "buf/validate/validate.proto";
 import "common/common.proto";
 import "policy/objects.proto";
+import "policy/rules.proto";
 import "policy/selectors.proto";
 
 /*
@@ -16,19 +17,7 @@ message GetActionRequest {
   oneof identifier {
     option (buf.validate.oneof).required = true;
     string id = 1 [(buf.validate.field).string.uuid = true];
-    string name = 2 [
-      (buf.validate.field).string.min_len = 1,
-      (buf.validate.field).string.max_len = 253,
-      (buf.validate.field).cel = {
-        id: "action_name_format"
-        message:
-          "Action name must be an alphanumeric string, "
-          "allowing hyphens and underscores but not as the "
-          "first or last character. The stored action name "
-          "is normalized to lower case."
-        expression: "this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$')"
-      }
-    ];
+    string name = 2 [(buf.validate.field).string.(common_object_name_optional) = true];
   }
 }
 message GetActionResponse {
@@ -53,19 +42,7 @@ message ListActionsResponse {
 // Creation of Standard actions is not supported.
 message CreateActionRequest {
   // Required
-  string name = 1 [
-    (buf.validate.field).string.min_len = 1,
-    (buf.validate.field).string.max_len = 253,
-    (buf.validate.field).cel = {
-      id: "action_name_format"
-      message:
-        "Action name must be an alphanumeric string, "
-        "allowing hyphens and underscores but not as the "
-        "first or last character. The stored action name "
-        "is normalized to lower case."
-      expression: "this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$')"
-    }
-  ];
+  string name = 1 [(buf.validate.field).string.(common_object_name_required) = true];
 
   // Optional
   common.MetadataMutable metadata = 100;
diff --git a/service/policy/rules.proto b/service/policy/rules.proto
new file mode 100644
index 0000000000..7eeebf43b6
--- /dev/null
+++ b/service/policy/rules.proto
@@ -0,0 +1,26 @@
+syntax = "proto2";
+
+package policy;
+
+import "buf/validate/validate.proto";
+
+extend buf.validate.StringRules {
+  optional bool common_object_name_required = 80048952 [(buf.validate.predefined).cel = {
+    id: "string.common_object_name.required"
+    message:
+      "Field is required, alphanumeric, optionally including "
+      "underscores and dashes but not preceding or trailing, "
+      "and must be between 0 and 254 characters in length. "
+      "Stored field value will be normalized to lower case."
+    expression: "size(this) > 0 && size(this) < 254 && this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$')"
+  }];
+  optional bool common_object_name_optional = 80048953 [(buf.validate.predefined).cel = {
+    id: "string.common_object_name.optional"
+    message:
+      "Field is optional, and if provided, alphanumeric, allowing "
+      "underscores and dashes but not preceding or trailing, and "
+      "must be between 0 and 254 characters in length. Stored "
+      "field value will be normalized to lower case."
+    expression: "size(this) > 0 ? this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$') : true"
+  }];
+}

From 8a37484d31283f1baa721b4a5a66a39a14ff290f Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 11 Apr 2025 13:50:56 -0700
Subject: [PATCH 058/110] bump proto-generating deps

---
 go.work            |  2 +-
 protocol/go/go.mod |  8 ++++----
 protocol/go/go.sum | 17 ++++++-----------
 service/go.mod     | 24 +++++++++++++-----------
 service/go.sum     | 22 ++++++++++++++++++++++
 5 files changed, 46 insertions(+), 27 deletions(-)

diff --git a/go.work b/go.work
index a345ebf231..4247cda0bf 100644
--- a/go.work
+++ b/go.work
@@ -1,4 +1,4 @@
-go 1.23.0
+go 1.23.4
 
 toolchain go1.24.2
 
diff --git a/protocol/go/go.mod b/protocol/go/go.mod
index b247f7754b..1394ff25a5 100644
--- a/protocol/go/go.mod
+++ b/protocol/go/go.mod
@@ -1,21 +1,21 @@
 module github.com/opentdf/platform/protocol/go
 
-go 1.23.0
+go 1.23.4
 
 toolchain go1.24.2
 
 require (
-	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.34.1-20240508200655-46a4cf4ba109.1
+	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-20250307204501-0409229c3780.1
 	connectrpc.com/connect v1.17.0
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0
 	google.golang.org/genproto/googleapis/api v0.0.0-20241007155032-5fefd90f89a9
 	google.golang.org/grpc v1.67.1
-	google.golang.org/protobuf v1.35.1
+	google.golang.org/protobuf v1.36.6
 )
 
 require (
 	golang.org/x/net v0.36.0 // indirect
 	golang.org/x/sys v0.30.0 // indirect
-	golang.org/x/text v0.22.0 // indirect
+	golang.org/x/text v0.23.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20241007155032-5fefd90f89a9 // indirect
 )
diff --git a/protocol/go/go.sum b/protocol/go/go.sum
index bdeb336207..f44debd7e8 100644
--- a/protocol/go/go.sum
+++ b/protocol/go/go.sum
@@ -1,9 +1,7 @@
-buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.34.1-20240508200655-46a4cf4ba109.1 h1:LEXWFH/xZ5oOWrC3oOtHbUyBdzRWMCPpAQmKC9v05mA=
-buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.34.1-20240508200655-46a4cf4ba109.1/go.mod h1:XF+P8+RmfdufmIYpGUC+6bF7S+IlmHDEnCrO3OXaUAQ=
+buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-20250307204501-0409229c3780.1 h1:zgJPqo17m28+Lf5BW4xv3PvU20BnrmTcGYrog22lLIU=
+buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-20250307204501-0409229c3780.1/go.mod h1:avRlCjnFzl98VPaeCtJ24RrV/wwHFzB8sWXhj26+n/U=
 connectrpc.com/connect v1.17.0 h1:W0ZqMhtVzn9Zhn2yATuUokDLO5N+gIuBWMOnsQrfmZk=
 connectrpc.com/connect v1.17.0/go.mod h1:0292hj1rnx8oFrStN7cB4jjVBeqs+Yx5yDIC2prWDO8=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0 h1:asbCHRVmodnJTuQ3qamDwqVOIjwqUPTYmYuemVOx+Ys=
@@ -12,16 +10,13 @@ golang.org/x/net v0.36.0 h1:vWF2fRbw4qslQsQzgFqZff+BItCvGFQqKzKIzx1rmoA=
 golang.org/x/net v0.36.0/go.mod h1:bFmbeoIPfrw4sMHNhb4J9f6+tPziuGjq7Jk/38fxi1I=
 golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
 golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
-golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
+golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
 google.golang.org/genproto/googleapis/api v0.0.0-20241007155032-5fefd90f89a9 h1:T6rh4haD3GVYsgEfWExoCZA2o2FmbNyKpTuAxbEFPTg=
 google.golang.org/genproto/googleapis/api v0.0.0-20241007155032-5fefd90f89a9/go.mod h1:wp2WsuBYj6j8wUdo3ToZsdxxixbvQNAHqVJrTgi5E5M=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20241007155032-5fefd90f89a9 h1:QCqS/PdaHTSWGvupk2F/ehwHtGc0/GYkT+3GAcR1CCc=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20241007155032-5fefd90f89a9/go.mod h1:GX3210XPVPUjJbTUbvwI8f2IpZDMZuPJWDzDuebbviI=
 google.golang.org/grpc v1.67.1 h1:zWnc1Vrcno+lHZCOofnIMvycFcc0QRGIzm9dhnDX68E=
 google.golang.org/grpc v1.67.1/go.mod h1:1gLDyUQU7CTLJI90u3nXZ9ekeghjeM7pTDZlqFNg2AA=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.34.1/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
-google.golang.org/protobuf v1.35.1 h1:m3LfL6/Ca+fqnjnlqQXNpFPABW1UD7mjh8KO2mKFytA=
-google.golang.org/protobuf v1.35.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
+google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
diff --git a/service/go.mod b/service/go.mod
index df9cd4dda1..306d08d5bf 100644
--- a/service/go.mod
+++ b/service/go.mod
@@ -1,18 +1,18 @@
 module github.com/opentdf/platform/service
 
-go 1.23.0
+go 1.23.4
 
 toolchain go1.24.2
 
 require (
-	connectrpc.com/connect v1.17.0
+	connectrpc.com/connect v1.18.1
 	connectrpc.com/grpchealth v1.3.0
 	connectrpc.com/grpcreflect v1.2.0
-	connectrpc.com/validate v0.1.0
+	connectrpc.com/validate v0.2.0
 	github.com/Masterminds/squirrel v1.5.4
 	github.com/Nerzal/gocloak/v13 v13.9.0
 	github.com/bmatcuk/doublestar v1.3.4
-	github.com/bufbuild/protovalidate-go v0.6.0
+	github.com/bufbuild/protovalidate-go v0.9.3
 	github.com/casbin/casbin/v2 v2.101.0
 	github.com/creasty/defaults v1.7.0
 	github.com/docker/docker v27.1.1+incompatible
@@ -34,7 +34,7 @@ require (
 	github.com/pressly/goose/v3 v3.19.1
 	github.com/spf13/cobra v1.8.1
 	github.com/spf13/viper v1.18.2
-	github.com/stretchr/testify v1.9.0
+	github.com/stretchr/testify v1.10.0
 	github.com/testcontainers/testcontainers-go v0.34.0
 	go.opentelemetry.io/otel v1.31.0
 	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.31.0
@@ -42,14 +42,16 @@ require (
 	go.opentelemetry.io/otel/trace v1.31.0
 	golang.org/x/net v0.36.0
 	google.golang.org/grpc v1.67.1
-	google.golang.org/protobuf v1.35.2
+	google.golang.org/protobuf v1.36.6
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
+require cel.dev/expr v0.19.1 // indirect
+
 require (
-	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.34.1-20240508200655-46a4cf4ba109.1 // indirect
+	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-20250307204501-0409229c3780.1 // indirect
 	dario.cat/mergo v1.0.0 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect; indi\
@@ -85,7 +87,7 @@ require (
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
 	github.com/golang/mock v1.6.0 // indirect
-	github.com/google/cel-go v0.20.1 // indirect
+	github.com/google/cel-go v0.24.1 // indirect
 	github.com/google/flatbuffers v23.5.26+incompatible // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/gowebpki/jcs v1.0.1 // indirect
@@ -155,11 +157,11 @@ require (
 	go.opentelemetry.io/otel/metric v1.31.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/crypto v0.35.0 // indirect
-	golang.org/x/exp v0.0.0-20240222234643-814bf88cf225 // indirect
+	golang.org/x/exp v0.0.0-20240325151524-a685a6edb6d8 // indirect
 	golang.org/x/oauth2 v0.22.0 // indirect
-	golang.org/x/sync v0.11.0 // indirect
+	golang.org/x/sync v0.12.0 // indirect
 	golang.org/x/sys v0.30.0 // indirect
-	golang.org/x/text v0.22.0 // indirect
+	golang.org/x/text v0.23.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20241007155032-5fefd90f89a9 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20241007155032-5fefd90f89a9 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
diff --git a/service/go.sum b/service/go.sum
index ff1f614593..b226a2e8e8 100644
--- a/service/go.sum
+++ b/service/go.sum
@@ -1,13 +1,21 @@
 buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.34.1-20240508200655-46a4cf4ba109.1 h1:LEXWFH/xZ5oOWrC3oOtHbUyBdzRWMCPpAQmKC9v05mA=
 buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.34.1-20240508200655-46a4cf4ba109.1/go.mod h1:XF+P8+RmfdufmIYpGUC+6bF7S+IlmHDEnCrO3OXaUAQ=
+buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-20250307204501-0409229c3780.1 h1:zgJPqo17m28+Lf5BW4xv3PvU20BnrmTcGYrog22lLIU=
+buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-20250307204501-0409229c3780.1/go.mod h1:avRlCjnFzl98VPaeCtJ24RrV/wwHFzB8sWXhj26+n/U=
+cel.dev/expr v0.19.1 h1:NciYrtDRIR0lNCnH1LFJegdjspNx9fI59O7TWcua/W4=
+cel.dev/expr v0.19.1/go.mod h1:MrpN08Q+lEBs+bGYdLxxHkZoUSsCp0nSKTs0nTymJgw=
 connectrpc.com/connect v1.17.0 h1:W0ZqMhtVzn9Zhn2yATuUokDLO5N+gIuBWMOnsQrfmZk=
 connectrpc.com/connect v1.17.0/go.mod h1:0292hj1rnx8oFrStN7cB4jjVBeqs+Yx5yDIC2prWDO8=
+connectrpc.com/connect v1.18.1 h1:PAg7CjSAGvscaf6YZKUefjoih5Z/qYkyaTrBW8xvYPw=
+connectrpc.com/connect v1.18.1/go.mod h1:0292hj1rnx8oFrStN7cB4jjVBeqs+Yx5yDIC2prWDO8=
 connectrpc.com/grpchealth v1.3.0 h1:FA3OIwAvuMokQIXQrY5LbIy8IenftksTP/lG4PbYN+E=
 connectrpc.com/grpchealth v1.3.0/go.mod h1:3vpqmX25/ir0gVgW6RdnCPPZRcR6HvqtXX5RNPmDXHM=
 connectrpc.com/grpcreflect v1.2.0 h1:Q6og1S7HinmtbEuBvARLNwYmTbhEGRpHDhqrPNlmK+U=
 connectrpc.com/grpcreflect v1.2.0/go.mod h1:nwSOKmE8nU5u/CidgHtPYk1PFI3U9ignz7iDMxOYkSY=
 connectrpc.com/validate v0.1.0 h1:r55jirxMK7HO/xZwVHj3w2XkVFarsUM77ZDy367NtH4=
 connectrpc.com/validate v0.1.0/go.mod h1:GU47c9/x/gd+u9wRSPkrQOP46gx2rMN+Wo37EHgI3Ow=
+connectrpc.com/validate v0.2.0 h1:izFAPJwZzfseE93aq0ZqnMBsuNRXKZe6aDWZ3vo8dhY=
+connectrpc.com/validate v0.2.0/go.mod h1:3v6kC0nIp6DtXwDMdq/BXrVPPm+w3nWlHW8T193FErE=
 dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
 dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=
@@ -46,6 +54,8 @@ github.com/bmatcuk/doublestar/v4 v4.6.1 h1:FH9SifrbvJhnlQpztAx++wlkk70QBf0iBWDwN
 github.com/bmatcuk/doublestar/v4 v4.6.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/bufbuild/protovalidate-go v0.6.0 h1:Jgs1kFuZ2LHvvdj8SpCLA1W/+pXS8QSM3F/E2l3InPY=
 github.com/bufbuild/protovalidate-go v0.6.0/go.mod h1:1LamgoYHZ2NdIQH0XGczGTc6Z8YrTHjcJVmiBaar4t4=
+github.com/bufbuild/protovalidate-go v0.9.3 h1:XvdtwQuppS3wjzGfpOirsqwN5ExH2+PiIuA/XZd3MTM=
+github.com/bufbuild/protovalidate-go v0.9.3/go.mod h1:2lUDP6fNd3wxznRNH3Nj64VB07+PySeslamkerwP6tE=
 github.com/bytecodealliance/wasmtime-go/v3 v3.0.2 h1:3uZCA/BLTIu+DqCfguByNMJa2HVHpXvjfy0Dy7g6fuA=
 github.com/bytecodealliance/wasmtime-go/v3 v3.0.2/go.mod h1:RnUjnIXxEJcL6BgCvNyzCCRzZcxCgsZCi+RNlvYor5Q=
 github.com/casbin/casbin/v2 v2.101.0 h1:y8qZRXcgv5omd3k/7kpaP03Hov82sXzCC5FAfm17lkw=
@@ -103,6 +113,7 @@ github.com/elastic/go-windows v1.0.1 h1:AlYZOldA+UJ0/2nBuqWdo90GFCgG9xuyw9SYzGUt
 github.com/elastic/go-windows v1.0.1/go.mod h1:FoVvqWSun28vaDQPbj2Elfc0JahhPB7WQEGa3c814Ss=
 github.com/envoyproxy/protoc-gen-validate v1.1.0 h1:tntQDh69XqOCOZsDz0lVJQez/2L6Uu2PdjCQwWCJ3bM=
 github.com/envoyproxy/protoc-gen-validate v1.1.0/go.mod h1:sXRDRVmzEbkM7CVcM06s9shE/m23dg3wzjl0UWqJ2q4=
+github.com/envoyproxy/protoc-gen-validate v1.2.1 h1:DEo3O99U8j4hBFwbJfrz9VtgcDfUKS7KJ7spH3d86P8=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8vw=
@@ -166,6 +177,8 @@ github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
 github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/google/cel-go v0.20.1 h1:nDx9r8S3L4pE61eDdt8igGj8rf5kjYR3ILxWIpWNi84=
 github.com/google/cel-go v0.20.1/go.mod h1:kWcIzTsPX0zmQ+H3TirHstLLf9ep5QTsZBN9u4dOYLg=
+github.com/google/cel-go v0.24.1 h1:jsBCtxG8mM5wiUJDSGUqU0K7Mtr3w7Eyv00rw4DiZxI=
+github.com/google/cel-go v0.24.1/go.mod h1:Hdf9TqOaTNSFQA1ybQaRqATVoK7m/zcf7IMhGXP5zI8=
 github.com/google/flatbuffers v23.5.26+incompatible h1:M9dgRyhJemaM4Sw8+66GHBu8ioaQmyPLg1b8VwK5WJg=
 github.com/google/flatbuffers v23.5.26+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
@@ -366,6 +379,7 @@ github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
 github.com/tchap/go-patricia/v2 v2.3.1 h1:6rQp39lgIYZ+MHmdEq4xzuk1t7OdC35z/xm0BGhTkes=
@@ -433,6 +447,8 @@ golang.org/x/crypto v0.35.0 h1:b15kiHdrGCHrP6LvwaQ3c03kgNhhiMgvlhxHQhmg2Xs=
 golang.org/x/crypto v0.35.0/go.mod h1:dy7dXNW32cAb/6/PRuTNsix8T+vJAqvuIy5Bli/x0YQ=
 golang.org/x/exp v0.0.0-20240222234643-814bf88cf225 h1:LfspQV/FYTatPTr/3HzIcmiUFH7PGP+OQ6mgDYo3yuQ=
 golang.org/x/exp v0.0.0-20240222234643-814bf88cf225/go.mod h1:CxmFvTBINI24O/j8iY7H1xHzx2i4OsyguNBmN/uPtqc=
+golang.org/x/exp v0.0.0-20240325151524-a685a6edb6d8 h1:aAcj0Da7eBAtrTp03QXWvm88pSyOt+UgdZw2BFZ+lEw=
+golang.org/x/exp v0.0.0-20240325151524-a685a6edb6d8/go.mod h1:CQ1k9gNrJ50XIzaKCRR2hssIjF07kZFEiieALBM/ARQ=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -464,6 +480,8 @@ golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
 golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
+golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -501,6 +519,8 @@ golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
 golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
+golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
+golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
 golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/time v0.6.0 h1:eTDhh4ZXt5Qf0augr54TN6suAUudPcawVZeIAPU7D4U=
 golang.org/x/time v0.6.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
@@ -528,6 +548,8 @@ google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp0
 google.golang.org/protobuf v1.34.1/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 google.golang.org/protobuf v1.35.2 h1:8Ar7bF+apOIoThw1EdZl0p1oWvMqTHmpA2fRTyZO8io=
 google.golang.org/protobuf v1.35.2/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
+google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=

From 748fdb42796c0c2a377f60811b5bcaac5ae04b9c Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 11 Apr 2025 13:51:26 -0700
Subject: [PATCH 059/110] validator is no longer a pointer

---
 service/policy/attributes/attributes_test.go                  | 2 +-
 service/policy/kasregistry/key_access_server_registry_test.go | 2 +-
 service/policy/namespaces/namespaces_test.go                  | 2 +-
 service/policy/resourcemapping/resource_mapping_test.go       | 2 +-
 service/policy/subjectmapping/subject_mapping_test.go         | 2 +-
 service/policy/unsafe/unsafe_test.go                          | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/service/policy/attributes/attributes_test.go b/service/policy/attributes/attributes_test.go
index 075678bcaf..7cdae74df1 100644
--- a/service/policy/attributes/attributes_test.go
+++ b/service/policy/attributes/attributes_test.go
@@ -11,7 +11,7 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func getValidator() *protovalidate.Validator {
+func getValidator() protovalidate.Validator {
 	v, err := protovalidate.New()
 	if err != nil {
 		panic(err)
diff --git a/service/policy/kasregistry/key_access_server_registry_test.go b/service/policy/kasregistry/key_access_server_registry_test.go
index 602cfb9abc..167744ee18 100644
--- a/service/policy/kasregistry/key_access_server_registry_test.go
+++ b/service/policy/kasregistry/key_access_server_registry_test.go
@@ -10,7 +10,7 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func getValidator() *protovalidate.Validator {
+func getValidator() protovalidate.Validator {
 	v, err := protovalidate.New()
 	if err != nil {
 		panic(err)
diff --git a/service/policy/namespaces/namespaces_test.go b/service/policy/namespaces/namespaces_test.go
index adce58a5ea..8ac16d3e18 100644
--- a/service/policy/namespaces/namespaces_test.go
+++ b/service/policy/namespaces/namespaces_test.go
@@ -19,7 +19,7 @@ const (
 	errExclusiveFields = "exclusive_fields"
 )
 
-func getValidator() *protovalidate.Validator {
+func getValidator() protovalidate.Validator {
 	v, err := protovalidate.New()
 	if err != nil {
 		panic(err)
diff --git a/service/policy/resourcemapping/resource_mapping_test.go b/service/policy/resourcemapping/resource_mapping_test.go
index 81efcd3b88..a2fba3bd2b 100644
--- a/service/policy/resourcemapping/resource_mapping_test.go
+++ b/service/policy/resourcemapping/resource_mapping_test.go
@@ -48,7 +48,7 @@ var (
 	}
 )
 
-func getValidator() *protovalidate.Validator {
+func getValidator() protovalidate.Validator {
 	v, err := protovalidate.New()
 	if err != nil {
 		panic(err)
diff --git a/service/policy/subjectmapping/subject_mapping_test.go b/service/policy/subjectmapping/subject_mapping_test.go
index 659b069710..b9dede79bf 100644
--- a/service/policy/subjectmapping/subject_mapping_test.go
+++ b/service/policy/subjectmapping/subject_mapping_test.go
@@ -9,7 +9,7 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func getValidator() *protovalidate.Validator {
+func getValidator() protovalidate.Validator {
 	v, err := protovalidate.New()
 	if err != nil {
 		panic(err)
diff --git a/service/policy/unsafe/unsafe_test.go b/service/policy/unsafe/unsafe_test.go
index 8e7d59bcbe..b5f0459aa7 100644
--- a/service/policy/unsafe/unsafe_test.go
+++ b/service/policy/unsafe/unsafe_test.go
@@ -13,7 +13,7 @@ var (
 	validUUID      = "00000000-0000-0000-0000-000000000000"
 )
 
-func getValidator() *protovalidate.Validator {
+func getValidator() protovalidate.Validator {
 	v, err := protovalidate.New()
 	if err != nil {
 		panic(err)

From 8df00e0dc30a64f103e91fd5595d09cd2dd7e8d0 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 11 Apr 2025 13:51:44 -0700
Subject: [PATCH 060/110] consume latest proto rules

---
 service/policy/actions/actions_test.go | 78 +++++++++++---------------
 1 file changed, 32 insertions(+), 46 deletions(-)

diff --git a/service/policy/actions/actions_test.go b/service/policy/actions/actions_test.go
index a8972f951c..5983f1ddda 100644
--- a/service/policy/actions/actions_test.go
+++ b/service/policy/actions/actions_test.go
@@ -12,33 +12,29 @@ import (
 )
 
 const (
-	validUUID                  = "00000000-0000-0000-0000-000000000000"
-	errMessageUUID             = "string.uuid"
-	errMessageActionNameFormat = "action_name_format"
-	errMessageMinLen           = "string.min_len"
-	errMessageMaxLen           = "string.max_len"
-	errMessageURI              = "string.uri"
-	errMessageRequired         = "required"
+	validUUID                          = "00000000-0000-0000-0000-000000000000"
+	errMessageUUID                     = "string.uuid"
+	errMessageActionNameFormatRequired = "common_object_name_required"
+	errMessageActionNameFormatOptional = "common_object_name_optional"
+	errMessageURI                      = "string.uri"
+	errMessageRequired                 = "required"
 )
 
 var (
 	validNames = []string{"valid_Name", "valid_name", "NAME", "NAME-IS-VALID", "SOME_VALID_NAME", "valid-name", strings.Repeat("a", 253), strings.Repeat("a", 1)}
 
-	invalidNameTests = []struct {
-		name           string
-		expectedErrMsg string
-	}{
-		{strings.Repeat("a", 254), errMessageMaxLen},
-		{"!", errMessageActionNameFormat},
-		{"name with space", errMessageActionNameFormat},
-		{"slash/", errMessageActionNameFormat},
-		{"slash\\", errMessageActionNameFormat},
-		{"name:with:colon", errMessageActionNameFormat},
-		{"name.dot.delimited", errMessageActionNameFormat},
-		{"_cannot_start_with_underscore", errMessageActionNameFormat},
-		{"cannot_end_with__underscore_", errMessageActionNameFormat},
-		{"-cannot-start-with-hyphen", errMessageActionNameFormat},
-		{"cannot-end-with-hyphen-", errMessageActionNameFormat},
+	invalidNameTests = []string{
+		strings.Repeat("a", 254),
+		"!",
+		"name with space",
+		"slash/",
+		"slash\\",
+		"name:with:colon",
+		"name.dot.delimited",
+		"_cannot_start_with_underscore",
+		"cannot_end_with__underscore_",
+		"-cannot-start-with-hyphen",
+		"cannot-end-with-hyphen-",
 	}
 )
 
@@ -46,7 +42,7 @@ var (
 
 type ActionSuite struct {
 	suite.Suite
-	v *protovalidate.Validator
+	v protovalidate.Validator
 }
 
 // Set up the test environment
@@ -63,14 +59,14 @@ func TestActionsServiceProtos(t *testing.T) {
 }
 
 func (s *ActionSuite) Test_CreateActionRequest_Fails() {
-	for _, test := range invalidNameTests {
-		s.Run(test.name, func() {
+	for _, name := range invalidNameTests {
+		s.Run(name, func() {
 			req := &actions.CreateActionRequest{
-				Name: test.name,
+				Name: name,
 			}
 			err := s.v.Validate(req)
 			s.Require().Error(err)
-			s.Require().Contains(err.Error(), test.expectedErrMsg)
+			s.Require().Contains(err.Error(), errMessageActionNameFormatRequired)
 		})
 	}
 
@@ -80,7 +76,7 @@ func (s *ActionSuite) Test_CreateActionRequest_Fails() {
 	}
 	err := s.v.Validate(req)
 	s.Require().Error(err)
-	s.Require().Contains(err.Error(), errMessageMinLen)
+	s.Require().Contains(err.Error(), errMessageActionNameFormatRequired)
 }
 
 func (s *ActionSuite) Test_CreateActionRequest_Succeeds() {
@@ -142,28 +138,18 @@ func (s *ActionSuite) Test_GetAction_Fails() {
 	s.Require().Error(err)
 	s.Require().Contains(err.Error(), errMessageRequired)
 
-	for _, test := range invalidNameTests {
-		s.Run(test.name, func() {
+	for _, name := range invalidNameTests {
+		s.Run(name, func() {
 			req = &actions.GetActionRequest{
 				Identifier: &actions.GetActionRequest_Name{
-					Name: test.name,
+					Name: name,
 				},
 			}
 			err := s.v.Validate(req)
 			s.Require().Error(err)
-			s.Require().Contains(err.Error(), test.expectedErrMsg)
+			s.Require().Contains(err.Error(), errMessageActionNameFormatOptional)
 		})
 	}
-
-	// no name
-	req = &actions.GetActionRequest{
-		Identifier: &actions.GetActionRequest_Name{
-			Name: "",
-		},
-	}
-	err = s.v.Validate(req)
-	s.Require().Error(err)
-	s.Require().Contains(err.Error(), errMessageMinLen)
 }
 
 func (s *ActionSuite) Test_ListActions_Succeeds() {
@@ -218,15 +204,15 @@ func (s *ActionSuite) Test_UpdateActionRequest_Fails() {
 	s.Require().Error(err)
 	s.Require().Contains(err.Error(), errMessageUUID)
 
-	for _, test := range invalidNameTests {
-		s.Run(test.name, func() {
+	for _, name := range invalidNameTests {
+		s.Run(name, func() {
 			req = &actions.UpdateActionRequest{
 				Id:   validUUID,
-				Name: test.name,
+				Name: name,
 			}
 			err := s.v.Validate(req)
 			s.Require().Error(err)
-			s.Require().Contains(err.Error(), test.expectedErrMsg)
+			s.Require().Contains(err.Error(), errMessageActionNameFormatOptional)
 		})
 	}
 }

From f62fb0d0ba17a427109e1742b27f3a967f528823 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 11 Apr 2025 13:52:01 -0700
Subject: [PATCH 061/110] test common rule protos

---
 protocol/go/policy/actions/actions.pb.go | 142 ++++++++++-------------
 protocol/go/policy/rules.pb.go           |  41 ++++---
 service/policy/actions/actions.proto     |  16 +--
 service/policy/rules.proto               |   6 +-
 4 files changed, 88 insertions(+), 117 deletions(-)

diff --git a/protocol/go/policy/actions/actions.pb.go b/protocol/go/policy/actions/actions.pb.go
index 2ae024ab43..2d51999b62 100644
--- a/protocol/go/policy/actions/actions.pb.go
+++ b/protocol/go/policy/actions/actions.pb.go
@@ -654,91 +654,73 @@ var file_policy_actions_actions_proto_rawDesc = []byte{
 	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63,
 	0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c,
 	0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x22, 0xfa, 0x03, 0x0a, 0x13, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74,
+	0x6f, 0x6e, 0x22, 0xdb, 0x01, 0x0a, 0x13, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74,
 	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64,
 	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01,
-	0x52, 0x02, 0x69, 0x64, 0x12, 0xbd, 0x02, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x42, 0xa8, 0x02, 0xba, 0x48, 0xa4, 0x02, 0xba, 0x01, 0x98, 0x02, 0x0a, 0x1b,
-	0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f,
-	0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0xa8, 0x01, 0x41, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62,
-	0x65, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69,
-	0x63, 0x20, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x2c, 0x20, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x69,
-	0x6e, 0x67, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x75,
-	0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f, 0x72, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74, 0x20, 0x6e,
-	0x6f, 0x74, 0x20, 0x61, 0x73, 0x20, 0x74, 0x68, 0x65, 0x20, 0x66, 0x69, 0x72, 0x73, 0x74, 0x20,
-	0x6f, 0x72, 0x20, 0x6c, 0x61, 0x73, 0x74, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65,
-	0x72, 0x2e, 0x20, 0x54, 0x68, 0x65, 0x20, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20, 0x61, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x69, 0x73, 0x20, 0x6e, 0x6f, 0x72,
-	0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64, 0x20, 0x74, 0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72,
-	0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a, 0x4e, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69,
-	0x73, 0x29, 0x20, 0x3d, 0x3d, 0x20, 0x30, 0x20, 0x7c, 0x7c, 0x20, 0x74, 0x68, 0x69, 0x73, 0x2e,
-	0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d,
-	0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30,
-	0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39,
-	0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29, 0xc8, 0x01, 0x00, 0x72, 0x03, 0x18, 0xfd, 0x01, 0x52, 0x04,
-	0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
-	0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e,
-	0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4d, 0x75, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x52,
-	0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x54, 0x0a, 0x18, 0x6d, 0x65, 0x74,
-	0x61, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x62, 0x65, 0x68,
-	0x61, 0x76, 0x69, 0x6f, 0x72, 0x18, 0x65, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e, 0x63, 0x6f,
-	0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x55, 0x70, 0x64,
-	0x61, 0x74, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x52, 0x16, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x42, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x22,
-	0x3e, 0x0a, 0x14, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22,
-	0x2f, 0x0a, 0x13, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x52, 0x02, 0x69, 0x64,
-	0x22, 0x3e, 0x0a, 0x14, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x52, 0x02, 0x69, 0x64, 0x12, 0x1f, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x42, 0x0b, 0xba, 0x48, 0x08, 0x72, 0x06, 0xc8, 0xb3, 0xae, 0xb1, 0x02, 0x01, 0x52,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e,
+	0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4d, 0x75, 0x74, 0x61, 0x62, 0x6c, 0x65,
+	0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x54, 0x0a, 0x18, 0x6d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x62, 0x65,
+	0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x18, 0x65, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e, 0x63,
+	0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x55, 0x70,
+	0x64, 0x61, 0x74, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x52, 0x16, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x42, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72,
+	0x22, 0x3e, 0x0a, 0x14, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
 	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69,
 	0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63,
 	0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x32, 0xd4, 0x03, 0x0a, 0x0d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x72, 0x76, 0x69,
-	0x63, 0x65, 0x12, 0x52, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12,
-	0x20, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x21, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x22, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00,
-	0x12, 0x5b, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x12, 0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b, 0x0a,
-	0x0c, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x2e,
-	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x55,
-	0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x44, 0x65,
-	0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x2e, 0x70, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x44, 0x65, 0x6c, 0x65,
-	0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
-	0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0xb3, 0x01, 0x0a, 0x12, 0x63, 0x6f, 0x6d, 0x2e,
-	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x42, 0x0c,
-	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x36,
-	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x74,
-	0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x61,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xa2, 0x02, 0x03, 0x50, 0x41, 0x58, 0xaa, 0x02, 0x0e, 0x50,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xca, 0x02, 0x0e,
-	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xe2, 0x02,
-	0x1a, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x5c,
-	0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x0f, 0x50, 0x6f,
-	0x6c, 0x69, 0x63, 0x79, 0x3a, 0x3a, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x62, 0x06, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x22, 0x2f, 0x0a, 0x13, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x52, 0x02, 0x69,
+	0x64, 0x22, 0x3e, 0x0a, 0x14, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x32, 0xd4, 0x03, 0x0a, 0x0d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x12, 0x52, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x12, 0x20, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x21, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x41,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x22, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
+	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x70, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x12, 0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
+	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b,
+	0x0a, 0x0c, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23,
+	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e,
+	0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x44,
+	0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x2e, 0x70, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x44, 0x65, 0x6c,
+	0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0xb3, 0x01, 0x0a, 0x12, 0x63, 0x6f, 0x6d,
+	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x42,
+	0x0c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a,
+	0x36, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65, 0x6e,
+	0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f,
+	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xa2, 0x02, 0x03, 0x50, 0x41, 0x58, 0xaa, 0x02, 0x0e,
+	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xca, 0x02,
+	0x0e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xe2,
+	0x02, 0x1a, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
+	0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x0f, 0x50,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x3a, 0x3a, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x62, 0x06,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/protocol/go/policy/rules.pb.go b/protocol/go/policy/rules.pb.go
index 6750f79bc2..a71fe99b20 100644
--- a/protocol/go/policy/rules.pb.go
+++ b/protocol/go/policy/rules.pb.go
@@ -60,7 +60,7 @@ var file_policy_rules_proto_rawDesc = []byte{
 	0x75, 0x6c, 0x65, 0x73, 0x18, 0xb8, 0xe6, 0x95, 0x26, 0x20, 0x01, 0x28, 0x08, 0x42, 0xe5, 0x02,
 	0xc2, 0x48, 0xe1, 0x02, 0x0a, 0xde, 0x02, 0x0a, 0x22, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x2e,
 	0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x6e, 0x61,
-	0x6d, 0x65, 0x2e, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x12, 0xd4, 0x01, 0x46, 0x69,
+	0x6d, 0x65, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x12, 0xd4, 0x01, 0x46, 0x69,
 	0x65, 0x6c, 0x64, 0x20, 0x69, 0x73, 0x20, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x2c,
 	0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x2c, 0x20, 0x6f,
 	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x6c, 0x79, 0x20, 0x69, 0x6e, 0x63, 0x6c, 0x75, 0x64,
@@ -82,13 +82,13 @@ var file_policy_rules_proto_rawDesc = []byte{
 	0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d,
 	0x29, 0x3f, 0x24, 0x27, 0x29, 0x52, 0x18, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x4f, 0x62, 0x6a,
 	0x65, 0x63, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x52, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x3a,
-	0xba, 0x03, 0x0a, 0x1b, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63,
+	0xe2, 0x03, 0x0a, 0x1b, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63,
 	0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x12,
 	0x19, 0x2e, 0x62, 0x75, 0x66, 0x2e, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2e, 0x53,
 	0x74, 0x72, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x18, 0xb9, 0xe6, 0x95, 0x26, 0x20,
-	0x01, 0x28, 0x08, 0x42, 0xdc, 0x02, 0xc2, 0x48, 0xd8, 0x02, 0x0a, 0xd5, 0x02, 0x0a, 0x22, 0x73,
+	0x01, 0x28, 0x08, 0x42, 0x84, 0x03, 0xc2, 0x48, 0x80, 0x03, 0x0a, 0xfd, 0x02, 0x0a, 0x22, 0x73,
 	0x74, 0x72, 0x69, 0x6e, 0x67, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x5f, 0x6f, 0x62, 0x6a,
-	0x65, 0x63, 0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x2e, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61,
+	0x65, 0x63, 0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61,
 	0x6c, 0x12, 0xd9, 0x01, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x20, 0x69, 0x73, 0x20, 0x6f, 0x70, 0x74,
 	0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x69, 0x66, 0x20, 0x70, 0x72,
 	0x6f, 0x76, 0x69, 0x64, 0x65, 0x64, 0x2c, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d,
@@ -102,22 +102,25 @@ var file_policy_rules_proto_rawDesc = []byte{
 	0x20, 0x6c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x2e, 0x20, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20,
 	0x66, 0x69, 0x65, 0x6c, 0x64, 0x20, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x20, 0x77, 0x69, 0x6c, 0x6c,
 	0x20, 0x62, 0x65, 0x20, 0x6e, 0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64, 0x20, 0x74,
-	0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a, 0x53, 0x73,
+	0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a, 0x7b, 0x73,
 	0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3e, 0x20, 0x30, 0x20, 0x3f, 0x20,
-	0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b,
-	0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61, 0x2d,
-	0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x41,
-	0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x20, 0x3a, 0x20, 0x74, 0x72,
-	0x75, 0x65, 0x52, 0x18, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74,
-	0x4e, 0x61, 0x6d, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x42, 0x80, 0x01, 0x0a,
-	0x0a, 0x63, 0x6f, 0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x42, 0x0a, 0x52, 0x75, 0x6c,
-	0x65, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x2e, 0x67, 0x69, 0x74, 0x68, 0x75,
-	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c,
-	0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f,
-	0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xa2, 0x02, 0x03, 0x50, 0x58, 0x58, 0xaa,
-	0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xca, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63,
-	0x79, 0xe2, 0x02, 0x12, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65,
-	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x28, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3e, 0x20, 0x30, 0x20,
+	0x26, 0x26, 0x20, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3c, 0x20,
+	0x32, 0x35, 0x34, 0x20, 0x26, 0x26, 0x20, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63,
+	0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39,
+	0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d,
+	0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24,
+	0x27, 0x29, 0x29, 0x20, 0x3a, 0x20, 0x74, 0x72, 0x75, 0x65, 0x52, 0x18, 0x63, 0x6f, 0x6d, 0x6d,
+	0x6f, 0x6e, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x4f, 0x70, 0x74, 0x69,
+	0x6f, 0x6e, 0x61, 0x6c, 0x42, 0x80, 0x01, 0x0a, 0x0a, 0x63, 0x6f, 0x6d, 0x2e, 0x70, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x42, 0x0a, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50,
+	0x01, 0x5a, 0x2e, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70,
+	0x65, 0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63,
+	0x79, 0xa2, 0x02, 0x03, 0x50, 0x58, 0x58, 0xaa, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0xca, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xe2, 0x02, 0x12, 0x50, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02,
+	0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
 }
 
 var file_policy_rules_proto_goTypes = []interface{}{
diff --git a/service/policy/actions/actions.proto b/service/policy/actions/actions.proto
index 7c704d1849..25a1fb8ccf 100644
--- a/service/policy/actions/actions.proto
+++ b/service/policy/actions/actions.proto
@@ -59,21 +59,7 @@ message UpdateActionRequest {
 
   // Optional
   // Custom actions only: replaces the existing action name
-  string name = 2 [
-    (buf.validate.field).required = false,
-    (buf.validate.field).string.max_len = 253,
-    (buf.validate.field).cel = {
-      id: "optional_action_name_format"
-      message:
-        "Action name must be an alphanumeric string, "
-        "allowing hyphens and underscores but not as the "
-        "first or last character. The stored action name "
-        "is normalized to lower case."
-      expression:
-        "size(this) == 0 || "
-        "this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$')"
-    }
-  ];
+  string name = 2 [(buf.validate.field).string.(common_object_name_optional) = true];
 
   // Common metadata
   common.MetadataMutable metadata = 100;
diff --git a/service/policy/rules.proto b/service/policy/rules.proto
index 7eeebf43b6..c0dbe2459d 100644
--- a/service/policy/rules.proto
+++ b/service/policy/rules.proto
@@ -6,7 +6,7 @@ import "buf/validate/validate.proto";
 
 extend buf.validate.StringRules {
   optional bool common_object_name_required = 80048952 [(buf.validate.predefined).cel = {
-    id: "string.common_object_name.required"
+    id: "string.common_object_name_required"
     message:
       "Field is required, alphanumeric, optionally including "
       "underscores and dashes but not preceding or trailing, "
@@ -15,12 +15,12 @@ extend buf.validate.StringRules {
     expression: "size(this) > 0 && size(this) < 254 && this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$')"
   }];
   optional bool common_object_name_optional = 80048953 [(buf.validate.predefined).cel = {
-    id: "string.common_object_name.optional"
+    id: "string.common_object_name_optional"
     message:
       "Field is optional, and if provided, alphanumeric, allowing "
       "underscores and dashes but not preceding or trailing, and "
       "must be between 0 and 254 characters in length. Stored "
       "field value will be normalized to lower case."
-    expression: "size(this) > 0 ? this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$') : true"
+    expression: "size(this) > 0 ? (size(this) > 0 && size(this) < 254 && this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$')) : true"
   }];
 }

From 23a6ab7c830cd114df36f857120dd0c325feb270 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 11 Apr 2025 13:57:29 -0700
Subject: [PATCH 062/110] rules proto file rename and regeneration with
 improved CEL

---
 docs/grpc/index.html                          |  10 +-
 ...ger.json => predefined_rules.swagger.json} |   2 +-
 protocol/go/policy/actions/actions.pb.go      | 213 +++++++++---------
 protocol/go/policy/predefined_rules.pb.go     | 163 ++++++++++++++
 protocol/go/policy/rules.pb.go                | 162 -------------
 service/policy/actions/actions.proto          |   2 +-
 .../{rules.proto => predefined_rules.proto}   |   2 +-
 7 files changed, 278 insertions(+), 276 deletions(-)
 rename docs/openapi/policy/{rules.swagger.json => predefined_rules.swagger.json} (99%)
 create mode 100644 protocol/go/policy/predefined_rules.pb.go
 delete mode 100644 protocol/go/policy/rules.pb.go
 rename service/policy/{rules.proto => predefined_rules.proto} (87%)

diff --git a/docs/grpc/index.html b/docs/grpc/index.html
index 09f1c984c7..4c11c8499a 100644
--- a/docs/grpc/index.html
+++ b/docs/grpc/index.html
@@ -514,17 +514,17 @@ <h2>Table of Contents</h2>
         
           
           <li>
-            <a href="#policy%2frules.proto">policy/rules.proto</a>
+            <a href="#policy%2fpredefined_rules.proto">policy/predefined_rules.proto</a>
             <ul>
               
               
               
                 <li>
-                  <a href="#policy%2frules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                  <a href="#policy%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
                 <li>
-                  <a href="#policy%2frules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                  <a href="#policy%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
               
@@ -4344,7 +4344,7 @@ <h4>Methods with idempotency_level option</h4>
     
       
       <div class="file-heading">
-        <h2 id="policy/rules.proto">policy/rules.proto</h2><a href="#title">Top</a>
+        <h2 id="policy/predefined_rules.proto">policy/predefined_rules.proto</h2><a href="#title">Top</a>
       </div>
       <p></p>
 
@@ -4353,7 +4353,7 @@ <h2 id="policy/rules.proto">policy/rules.proto</h2><a href="#title">Top</a>
       
 
       
-        <h3 id="policy/rules.proto-extensions">File-level Extensions</h3>
+        <h3 id="policy/predefined_rules.proto-extensions">File-level Extensions</h3>
         <table class="extension-table">
           <thead>
             <tr><td>Extension</td><td>Type</td><td>Base</td><td>Number</td><td>Description</td></tr>
diff --git a/docs/openapi/policy/rules.swagger.json b/docs/openapi/policy/predefined_rules.swagger.json
similarity index 99%
rename from docs/openapi/policy/rules.swagger.json
rename to docs/openapi/policy/predefined_rules.swagger.json
index 7eeba4114d..56e498b26c 100644
--- a/docs/openapi/policy/rules.swagger.json
+++ b/docs/openapi/policy/predefined_rules.swagger.json
@@ -1,7 +1,7 @@
 {
   "swagger": "2.0",
   "info": {
-    "title": "policy/rules.proto",
+    "title": "policy/predefined_rules.proto",
     "version": "version not set"
   },
   "consumes": [
diff --git a/protocol/go/policy/actions/actions.pb.go b/protocol/go/policy/actions/actions.pb.go
index 2d51999b62..b1afb72ac3 100644
--- a/protocol/go/policy/actions/actions.pb.go
+++ b/protocol/go/policy/actions/actions.pb.go
@@ -609,118 +609,119 @@ var file_policy_actions_actions_proto_rawDesc = []byte{
 	0x69, 0x64, 0x61, 0x74, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x13, 0x63, 0x6f, 0x6d,
 	0x6d, 0x6f, 0x6e, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
 	0x1a, 0x14, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x12, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x72,
-	0x75, 0x6c, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x16, 0x70, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x2f, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x22, 0x66, 0x0a, 0x10, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x48, 0x00, 0x52, 0x02,
-	0x69, 0x64, 0x12, 0x21, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x42, 0x0b, 0xba, 0x48, 0x08, 0x72, 0x06, 0xc8, 0xb3, 0xae, 0xb1, 0x02, 0x01, 0x48, 0x00, 0x52,
-	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x42, 0x13, 0x0a, 0x0a, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66,
-	0x69, 0x65, 0x72, 0x12, 0x05, 0xba, 0x48, 0x02, 0x08, 0x01, 0x22, 0x7e, 0x0a, 0x11, 0x47, 0x65,
-	0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
-	0x26, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
-	0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x41, 0x0a, 0x10, 0x73, 0x75, 0x62, 0x6a, 0x65,
-	0x63, 0x74, 0x5f, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x16, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65,
-	0x63, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x0f, 0x73, 0x75, 0x62, 0x6a, 0x65,
-	0x63, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x22, 0x49, 0x0a, 0x12, 0x4c, 0x69,
-	0x73, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x12, 0x33, 0x0a, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x0a,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x61,
-	0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x52, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0xbd, 0x01, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x39, 0x0a,
-	0x10, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x5f, 0x73, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72,
-	0x64, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x53, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x12, 0x35, 0x0a, 0x0e, 0x61, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x5f, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x52, 0x0d, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x12,
-	0x34, 0x0a, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x0a, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x61, 0x67,
-	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x52, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x6b, 0x0a, 0x13, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1f, 0x0a, 0x04,
-	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0b, 0xba, 0x48, 0x08, 0x72,
-	0x06, 0xc0, 0xb3, 0xae, 0xb1, 0x02, 0x01, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a,
-	0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x17, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x4d, 0x75, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x22, 0x3e, 0x0a, 0x14, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1d, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x70,
+	0x72, 0x65, 0x64, 0x65, 0x66, 0x69, 0x6e, 0x65, 0x64, 0x5f, 0x72, 0x75, 0x6c, 0x65, 0x73, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x16, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x73, 0x65,
+	0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x66, 0x0a,
+	0x10, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x1a, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba,
+	0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x48, 0x00, 0x52, 0x02, 0x69, 0x64, 0x12, 0x21, 0x0a,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0b, 0xba, 0x48, 0x08,
+	0x72, 0x06, 0xc8, 0xb3, 0xae, 0xb1, 0x02, 0x01, 0x48, 0x00, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65,
+	0x42, 0x13, 0x0a, 0x0a, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x12, 0x05,
+	0xba, 0x48, 0x02, 0x08, 0x01, 0x22, 0x7e, 0x0a, 0x11, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69,
 	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63,
 	0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c,
 	0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x22, 0xdb, 0x01, 0x0a, 0x13, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01,
-	0x52, 0x02, 0x69, 0x64, 0x12, 0x1f, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x42, 0x0b, 0xba, 0x48, 0x08, 0x72, 0x06, 0xc8, 0xb3, 0xae, 0xb1, 0x02, 0x01, 0x52,
-	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e,
-	0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4d, 0x75, 0x74, 0x61, 0x62, 0x6c, 0x65,
-	0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x54, 0x0a, 0x18, 0x6d, 0x65,
-	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x62, 0x65,
-	0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x18, 0x65, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e, 0x63,
-	0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x55, 0x70,
-	0x64, 0x61, 0x74, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x52, 0x16, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x42, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72,
-	0x22, 0x3e, 0x0a, 0x14, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63,
-	0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x22, 0x2f, 0x0a, 0x13, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x52, 0x02, 0x69,
-	0x64, 0x22, 0x3e, 0x0a, 0x14, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x32, 0xd4, 0x03, 0x0a, 0x0d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x12, 0x52, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x12, 0x20, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x21, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x41,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x22, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
-	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x70, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74,
-	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
-	0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x12, 0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6f, 0x6e, 0x12, 0x41, 0x0a, 0x10, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x6d, 0x61,
+	0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x70,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4d, 0x61, 0x70,
+	0x70, 0x69, 0x6e, 0x67, 0x52, 0x0f, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4d, 0x61, 0x70,
+	0x70, 0x69, 0x6e, 0x67, 0x73, 0x22, 0x49, 0x0a, 0x12, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x33, 0x0a, 0x0a, 0x70,
+	0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x13, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x52, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x22, 0xbd, 0x01, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x39, 0x0a, 0x10, 0x61, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x5f, 0x73, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x18, 0x01, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x52, 0x0f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x53, 0x74, 0x61, 0x6e, 0x64,
+	0x61, 0x72, 0x64, 0x12, 0x35, 0x0a, 0x0e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x5f, 0x63,
+	0x75, 0x73, 0x74, 0x6f, 0x6d, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0d, 0x61, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x12, 0x34, 0x0a, 0x0a, 0x70, 0x61,
+	0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14,
+	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x52, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x22, 0x6b, 0x0a, 0x13, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1f, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0b, 0xba, 0x48, 0x08, 0x72, 0x06, 0xc0, 0xb3, 0xae, 0xb1,
+	0x02, 0x01, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f, 0x6d,
+	0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4d, 0x75, 0x74, 0x61,
+	0x62, 0x6c, 0x65, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x3e, 0x0a,
+	0x14, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0xdb, 0x01,
+	0x0a, 0x13, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x52, 0x02, 0x69, 0x64, 0x12,
+	0x1f, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0b, 0xba,
+	0x48, 0x08, 0x72, 0x06, 0xc8, 0xb3, 0xae, 0xb1, 0x02, 0x01, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65,
+	0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x4d, 0x75, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x08, 0x6d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x54, 0x0a, 0x18, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0x5f, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x62, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f,
+	0x72, 0x18, 0x65, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e,
+	0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x45,
+	0x6e, 0x75, 0x6d, 0x52, 0x16, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x55, 0x70, 0x64,
+	0x61, 0x74, 0x65, 0x42, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x22, 0x3e, 0x0a, 0x14, 0x55,
+	0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x2f, 0x0a, 0x13, 0x44,
+	0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08,
+	0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x52, 0x02, 0x69, 0x64, 0x22, 0x3e, 0x0a, 0x14,
+	0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x32, 0xd4, 0x03, 0x0a,
+	0x0d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x52,
+	0x0a, 0x09, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x20, 0x2e, 0x70, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x47, 0x65, 0x74,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e,
+	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x47,
+	0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x22, 0x00, 0x12, 0x58, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x12, 0x22, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c,
+	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x2e, 0x70,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72,
+	0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f,
 	0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
-	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b,
-	0x0a, 0x0c, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x55, 0x70, 0x64,
+	0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74,
+	0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24,
 	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e,
-	0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x44,
-	0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x2e, 0x70, 0x6f,
+	0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
+	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f,
 	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x44, 0x65, 0x6c,
-	0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x73, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0xb3, 0x01, 0x0a, 0x12, 0x63, 0x6f, 0x6d,
-	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x42,
-	0x0c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a,
-	0x36, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65, 0x6e,
-	0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f,
-	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xa2, 0x02, 0x03, 0x50, 0x41, 0x58, 0xaa, 0x02, 0x0e,
-	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xca, 0x02,
-	0x0e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xe2,
-	0x02, 0x1a, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x0f, 0x50,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x3a, 0x3a, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x62, 0x06,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x22, 0x00, 0x42, 0xb3, 0x01, 0x0a, 0x12, 0x63, 0x6f, 0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x42, 0x0c, 0x41, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x36, 0x67, 0x69, 0x74, 0x68,
+	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70,
+	0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c,
+	0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0xa2, 0x02, 0x03, 0x50, 0x41, 0x58, 0xaa, 0x02, 0x0e, 0x50, 0x6f, 0x6c, 0x69, 0x63,
+	0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xca, 0x02, 0x0e, 0x50, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xe2, 0x02, 0x1a, 0x50, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x5c, 0x47, 0x50, 0x42, 0x4d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x0f, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x3a, 0x3a, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x33,
 }
 
 var (
diff --git a/protocol/go/policy/predefined_rules.pb.go b/protocol/go/policy/predefined_rules.pb.go
new file mode 100644
index 0000000000..71b88aec09
--- /dev/null
+++ b/protocol/go/policy/predefined_rules.pb.go
@@ -0,0 +1,163 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.33.0
+// 	protoc        (unknown)
+// source: policy/predefined_rules.proto
+
+package policy
+
+import (
+	validate "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+var file_policy_predefined_rules_proto_extTypes = []protoimpl.ExtensionInfo{
+	{
+		ExtendedType:  (*validate.StringRules)(nil),
+		ExtensionType: (*bool)(nil),
+		Field:         80048952,
+		Name:          "policy.common_object_name_required",
+		Tag:           "varint,80048952,opt,name=common_object_name_required",
+		Filename:      "policy/predefined_rules.proto",
+	},
+	{
+		ExtendedType:  (*validate.StringRules)(nil),
+		ExtensionType: (*bool)(nil),
+		Field:         80048953,
+		Name:          "policy.common_object_name_optional",
+		Tag:           "varint,80048953,opt,name=common_object_name_optional",
+		Filename:      "policy/predefined_rules.proto",
+	},
+}
+
+// Extension fields to validate.StringRules.
+var (
+	// optional bool common_object_name_required = 80048952;
+	E_CommonObjectNameRequired = &file_policy_predefined_rules_proto_extTypes[0]
+	// optional bool common_object_name_optional = 80048953;
+	E_CommonObjectNameOptional = &file_policy_predefined_rules_proto_extTypes[1]
+)
+
+var File_policy_predefined_rules_proto protoreflect.FileDescriptor
+
+var file_policy_predefined_rules_proto_rawDesc = []byte{
+	0x0a, 0x1d, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x70, 0x72, 0x65, 0x64, 0x65, 0x66, 0x69,
+	0x6e, 0x65, 0x64, 0x5f, 0x72, 0x75, 0x6c, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12,
+	0x06, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x1a, 0x1b, 0x62, 0x75, 0x66, 0x2f, 0x76, 0x61, 0x6c,
+	0x69, 0x64, 0x61, 0x74, 0x65, 0x2f, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x3a, 0xc3, 0x03, 0x0a, 0x1b, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x5f,
+	0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x72, 0x65, 0x71, 0x75,
+	0x69, 0x72, 0x65, 0x64, 0x12, 0x19, 0x2e, 0x62, 0x75, 0x66, 0x2e, 0x76, 0x61, 0x6c, 0x69, 0x64,
+	0x61, 0x74, 0x65, 0x2e, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x18,
+	0xb8, 0xe6, 0x95, 0x26, 0x20, 0x01, 0x28, 0x08, 0x42, 0xe5, 0x02, 0xc2, 0x48, 0xe1, 0x02, 0x0a,
+	0xde, 0x02, 0x0a, 0x22, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f,
+	0x6e, 0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x72, 0x65,
+	0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x12, 0xd4, 0x01, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x20, 0x69,
+	0x73, 0x20, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x2c, 0x20, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x2c, 0x20, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
+	0x61, 0x6c, 0x6c, 0x79, 0x20, 0x69, 0x6e, 0x63, 0x6c, 0x75, 0x64, 0x69, 0x6e, 0x67, 0x20, 0x75,
+	0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f, 0x72, 0x65, 0x73, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x64,
+	0x61, 0x73, 0x68, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74, 0x20, 0x6e, 0x6f, 0x74, 0x20, 0x70, 0x72,
+	0x65, 0x63, 0x65, 0x64, 0x69, 0x6e, 0x67, 0x20, 0x6f, 0x72, 0x20, 0x74, 0x72, 0x61, 0x69, 0x6c,
+	0x69, 0x6e, 0x67, 0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65,
+	0x20, 0x62, 0x65, 0x74, 0x77, 0x65, 0x65, 0x6e, 0x20, 0x30, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x32,
+	0x35, 0x34, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x73, 0x20, 0x69, 0x6e,
+	0x20, 0x6c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x2e, 0x20, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20,
+	0x66, 0x69, 0x65, 0x6c, 0x64, 0x20, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x20, 0x77, 0x69, 0x6c, 0x6c,
+	0x20, 0x62, 0x65, 0x20, 0x6e, 0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64, 0x20, 0x74,
+	0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a, 0x61, 0x73,
+	0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3e, 0x20, 0x30, 0x20, 0x26, 0x26,
+	0x20, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3c, 0x20, 0x32, 0x35,
+	0x34, 0x20, 0x26, 0x26, 0x20, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65,
+	0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28,
+	0x3f, 0x3a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a,
+	0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29,
+	0x52, 0x18, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4e, 0x61,
+	0x6d, 0x65, 0x52, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x3a, 0xdd, 0x03, 0x0a, 0x1b, 0x63,
+	0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x6e, 0x61, 0x6d,
+	0x65, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x12, 0x19, 0x2e, 0x62, 0x75, 0x66,
+	0x2e, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2e, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67,
+	0x52, 0x75, 0x6c, 0x65, 0x73, 0x18, 0xb9, 0xe6, 0x95, 0x26, 0x20, 0x01, 0x28, 0x08, 0x42, 0xff,
+	0x02, 0xc2, 0x48, 0xfb, 0x02, 0x0a, 0xf8, 0x02, 0x0a, 0x22, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67,
+	0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x6e,
+	0x61, 0x6d, 0x65, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x12, 0xd9, 0x01, 0x46,
+	0x69, 0x65, 0x6c, 0x64, 0x20, 0x69, 0x73, 0x20, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c,
+	0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x69, 0x66, 0x20, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65,
+	0x64, 0x2c, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x2c,
+	0x20, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x69, 0x6e, 0x67, 0x20, 0x75, 0x6e, 0x64, 0x65, 0x72, 0x73,
+	0x63, 0x6f, 0x72, 0x65, 0x73, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x64, 0x61, 0x73, 0x68, 0x65, 0x73,
+	0x20, 0x62, 0x75, 0x74, 0x20, 0x6e, 0x6f, 0x74, 0x20, 0x70, 0x72, 0x65, 0x63, 0x65, 0x64, 0x69,
+	0x6e, 0x67, 0x20, 0x6f, 0x72, 0x20, 0x74, 0x72, 0x61, 0x69, 0x6c, 0x69, 0x6e, 0x67, 0x2c, 0x20,
+	0x61, 0x6e, 0x64, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x62, 0x65, 0x74, 0x77,
+	0x65, 0x65, 0x6e, 0x20, 0x30, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x32, 0x35, 0x34, 0x20, 0x63, 0x68,
+	0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x73, 0x20, 0x69, 0x6e, 0x20, 0x6c, 0x65, 0x6e, 0x67,
+	0x74, 0x68, 0x2e, 0x20, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20, 0x66, 0x69, 0x65, 0x6c, 0x64,
+	0x20, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x20, 0x77, 0x69, 0x6c, 0x6c, 0x20, 0x62, 0x65, 0x20, 0x6e,
+	0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64, 0x20, 0x74, 0x6f, 0x20, 0x6c, 0x6f, 0x77,
+	0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a, 0x76, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x74,
+	0x68, 0x69, 0x73, 0x29, 0x20, 0x3d, 0x3d, 0x20, 0x30, 0x20, 0x7c, 0x7c, 0x20, 0x28, 0x73, 0x69,
+	0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3e, 0x20, 0x30, 0x20, 0x26, 0x26, 0x20,
+	0x73, 0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3c, 0x20, 0x32, 0x35, 0x34,
+	0x20, 0x26, 0x26, 0x20, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73,
+	0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f,
+	0x3a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b,
+	0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x29,
+	0x52, 0x18, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4e, 0x61,
+	0x6d, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x42, 0x8a, 0x01, 0x0a, 0x0a, 0x63,
+	0x6f, 0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x42, 0x14, 0x50, 0x72, 0x65, 0x64, 0x65,
+	0x66, 0x69, 0x6e, 0x65, 0x64, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50,
+	0x01, 0x5a, 0x2e, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70,
+	0x65, 0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63,
+	0x79, 0xa2, 0x02, 0x03, 0x50, 0x58, 0x58, 0xaa, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0xca, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xe2, 0x02, 0x12, 0x50, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02,
+	0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+}
+
+var file_policy_predefined_rules_proto_goTypes = []interface{}{
+	(*validate.StringRules)(nil), // 0: buf.validate.StringRules
+}
+var file_policy_predefined_rules_proto_depIdxs = []int32{
+	0, // 0: policy.common_object_name_required:extendee -> buf.validate.StringRules
+	0, // 1: policy.common_object_name_optional:extendee -> buf.validate.StringRules
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	0, // [0:2] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_policy_predefined_rules_proto_init() }
+func file_policy_predefined_rules_proto_init() {
+	if File_policy_predefined_rules_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_policy_predefined_rules_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   0,
+			NumExtensions: 2,
+			NumServices:   0,
+		},
+		GoTypes:           file_policy_predefined_rules_proto_goTypes,
+		DependencyIndexes: file_policy_predefined_rules_proto_depIdxs,
+		ExtensionInfos:    file_policy_predefined_rules_proto_extTypes,
+	}.Build()
+	File_policy_predefined_rules_proto = out.File
+	file_policy_predefined_rules_proto_rawDesc = nil
+	file_policy_predefined_rules_proto_goTypes = nil
+	file_policy_predefined_rules_proto_depIdxs = nil
+}
diff --git a/protocol/go/policy/rules.pb.go b/protocol/go/policy/rules.pb.go
deleted file mode 100644
index a71fe99b20..0000000000
--- a/protocol/go/policy/rules.pb.go
+++ /dev/null
@@ -1,162 +0,0 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
-// versions:
-// 	protoc-gen-go v1.33.0
-// 	protoc        (unknown)
-// source: policy/rules.proto
-
-package policy
-
-import (
-	validate "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate"
-	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
-	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	reflect "reflect"
-)
-
-const (
-	// Verify that this generated code is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
-	// Verify that runtime/protoimpl is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
-)
-
-var file_policy_rules_proto_extTypes = []protoimpl.ExtensionInfo{
-	{
-		ExtendedType:  (*validate.StringRules)(nil),
-		ExtensionType: (*bool)(nil),
-		Field:         80048952,
-		Name:          "policy.common_object_name_required",
-		Tag:           "varint,80048952,opt,name=common_object_name_required",
-		Filename:      "policy/rules.proto",
-	},
-	{
-		ExtendedType:  (*validate.StringRules)(nil),
-		ExtensionType: (*bool)(nil),
-		Field:         80048953,
-		Name:          "policy.common_object_name_optional",
-		Tag:           "varint,80048953,opt,name=common_object_name_optional",
-		Filename:      "policy/rules.proto",
-	},
-}
-
-// Extension fields to validate.StringRules.
-var (
-	// optional bool common_object_name_required = 80048952;
-	E_CommonObjectNameRequired = &file_policy_rules_proto_extTypes[0]
-	// optional bool common_object_name_optional = 80048953;
-	E_CommonObjectNameOptional = &file_policy_rules_proto_extTypes[1]
-)
-
-var File_policy_rules_proto protoreflect.FileDescriptor
-
-var file_policy_rules_proto_rawDesc = []byte{
-	0x0a, 0x12, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x72, 0x75, 0x6c, 0x65, 0x73, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x12, 0x06, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x1a, 0x1b, 0x62, 0x75,
-	0x66, 0x2f, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2f, 0x76, 0x61, 0x6c, 0x69, 0x64,
-	0x61, 0x74, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x3a, 0xc3, 0x03, 0x0a, 0x1b, 0x63, 0x6f,
-	0x6d, 0x6d, 0x6f, 0x6e, 0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65,
-	0x5f, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x12, 0x19, 0x2e, 0x62, 0x75, 0x66, 0x2e,
-	0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2e, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x52,
-	0x75, 0x6c, 0x65, 0x73, 0x18, 0xb8, 0xe6, 0x95, 0x26, 0x20, 0x01, 0x28, 0x08, 0x42, 0xe5, 0x02,
-	0xc2, 0x48, 0xe1, 0x02, 0x0a, 0xde, 0x02, 0x0a, 0x22, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x2e,
-	0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x6e, 0x61,
-	0x6d, 0x65, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x12, 0xd4, 0x01, 0x46, 0x69,
-	0x65, 0x6c, 0x64, 0x20, 0x69, 0x73, 0x20, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x2c,
-	0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x2c, 0x20, 0x6f,
-	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x6c, 0x79, 0x20, 0x69, 0x6e, 0x63, 0x6c, 0x75, 0x64,
-	0x69, 0x6e, 0x67, 0x20, 0x75, 0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f, 0x72, 0x65, 0x73, 0x20,
-	0x61, 0x6e, 0x64, 0x20, 0x64, 0x61, 0x73, 0x68, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74, 0x20, 0x6e,
-	0x6f, 0x74, 0x20, 0x70, 0x72, 0x65, 0x63, 0x65, 0x64, 0x69, 0x6e, 0x67, 0x20, 0x6f, 0x72, 0x20,
-	0x74, 0x72, 0x61, 0x69, 0x6c, 0x69, 0x6e, 0x67, 0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x6d, 0x75,
-	0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x62, 0x65, 0x74, 0x77, 0x65, 0x65, 0x6e, 0x20, 0x30, 0x20,
-	0x61, 0x6e, 0x64, 0x20, 0x32, 0x35, 0x34, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65,
-	0x72, 0x73, 0x20, 0x69, 0x6e, 0x20, 0x6c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x2e, 0x20, 0x53, 0x74,
-	0x6f, 0x72, 0x65, 0x64, 0x20, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x20, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x20, 0x77, 0x69, 0x6c, 0x6c, 0x20, 0x62, 0x65, 0x20, 0x6e, 0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69,
-	0x7a, 0x65, 0x64, 0x20, 0x74, 0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20, 0x63, 0x61, 0x73,
-	0x65, 0x2e, 0x1a, 0x61, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3e,
-	0x20, 0x30, 0x20, 0x26, 0x26, 0x20, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x29,
-	0x20, 0x3c, 0x20, 0x32, 0x35, 0x34, 0x20, 0x26, 0x26, 0x20, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d,
-	0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a,
-	0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d,
-	0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d,
-	0x29, 0x3f, 0x24, 0x27, 0x29, 0x52, 0x18, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x4f, 0x62, 0x6a,
-	0x65, 0x63, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x52, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x3a,
-	0xe2, 0x03, 0x0a, 0x1b, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63,
-	0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x12,
-	0x19, 0x2e, 0x62, 0x75, 0x66, 0x2e, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2e, 0x53,
-	0x74, 0x72, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x18, 0xb9, 0xe6, 0x95, 0x26, 0x20,
-	0x01, 0x28, 0x08, 0x42, 0x84, 0x03, 0xc2, 0x48, 0x80, 0x03, 0x0a, 0xfd, 0x02, 0x0a, 0x22, 0x73,
-	0x74, 0x72, 0x69, 0x6e, 0x67, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x5f, 0x6f, 0x62, 0x6a,
-	0x65, 0x63, 0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61,
-	0x6c, 0x12, 0xd9, 0x01, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x20, 0x69, 0x73, 0x20, 0x6f, 0x70, 0x74,
-	0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x69, 0x66, 0x20, 0x70, 0x72,
-	0x6f, 0x76, 0x69, 0x64, 0x65, 0x64, 0x2c, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d,
-	0x65, 0x72, 0x69, 0x63, 0x2c, 0x20, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x69, 0x6e, 0x67, 0x20, 0x75,
-	0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f, 0x72, 0x65, 0x73, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x64,
-	0x61, 0x73, 0x68, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74, 0x20, 0x6e, 0x6f, 0x74, 0x20, 0x70, 0x72,
-	0x65, 0x63, 0x65, 0x64, 0x69, 0x6e, 0x67, 0x20, 0x6f, 0x72, 0x20, 0x74, 0x72, 0x61, 0x69, 0x6c,
-	0x69, 0x6e, 0x67, 0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65,
-	0x20, 0x62, 0x65, 0x74, 0x77, 0x65, 0x65, 0x6e, 0x20, 0x30, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x32,
-	0x35, 0x34, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x73, 0x20, 0x69, 0x6e,
-	0x20, 0x6c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x2e, 0x20, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20,
-	0x66, 0x69, 0x65, 0x6c, 0x64, 0x20, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x20, 0x77, 0x69, 0x6c, 0x6c,
-	0x20, 0x62, 0x65, 0x20, 0x6e, 0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64, 0x20, 0x74,
-	0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a, 0x7b, 0x73,
-	0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3e, 0x20, 0x30, 0x20, 0x3f, 0x20,
-	0x28, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3e, 0x20, 0x30, 0x20,
-	0x26, 0x26, 0x20, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3c, 0x20,
-	0x32, 0x35, 0x34, 0x20, 0x26, 0x26, 0x20, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63,
-	0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39,
-	0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d,
-	0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24,
-	0x27, 0x29, 0x29, 0x20, 0x3a, 0x20, 0x74, 0x72, 0x75, 0x65, 0x52, 0x18, 0x63, 0x6f, 0x6d, 0x6d,
-	0x6f, 0x6e, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x4f, 0x70, 0x74, 0x69,
-	0x6f, 0x6e, 0x61, 0x6c, 0x42, 0x80, 0x01, 0x0a, 0x0a, 0x63, 0x6f, 0x6d, 0x2e, 0x70, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x42, 0x0a, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50,
-	0x01, 0x5a, 0x2e, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70,
-	0x65, 0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63,
-	0x79, 0xa2, 0x02, 0x03, 0x50, 0x58, 0x58, 0xaa, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0xca, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xe2, 0x02, 0x12, 0x50, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02,
-	0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-}
-
-var file_policy_rules_proto_goTypes = []interface{}{
-	(*validate.StringRules)(nil), // 0: buf.validate.StringRules
-}
-var file_policy_rules_proto_depIdxs = []int32{
-	0, // 0: policy.common_object_name_required:extendee -> buf.validate.StringRules
-	0, // 1: policy.common_object_name_optional:extendee -> buf.validate.StringRules
-	2, // [2:2] is the sub-list for method output_type
-	2, // [2:2] is the sub-list for method input_type
-	2, // [2:2] is the sub-list for extension type_name
-	0, // [0:2] is the sub-list for extension extendee
-	0, // [0:0] is the sub-list for field type_name
-}
-
-func init() { file_policy_rules_proto_init() }
-func file_policy_rules_proto_init() {
-	if File_policy_rules_proto != nil {
-		return
-	}
-	type x struct{}
-	out := protoimpl.TypeBuilder{
-		File: protoimpl.DescBuilder{
-			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_policy_rules_proto_rawDesc,
-			NumEnums:      0,
-			NumMessages:   0,
-			NumExtensions: 2,
-			NumServices:   0,
-		},
-		GoTypes:           file_policy_rules_proto_goTypes,
-		DependencyIndexes: file_policy_rules_proto_depIdxs,
-		ExtensionInfos:    file_policy_rules_proto_extTypes,
-	}.Build()
-	File_policy_rules_proto = out.File
-	file_policy_rules_proto_rawDesc = nil
-	file_policy_rules_proto_goTypes = nil
-	file_policy_rules_proto_depIdxs = nil
-}
diff --git a/service/policy/actions/actions.proto b/service/policy/actions/actions.proto
index 25a1fb8ccf..72cbc2410b 100644
--- a/service/policy/actions/actions.proto
+++ b/service/policy/actions/actions.proto
@@ -5,7 +5,7 @@ package policy.actions;
 import "buf/validate/validate.proto";
 import "common/common.proto";
 import "policy/objects.proto";
-import "policy/rules.proto";
+import "policy/predefined_rules.proto";
 import "policy/selectors.proto";
 
 /*
diff --git a/service/policy/rules.proto b/service/policy/predefined_rules.proto
similarity index 87%
rename from service/policy/rules.proto
rename to service/policy/predefined_rules.proto
index c0dbe2459d..f715ebedea 100644
--- a/service/policy/rules.proto
+++ b/service/policy/predefined_rules.proto
@@ -21,6 +21,6 @@ extend buf.validate.StringRules {
       "underscores and dashes but not preceding or trailing, and "
       "must be between 0 and 254 characters in length. Stored "
       "field value will be normalized to lower case."
-    expression: "size(this) > 0 ? (size(this) > 0 && size(this) < 254 && this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$')) : true"
+    expression: "size(this) == 0 || (size(this) > 0 && size(this) < 254 && this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$'))"
   }];
 }

From c4ffbc5c659ab63eed725e24792082b63ac1ad7a Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 11 Apr 2025 14:05:18 -0700
Subject: [PATCH 063/110] rename string extension rules

---
 docs/grpc/index.html                      |   4 +-
 protocol/go/policy/predefined_rules.pb.go | 153 +++++++++++-----------
 service/policy/actions/actions.proto      |   6 +-
 service/policy/predefined_rules.proto     |   8 +-
 4 files changed, 84 insertions(+), 87 deletions(-)

diff --git a/docs/grpc/index.html b/docs/grpc/index.html
index 4c11c8499a..9905bf9dda 100644
--- a/docs/grpc/index.html
+++ b/docs/grpc/index.html
@@ -4361,7 +4361,7 @@ <h3 id="policy/predefined_rules.proto-extensions">File-level Extensions</h3>
           <tbody>
             
               <tr>
-                <td>common_object_name_optional</td>
+                <td>optional_object_name</td>
                 <td><a href="#bool">bool</a></td>
                 <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
                 <td>80048953</td>
@@ -4369,7 +4369,7 @@ <h3 id="policy/predefined_rules.proto-extensions">File-level Extensions</h3>
               </tr>
             
               <tr>
-                <td>common_object_name_required</td>
+                <td>required_object_name</td>
                 <td><a href="#bool">bool</a></td>
                 <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
                 <td>80048952</td>
diff --git a/protocol/go/policy/predefined_rules.pb.go b/protocol/go/policy/predefined_rules.pb.go
index 71b88aec09..ab0163ec43 100644
--- a/protocol/go/policy/predefined_rules.pb.go
+++ b/protocol/go/policy/predefined_rules.pb.go
@@ -25,26 +25,26 @@ var file_policy_predefined_rules_proto_extTypes = []protoimpl.ExtensionInfo{
 		ExtendedType:  (*validate.StringRules)(nil),
 		ExtensionType: (*bool)(nil),
 		Field:         80048952,
-		Name:          "policy.common_object_name_required",
-		Tag:           "varint,80048952,opt,name=common_object_name_required",
+		Name:          "policy.required_object_name",
+		Tag:           "varint,80048952,opt,name=required_object_name",
 		Filename:      "policy/predefined_rules.proto",
 	},
 	{
 		ExtendedType:  (*validate.StringRules)(nil),
 		ExtensionType: (*bool)(nil),
 		Field:         80048953,
-		Name:          "policy.common_object_name_optional",
-		Tag:           "varint,80048953,opt,name=common_object_name_optional",
+		Name:          "policy.optional_object_name",
+		Tag:           "varint,80048953,opt,name=optional_object_name",
 		Filename:      "policy/predefined_rules.proto",
 	},
 }
 
 // Extension fields to validate.StringRules.
 var (
-	// optional bool common_object_name_required = 80048952;
-	E_CommonObjectNameRequired = &file_policy_predefined_rules_proto_extTypes[0]
-	// optional bool common_object_name_optional = 80048953;
-	E_CommonObjectNameOptional = &file_policy_predefined_rules_proto_extTypes[1]
+	// optional bool required_object_name = 80048952;
+	E_RequiredObjectName = &file_policy_predefined_rules_proto_extTypes[0]
+	// optional bool optional_object_name = 80048953;
+	E_OptionalObjectName = &file_policy_predefined_rules_proto_extTypes[1]
 )
 
 var File_policy_predefined_rules_proto protoreflect.FileDescriptor
@@ -54,82 +54,79 @@ var file_policy_predefined_rules_proto_rawDesc = []byte{
 	0x6e, 0x65, 0x64, 0x5f, 0x72, 0x75, 0x6c, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12,
 	0x06, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x1a, 0x1b, 0x62, 0x75, 0x66, 0x2f, 0x76, 0x61, 0x6c,
 	0x69, 0x64, 0x61, 0x74, 0x65, 0x2f, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x3a, 0xc3, 0x03, 0x0a, 0x1b, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x5f,
-	0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x72, 0x65, 0x71, 0x75,
-	0x69, 0x72, 0x65, 0x64, 0x12, 0x19, 0x2e, 0x62, 0x75, 0x66, 0x2e, 0x76, 0x61, 0x6c, 0x69, 0x64,
-	0x61, 0x74, 0x65, 0x2e, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x18,
-	0xb8, 0xe6, 0x95, 0x26, 0x20, 0x01, 0x28, 0x08, 0x42, 0xe5, 0x02, 0xc2, 0x48, 0xe1, 0x02, 0x0a,
-	0xde, 0x02, 0x0a, 0x22, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f,
-	0x6e, 0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x72, 0x65,
-	0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x12, 0xd4, 0x01, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x20, 0x69,
-	0x73, 0x20, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x2c, 0x20, 0x61, 0x6c, 0x70, 0x68,
-	0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x2c, 0x20, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
-	0x61, 0x6c, 0x6c, 0x79, 0x20, 0x69, 0x6e, 0x63, 0x6c, 0x75, 0x64, 0x69, 0x6e, 0x67, 0x20, 0x75,
-	0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f, 0x72, 0x65, 0x73, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x64,
-	0x61, 0x73, 0x68, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74, 0x20, 0x6e, 0x6f, 0x74, 0x20, 0x70, 0x72,
-	0x65, 0x63, 0x65, 0x64, 0x69, 0x6e, 0x67, 0x20, 0x6f, 0x72, 0x20, 0x74, 0x72, 0x61, 0x69, 0x6c,
-	0x69, 0x6e, 0x67, 0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65,
-	0x20, 0x62, 0x65, 0x74, 0x77, 0x65, 0x65, 0x6e, 0x20, 0x30, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x32,
-	0x35, 0x34, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x73, 0x20, 0x69, 0x6e,
-	0x20, 0x6c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x2e, 0x20, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20,
-	0x66, 0x69, 0x65, 0x6c, 0x64, 0x20, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x20, 0x77, 0x69, 0x6c, 0x6c,
-	0x20, 0x62, 0x65, 0x20, 0x6e, 0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64, 0x20, 0x74,
-	0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a, 0x61, 0x73,
-	0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3e, 0x20, 0x30, 0x20, 0x26, 0x26,
-	0x20, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3c, 0x20, 0x32, 0x35,
-	0x34, 0x20, 0x26, 0x26, 0x20, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65,
-	0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28,
-	0x3f, 0x3a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a,
-	0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29,
-	0x52, 0x18, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4e, 0x61,
-	0x6d, 0x65, 0x52, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x3a, 0xdd, 0x03, 0x0a, 0x1b, 0x63,
-	0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x6e, 0x61, 0x6d,
-	0x65, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x12, 0x19, 0x2e, 0x62, 0x75, 0x66,
-	0x2e, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2e, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67,
-	0x52, 0x75, 0x6c, 0x65, 0x73, 0x18, 0xb9, 0xe6, 0x95, 0x26, 0x20, 0x01, 0x28, 0x08, 0x42, 0xff,
-	0x02, 0xc2, 0x48, 0xfb, 0x02, 0x0a, 0xf8, 0x02, 0x0a, 0x22, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67,
-	0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x6e,
-	0x61, 0x6d, 0x65, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x12, 0xd9, 0x01, 0x46,
-	0x69, 0x65, 0x6c, 0x64, 0x20, 0x69, 0x73, 0x20, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c,
-	0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x69, 0x66, 0x20, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65,
-	0x64, 0x2c, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x2c,
-	0x20, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x69, 0x6e, 0x67, 0x20, 0x75, 0x6e, 0x64, 0x65, 0x72, 0x73,
-	0x63, 0x6f, 0x72, 0x65, 0x73, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x64, 0x61, 0x73, 0x68, 0x65, 0x73,
-	0x20, 0x62, 0x75, 0x74, 0x20, 0x6e, 0x6f, 0x74, 0x20, 0x70, 0x72, 0x65, 0x63, 0x65, 0x64, 0x69,
-	0x6e, 0x67, 0x20, 0x6f, 0x72, 0x20, 0x74, 0x72, 0x61, 0x69, 0x6c, 0x69, 0x6e, 0x67, 0x2c, 0x20,
-	0x61, 0x6e, 0x64, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x62, 0x65, 0x74, 0x77,
-	0x65, 0x65, 0x6e, 0x20, 0x30, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x32, 0x35, 0x34, 0x20, 0x63, 0x68,
-	0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x73, 0x20, 0x69, 0x6e, 0x20, 0x6c, 0x65, 0x6e, 0x67,
-	0x74, 0x68, 0x2e, 0x20, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20, 0x66, 0x69, 0x65, 0x6c, 0x64,
-	0x20, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x20, 0x77, 0x69, 0x6c, 0x6c, 0x20, 0x62, 0x65, 0x20, 0x6e,
-	0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64, 0x20, 0x74, 0x6f, 0x20, 0x6c, 0x6f, 0x77,
-	0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a, 0x76, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x74,
-	0x68, 0x69, 0x73, 0x29, 0x20, 0x3d, 0x3d, 0x20, 0x30, 0x20, 0x7c, 0x7c, 0x20, 0x28, 0x73, 0x69,
-	0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3e, 0x20, 0x30, 0x20, 0x26, 0x26, 0x20,
-	0x73, 0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3c, 0x20, 0x32, 0x35, 0x34,
-	0x20, 0x26, 0x26, 0x20, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73,
-	0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f,
-	0x3a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b,
-	0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x29,
-	0x52, 0x18, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4e, 0x61,
-	0x6d, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x42, 0x8a, 0x01, 0x0a, 0x0a, 0x63,
-	0x6f, 0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x42, 0x14, 0x50, 0x72, 0x65, 0x64, 0x65,
-	0x66, 0x69, 0x6e, 0x65, 0x64, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50,
-	0x01, 0x5a, 0x2e, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70,
-	0x65, 0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63,
-	0x79, 0xa2, 0x02, 0x03, 0x50, 0x58, 0x58, 0xaa, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0xca, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xe2, 0x02, 0x12, 0x50, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02,
-	0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x72, 0x6f, 0x74, 0x6f, 0x3a, 0xaf, 0x03, 0x0a, 0x14, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65,
+	0x64, 0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x19, 0x2e,
+	0x62, 0x75, 0x66, 0x2e, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2e, 0x53, 0x74, 0x72,
+	0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x18, 0xb8, 0xe6, 0x95, 0x26, 0x20, 0x01, 0x28,
+	0x08, 0x42, 0xde, 0x02, 0xc2, 0x48, 0xda, 0x02, 0x0a, 0xd7, 0x02, 0x0a, 0x1b, 0x73, 0x74, 0x72,
+	0x69, 0x6e, 0x67, 0x2e, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x5f, 0x6f, 0x62, 0x6a,
+	0x65, 0x63, 0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0xd4, 0x01, 0x46, 0x69, 0x65, 0x6c, 0x64,
+	0x20, 0x69, 0x73, 0x20, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x2c, 0x20, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x2c, 0x20, 0x6f, 0x70, 0x74, 0x69,
+	0x6f, 0x6e, 0x61, 0x6c, 0x6c, 0x79, 0x20, 0x69, 0x6e, 0x63, 0x6c, 0x75, 0x64, 0x69, 0x6e, 0x67,
+	0x20, 0x75, 0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f, 0x72, 0x65, 0x73, 0x20, 0x61, 0x6e, 0x64,
+	0x20, 0x64, 0x61, 0x73, 0x68, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74, 0x20, 0x6e, 0x6f, 0x74, 0x20,
+	0x70, 0x72, 0x65, 0x63, 0x65, 0x64, 0x69, 0x6e, 0x67, 0x20, 0x6f, 0x72, 0x20, 0x74, 0x72, 0x61,
+	0x69, 0x6c, 0x69, 0x6e, 0x67, 0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20,
+	0x62, 0x65, 0x20, 0x62, 0x65, 0x74, 0x77, 0x65, 0x65, 0x6e, 0x20, 0x30, 0x20, 0x61, 0x6e, 0x64,
+	0x20, 0x32, 0x35, 0x34, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x73, 0x20,
+	0x69, 0x6e, 0x20, 0x6c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x2e, 0x20, 0x53, 0x74, 0x6f, 0x72, 0x65,
+	0x64, 0x20, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x20, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x20, 0x77, 0x69,
+	0x6c, 0x6c, 0x20, 0x62, 0x65, 0x20, 0x6e, 0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64,
+	0x20, 0x74, 0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a,
+	0x61, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3e, 0x20, 0x30, 0x20,
+	0x26, 0x26, 0x20, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3c, 0x20,
+	0x32, 0x35, 0x34, 0x20, 0x26, 0x26, 0x20, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63,
+	0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39,
+	0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d,
+	0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24,
+	0x27, 0x29, 0x52, 0x12, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x4f, 0x62, 0x6a, 0x65,
+	0x63, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x3a, 0xc9, 0x03, 0x0a, 0x14, 0x6f, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x61, 0x6c, 0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x12,
+	0x19, 0x2e, 0x62, 0x75, 0x66, 0x2e, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2e, 0x53,
+	0x74, 0x72, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x18, 0xb9, 0xe6, 0x95, 0x26, 0x20,
+	0x01, 0x28, 0x08, 0x42, 0xf8, 0x02, 0xc2, 0x48, 0xf4, 0x02, 0x0a, 0xf1, 0x02, 0x0a, 0x1b, 0x73,
+	0x74, 0x72, 0x69, 0x6e, 0x67, 0x2e, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x5f, 0x6f,
+	0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0xd9, 0x01, 0x46, 0x69, 0x65,
+	0x6c, 0x64, 0x20, 0x69, 0x73, 0x20, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2c, 0x20,
+	0x61, 0x6e, 0x64, 0x20, 0x69, 0x66, 0x20, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x64, 0x2c,
+	0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x2c, 0x20, 0x61,
+	0x6c, 0x6c, 0x6f, 0x77, 0x69, 0x6e, 0x67, 0x20, 0x75, 0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f,
+	0x72, 0x65, 0x73, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x64, 0x61, 0x73, 0x68, 0x65, 0x73, 0x20, 0x62,
+	0x75, 0x74, 0x20, 0x6e, 0x6f, 0x74, 0x20, 0x70, 0x72, 0x65, 0x63, 0x65, 0x64, 0x69, 0x6e, 0x67,
+	0x20, 0x6f, 0x72, 0x20, 0x74, 0x72, 0x61, 0x69, 0x6c, 0x69, 0x6e, 0x67, 0x2c, 0x20, 0x61, 0x6e,
+	0x64, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x62, 0x65, 0x74, 0x77, 0x65, 0x65,
+	0x6e, 0x20, 0x30, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x32, 0x35, 0x34, 0x20, 0x63, 0x68, 0x61, 0x72,
+	0x61, 0x63, 0x74, 0x65, 0x72, 0x73, 0x20, 0x69, 0x6e, 0x20, 0x6c, 0x65, 0x6e, 0x67, 0x74, 0x68,
+	0x2e, 0x20, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x20, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x20, 0x77, 0x69, 0x6c, 0x6c, 0x20, 0x62, 0x65, 0x20, 0x6e, 0x6f, 0x72,
+	0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64, 0x20, 0x74, 0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72,
+	0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a, 0x76, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69,
+	0x73, 0x29, 0x20, 0x3d, 0x3d, 0x20, 0x30, 0x20, 0x7c, 0x7c, 0x20, 0x28, 0x73, 0x69, 0x7a, 0x65,
+	0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3e, 0x20, 0x30, 0x20, 0x26, 0x26, 0x20, 0x73, 0x69,
+	0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3c, 0x20, 0x32, 0x35, 0x34, 0x20, 0x26,
+	0x26, 0x20, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27,
+	0x5e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f, 0x3a, 0x5b,
+	0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d,
+	0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x29, 0x52, 0x12,
+	0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4e, 0x61,
+	0x6d, 0x65, 0x42, 0x8a, 0x01, 0x0a, 0x0a, 0x63, 0x6f, 0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63,
+	0x79, 0x42, 0x14, 0x50, 0x72, 0x65, 0x64, 0x65, 0x66, 0x69, 0x6e, 0x65, 0x64, 0x52, 0x75, 0x6c,
+	0x65, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x2e, 0x67, 0x69, 0x74, 0x68, 0x75,
+	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c,
+	0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f,
+	0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xa2, 0x02, 0x03, 0x50, 0x58, 0x58, 0xaa,
+	0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xca, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63,
+	0x79, 0xe2, 0x02, 0x12, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
 }
 
 var file_policy_predefined_rules_proto_goTypes = []interface{}{
 	(*validate.StringRules)(nil), // 0: buf.validate.StringRules
 }
 var file_policy_predefined_rules_proto_depIdxs = []int32{
-	0, // 0: policy.common_object_name_required:extendee -> buf.validate.StringRules
-	0, // 1: policy.common_object_name_optional:extendee -> buf.validate.StringRules
+	0, // 0: policy.required_object_name:extendee -> buf.validate.StringRules
+	0, // 1: policy.optional_object_name:extendee -> buf.validate.StringRules
 	2, // [2:2] is the sub-list for method output_type
 	2, // [2:2] is the sub-list for method input_type
 	2, // [2:2] is the sub-list for extension type_name
diff --git a/service/policy/actions/actions.proto b/service/policy/actions/actions.proto
index 72cbc2410b..fd7f898596 100644
--- a/service/policy/actions/actions.proto
+++ b/service/policy/actions/actions.proto
@@ -17,7 +17,7 @@ message GetActionRequest {
   oneof identifier {
     option (buf.validate.oneof).required = true;
     string id = 1 [(buf.validate.field).string.uuid = true];
-    string name = 2 [(buf.validate.field).string.(common_object_name_optional) = true];
+    string name = 2 [(buf.validate.field).string.(optional_object_name) = true];
   }
 }
 message GetActionResponse {
@@ -42,7 +42,7 @@ message ListActionsResponse {
 // Creation of Standard actions is not supported.
 message CreateActionRequest {
   // Required
-  string name = 1 [(buf.validate.field).string.(common_object_name_required) = true];
+  string name = 1 [(buf.validate.field).string.(required_object_name) = true];
 
   // Optional
   common.MetadataMutable metadata = 100;
@@ -59,7 +59,7 @@ message UpdateActionRequest {
 
   // Optional
   // Custom actions only: replaces the existing action name
-  string name = 2 [(buf.validate.field).string.(common_object_name_optional) = true];
+  string name = 2 [(buf.validate.field).string.(optional_object_name) = true];
 
   // Common metadata
   common.MetadataMutable metadata = 100;
diff --git a/service/policy/predefined_rules.proto b/service/policy/predefined_rules.proto
index f715ebedea..ad94c9a1db 100644
--- a/service/policy/predefined_rules.proto
+++ b/service/policy/predefined_rules.proto
@@ -5,8 +5,8 @@ package policy;
 import "buf/validate/validate.proto";
 
 extend buf.validate.StringRules {
-  optional bool common_object_name_required = 80048952 [(buf.validate.predefined).cel = {
-    id: "string.common_object_name_required"
+  optional bool required_object_name = 80048952 [(buf.validate.predefined).cel = {
+    id: "string.required_object_name"
     message:
       "Field is required, alphanumeric, optionally including "
       "underscores and dashes but not preceding or trailing, "
@@ -14,8 +14,8 @@ extend buf.validate.StringRules {
       "Stored field value will be normalized to lower case."
     expression: "size(this) > 0 && size(this) < 254 && this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$')"
   }];
-  optional bool common_object_name_optional = 80048953 [(buf.validate.predefined).cel = {
-    id: "string.common_object_name_optional"
+  optional bool optional_object_name = 80048953 [(buf.validate.predefined).cel = {
+    id: "string.optional_object_name"
     message:
       "Field is optional, and if provided, alphanumeric, allowing "
       "underscores and dashes but not preceding or trailing, and "

From d0dd4602a351379c5df00037dc9a8a32c9b75b39 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 11 Apr 2025 14:09:27 -0700
Subject: [PATCH 064/110] defunct test case

---
 service/integration/subject_mappings_test.go | 1 -
 1 file changed, 1 deletion(-)

diff --git a/service/integration/subject_mappings_test.go b/service/integration/subject_mappings_test.go
index f40c64cf00..4b498ab13a 100644
--- a/service/integration/subject_mappings_test.go
+++ b/service/integration/subject_mappings_test.go
@@ -105,7 +105,6 @@ func (s *SubjectMappingsSuite) TestCreateSubjectMapping_ExistingSubjectCondition
 	s.Equal(newSubjectMapping.GetAttributeValueId(), sm.GetAttributeValue().GetId())
 	s.Equal(newSubjectMapping.GetExistingSubjectConditionSetId(), sm.GetSubjectConditionSet().GetId())
 	s.Len(sm.GetActions(), 2)
-	s.Equal(sm.GetActions(), newSubjectMapping.GetActions())
 }
 
 func (s *SubjectMappingsSuite) TestCreateSubjectMapping_NewSubjectConditionSet() {

From 98df67c7311fbdce6ac5d61727632b1a87af788f Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 11 Apr 2025 14:11:05 -0700
Subject: [PATCH 065/110] rm extraneous comment

---
 service/kas/access/accessPdp.go | 1 -
 1 file changed, 1 deletion(-)

diff --git a/service/kas/access/accessPdp.go b/service/kas/access/accessPdp.go
index 81d47abfdd..8bdfb87e7b 100644
--- a/service/kas/access/accessPdp.go
+++ b/service/kas/access/accessPdp.go
@@ -64,7 +64,6 @@ func (p *Provider) checkAttributes(ctx context.Context, ras []*authorization.Res
 		DecisionRequests: []*authorization.TokenDecisionRequest{
 			{
 				Actions: []*policy.Action{
-					// TODO: actions should come from the request and not be hardcoded
 					{Value: &policy.Action_Standard{Standard: policy.Action_STANDARD_ACTION_DECRYPT}},
 				},
 				Tokens:             []*authorization.Token{ent},

From 279aa1ebe9989512fe6abd5d800e96c69eb04cc2 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 11 Apr 2025 14:13:15 -0700
Subject: [PATCH 066/110] put back authz service logic

---
 examples/cmd/authorization.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/examples/cmd/authorization.go b/examples/cmd/authorization.go
index f401e32c9c..9d3364e21b 100644
--- a/examples/cmd/authorization.go
+++ b/examples/cmd/authorization.go
@@ -28,9 +28,9 @@ func authorizationExamples() error {
 	}
 	defer s.Close()
 
-	// request decision on "CREATE" Action
+	// request decision on "TRANSMIT" Action
 	actions := []*policy.Action{{
-		Value: &policy.Action_Standard{Standard: policy.Action_STANDARD_ACTION_DECRYPT},
+		Value: &policy.Action_Standard{Standard: policy.Action_STANDARD_ACTION_TRANSMIT},
 	}}
 
 	// model two groups of entities; user bob and user alice

From 6d992f4c343e1e2223b9d24008a20e83bfd635c4 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 11 Apr 2025 14:24:37 -0700
Subject: [PATCH 067/110] bump protovalidate

---
 protocol/go/go.mod | 4 ++--
 protocol/go/go.sum | 3 +++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/protocol/go/go.mod b/protocol/go/go.mod
index b247f7754b..e88bad7884 100644
--- a/protocol/go/go.mod
+++ b/protocol/go/go.mod
@@ -5,12 +5,12 @@ go 1.23.0
 toolchain go1.24.2
 
 require (
-	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.34.1-20240508200655-46a4cf4ba109.1
+	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-20250307204501-0409229c3780.1
 	connectrpc.com/connect v1.17.0
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0
 	google.golang.org/genproto/googleapis/api v0.0.0-20241007155032-5fefd90f89a9
 	google.golang.org/grpc v1.67.1
-	google.golang.org/protobuf v1.35.1
+	google.golang.org/protobuf v1.36.6
 )
 
 require (
diff --git a/protocol/go/go.sum b/protocol/go/go.sum
index bdeb336207..b9fda493bd 100644
--- a/protocol/go/go.sum
+++ b/protocol/go/go.sum
@@ -1,5 +1,7 @@
 buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.34.1-20240508200655-46a4cf4ba109.1 h1:LEXWFH/xZ5oOWrC3oOtHbUyBdzRWMCPpAQmKC9v05mA=
 buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.34.1-20240508200655-46a4cf4ba109.1/go.mod h1:XF+P8+RmfdufmIYpGUC+6bF7S+IlmHDEnCrO3OXaUAQ=
+buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-20250307204501-0409229c3780.1 h1:zgJPqo17m28+Lf5BW4xv3PvU20BnrmTcGYrog22lLIU=
+buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-20250307204501-0409229c3780.1/go.mod h1:avRlCjnFzl98VPaeCtJ24RrV/wwHFzB8sWXhj26+n/U=
 connectrpc.com/connect v1.17.0 h1:W0ZqMhtVzn9Zhn2yATuUokDLO5N+gIuBWMOnsQrfmZk=
 connectrpc.com/connect v1.17.0/go.mod h1:0292hj1rnx8oFrStN7cB4jjVBeqs+Yx5yDIC2prWDO8=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
@@ -25,3 +27,4 @@ google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp0
 google.golang.org/protobuf v1.34.1/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 google.golang.org/protobuf v1.35.1 h1:m3LfL6/Ca+fqnjnlqQXNpFPABW1UD7mjh8KO2mKFytA=
 google.golang.org/protobuf v1.35.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=

From 2cc0784cb84d304adaa0c6f8a893bb8450e43bc2 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 11 Apr 2025 14:26:33 -0700
Subject: [PATCH 068/110] go mod tidy

---
 protocol/go/go.sum | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/protocol/go/go.sum b/protocol/go/go.sum
index b9fda493bd..3081a28ae1 100644
--- a/protocol/go/go.sum
+++ b/protocol/go/go.sum
@@ -1,11 +1,7 @@
-buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.34.1-20240508200655-46a4cf4ba109.1 h1:LEXWFH/xZ5oOWrC3oOtHbUyBdzRWMCPpAQmKC9v05mA=
-buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.34.1-20240508200655-46a4cf4ba109.1/go.mod h1:XF+P8+RmfdufmIYpGUC+6bF7S+IlmHDEnCrO3OXaUAQ=
 buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-20250307204501-0409229c3780.1 h1:zgJPqo17m28+Lf5BW4xv3PvU20BnrmTcGYrog22lLIU=
 buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-20250307204501-0409229c3780.1/go.mod h1:avRlCjnFzl98VPaeCtJ24RrV/wwHFzB8sWXhj26+n/U=
 connectrpc.com/connect v1.17.0 h1:W0ZqMhtVzn9Zhn2yATuUokDLO5N+gIuBWMOnsQrfmZk=
 connectrpc.com/connect v1.17.0/go.mod h1:0292hj1rnx8oFrStN7cB4jjVBeqs+Yx5yDIC2prWDO8=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0 h1:asbCHRVmodnJTuQ3qamDwqVOIjwqUPTYmYuemVOx+Ys=
@@ -16,15 +12,11 @@ golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
 golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
 golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/genproto/googleapis/api v0.0.0-20241007155032-5fefd90f89a9 h1:T6rh4haD3GVYsgEfWExoCZA2o2FmbNyKpTuAxbEFPTg=
 google.golang.org/genproto/googleapis/api v0.0.0-20241007155032-5fefd90f89a9/go.mod h1:wp2WsuBYj6j8wUdo3ToZsdxxixbvQNAHqVJrTgi5E5M=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20241007155032-5fefd90f89a9 h1:QCqS/PdaHTSWGvupk2F/ehwHtGc0/GYkT+3GAcR1CCc=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20241007155032-5fefd90f89a9/go.mod h1:GX3210XPVPUjJbTUbvwI8f2IpZDMZuPJWDzDuebbviI=
 google.golang.org/grpc v1.67.1 h1:zWnc1Vrcno+lHZCOofnIMvycFcc0QRGIzm9dhnDX68E=
 google.golang.org/grpc v1.67.1/go.mod h1:1gLDyUQU7CTLJI90u3nXZ9ekeghjeM7pTDZlqFNg2AA=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.34.1/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
-google.golang.org/protobuf v1.35.1 h1:m3LfL6/Ca+fqnjnlqQXNpFPABW1UD7mjh8KO2mKFytA=
-google.golang.org/protobuf v1.35.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
 google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=

From 486f9e088a209d4b2777d7d0e78b604993bdd347 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 11 Apr 2025 14:28:29 -0700
Subject: [PATCH 069/110] bump to 1.23.4

---
 go.work            | 2 +-
 protocol/go/go.mod | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/go.work b/go.work
index a345ebf231..4247cda0bf 100644
--- a/go.work
+++ b/go.work
@@ -1,4 +1,4 @@
-go 1.23.0
+go 1.23.4
 
 toolchain go1.24.2
 
diff --git a/protocol/go/go.mod b/protocol/go/go.mod
index e88bad7884..a1e97e3b78 100644
--- a/protocol/go/go.mod
+++ b/protocol/go/go.mod
@@ -1,6 +1,6 @@
 module github.com/opentdf/platform/protocol/go
 
-go 1.23.0
+go 1.23.4
 
 toolchain go1.24.2
 

From 892f115e6838d26d3edc538956baf4dba65d6245 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 11 Apr 2025 14:30:19 -0700
Subject: [PATCH 070/110] put back protocol/go bump

---
 protocol/go/go.mod | 2 +-
 protocol/go/go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/protocol/go/go.mod b/protocol/go/go.mod
index 1394ff25a5..a1e97e3b78 100644
--- a/protocol/go/go.mod
+++ b/protocol/go/go.mod
@@ -16,6 +16,6 @@ require (
 require (
 	golang.org/x/net v0.36.0 // indirect
 	golang.org/x/sys v0.30.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
+	golang.org/x/text v0.22.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20241007155032-5fefd90f89a9 // indirect
 )
diff --git a/protocol/go/go.sum b/protocol/go/go.sum
index f44debd7e8..3081a28ae1 100644
--- a/protocol/go/go.sum
+++ b/protocol/go/go.sum
@@ -10,8 +10,8 @@ golang.org/x/net v0.36.0 h1:vWF2fRbw4qslQsQzgFqZff+BItCvGFQqKzKIzx1rmoA=
 golang.org/x/net v0.36.0/go.mod h1:bFmbeoIPfrw4sMHNhb4J9f6+tPziuGjq7Jk/38fxi1I=
 golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
 golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
-golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
+golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
 google.golang.org/genproto/googleapis/api v0.0.0-20241007155032-5fefd90f89a9 h1:T6rh4haD3GVYsgEfWExoCZA2o2FmbNyKpTuAxbEFPTg=
 google.golang.org/genproto/googleapis/api v0.0.0-20241007155032-5fefd90f89a9/go.mod h1:wp2WsuBYj6j8wUdo3ToZsdxxixbvQNAHqVJrTgi5E5M=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20241007155032-5fefd90f89a9 h1:QCqS/PdaHTSWGvupk2F/ehwHtGc0/GYkT+3GAcR1CCc=

From 894455bf87540ce0b4d91b53fd08f492b7c01da7 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 11 Apr 2025 14:32:10 -0700
Subject: [PATCH 071/110] fix unit tests

---
 service/policy/actions/actions_test.go | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/service/policy/actions/actions_test.go b/service/policy/actions/actions_test.go
index 5983f1ddda..2a8d76145d 100644
--- a/service/policy/actions/actions_test.go
+++ b/service/policy/actions/actions_test.go
@@ -12,12 +12,12 @@ import (
 )
 
 const (
-	validUUID                          = "00000000-0000-0000-0000-000000000000"
-	errMessageUUID                     = "string.uuid"
-	errMessageActionNameFormatRequired = "common_object_name_required"
-	errMessageActionNameFormatOptional = "common_object_name_optional"
-	errMessageURI                      = "string.uri"
-	errMessageRequired                 = "required"
+	validUUID                    = "00000000-0000-0000-0000-000000000000"
+	errMessageUUID               = "string.uuid"
+	errMessageRequiredObjectName = "string.required_object_name"
+	errMessageOptionalObjectName = "string.optional_object_name"
+	errMessageURI                = "string.uri"
+	errMessageRequired           = "required"
 )
 
 var (
@@ -66,7 +66,7 @@ func (s *ActionSuite) Test_CreateActionRequest_Fails() {
 			}
 			err := s.v.Validate(req)
 			s.Require().Error(err)
-			s.Require().Contains(err.Error(), errMessageActionNameFormatRequired)
+			s.Require().Contains(err.Error(), errMessageRequiredObjectName)
 		})
 	}
 
@@ -76,7 +76,7 @@ func (s *ActionSuite) Test_CreateActionRequest_Fails() {
 	}
 	err := s.v.Validate(req)
 	s.Require().Error(err)
-	s.Require().Contains(err.Error(), errMessageActionNameFormatRequired)
+	s.Require().Contains(err.Error(), errMessageRequiredObjectName)
 }
 
 func (s *ActionSuite) Test_CreateActionRequest_Succeeds() {
@@ -147,7 +147,7 @@ func (s *ActionSuite) Test_GetAction_Fails() {
 			}
 			err := s.v.Validate(req)
 			s.Require().Error(err)
-			s.Require().Contains(err.Error(), errMessageActionNameFormatOptional)
+			s.Require().Contains(err.Error(), errMessageOptionalObjectName)
 		})
 	}
 }
@@ -212,7 +212,7 @@ func (s *ActionSuite) Test_UpdateActionRequest_Fails() {
 			}
 			err := s.v.Validate(req)
 			s.Require().Error(err)
-			s.Require().Contains(err.Error(), errMessageActionNameFormatOptional)
+			s.Require().Contains(err.Error(), errMessageOptionalObjectName)
 		})
 	}
 }

From 03a9a0d91fbc814bb0cfbd7e550a0e2e5aa209f4 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 11 Apr 2025 14:40:19 -0700
Subject: [PATCH 072/110] bump proto-validate in service package to be
 compatible with CI

---
 service/go.mod                                | 20 ++++++++++---------
 service/go.sum                                | 16 +++++++++++++++
 service/policy/attributes/attributes_test.go  |  2 +-
 .../key_access_server_registry_test.go        |  2 +-
 service/policy/namespaces/namespaces_test.go  |  2 +-
 .../resourcemapping/resource_mapping_test.go  |  2 +-
 .../subjectmapping/subject_mapping_test.go    |  2 +-
 service/policy/unsafe/unsafe_test.go          |  2 +-
 8 files changed, 33 insertions(+), 15 deletions(-)

diff --git a/service/go.mod b/service/go.mod
index df9cd4dda1..4ede801c2c 100644
--- a/service/go.mod
+++ b/service/go.mod
@@ -1,6 +1,6 @@
 module github.com/opentdf/platform/service
 
-go 1.23.0
+go 1.23.4
 
 toolchain go1.24.2
 
@@ -12,7 +12,7 @@ require (
 	github.com/Masterminds/squirrel v1.5.4
 	github.com/Nerzal/gocloak/v13 v13.9.0
 	github.com/bmatcuk/doublestar v1.3.4
-	github.com/bufbuild/protovalidate-go v0.6.0
+	github.com/bufbuild/protovalidate-go v0.9.3
 	github.com/casbin/casbin/v2 v2.101.0
 	github.com/creasty/defaults v1.7.0
 	github.com/docker/docker v27.1.1+incompatible
@@ -34,7 +34,7 @@ require (
 	github.com/pressly/goose/v3 v3.19.1
 	github.com/spf13/cobra v1.8.1
 	github.com/spf13/viper v1.18.2
-	github.com/stretchr/testify v1.9.0
+	github.com/stretchr/testify v1.10.0
 	github.com/testcontainers/testcontainers-go v0.34.0
 	go.opentelemetry.io/otel v1.31.0
 	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.31.0
@@ -42,14 +42,16 @@ require (
 	go.opentelemetry.io/otel/trace v1.31.0
 	golang.org/x/net v0.36.0
 	google.golang.org/grpc v1.67.1
-	google.golang.org/protobuf v1.35.2
+	google.golang.org/protobuf v1.36.6
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
+require cel.dev/expr v0.19.1 // indirect
+
 require (
-	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.34.1-20240508200655-46a4cf4ba109.1 // indirect
+	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-20250307204501-0409229c3780.1 // indirect
 	dario.cat/mergo v1.0.0 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect; indi\
@@ -85,7 +87,7 @@ require (
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
 	github.com/golang/mock v1.6.0 // indirect
-	github.com/google/cel-go v0.20.1 // indirect
+	github.com/google/cel-go v0.24.1 // indirect
 	github.com/google/flatbuffers v23.5.26+incompatible // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/gowebpki/jcs v1.0.1 // indirect
@@ -155,11 +157,11 @@ require (
 	go.opentelemetry.io/otel/metric v1.31.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/crypto v0.35.0 // indirect
-	golang.org/x/exp v0.0.0-20240222234643-814bf88cf225 // indirect
+	golang.org/x/exp v0.0.0-20240325151524-a685a6edb6d8 // indirect
 	golang.org/x/oauth2 v0.22.0 // indirect
-	golang.org/x/sync v0.11.0 // indirect
+	golang.org/x/sync v0.12.0 // indirect
 	golang.org/x/sys v0.30.0 // indirect
-	golang.org/x/text v0.22.0 // indirect
+	golang.org/x/text v0.23.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20241007155032-5fefd90f89a9 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20241007155032-5fefd90f89a9 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
diff --git a/service/go.sum b/service/go.sum
index ff1f614593..7599dec88a 100644
--- a/service/go.sum
+++ b/service/go.sum
@@ -1,5 +1,9 @@
 buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.34.1-20240508200655-46a4cf4ba109.1 h1:LEXWFH/xZ5oOWrC3oOtHbUyBdzRWMCPpAQmKC9v05mA=
 buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.34.1-20240508200655-46a4cf4ba109.1/go.mod h1:XF+P8+RmfdufmIYpGUC+6bF7S+IlmHDEnCrO3OXaUAQ=
+buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-20250307204501-0409229c3780.1 h1:zgJPqo17m28+Lf5BW4xv3PvU20BnrmTcGYrog22lLIU=
+buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-20250307204501-0409229c3780.1/go.mod h1:avRlCjnFzl98VPaeCtJ24RrV/wwHFzB8sWXhj26+n/U=
+cel.dev/expr v0.19.1 h1:NciYrtDRIR0lNCnH1LFJegdjspNx9fI59O7TWcua/W4=
+cel.dev/expr v0.19.1/go.mod h1:MrpN08Q+lEBs+bGYdLxxHkZoUSsCp0nSKTs0nTymJgw=
 connectrpc.com/connect v1.17.0 h1:W0ZqMhtVzn9Zhn2yATuUokDLO5N+gIuBWMOnsQrfmZk=
 connectrpc.com/connect v1.17.0/go.mod h1:0292hj1rnx8oFrStN7cB4jjVBeqs+Yx5yDIC2prWDO8=
 connectrpc.com/grpchealth v1.3.0 h1:FA3OIwAvuMokQIXQrY5LbIy8IenftksTP/lG4PbYN+E=
@@ -46,6 +50,8 @@ github.com/bmatcuk/doublestar/v4 v4.6.1 h1:FH9SifrbvJhnlQpztAx++wlkk70QBf0iBWDwN
 github.com/bmatcuk/doublestar/v4 v4.6.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/bufbuild/protovalidate-go v0.6.0 h1:Jgs1kFuZ2LHvvdj8SpCLA1W/+pXS8QSM3F/E2l3InPY=
 github.com/bufbuild/protovalidate-go v0.6.0/go.mod h1:1LamgoYHZ2NdIQH0XGczGTc6Z8YrTHjcJVmiBaar4t4=
+github.com/bufbuild/protovalidate-go v0.9.3 h1:XvdtwQuppS3wjzGfpOirsqwN5ExH2+PiIuA/XZd3MTM=
+github.com/bufbuild/protovalidate-go v0.9.3/go.mod h1:2lUDP6fNd3wxznRNH3Nj64VB07+PySeslamkerwP6tE=
 github.com/bytecodealliance/wasmtime-go/v3 v3.0.2 h1:3uZCA/BLTIu+DqCfguByNMJa2HVHpXvjfy0Dy7g6fuA=
 github.com/bytecodealliance/wasmtime-go/v3 v3.0.2/go.mod h1:RnUjnIXxEJcL6BgCvNyzCCRzZcxCgsZCi+RNlvYor5Q=
 github.com/casbin/casbin/v2 v2.101.0 h1:y8qZRXcgv5omd3k/7kpaP03Hov82sXzCC5FAfm17lkw=
@@ -166,6 +172,8 @@ github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
 github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/google/cel-go v0.20.1 h1:nDx9r8S3L4pE61eDdt8igGj8rf5kjYR3ILxWIpWNi84=
 github.com/google/cel-go v0.20.1/go.mod h1:kWcIzTsPX0zmQ+H3TirHstLLf9ep5QTsZBN9u4dOYLg=
+github.com/google/cel-go v0.24.1 h1:jsBCtxG8mM5wiUJDSGUqU0K7Mtr3w7Eyv00rw4DiZxI=
+github.com/google/cel-go v0.24.1/go.mod h1:Hdf9TqOaTNSFQA1ybQaRqATVoK7m/zcf7IMhGXP5zI8=
 github.com/google/flatbuffers v23.5.26+incompatible h1:M9dgRyhJemaM4Sw8+66GHBu8ioaQmyPLg1b8VwK5WJg=
 github.com/google/flatbuffers v23.5.26+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
@@ -366,6 +374,7 @@ github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
 github.com/tchap/go-patricia/v2 v2.3.1 h1:6rQp39lgIYZ+MHmdEq4xzuk1t7OdC35z/xm0BGhTkes=
@@ -433,6 +442,8 @@ golang.org/x/crypto v0.35.0 h1:b15kiHdrGCHrP6LvwaQ3c03kgNhhiMgvlhxHQhmg2Xs=
 golang.org/x/crypto v0.35.0/go.mod h1:dy7dXNW32cAb/6/PRuTNsix8T+vJAqvuIy5Bli/x0YQ=
 golang.org/x/exp v0.0.0-20240222234643-814bf88cf225 h1:LfspQV/FYTatPTr/3HzIcmiUFH7PGP+OQ6mgDYo3yuQ=
 golang.org/x/exp v0.0.0-20240222234643-814bf88cf225/go.mod h1:CxmFvTBINI24O/j8iY7H1xHzx2i4OsyguNBmN/uPtqc=
+golang.org/x/exp v0.0.0-20240325151524-a685a6edb6d8 h1:aAcj0Da7eBAtrTp03QXWvm88pSyOt+UgdZw2BFZ+lEw=
+golang.org/x/exp v0.0.0-20240325151524-a685a6edb6d8/go.mod h1:CQ1k9gNrJ50XIzaKCRR2hssIjF07kZFEiieALBM/ARQ=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -464,6 +475,7 @@ golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
 golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -501,6 +513,8 @@ golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
 golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
+golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
+golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
 golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/time v0.6.0 h1:eTDhh4ZXt5Qf0augr54TN6suAUudPcawVZeIAPU7D4U=
 golang.org/x/time v0.6.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
@@ -528,6 +542,8 @@ google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp0
 google.golang.org/protobuf v1.34.1/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 google.golang.org/protobuf v1.35.2 h1:8Ar7bF+apOIoThw1EdZl0p1oWvMqTHmpA2fRTyZO8io=
 google.golang.org/protobuf v1.35.2/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
+google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
diff --git a/service/policy/attributes/attributes_test.go b/service/policy/attributes/attributes_test.go
index 075678bcaf..7cdae74df1 100644
--- a/service/policy/attributes/attributes_test.go
+++ b/service/policy/attributes/attributes_test.go
@@ -11,7 +11,7 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func getValidator() *protovalidate.Validator {
+func getValidator() protovalidate.Validator {
 	v, err := protovalidate.New()
 	if err != nil {
 		panic(err)
diff --git a/service/policy/kasregistry/key_access_server_registry_test.go b/service/policy/kasregistry/key_access_server_registry_test.go
index 602cfb9abc..167744ee18 100644
--- a/service/policy/kasregistry/key_access_server_registry_test.go
+++ b/service/policy/kasregistry/key_access_server_registry_test.go
@@ -10,7 +10,7 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func getValidator() *protovalidate.Validator {
+func getValidator() protovalidate.Validator {
 	v, err := protovalidate.New()
 	if err != nil {
 		panic(err)
diff --git a/service/policy/namespaces/namespaces_test.go b/service/policy/namespaces/namespaces_test.go
index adce58a5ea..8ac16d3e18 100644
--- a/service/policy/namespaces/namespaces_test.go
+++ b/service/policy/namespaces/namespaces_test.go
@@ -19,7 +19,7 @@ const (
 	errExclusiveFields = "exclusive_fields"
 )
 
-func getValidator() *protovalidate.Validator {
+func getValidator() protovalidate.Validator {
 	v, err := protovalidate.New()
 	if err != nil {
 		panic(err)
diff --git a/service/policy/resourcemapping/resource_mapping_test.go b/service/policy/resourcemapping/resource_mapping_test.go
index 81efcd3b88..a2fba3bd2b 100644
--- a/service/policy/resourcemapping/resource_mapping_test.go
+++ b/service/policy/resourcemapping/resource_mapping_test.go
@@ -48,7 +48,7 @@ var (
 	}
 )
 
-func getValidator() *protovalidate.Validator {
+func getValidator() protovalidate.Validator {
 	v, err := protovalidate.New()
 	if err != nil {
 		panic(err)
diff --git a/service/policy/subjectmapping/subject_mapping_test.go b/service/policy/subjectmapping/subject_mapping_test.go
index 659b069710..b9dede79bf 100644
--- a/service/policy/subjectmapping/subject_mapping_test.go
+++ b/service/policy/subjectmapping/subject_mapping_test.go
@@ -9,7 +9,7 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func getValidator() *protovalidate.Validator {
+func getValidator() protovalidate.Validator {
 	v, err := protovalidate.New()
 	if err != nil {
 		panic(err)
diff --git a/service/policy/unsafe/unsafe_test.go b/service/policy/unsafe/unsafe_test.go
index 8e7d59bcbe..b5f0459aa7 100644
--- a/service/policy/unsafe/unsafe_test.go
+++ b/service/policy/unsafe/unsafe_test.go
@@ -13,7 +13,7 @@ var (
 	validUUID      = "00000000-0000-0000-0000-000000000000"
 )
 
-func getValidator() *protovalidate.Validator {
+func getValidator() protovalidate.Validator {
 	v, err := protovalidate.New()
 	if err != nil {
 		panic(err)

From c38d722404deea700e0f867f17df82cdb644984b Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 11 Apr 2025 14:41:44 -0700
Subject: [PATCH 073/110] go mod tidy

---
 service/go.sum | 26 ++++----------------------
 1 file changed, 4 insertions(+), 22 deletions(-)

diff --git a/service/go.sum b/service/go.sum
index 7599dec88a..73ce2b7659 100644
--- a/service/go.sum
+++ b/service/go.sum
@@ -1,5 +1,3 @@
-buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.34.1-20240508200655-46a4cf4ba109.1 h1:LEXWFH/xZ5oOWrC3oOtHbUyBdzRWMCPpAQmKC9v05mA=
-buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.34.1-20240508200655-46a4cf4ba109.1/go.mod h1:XF+P8+RmfdufmIYpGUC+6bF7S+IlmHDEnCrO3OXaUAQ=
 buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-20250307204501-0409229c3780.1 h1:zgJPqo17m28+Lf5BW4xv3PvU20BnrmTcGYrog22lLIU=
 buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-20250307204501-0409229c3780.1/go.mod h1:avRlCjnFzl98VPaeCtJ24RrV/wwHFzB8sWXhj26+n/U=
 cel.dev/expr v0.19.1 h1:NciYrtDRIR0lNCnH1LFJegdjspNx9fI59O7TWcua/W4=
@@ -48,8 +46,6 @@ github.com/bmatcuk/doublestar v1.3.4 h1:gPypJ5xD31uhX6Tf54sDPUOBXTqKH4c9aPY66CyQ
 github.com/bmatcuk/doublestar v1.3.4/go.mod h1:wiQtGV+rzVYxB7WIlirSN++5HPtPlXEo9MEoZQC/PmE=
 github.com/bmatcuk/doublestar/v4 v4.6.1 h1:FH9SifrbvJhnlQpztAx++wlkk70QBf0iBWDwNy7PA4I=
 github.com/bmatcuk/doublestar/v4 v4.6.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
-github.com/bufbuild/protovalidate-go v0.6.0 h1:Jgs1kFuZ2LHvvdj8SpCLA1W/+pXS8QSM3F/E2l3InPY=
-github.com/bufbuild/protovalidate-go v0.6.0/go.mod h1:1LamgoYHZ2NdIQH0XGczGTc6Z8YrTHjcJVmiBaar4t4=
 github.com/bufbuild/protovalidate-go v0.9.3 h1:XvdtwQuppS3wjzGfpOirsqwN5ExH2+PiIuA/XZd3MTM=
 github.com/bufbuild/protovalidate-go v0.9.3/go.mod h1:2lUDP6fNd3wxznRNH3Nj64VB07+PySeslamkerwP6tE=
 github.com/bytecodealliance/wasmtime-go/v3 v3.0.2 h1:3uZCA/BLTIu+DqCfguByNMJa2HVHpXvjfy0Dy7g6fuA=
@@ -107,8 +103,8 @@ github.com/elastic/go-sysinfo v1.11.2 h1:mcm4OSYVMyws6+n2HIVMGkln5HOpo5Ie1ZmbbNn
 github.com/elastic/go-sysinfo v1.11.2/go.mod h1:GKqR8bbMK/1ITnez9NIsIfXQr25aLhRJa7AfT8HpBFQ=
 github.com/elastic/go-windows v1.0.1 h1:AlYZOldA+UJ0/2nBuqWdo90GFCgG9xuyw9SYzGUtJm0=
 github.com/elastic/go-windows v1.0.1/go.mod h1:FoVvqWSun28vaDQPbj2Elfc0JahhPB7WQEGa3c814Ss=
-github.com/envoyproxy/protoc-gen-validate v1.1.0 h1:tntQDh69XqOCOZsDz0lVJQez/2L6Uu2PdjCQwWCJ3bM=
-github.com/envoyproxy/protoc-gen-validate v1.1.0/go.mod h1:sXRDRVmzEbkM7CVcM06s9shE/m23dg3wzjl0UWqJ2q4=
+github.com/envoyproxy/protoc-gen-validate v1.2.1 h1:DEo3O99U8j4hBFwbJfrz9VtgcDfUKS7KJ7spH3d86P8=
+github.com/envoyproxy/protoc-gen-validate v1.2.1/go.mod h1:d/C80l/jxXLdfEIhX1W2TmLfsJ31lvEjwamM4DxlWXU=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8vw=
@@ -165,18 +161,14 @@ github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4er
 github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
 github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc=
 github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
 github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
-github.com/google/cel-go v0.20.1 h1:nDx9r8S3L4pE61eDdt8igGj8rf5kjYR3ILxWIpWNi84=
-github.com/google/cel-go v0.20.1/go.mod h1:kWcIzTsPX0zmQ+H3TirHstLLf9ep5QTsZBN9u4dOYLg=
 github.com/google/cel-go v0.24.1 h1:jsBCtxG8mM5wiUJDSGUqU0K7Mtr3w7Eyv00rw4DiZxI=
 github.com/google/cel-go v0.24.1/go.mod h1:Hdf9TqOaTNSFQA1ybQaRqATVoK7m/zcf7IMhGXP5zI8=
 github.com/google/flatbuffers v23.5.26+incompatible h1:M9dgRyhJemaM4Sw8+66GHBu8ioaQmyPLg1b8VwK5WJg=
 github.com/google/flatbuffers v23.5.26+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
@@ -372,8 +364,7 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
-github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
@@ -440,8 +431,6 @@ golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDf
 golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
 golang.org/x/crypto v0.35.0 h1:b15kiHdrGCHrP6LvwaQ3c03kgNhhiMgvlhxHQhmg2Xs=
 golang.org/x/crypto v0.35.0/go.mod h1:dy7dXNW32cAb/6/PRuTNsix8T+vJAqvuIy5Bli/x0YQ=
-golang.org/x/exp v0.0.0-20240222234643-814bf88cf225 h1:LfspQV/FYTatPTr/3HzIcmiUFH7PGP+OQ6mgDYo3yuQ=
-golang.org/x/exp v0.0.0-20240222234643-814bf88cf225/go.mod h1:CxmFvTBINI24O/j8iY7H1xHzx2i4OsyguNBmN/uPtqc=
 golang.org/x/exp v0.0.0-20240325151524-a685a6edb6d8 h1:aAcj0Da7eBAtrTp03QXWvm88pSyOt+UgdZw2BFZ+lEw=
 golang.org/x/exp v0.0.0-20240325151524-a685a6edb6d8/go.mod h1:CQ1k9gNrJ50XIzaKCRR2hssIjF07kZFEiieALBM/ARQ=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -473,8 +462,7 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
-golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
 golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -511,8 +499,6 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
-golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
 golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
 golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
 golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
@@ -538,10 +524,6 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20241007155032-5fefd90f89a9 h1:
 google.golang.org/genproto/googleapis/rpc v0.0.0-20241007155032-5fefd90f89a9/go.mod h1:GX3210XPVPUjJbTUbvwI8f2IpZDMZuPJWDzDuebbviI=
 google.golang.org/grpc v1.67.1 h1:zWnc1Vrcno+lHZCOofnIMvycFcc0QRGIzm9dhnDX68E=
 google.golang.org/grpc v1.67.1/go.mod h1:1gLDyUQU7CTLJI90u3nXZ9ekeghjeM7pTDZlqFNg2AA=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.34.1/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
-google.golang.org/protobuf v1.35.2 h1:8Ar7bF+apOIoThw1EdZl0p1oWvMqTHmpA2fRTyZO8io=
-google.golang.org/protobuf v1.35.2/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
 google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

From c9a0eef73131fcf4ed91cca3573e363f1c177b8f Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 11 Apr 2025 14:43:24 -0700
Subject: [PATCH 074/110] bump connect dep as well

---
 service/go.mod | 2 +-
 service/go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/service/go.mod b/service/go.mod
index 4ede801c2c..2d07baddfd 100644
--- a/service/go.mod
+++ b/service/go.mod
@@ -5,7 +5,7 @@ go 1.23.4
 toolchain go1.24.2
 
 require (
-	connectrpc.com/connect v1.17.0
+	connectrpc.com/connect v1.18.1
 	connectrpc.com/grpchealth v1.3.0
 	connectrpc.com/grpcreflect v1.2.0
 	connectrpc.com/validate v0.1.0
diff --git a/service/go.sum b/service/go.sum
index 73ce2b7659..19d64ddff5 100644
--- a/service/go.sum
+++ b/service/go.sum
@@ -2,8 +2,8 @@ buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-2025030720450
 buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-20250307204501-0409229c3780.1/go.mod h1:avRlCjnFzl98VPaeCtJ24RrV/wwHFzB8sWXhj26+n/U=
 cel.dev/expr v0.19.1 h1:NciYrtDRIR0lNCnH1LFJegdjspNx9fI59O7TWcua/W4=
 cel.dev/expr v0.19.1/go.mod h1:MrpN08Q+lEBs+bGYdLxxHkZoUSsCp0nSKTs0nTymJgw=
-connectrpc.com/connect v1.17.0 h1:W0ZqMhtVzn9Zhn2yATuUokDLO5N+gIuBWMOnsQrfmZk=
-connectrpc.com/connect v1.17.0/go.mod h1:0292hj1rnx8oFrStN7cB4jjVBeqs+Yx5yDIC2prWDO8=
+connectrpc.com/connect v1.18.1 h1:PAg7CjSAGvscaf6YZKUefjoih5Z/qYkyaTrBW8xvYPw=
+connectrpc.com/connect v1.18.1/go.mod h1:0292hj1rnx8oFrStN7cB4jjVBeqs+Yx5yDIC2prWDO8=
 connectrpc.com/grpchealth v1.3.0 h1:FA3OIwAvuMokQIXQrY5LbIy8IenftksTP/lG4PbYN+E=
 connectrpc.com/grpchealth v1.3.0/go.mod h1:3vpqmX25/ir0gVgW6RdnCPPZRcR6HvqtXX5RNPmDXHM=
 connectrpc.com/grpcreflect v1.2.0 h1:Q6og1S7HinmtbEuBvARLNwYmTbhEGRpHDhqrPNlmK+U=

From 48121d2ff7e8f4f8792e3c0fd1ffd1918b56c30d Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Fri, 11 Apr 2025 14:50:58 -0700
Subject: [PATCH 075/110] trigger CI

---
 service/policy/actions/actions.proto | 1 +
 1 file changed, 1 insertion(+)

diff --git a/service/policy/actions/actions.proto b/service/policy/actions/actions.proto
index fd7f898596..fd8167a9a5 100644
--- a/service/policy/actions/actions.proto
+++ b/service/policy/actions/actions.proto
@@ -3,6 +3,7 @@ syntax = "proto3";
 package policy.actions;
 
 import "buf/validate/validate.proto";
+
 import "common/common.proto";
 import "policy/objects.proto";
 import "policy/predefined_rules.proto";

From 7a55a40cd10a71b2849cee55bc11b0f6782b79bf Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 14 Apr 2025 11:03:42 -0700
Subject: [PATCH 076/110] test replacement with protocol/go containing proto
 validations

---
 service/go.mod | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/service/go.mod b/service/go.mod
index fc2bc8e37d..2908830bf8 100644
--- a/service/go.mod
+++ b/service/go.mod
@@ -4,6 +4,8 @@ go 1.24.0
 
 toolchain go1.24.2
 
+replace github.com/opentdf/platform/protocol/go => github.com/opentdf/platform/protocol/go v0.2.30-0.20250414175837-aa99448e080a
+
 require (
 	connectrpc.com/connect v1.18.1
 	connectrpc.com/grpchealth v1.3.0

From 18a5f989e3036fd63523f00c0fa4a006d49085e3 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 14 Apr 2025 11:10:21 -0700
Subject: [PATCH 077/110] service should follow policy patterns with config
 update hooks

---
 service/policy/actions/actions.go | 39 ++++++++++++++++++++++++++-----
 1 file changed, 33 insertions(+), 6 deletions(-)

diff --git a/service/policy/actions/actions.go b/service/policy/actions/actions.go
index 418dd6e8bb..208c4d1797 100644
--- a/service/policy/actions/actions.go
+++ b/service/policy/actions/actions.go
@@ -3,11 +3,14 @@ package actions
 import (
 	"context"
 	"errors"
+	"fmt"
+	"log/slog"
 
 	"connectrpc.com/connect"
 	"github.com/opentdf/platform/protocol/go/policy/actions"
 	"github.com/opentdf/platform/protocol/go/policy/actions/actionsconnect"
 	"github.com/opentdf/platform/service/logger"
+	"github.com/opentdf/platform/service/pkg/config"
 	"github.com/opentdf/platform/service/pkg/serviceregistry"
 
 	policyconfig "github.com/opentdf/platform/service/policy/config"
@@ -20,20 +23,44 @@ type ActionsService struct { //nolint:revive // ActionsService is a valid name f
 	config   *policyconfig.Config
 }
 
+func OnConfigUpdate(actionsSvc *ActionsService) serviceregistry.OnConfigUpdateHook {
+	return func(_ context.Context, cfg config.ServiceConfig) error {
+		sharedCfg, err := policyconfig.GetSharedPolicyConfig(cfg)
+		if err != nil {
+			return fmt.Errorf("failed to get shared policy config: %w", err)
+		}
+		actionsSvc.config = sharedCfg
+		actionsSvc.dbClient = policydb.NewClient(actionsSvc.dbClient.Client, actionsSvc.logger, int32(sharedCfg.ListRequestLimitMax), int32(sharedCfg.ListRequestLimitDefault))
+
+		actionsSvc.logger.Info("actions service config reloaded")
+
+		return nil
+	}
+}
+
 func NewRegistration(ns string, dbRegister serviceregistry.DBRegister) *serviceregistry.Service[actionsconnect.ActionServiceHandler] {
+	actionsSvc := new(ActionsService)
+	onUpdateConfigHook := OnConfigUpdate(actionsSvc)
+
 	return &serviceregistry.Service[actionsconnect.ActionServiceHandler]{
 		ServiceOptions: serviceregistry.ServiceOptions[actionsconnect.ActionServiceHandler]{
 			Namespace:      ns,
 			DB:             dbRegister,
 			ServiceDesc:    &actions.ActionService_ServiceDesc,
 			ConnectRPCFunc: actionsconnect.NewActionServiceHandler,
+			OnConfigUpdate: onUpdateConfigHook,
 			RegisterFunc: func(srp serviceregistry.RegistrationParams) (actionsconnect.ActionServiceHandler, serviceregistry.HandlerServer) {
-				cfg := policyconfig.GetSharedPolicyConfig(srp)
-				return &ActionsService{
-					dbClient: policydb.NewClient(srp.DBClient, srp.Logger, int32(cfg.ListRequestLimitMax), int32(cfg.ListRequestLimitDefault)),
-					logger:   srp.Logger,
-					config:   cfg,
-				}, nil
+				logger := srp.Logger
+				cfg, err := policyconfig.GetSharedPolicyConfig(srp.Config)
+				if err != nil {
+					logger.Error("error getting actions service policy config", slog.String("error", err.Error()))
+					panic(err)
+				}
+
+				actionsSvc.logger = logger
+				actionsSvc.config = cfg
+				actionsSvc.dbClient = policydb.NewClient(srp.DBClient, logger, int32(cfg.ListRequestLimitMax), int32(cfg.ListRequestLimitDefault))
+				return actionsSvc, nil
 			},
 		},
 	}

From a59898949ccd105f24320aa736c66871060d46fd Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 14 Apr 2025 15:19:42 -0700
Subject: [PATCH 078/110] fix(policy): remove predefined rules in actions
 protos

---
 docs/grpc/index.html                          |  59 -----
 .../policy/predefined_rules.swagger.json      |  46 ----
 protocol/go/policy/actions/actions.pb.go      | 249 +++++++++++-------
 protocol/go/policy/predefined_rules.pb.go     | 160 -----------
 service/policy/actions/actions.proto          |  30 ++-
 service/policy/predefined_rules.proto         |  26 --
 6 files changed, 173 insertions(+), 397 deletions(-)
 delete mode 100644 docs/openapi/policy/predefined_rules.swagger.json
 delete mode 100644 protocol/go/policy/predefined_rules.pb.go
 delete mode 100644 service/policy/predefined_rules.proto

diff --git a/docs/grpc/index.html b/docs/grpc/index.html
index 9905bf9dda..d448c9ecb4 100644
--- a/docs/grpc/index.html
+++ b/docs/grpc/index.html
@@ -513,25 +513,6 @@ <h2>Table of Contents</h2>
           </li>
         
           
-          <li>
-            <a href="#policy%2fpredefined_rules.proto">policy/predefined_rules.proto</a>
-            <ul>
-              
-              
-              
-                <li>
-                  <a href="#policy%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
-                </li>
-              
-                <li>
-                  <a href="#policy%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
-                </li>
-              
-              
-            </ul>
-          </li>
-        
-          
           <li>
             <a href="#policy%2fselectors.proto">policy/selectors.proto</a>
             <ul>
@@ -4343,46 +4324,6 @@ <h4>Methods with idempotency_level option</h4>
         
     
       
-      <div class="file-heading">
-        <h2 id="policy/predefined_rules.proto">policy/predefined_rules.proto</h2><a href="#title">Top</a>
-      </div>
-      <p></p>
-
-      
-
-      
-
-      
-        <h3 id="policy/predefined_rules.proto-extensions">File-level Extensions</h3>
-        <table class="extension-table">
-          <thead>
-            <tr><td>Extension</td><td>Type</td><td>Base</td><td>Number</td><td>Description</td></tr>
-          </thead>
-          <tbody>
-            
-              <tr>
-                <td>optional_object_name</td>
-                <td><a href="#bool">bool</a></td>
-                <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
-                <td>80048953</td>
-                <td><p></p></td>
-              </tr>
-            
-              <tr>
-                <td>required_object_name</td>
-                <td><a href="#bool">bool</a></td>
-                <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
-                <td>80048952</td>
-                <td><p></p></td>
-              </tr>
-            
-          </tbody>
-        </table>
-      
-
-      
-    
-      
       <div class="file-heading">
         <h2 id="policy/selectors.proto">policy/selectors.proto</h2><a href="#title">Top</a>
       </div>
diff --git a/docs/openapi/policy/predefined_rules.swagger.json b/docs/openapi/policy/predefined_rules.swagger.json
deleted file mode 100644
index 56e498b26c..0000000000
--- a/docs/openapi/policy/predefined_rules.swagger.json
+++ /dev/null
@@ -1,46 +0,0 @@
-{
-  "swagger": "2.0",
-  "info": {
-    "title": "policy/predefined_rules.proto",
-    "version": "version not set"
-  },
-  "consumes": [
-    "application/json"
-  ],
-  "produces": [
-    "application/json"
-  ],
-  "paths": {},
-  "definitions": {
-    "protobufAny": {
-      "type": "object",
-      "properties": {
-        "@type": {
-          "type": "string",
-          "description": "A URL/resource name that uniquely identifies the type of the serialized\nprotocol buffer message. This string must contain at least\none \"/\" character. The last segment of the URL's path must represent\nthe fully qualified name of the type (as in\n`path/google.protobuf.Duration`). The name should be in a canonical form\n(e.g., leading \".\" is not accepted).\n\nIn practice, teams usually precompile into the binary all types that they\nexpect it to use in the context of Any. However, for URLs which use the\nscheme `http`, `https`, or no scheme, one can optionally set up a type\nserver that maps type URLs to message definitions as follows:\n\n* If no scheme is provided, `https` is assumed.\n* An HTTP GET on the URL must yield a [google.protobuf.Type][]\n  value in binary format, or produce an error.\n* Applications are allowed to cache lookup results based on the\n  URL, or have them precompiled into a binary to avoid any\n  lookup. Therefore, binary compatibility needs to be preserved\n  on changes to types. (Use versioned type names to manage\n  breaking changes.)\n\nNote: this functionality is not currently available in the official\nprotobuf release, and it is not used for type URLs beginning with\ntype.googleapis.com. As of May 2023, there are no widely used type server\nimplementations and no plans to implement one.\n\nSchemes other than `http`, `https` (or the empty scheme) might be\nused with implementation specific semantics."
-        }
-      },
-      "additionalProperties": {},
-      "description": "`Any` contains an arbitrary serialized protocol buffer message along with a\nURL that describes the type of the serialized message.\n\nProtobuf library provides support to pack/unpack Any values in the form\nof utility functions or additional generated methods of the Any type.\n\nExample 1: Pack and unpack a message in C++.\n\n    Foo foo = ...;\n    Any any;\n    any.PackFrom(foo);\n    ...\n    if (any.UnpackTo(\u0026foo)) {\n      ...\n    }\n\nExample 2: Pack and unpack a message in Java.\n\n    Foo foo = ...;\n    Any any = Any.pack(foo);\n    ...\n    if (any.is(Foo.class)) {\n      foo = any.unpack(Foo.class);\n    }\n    // or ...\n    if (any.isSameTypeAs(Foo.getDefaultInstance())) {\n      foo = any.unpack(Foo.getDefaultInstance());\n    }\n\n Example 3: Pack and unpack a message in Python.\n\n    foo = Foo(...)\n    any = Any()\n    any.Pack(foo)\n    ...\n    if any.Is(Foo.DESCRIPTOR):\n      any.Unpack(foo)\n      ...\n\n Example 4: Pack and unpack a message in Go\n\n     foo := \u0026pb.Foo{...}\n     any, err := anypb.New(foo)\n     if err != nil {\n       ...\n     }\n     ...\n     foo := \u0026pb.Foo{}\n     if err := any.UnmarshalTo(foo); err != nil {\n       ...\n     }\n\nThe pack methods provided by protobuf library will by default use\n'type.googleapis.com/full.type.name' as the type URL and the unpack\nmethods only use the fully qualified type name after the last '/'\nin the type URL, for example \"foo.bar.com/x/y.z\" will yield type\nname \"y.z\".\n\nJSON\n====\nThe JSON representation of an `Any` value uses the regular\nrepresentation of the deserialized, embedded message, with an\nadditional field `@type` which contains the type URL. Example:\n\n    package google.profile;\n    message Person {\n      string first_name = 1;\n      string last_name = 2;\n    }\n\n    {\n      \"@type\": \"type.googleapis.com/google.profile.Person\",\n      \"firstName\": \u003cstring\u003e,\n      \"lastName\": \u003cstring\u003e\n    }\n\nIf the embedded message type is well-known and has a custom JSON\nrepresentation, that representation will be embedded adding a field\n`value` which holds the custom JSON in addition to the `@type`\nfield. Example (for message [google.protobuf.Duration][]):\n\n    {\n      \"@type\": \"type.googleapis.com/google.protobuf.Duration\",\n      \"value\": \"1.212s\"\n    }"
-    },
-    "rpcStatus": {
-      "type": "object",
-      "properties": {
-        "code": {
-          "type": "integer",
-          "format": "int32"
-        },
-        "message": {
-          "type": "string"
-        },
-        "details": {
-          "type": "array",
-          "items": {
-            "type": "object",
-            "$ref": "#/definitions/protobufAny"
-          }
-        }
-      }
-    }
-  }
-}
diff --git a/protocol/go/policy/actions/actions.pb.go b/protocol/go/policy/actions/actions.pb.go
index b1afb72ac3..1d8a5cbb8d 100644
--- a/protocol/go/policy/actions/actions.pb.go
+++ b/protocol/go/policy/actions/actions.pb.go
@@ -281,7 +281,7 @@ type CreateActionRequest struct {
 	unknownFields protoimpl.UnknownFields
 
 	// Required
-	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
 	// Optional
 	Metadata *common.MetadataMutable `protobuf:"bytes,100,opt,name=metadata,proto3" json:"metadata,omitempty"`
 }
@@ -609,119 +609,166 @@ var file_policy_actions_actions_proto_rawDesc = []byte{
 	0x69, 0x64, 0x61, 0x74, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x13, 0x63, 0x6f, 0x6d,
 	0x6d, 0x6f, 0x6e, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
 	0x1a, 0x14, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1d, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x70,
-	0x72, 0x65, 0x64, 0x65, 0x66, 0x69, 0x6e, 0x65, 0x64, 0x5f, 0x72, 0x75, 0x6c, 0x65, 0x73, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x16, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x73, 0x65,
-	0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x66, 0x0a,
-	0x10, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x12, 0x1a, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba,
-	0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x48, 0x00, 0x52, 0x02, 0x69, 0x64, 0x12, 0x21, 0x0a,
-	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0b, 0xba, 0x48, 0x08,
-	0x72, 0x06, 0xc8, 0xb3, 0xae, 0xb1, 0x02, 0x01, 0x48, 0x00, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65,
-	0x42, 0x13, 0x0a, 0x0a, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x12, 0x05,
-	0xba, 0x48, 0x02, 0x08, 0x01, 0x22, 0x7e, 0x0a, 0x11, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x12, 0x41, 0x0a, 0x10, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x6d, 0x61,
-	0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x70,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4d, 0x61, 0x70,
-	0x70, 0x69, 0x6e, 0x67, 0x52, 0x0f, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4d, 0x61, 0x70,
-	0x70, 0x69, 0x6e, 0x67, 0x73, 0x22, 0x49, 0x0a, 0x12, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x33, 0x0a, 0x0a, 0x70,
-	0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x13, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x52, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x22, 0xbd, 0x01, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x39, 0x0a, 0x10, 0x61, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x5f, 0x73, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x18, 0x01, 0x20, 0x03,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x16, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x73,
+	0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xeb,
+	0x02, 0x0a, 0x10, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42,
+	0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x48, 0x00, 0x52, 0x02, 0x69, 0x64, 0x12,
+	0xa5, 0x02, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x8e,
+	0x02, 0xba, 0x48, 0x8a, 0x02, 0xba, 0x01, 0x81, 0x02, 0x0a, 0x12, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0xad, 0x01,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x6d, 0x75, 0x73, 0x74,
+	0x20, 0x62, 0x65, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65,
+	0x72, 0x69, 0x63, 0x20, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x2c, 0x20, 0x61, 0x6c, 0x6c, 0x6f,
+	0x77, 0x69, 0x6e, 0x67, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x20, 0x61, 0x6e, 0x64,
+	0x20, 0x75, 0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f, 0x72, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74,
+	0x20, 0x6e, 0x6f, 0x74, 0x20, 0x61, 0x73, 0x20, 0x74, 0x68, 0x65, 0x20, 0x66, 0x69, 0x72, 0x73,
+	0x74, 0x20, 0x6f, 0x72, 0x20, 0x6c, 0x61, 0x73, 0x74, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63,
+	0x74, 0x65, 0x72, 0x2e, 0x20, 0x54, 0x68, 0x65, 0x20, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20,
+	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x77, 0x69, 0x6c, 0x6c,
+	0x20, 0x62, 0x65, 0x20, 0x6e, 0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64, 0x20, 0x74,
+	0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a, 0x3b, 0x74,
+	0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61,
+	0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61, 0x2d, 0x7a,
+	0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d,
+	0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x72, 0x03, 0x18, 0xfd, 0x01, 0x48,
+	0x00, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x42, 0x13, 0x0a, 0x0a, 0x69, 0x64, 0x65, 0x6e, 0x74,
+	0x69, 0x66, 0x69, 0x65, 0x72, 0x12, 0x05, 0xba, 0x48, 0x02, 0x08, 0x01, 0x22, 0x7e, 0x0a, 0x11,
+	0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x41, 0x0a, 0x10, 0x73, 0x75, 0x62,
+	0x6a, 0x65, 0x63, 0x74, 0x5f, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x02, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x53, 0x75, 0x62,
+	0x6a, 0x65, 0x63, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x0f, 0x73, 0x75, 0x62,
+	0x6a, 0x65, 0x63, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x22, 0x49, 0x0a, 0x12,
+	0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x33, 0x0a, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
+	0x50, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x52, 0x0a, 0x70, 0x61, 0x67,
+	0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0xbd, 0x01, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x39, 0x0a, 0x10, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x5f, 0x73, 0x74, 0x61, 0x6e, 0x64,
+	0x61, 0x72, 0x64, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0f, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x53, 0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x12, 0x35, 0x0a, 0x0e, 0x61, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x5f, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x18, 0x02, 0x20, 0x03,
 	0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x52, 0x0f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x53, 0x74, 0x61, 0x6e, 0x64,
-	0x61, 0x72, 0x64, 0x12, 0x35, 0x0a, 0x0e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x5f, 0x63,
-	0x75, 0x73, 0x74, 0x6f, 0x6d, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f,
-	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0d, 0x61, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x43, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x12, 0x34, 0x0a, 0x0a, 0x70, 0x61,
-	0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14,
-	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x52, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x22, 0x6b, 0x0a, 0x13, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1f, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0b, 0xba, 0x48, 0x08, 0x72, 0x06, 0xc0, 0xb3, 0xae, 0xb1,
-	0x02, 0x01, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61,
+	0x6f, 0x6e, 0x52, 0x0d, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x43, 0x75, 0x73, 0x74, 0x6f,
+	0x6d, 0x12, 0x34, 0x0a, 0x0a, 0x70, 0x61, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18,
+	0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50,
+	0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x52, 0x0a, 0x70, 0x61, 0x67,
+	0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0xf3, 0x02, 0x0a, 0x13, 0x43, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0xa6, 0x02, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x91,
+	0x02, 0xba, 0x48, 0x8d, 0x02, 0xba, 0x01, 0x81, 0x02, 0x0a, 0x12, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0xad, 0x01,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x6d, 0x75, 0x73, 0x74,
+	0x20, 0x62, 0x65, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65,
+	0x72, 0x69, 0x63, 0x20, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x2c, 0x20, 0x61, 0x6c, 0x6c, 0x6f,
+	0x77, 0x69, 0x6e, 0x67, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x20, 0x61, 0x6e, 0x64,
+	0x20, 0x75, 0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f, 0x72, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74,
+	0x20, 0x6e, 0x6f, 0x74, 0x20, 0x61, 0x73, 0x20, 0x74, 0x68, 0x65, 0x20, 0x66, 0x69, 0x72, 0x73,
+	0x74, 0x20, 0x6f, 0x72, 0x20, 0x6c, 0x61, 0x73, 0x74, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63,
+	0x74, 0x65, 0x72, 0x2e, 0x20, 0x54, 0x68, 0x65, 0x20, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20,
+	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x77, 0x69, 0x6c, 0x6c,
+	0x20, 0x62, 0x65, 0x20, 0x6e, 0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64, 0x20, 0x74,
+	0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a, 0x3b, 0x74,
+	0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61,
+	0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61, 0x2d, 0x7a,
+	0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d,
+	0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29, 0xc8, 0x01, 0x01, 0x72, 0x03, 0x18,
+	0xfd, 0x01, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61,
 	0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f, 0x6d,
 	0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4d, 0x75, 0x74, 0x61,
 	0x62, 0x6c, 0x65, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x3e, 0x0a,
 	0x14, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73,
 	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18,
 	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0xdb, 0x01,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0xe0, 0x03,
 	0x0a, 0x13, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
 	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
 	0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x52, 0x02, 0x69, 0x64, 0x12,
-	0x1f, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0b, 0xba,
-	0x48, 0x08, 0x72, 0x06, 0xc8, 0xb3, 0xae, 0xb1, 0x02, 0x01, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65,
-	0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61,
-	0x64, 0x61, 0x74, 0x61, 0x4d, 0x75, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x08, 0x6d, 0x65, 0x74,
-	0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x54, 0x0a, 0x18, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x5f, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x62, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f,
-	0x72, 0x18, 0x65, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e,
-	0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x45,
-	0x6e, 0x75, 0x6d, 0x52, 0x16, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x55, 0x70, 0x64,
-	0x61, 0x74, 0x65, 0x42, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x22, 0x3e, 0x0a, 0x14, 0x55,
-	0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x2f, 0x0a, 0x13, 0x44,
-	0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08,
-	0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x52, 0x02, 0x69, 0x64, 0x22, 0x3e, 0x0a, 0x14,
-	0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x32, 0xd4, 0x03, 0x0a,
-	0x0d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x52,
-	0x0a, 0x09, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x20, 0x2e, 0x70, 0x6f,
-	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x47, 0x65, 0x74,
-	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e,
-	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x47,
-	0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x22, 0x00, 0x12, 0x58, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x73, 0x12, 0x22, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c,
-	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x2e, 0x70,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0xa3, 0x02, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x8e,
+	0x02, 0xba, 0x48, 0x8a, 0x02, 0xba, 0x01, 0x81, 0x02, 0x0a, 0x12, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0xad, 0x01,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x6d, 0x75, 0x73, 0x74,
+	0x20, 0x62, 0x65, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65,
+	0x72, 0x69, 0x63, 0x20, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x2c, 0x20, 0x61, 0x6c, 0x6c, 0x6f,
+	0x77, 0x69, 0x6e, 0x67, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x20, 0x61, 0x6e, 0x64,
+	0x20, 0x75, 0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f, 0x72, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74,
+	0x20, 0x6e, 0x6f, 0x74, 0x20, 0x61, 0x73, 0x20, 0x74, 0x68, 0x65, 0x20, 0x66, 0x69, 0x72, 0x73,
+	0x74, 0x20, 0x6f, 0x72, 0x20, 0x6c, 0x61, 0x73, 0x74, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63,
+	0x74, 0x65, 0x72, 0x2e, 0x20, 0x54, 0x68, 0x65, 0x20, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20,
+	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x77, 0x69, 0x6c, 0x6c,
+	0x20, 0x62, 0x65, 0x20, 0x6e, 0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64, 0x20, 0x74,
+	0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a, 0x3b, 0x74,
+	0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61,
+	0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61, 0x2d, 0x7a,
+	0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d,
+	0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x72, 0x03, 0x18, 0xfd, 0x01, 0x52,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e,
+	0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4d, 0x75, 0x74, 0x61, 0x62, 0x6c, 0x65,
+	0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x54, 0x0a, 0x18, 0x6d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x62, 0x65,
+	0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x18, 0x65, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e, 0x63,
+	0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x55, 0x70,
+	0x64, 0x61, 0x74, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x52, 0x16, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x42, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72,
+	0x22, 0x3e, 0x0a, 0x14, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63,
+	0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x22, 0x2f, 0x0a, 0x13, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x52, 0x02, 0x69,
+	0x64, 0x22, 0x3e, 0x0a, 0x14, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x32, 0xd4, 0x03, 0x0a, 0x0d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x12, 0x52, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x12, 0x20, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x21, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x41,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x22, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
+	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x70, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74,
+	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x12, 0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f,
 	0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x55, 0x70, 0x64,
-	0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74,
-	0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
+	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b,
+	0x0a, 0x0c, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23,
 	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e,
-	0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65,
-	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
-	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f,
+	0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x44,
+	0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x2e, 0x70, 0x6f,
 	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x44, 0x65, 0x6c,
-	0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x22, 0x00, 0x42, 0xb3, 0x01, 0x0a, 0x12, 0x63, 0x6f, 0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x42, 0x0c, 0x41, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x36, 0x67, 0x69, 0x74, 0x68,
-	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70,
-	0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c,
-	0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0xa2, 0x02, 0x03, 0x50, 0x41, 0x58, 0xaa, 0x02, 0x0e, 0x50, 0x6f, 0x6c, 0x69, 0x63,
-	0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xca, 0x02, 0x0e, 0x50, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xe2, 0x02, 0x1a, 0x50, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x5c, 0x47, 0x50, 0x42, 0x4d,
-	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x0f, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-	0x3a, 0x3a, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x33,
+	0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0xb3, 0x01, 0x0a, 0x12, 0x63, 0x6f, 0x6d,
+	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x42,
+	0x0c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a,
+	0x36, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65, 0x6e,
+	0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f,
+	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xa2, 0x02, 0x03, 0x50, 0x41, 0x58, 0xaa, 0x02, 0x0e,
+	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xca, 0x02,
+	0x0e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xe2,
+	0x02, 0x1a, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
+	0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x0f, 0x50,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x3a, 0x3a, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x62, 0x06,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/protocol/go/policy/predefined_rules.pb.go b/protocol/go/policy/predefined_rules.pb.go
deleted file mode 100644
index ab0163ec43..0000000000
--- a/protocol/go/policy/predefined_rules.pb.go
+++ /dev/null
@@ -1,160 +0,0 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
-// versions:
-// 	protoc-gen-go v1.33.0
-// 	protoc        (unknown)
-// source: policy/predefined_rules.proto
-
-package policy
-
-import (
-	validate "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate"
-	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
-	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	reflect "reflect"
-)
-
-const (
-	// Verify that this generated code is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
-	// Verify that runtime/protoimpl is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
-)
-
-var file_policy_predefined_rules_proto_extTypes = []protoimpl.ExtensionInfo{
-	{
-		ExtendedType:  (*validate.StringRules)(nil),
-		ExtensionType: (*bool)(nil),
-		Field:         80048952,
-		Name:          "policy.required_object_name",
-		Tag:           "varint,80048952,opt,name=required_object_name",
-		Filename:      "policy/predefined_rules.proto",
-	},
-	{
-		ExtendedType:  (*validate.StringRules)(nil),
-		ExtensionType: (*bool)(nil),
-		Field:         80048953,
-		Name:          "policy.optional_object_name",
-		Tag:           "varint,80048953,opt,name=optional_object_name",
-		Filename:      "policy/predefined_rules.proto",
-	},
-}
-
-// Extension fields to validate.StringRules.
-var (
-	// optional bool required_object_name = 80048952;
-	E_RequiredObjectName = &file_policy_predefined_rules_proto_extTypes[0]
-	// optional bool optional_object_name = 80048953;
-	E_OptionalObjectName = &file_policy_predefined_rules_proto_extTypes[1]
-)
-
-var File_policy_predefined_rules_proto protoreflect.FileDescriptor
-
-var file_policy_predefined_rules_proto_rawDesc = []byte{
-	0x0a, 0x1d, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f, 0x70, 0x72, 0x65, 0x64, 0x65, 0x66, 0x69,
-	0x6e, 0x65, 0x64, 0x5f, 0x72, 0x75, 0x6c, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12,
-	0x06, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x1a, 0x1b, 0x62, 0x75, 0x66, 0x2f, 0x76, 0x61, 0x6c,
-	0x69, 0x64, 0x61, 0x74, 0x65, 0x2f, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x3a, 0xaf, 0x03, 0x0a, 0x14, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65,
-	0x64, 0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x19, 0x2e,
-	0x62, 0x75, 0x66, 0x2e, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2e, 0x53, 0x74, 0x72,
-	0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x18, 0xb8, 0xe6, 0x95, 0x26, 0x20, 0x01, 0x28,
-	0x08, 0x42, 0xde, 0x02, 0xc2, 0x48, 0xda, 0x02, 0x0a, 0xd7, 0x02, 0x0a, 0x1b, 0x73, 0x74, 0x72,
-	0x69, 0x6e, 0x67, 0x2e, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x5f, 0x6f, 0x62, 0x6a,
-	0x65, 0x63, 0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0xd4, 0x01, 0x46, 0x69, 0x65, 0x6c, 0x64,
-	0x20, 0x69, 0x73, 0x20, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x2c, 0x20, 0x61, 0x6c,
-	0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x2c, 0x20, 0x6f, 0x70, 0x74, 0x69,
-	0x6f, 0x6e, 0x61, 0x6c, 0x6c, 0x79, 0x20, 0x69, 0x6e, 0x63, 0x6c, 0x75, 0x64, 0x69, 0x6e, 0x67,
-	0x20, 0x75, 0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f, 0x72, 0x65, 0x73, 0x20, 0x61, 0x6e, 0x64,
-	0x20, 0x64, 0x61, 0x73, 0x68, 0x65, 0x73, 0x20, 0x62, 0x75, 0x74, 0x20, 0x6e, 0x6f, 0x74, 0x20,
-	0x70, 0x72, 0x65, 0x63, 0x65, 0x64, 0x69, 0x6e, 0x67, 0x20, 0x6f, 0x72, 0x20, 0x74, 0x72, 0x61,
-	0x69, 0x6c, 0x69, 0x6e, 0x67, 0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20,
-	0x62, 0x65, 0x20, 0x62, 0x65, 0x74, 0x77, 0x65, 0x65, 0x6e, 0x20, 0x30, 0x20, 0x61, 0x6e, 0x64,
-	0x20, 0x32, 0x35, 0x34, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x73, 0x20,
-	0x69, 0x6e, 0x20, 0x6c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x2e, 0x20, 0x53, 0x74, 0x6f, 0x72, 0x65,
-	0x64, 0x20, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x20, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x20, 0x77, 0x69,
-	0x6c, 0x6c, 0x20, 0x62, 0x65, 0x20, 0x6e, 0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64,
-	0x20, 0x74, 0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a,
-	0x61, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3e, 0x20, 0x30, 0x20,
-	0x26, 0x26, 0x20, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3c, 0x20,
-	0x32, 0x35, 0x34, 0x20, 0x26, 0x26, 0x20, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63,
-	0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39,
-	0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d,
-	0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24,
-	0x27, 0x29, 0x52, 0x12, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x4f, 0x62, 0x6a, 0x65,
-	0x63, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x3a, 0xc9, 0x03, 0x0a, 0x14, 0x6f, 0x70, 0x74, 0x69, 0x6f,
-	0x6e, 0x61, 0x6c, 0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x12,
-	0x19, 0x2e, 0x62, 0x75, 0x66, 0x2e, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2e, 0x53,
-	0x74, 0x72, 0x69, 0x6e, 0x67, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x18, 0xb9, 0xe6, 0x95, 0x26, 0x20,
-	0x01, 0x28, 0x08, 0x42, 0xf8, 0x02, 0xc2, 0x48, 0xf4, 0x02, 0x0a, 0xf1, 0x02, 0x0a, 0x1b, 0x73,
-	0x74, 0x72, 0x69, 0x6e, 0x67, 0x2e, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x5f, 0x6f,
-	0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0xd9, 0x01, 0x46, 0x69, 0x65,
-	0x6c, 0x64, 0x20, 0x69, 0x73, 0x20, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2c, 0x20,
-	0x61, 0x6e, 0x64, 0x20, 0x69, 0x66, 0x20, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x64, 0x2c,
-	0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x2c, 0x20, 0x61,
-	0x6c, 0x6c, 0x6f, 0x77, 0x69, 0x6e, 0x67, 0x20, 0x75, 0x6e, 0x64, 0x65, 0x72, 0x73, 0x63, 0x6f,
-	0x72, 0x65, 0x73, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x64, 0x61, 0x73, 0x68, 0x65, 0x73, 0x20, 0x62,
-	0x75, 0x74, 0x20, 0x6e, 0x6f, 0x74, 0x20, 0x70, 0x72, 0x65, 0x63, 0x65, 0x64, 0x69, 0x6e, 0x67,
-	0x20, 0x6f, 0x72, 0x20, 0x74, 0x72, 0x61, 0x69, 0x6c, 0x69, 0x6e, 0x67, 0x2c, 0x20, 0x61, 0x6e,
-	0x64, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x62, 0x65, 0x74, 0x77, 0x65, 0x65,
-	0x6e, 0x20, 0x30, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x32, 0x35, 0x34, 0x20, 0x63, 0x68, 0x61, 0x72,
-	0x61, 0x63, 0x74, 0x65, 0x72, 0x73, 0x20, 0x69, 0x6e, 0x20, 0x6c, 0x65, 0x6e, 0x67, 0x74, 0x68,
-	0x2e, 0x20, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x20, 0x76,
-	0x61, 0x6c, 0x75, 0x65, 0x20, 0x77, 0x69, 0x6c, 0x6c, 0x20, 0x62, 0x65, 0x20, 0x6e, 0x6f, 0x72,
-	0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64, 0x20, 0x74, 0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72,
-	0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a, 0x76, 0x73, 0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69,
-	0x73, 0x29, 0x20, 0x3d, 0x3d, 0x20, 0x30, 0x20, 0x7c, 0x7c, 0x20, 0x28, 0x73, 0x69, 0x7a, 0x65,
-	0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3e, 0x20, 0x30, 0x20, 0x26, 0x26, 0x20, 0x73, 0x69,
-	0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3c, 0x20, 0x32, 0x35, 0x34, 0x20, 0x26,
-	0x26, 0x20, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27,
-	0x5e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f, 0x3a, 0x5b,
-	0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d,
-	0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x29, 0x52, 0x12,
-	0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x4e, 0x61,
-	0x6d, 0x65, 0x42, 0x8a, 0x01, 0x0a, 0x0a, 0x63, 0x6f, 0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63,
-	0x79, 0x42, 0x14, 0x50, 0x72, 0x65, 0x64, 0x65, 0x66, 0x69, 0x6e, 0x65, 0x64, 0x52, 0x75, 0x6c,
-	0x65, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x2e, 0x67, 0x69, 0x74, 0x68, 0x75,
-	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c,
-	0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f,
-	0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xa2, 0x02, 0x03, 0x50, 0x58, 0x58, 0xaa,
-	0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0xca, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63,
-	0x79, 0xe2, 0x02, 0x12, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65,
-	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
-}
-
-var file_policy_predefined_rules_proto_goTypes = []interface{}{
-	(*validate.StringRules)(nil), // 0: buf.validate.StringRules
-}
-var file_policy_predefined_rules_proto_depIdxs = []int32{
-	0, // 0: policy.required_object_name:extendee -> buf.validate.StringRules
-	0, // 1: policy.optional_object_name:extendee -> buf.validate.StringRules
-	2, // [2:2] is the sub-list for method output_type
-	2, // [2:2] is the sub-list for method input_type
-	2, // [2:2] is the sub-list for extension type_name
-	0, // [0:2] is the sub-list for extension extendee
-	0, // [0:0] is the sub-list for field type_name
-}
-
-func init() { file_policy_predefined_rules_proto_init() }
-func file_policy_predefined_rules_proto_init() {
-	if File_policy_predefined_rules_proto != nil {
-		return
-	}
-	type x struct{}
-	out := protoimpl.TypeBuilder{
-		File: protoimpl.DescBuilder{
-			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_policy_predefined_rules_proto_rawDesc,
-			NumEnums:      0,
-			NumMessages:   0,
-			NumExtensions: 2,
-			NumServices:   0,
-		},
-		GoTypes:           file_policy_predefined_rules_proto_goTypes,
-		DependencyIndexes: file_policy_predefined_rules_proto_depIdxs,
-		ExtensionInfos:    file_policy_predefined_rules_proto_extTypes,
-	}.Build()
-	File_policy_predefined_rules_proto = out.File
-	file_policy_predefined_rules_proto_rawDesc = nil
-	file_policy_predefined_rules_proto_goTypes = nil
-	file_policy_predefined_rules_proto_depIdxs = nil
-}
diff --git a/service/policy/actions/actions.proto b/service/policy/actions/actions.proto
index fd8167a9a5..06be777dd9 100644
--- a/service/policy/actions/actions.proto
+++ b/service/policy/actions/actions.proto
@@ -3,10 +3,8 @@ syntax = "proto3";
 package policy.actions;
 
 import "buf/validate/validate.proto";
-
 import "common/common.proto";
 import "policy/objects.proto";
-import "policy/predefined_rules.proto";
 import "policy/selectors.proto";
 
 /*
@@ -18,7 +16,14 @@ message GetActionRequest {
   oneof identifier {
     option (buf.validate.oneof).required = true;
     string id = 1 [(buf.validate.field).string.uuid = true];
-    string name = 2 [(buf.validate.field).string.(optional_object_name) = true];
+    string name = 2 [
+      (buf.validate.field).string.max_len = 253,
+      (buf.validate.field).cel = {
+        id: "action_name_format"
+        message: "Action name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored action name will be normalized to lower case."
+        expression: "this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$')"
+      }
+    ];
   }
 }
 message GetActionResponse {
@@ -43,7 +48,15 @@ message ListActionsResponse {
 // Creation of Standard actions is not supported.
 message CreateActionRequest {
   // Required
-  string name = 1 [(buf.validate.field).string.(required_object_name) = true];
+  string name = 2 [
+    (buf.validate.field).required = true,
+    (buf.validate.field).string.max_len = 253,
+    (buf.validate.field).cel = {
+      id: "action_name_format"
+      message: "Action name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored action name will be normalized to lower case."
+      expression: "this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$')"
+    }
+  ];
 
   // Optional
   common.MetadataMutable metadata = 100;
@@ -60,7 +73,14 @@ message UpdateActionRequest {
 
   // Optional
   // Custom actions only: replaces the existing action name
-  string name = 2 [(buf.validate.field).string.(optional_object_name) = true];
+  string name = 2 [
+    (buf.validate.field).string.max_len = 253,
+    (buf.validate.field).cel = {
+      id: "action_name_format"
+      message: "Action name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored action name will be normalized to lower case."
+      expression: "this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$')"
+    }
+  ];
 
   // Common metadata
   common.MetadataMutable metadata = 100;
diff --git a/service/policy/predefined_rules.proto b/service/policy/predefined_rules.proto
deleted file mode 100644
index ad94c9a1db..0000000000
--- a/service/policy/predefined_rules.proto
+++ /dev/null
@@ -1,26 +0,0 @@
-syntax = "proto2";
-
-package policy;
-
-import "buf/validate/validate.proto";
-
-extend buf.validate.StringRules {
-  optional bool required_object_name = 80048952 [(buf.validate.predefined).cel = {
-    id: "string.required_object_name"
-    message:
-      "Field is required, alphanumeric, optionally including "
-      "underscores and dashes but not preceding or trailing, "
-      "and must be between 0 and 254 characters in length. "
-      "Stored field value will be normalized to lower case."
-    expression: "size(this) > 0 && size(this) < 254 && this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$')"
-  }];
-  optional bool optional_object_name = 80048953 [(buf.validate.predefined).cel = {
-    id: "string.optional_object_name"
-    message:
-      "Field is optional, and if provided, alphanumeric, allowing "
-      "underscores and dashes but not preceding or trailing, and "
-      "must be between 0 and 254 characters in length. Stored "
-      "field value will be normalized to lower case."
-    expression: "size(this) == 0 || (size(this) > 0 && size(this) < 254 && this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$'))"
-  }];
-}

From 7f14f6fc9c111d4ac9ef2202bbfb6c3c5be799f8 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 14 Apr 2025 15:21:07 -0700
Subject: [PATCH 079/110] fix

---
 service/policy/actions/actions.proto | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/service/policy/actions/actions.proto b/service/policy/actions/actions.proto
index 06be777dd9..f81964920f 100644
--- a/service/policy/actions/actions.proto
+++ b/service/policy/actions/actions.proto
@@ -48,7 +48,7 @@ message ListActionsResponse {
 // Creation of Standard actions is not supported.
 message CreateActionRequest {
   // Required
-  string name = 2 [
+  string name = 1 [
     (buf.validate.field).required = true,
     (buf.validate.field).string.max_len = 253,
     (buf.validate.field).cel = {

From ae9f6971c4215bd2a8f8cb93f0ef989229743848 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 14 Apr 2025 15:24:02 -0700
Subject: [PATCH 080/110] test rm predefined proto rules

---
 service/go.mod | 2 +-
 service/go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/service/go.mod b/service/go.mod
index 2908830bf8..759dbe7f8f 100644
--- a/service/go.mod
+++ b/service/go.mod
@@ -4,7 +4,7 @@ go 1.24.0
 
 toolchain go1.24.2
 
-replace github.com/opentdf/platform/protocol/go => github.com/opentdf/platform/protocol/go v0.2.30-0.20250414175837-aa99448e080a
+replace github.com/opentdf/platform/protocol/go => github.com/opentdf/platform/protocol/go v0.2.30-0.20250414222107-7f14f6fc9c11
 
 require (
 	connectrpc.com/connect v1.18.1
diff --git a/service/go.sum b/service/go.sum
index 71506062a7..14cb28f8f5 100644
--- a/service/go.sum
+++ b/service/go.sum
@@ -279,8 +279,8 @@ github.com/opentdf/platform/lib/flattening v0.1.3 h1:IuOm/wJVXNrzOV676Ticgr0wyBk
 github.com/opentdf/platform/lib/flattening v0.1.3/go.mod h1:Gs/T+6FGZKk9OAdz2Jf1R8CTGeNRYrq1lZGDeYT3hrY=
 github.com/opentdf/platform/lib/ocrypto v0.1.9 h1:GvgPB7CoK7JmWvsSvJ0hc+RC0wezgcuRpy3q2oYKjdA=
 github.com/opentdf/platform/lib/ocrypto v0.1.9/go.mod h1:UTtqh8mvhAYA+sEnaMxpr/406e84L5Q1sAxtKGIXfu4=
-github.com/opentdf/platform/protocol/go v0.2.30-0.20250414175837-aa99448e080a h1:oOp+1NftuedrET9bjVVTsSRQ8+yvYEAz4X/yzmKtCvk=
-github.com/opentdf/platform/protocol/go v0.2.30-0.20250414175837-aa99448e080a/go.mod h1:MY7p+WXL4LfXPT5Z1db8+FLTrUthVJwI1sOpDUPL9oE=
+github.com/opentdf/platform/protocol/go v0.2.30-0.20250414222107-7f14f6fc9c11 h1:4bZtzTeb0n0Dk7k6Wh55DSNL5DfJSsy1pZLjSWRHQsI=
+github.com/opentdf/platform/protocol/go v0.2.30-0.20250414222107-7f14f6fc9c11/go.mod h1:4W2L2IFWRQqzHVTXfbgtNrS41oU7iJf6rSs4Yp2OLkc=
 github.com/opentdf/platform/sdk v0.3.29 h1:ihTauf25sdgBKwBvK4GzFktSVINDLnwNch7xpLt88AY=
 github.com/opentdf/platform/sdk v0.3.29/go.mod h1:GeN7MqqIwop5sMBAPGR28ZIKXSOHAHaECma/ppsXoiw=
 github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=

From 5498a27a67b935c80428a7dfd742617aa7dc0d04 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 14 Apr 2025 15:25:51 -0700
Subject: [PATCH 081/110] fix proto validation failure names

---
 service/policy/actions/actions_test.go | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/service/policy/actions/actions_test.go b/service/policy/actions/actions_test.go
index 2a8d76145d..037187b954 100644
--- a/service/policy/actions/actions_test.go
+++ b/service/policy/actions/actions_test.go
@@ -14,8 +14,8 @@ import (
 const (
 	validUUID                    = "00000000-0000-0000-0000-000000000000"
 	errMessageUUID               = "string.uuid"
-	errMessageRequiredObjectName = "string.required_object_name"
-	errMessageOptionalObjectName = "string.optional_object_name"
+	errMessageRequiredActionName = "action_name_format"
+	errMessageOptionalActionName = "action_name_format"
 	errMessageURI                = "string.uri"
 	errMessageRequired           = "required"
 )
@@ -66,7 +66,7 @@ func (s *ActionSuite) Test_CreateActionRequest_Fails() {
 			}
 			err := s.v.Validate(req)
 			s.Require().Error(err)
-			s.Require().Contains(err.Error(), errMessageRequiredObjectName)
+			s.Require().Contains(err.Error(), errMessageRequiredActionName)
 		})
 	}
 
@@ -76,7 +76,7 @@ func (s *ActionSuite) Test_CreateActionRequest_Fails() {
 	}
 	err := s.v.Validate(req)
 	s.Require().Error(err)
-	s.Require().Contains(err.Error(), errMessageRequiredObjectName)
+	s.Require().Contains(err.Error(), errMessageRequiredActionName)
 }
 
 func (s *ActionSuite) Test_CreateActionRequest_Succeeds() {

From 2551747fc2301bbd6953c71b82c30a9f3a0f3b5e Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 14 Apr 2025 15:26:13 -0700
Subject: [PATCH 082/110] fix proto validation failure names

---
 service/policy/actions/actions_test.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/service/policy/actions/actions_test.go b/service/policy/actions/actions_test.go
index 037187b954..e80cde9140 100644
--- a/service/policy/actions/actions_test.go
+++ b/service/policy/actions/actions_test.go
@@ -147,7 +147,7 @@ func (s *ActionSuite) Test_GetAction_Fails() {
 			}
 			err := s.v.Validate(req)
 			s.Require().Error(err)
-			s.Require().Contains(err.Error(), errMessageOptionalObjectName)
+			s.Require().Contains(err.Error(), errMessageRequiredActionName)
 		})
 	}
 }
@@ -212,7 +212,7 @@ func (s *ActionSuite) Test_UpdateActionRequest_Fails() {
 			}
 			err := s.v.Validate(req)
 			s.Require().Error(err)
-			s.Require().Contains(err.Error(), errMessageOptionalObjectName)
+			s.Require().Contains(err.Error(), errMessageRequiredActionName)
 		})
 	}
 }

From 61bfcb4cb2cdb2123c5b1f29cbe2fb5cfe93aeb5 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 14 Apr 2025 15:32:30 -0700
Subject: [PATCH 083/110] fix tests

---
 service/policy/actions/actions_test.go | 27 +++++++++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/service/policy/actions/actions_test.go b/service/policy/actions/actions_test.go
index e80cde9140..d0393a5031 100644
--- a/service/policy/actions/actions_test.go
+++ b/service/policy/actions/actions_test.go
@@ -14,6 +14,7 @@ import (
 const (
 	validUUID                    = "00000000-0000-0000-0000-000000000000"
 	errMessageUUID               = "string.uuid"
+	errMessageMaxLength          = "string.max_len"
 	errMessageRequiredActionName = "action_name_format"
 	errMessageOptionalActionName = "action_name_format"
 	errMessageURI                = "string.uri"
@@ -24,7 +25,6 @@ var (
 	validNames = []string{"valid_Name", "valid_name", "NAME", "NAME-IS-VALID", "SOME_VALID_NAME", "valid-name", strings.Repeat("a", 253), strings.Repeat("a", 1)}
 
 	invalidNameTests = []string{
-		strings.Repeat("a", 254),
 		"!",
 		"name with space",
 		"slash/",
@@ -77,6 +77,14 @@ func (s *ActionSuite) Test_CreateActionRequest_Fails() {
 	err := s.v.Validate(req)
 	s.Require().Error(err)
 	s.Require().Contains(err.Error(), errMessageRequiredActionName)
+
+	// too long
+	req = &actions.CreateActionRequest{
+		Name: strings.Repeat("a", 254),
+	}
+	err = s.v.Validate(req)
+	s.Require().Error(err)
+	s.Require().Contains(err.Error(), errMessageMaxLength)
 }
 
 func (s *ActionSuite) Test_CreateActionRequest_Succeeds() {
@@ -150,6 +158,16 @@ func (s *ActionSuite) Test_GetAction_Fails() {
 			s.Require().Contains(err.Error(), errMessageRequiredActionName)
 		})
 	}
+
+	// too long
+	req = &actions.GetActionRequest{
+		Identifier: &actions.GetActionRequest_Name{
+			Name: strings.Repeat("a", 254),
+		},
+	}
+	err = s.v.Validate(req)
+	s.Require().Error(err)
+	s.Require().Contains(err.Error(), errMessageMaxLength)
 }
 
 func (s *ActionSuite) Test_ListActions_Succeeds() {
@@ -215,6 +233,13 @@ func (s *ActionSuite) Test_UpdateActionRequest_Fails() {
 			s.Require().Contains(err.Error(), errMessageRequiredActionName)
 		})
 	}
+
+	req = &actions.UpdateActionRequest{
+		Name: strings.Repeat("a", 254),
+	}
+	err = s.v.Validate(req)
+	s.Require().Error(err)
+	s.Require().Contains(err.Error(), errMessageMaxLength)
 }
 
 func (s *ActionSuite) Test_DeleteActionRequest_Succeeds() {

From d97099d3b4586efda302aa4b169da7a2fa4f88bd Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 14 Apr 2025 15:35:13 -0700
Subject: [PATCH 084/110] downgrade protovalidate/protocolbuffers/go

---
 protocol/go/go.mod | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/protocol/go/go.mod b/protocol/go/go.mod
index daa21a5f18..45831c8b0a 100644
--- a/protocol/go/go.mod
+++ b/protocol/go/go.mod
@@ -5,7 +5,7 @@ go 1.24.0
 toolchain go1.24.2
 
 require (
-	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-20250307204501-0409229c3780.1
+	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.34.1-20240508200655-46a4cf4ba109.1
 	connectrpc.com/connect v1.17.0
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0
 	google.golang.org/genproto/googleapis/api v0.0.0-20241007155032-5fefd90f89a9

From 9077368defecc4d2b649902b72cdcf92db7aa913 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 14 Apr 2025 15:37:45 -0700
Subject: [PATCH 085/110] update replacement directive pin commit

---
 service/go.mod | 2 +-
 service/go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/service/go.mod b/service/go.mod
index 759dbe7f8f..ea8262e77b 100644
--- a/service/go.mod
+++ b/service/go.mod
@@ -4,7 +4,7 @@ go 1.24.0
 
 toolchain go1.24.2
 
-replace github.com/opentdf/platform/protocol/go => github.com/opentdf/platform/protocol/go v0.2.30-0.20250414222107-7f14f6fc9c11
+replace github.com/opentdf/platform/protocol/go => github.com/opentdf/platform/protocol/go v0.2.30-0.20250414223513-d97099d3b458
 
 require (
 	connectrpc.com/connect v1.18.1
diff --git a/service/go.sum b/service/go.sum
index 14cb28f8f5..c8146dc15a 100644
--- a/service/go.sum
+++ b/service/go.sum
@@ -279,8 +279,8 @@ github.com/opentdf/platform/lib/flattening v0.1.3 h1:IuOm/wJVXNrzOV676Ticgr0wyBk
 github.com/opentdf/platform/lib/flattening v0.1.3/go.mod h1:Gs/T+6FGZKk9OAdz2Jf1R8CTGeNRYrq1lZGDeYT3hrY=
 github.com/opentdf/platform/lib/ocrypto v0.1.9 h1:GvgPB7CoK7JmWvsSvJ0hc+RC0wezgcuRpy3q2oYKjdA=
 github.com/opentdf/platform/lib/ocrypto v0.1.9/go.mod h1:UTtqh8mvhAYA+sEnaMxpr/406e84L5Q1sAxtKGIXfu4=
-github.com/opentdf/platform/protocol/go v0.2.30-0.20250414222107-7f14f6fc9c11 h1:4bZtzTeb0n0Dk7k6Wh55DSNL5DfJSsy1pZLjSWRHQsI=
-github.com/opentdf/platform/protocol/go v0.2.30-0.20250414222107-7f14f6fc9c11/go.mod h1:4W2L2IFWRQqzHVTXfbgtNrS41oU7iJf6rSs4Yp2OLkc=
+github.com/opentdf/platform/protocol/go v0.2.30-0.20250414223513-d97099d3b458 h1:1c+jF2jUoZX5WpcDhKv9CkMZybfZwYH3sU/YH9/tCf8=
+github.com/opentdf/platform/protocol/go v0.2.30-0.20250414223513-d97099d3b458/go.mod h1:3nolWMso+6FV8v1UgKO45EvxrVMPF7xHQq76/YRhR8I=
 github.com/opentdf/platform/sdk v0.3.29 h1:ihTauf25sdgBKwBvK4GzFktSVINDLnwNch7xpLt88AY=
 github.com/opentdf/platform/sdk v0.3.29/go.mod h1:GeN7MqqIwop5sMBAPGR28ZIKXSOHAHaECma/ppsXoiw=
 github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=

From 0dd18ae488000769836e04c90226f65fd14d20ef Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 14 Apr 2025 15:47:43 -0700
Subject: [PATCH 086/110] fix optional updation

---
 service/policy/actions/actions.proto | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/service/policy/actions/actions.proto b/service/policy/actions/actions.proto
index f81964920f..8dc5e427ce 100644
--- a/service/policy/actions/actions.proto
+++ b/service/policy/actions/actions.proto
@@ -78,7 +78,7 @@ message UpdateActionRequest {
     (buf.validate.field).cel = {
       id: "action_name_format"
       message: "Action name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored action name will be normalized to lower case."
-      expression: "this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$')"
+      expression: "size(this) == 0 || this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$')"
     }
   ];
 

From c6a2040f3cf54fc33f9e54ca4e2b3ebc6264ddda Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 14 Apr 2025 15:48:13 -0700
Subject: [PATCH 087/110] codegen

---
 protocol/go/policy/actions/actions.pb.go | 135 ++++++++++++-----------
 1 file changed, 68 insertions(+), 67 deletions(-)

diff --git a/protocol/go/policy/actions/actions.pb.go b/protocol/go/policy/actions/actions.pb.go
index 1d8a5cbb8d..0ebca0c38b 100644
--- a/protocol/go/policy/actions/actions.pb.go
+++ b/protocol/go/policy/actions/actions.pb.go
@@ -281,7 +281,7 @@ type CreateActionRequest struct {
 	unknownFields protoimpl.UnknownFields
 
 	// Required
-	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
 	// Optional
 	Metadata *common.MetadataMutable `protobuf:"bytes,100,opt,name=metadata,proto3" json:"metadata,omitempty"`
 }
@@ -660,7 +660,7 @@ var file_policy_actions_actions_proto_rawDesc = []byte{
 	0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x52, 0x0a, 0x70, 0x61, 0x67,
 	0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0xf3, 0x02, 0x0a, 0x13, 0x43, 0x72, 0x65, 0x61,
 	0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0xa6, 0x02, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x91,
+	0xa6, 0x02, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x91,
 	0x02, 0xba, 0x48, 0x8d, 0x02, 0xba, 0x01, 0x81, 0x02, 0x0a, 0x12, 0x61, 0x63, 0x74, 0x69, 0x6f,
 	0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0xad, 0x01,
 	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x6d, 0x75, 0x73, 0x74,
@@ -685,12 +685,12 @@ var file_policy_actions_actions_proto_rawDesc = []byte{
 	0x14, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73,
 	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18,
 	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0xe0, 0x03,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0xf3, 0x03,
 	0x0a, 0x13, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
 	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
 	0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x52, 0x02, 0x69, 0x64, 0x12,
-	0xa3, 0x02, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x8e,
-	0x02, 0xba, 0x48, 0x8a, 0x02, 0xba, 0x01, 0x81, 0x02, 0x0a, 0x12, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0xb6, 0x02, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0xa1,
+	0x02, 0xba, 0x48, 0x9d, 0x02, 0xba, 0x01, 0x94, 0x02, 0x0a, 0x12, 0x61, 0x63, 0x74, 0x69, 0x6f,
 	0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0xad, 0x01,
 	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x6d, 0x75, 0x73, 0x74,
 	0x20, 0x62, 0x65, 0x20, 0x61, 0x6e, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65,
@@ -702,73 +702,74 @@ var file_policy_actions_actions_proto_rawDesc = []byte{
 	0x74, 0x65, 0x72, 0x2e, 0x20, 0x54, 0x68, 0x65, 0x20, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x20,
 	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x20, 0x77, 0x69, 0x6c, 0x6c,
 	0x20, 0x62, 0x65, 0x20, 0x6e, 0x6f, 0x72, 0x6d, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x64, 0x20, 0x74,
-	0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a, 0x3b, 0x74,
-	0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61,
-	0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f, 0x3a, 0x5b, 0x61, 0x2d, 0x7a,
-	0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d,
-	0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x72, 0x03, 0x18, 0xfd, 0x01, 0x52,
-	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e,
-	0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4d, 0x75, 0x74, 0x61, 0x62, 0x6c, 0x65,
-	0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x54, 0x0a, 0x18, 0x6d, 0x65,
-	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x62, 0x65,
-	0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x18, 0x65, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e, 0x63,
-	0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x55, 0x70,
-	0x64, 0x61, 0x74, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x52, 0x16, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x42, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72,
-	0x22, 0x3e, 0x0a, 0x14, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63,
-	0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x22, 0x2f, 0x0a, 0x13, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x52, 0x02, 0x69,
-	0x64, 0x22, 0x3e, 0x0a, 0x14, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x32, 0xd4, 0x03, 0x0a, 0x0d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x12, 0x52, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x12, 0x20, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x21, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x41,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x22, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
-	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x70, 0x6f, 0x6c,
-	0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74,
-	0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
-	0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f,
+	0x6f, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x20, 0x63, 0x61, 0x73, 0x65, 0x2e, 0x1a, 0x4e, 0x73,
+	0x69, 0x7a, 0x65, 0x28, 0x74, 0x68, 0x69, 0x73, 0x29, 0x20, 0x3d, 0x3d, 0x20, 0x30, 0x20, 0x7c,
+	0x7c, 0x20, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27,
+	0x5e, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x3f, 0x3a, 0x5b,
+	0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5f, 0x2d, 0x5d, 0x2a, 0x5b, 0x61, 0x2d,
+	0x7a, 0x41, 0x2d, 0x5a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x72, 0x03, 0x18,
+	0xfd, 0x01, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x18, 0x64, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f, 0x6d,
+	0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4d, 0x75, 0x74, 0x61,
+	0x62, 0x6c, 0x65, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x54, 0x0a,
+	0x18, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65,
+	0x5f, 0x62, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x18, 0x65, 0x20, 0x01, 0x28, 0x0e, 0x32,
+	0x1a, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x45, 0x6e, 0x75, 0x6d, 0x52, 0x16, 0x6d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x42, 0x65, 0x68, 0x61, 0x76,
+	0x69, 0x6f, 0x72, 0x22, 0x3e, 0x0a, 0x14, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06, 0x61,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x22, 0x2f, 0x0a, 0x13, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x02, 0x69, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01,
+	0x52, 0x02, 0x69, 0x64, 0x22, 0x3e, 0x0a, 0x14, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x06,
+	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x61, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x32, 0xd4, 0x03, 0x0a, 0x0d, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x53,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x52, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x12, 0x20, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x47, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x0b, 0x4c, 0x69,
+	0x73, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x22, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x41,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e,
+	0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x4c,
+	0x69, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f,
 	0x6e, 0x12, 0x23, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
+	0x6e, 0x73, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52,
 	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
-	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x63,
+	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63,
 	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b,
-	0x0a, 0x0c, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23,
+	0x0a, 0x0c, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23,
 	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e,
-	0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75,
+	0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75,
 	0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5b, 0x0a, 0x0c, 0x44,
-	0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x2e, 0x70, 0x6f,
-	0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x44, 0x65, 0x6c,
-	0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x24, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x73, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0xb3, 0x01, 0x0a, 0x12, 0x63, 0x6f, 0x6d,
-	0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x42,
-	0x0c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a,
-	0x36, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65, 0x6e,
-	0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2f,
-	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xa2, 0x02, 0x03, 0x50, 0x41, 0x58, 0xaa, 0x02, 0x0e,
-	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xca, 0x02,
-	0x0e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xe2,
-	0x02, 0x1a, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x0f, 0x50,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x3a, 0x3a, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x62, 0x06,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0xb3, 0x01, 0x0a, 0x12,
+	0x63, 0x6f, 0x6d, 0x2e, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x42, 0x0c, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x50, 0x72, 0x6f, 0x74, 0x6f,
+	0x50, 0x01, 0x5a, 0x36, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f,
+	0x70, 0x65, 0x6e, 0x74, 0x64, 0x66, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x2f, 0x67, 0x6f, 0x2f, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x2f, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0xa2, 0x02, 0x03, 0x50, 0x41, 0x58,
+	0xaa, 0x02, 0x0e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0xca, 0x02, 0x0e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0xe2, 0x02, 0x1a, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5c, 0x41, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea,
+	0x02, 0x0f, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x3a, 0x3a, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (

From 2a85aeb64f13f03084d23fbb900755678880bce3 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 14 Apr 2025 15:49:55 -0700
Subject: [PATCH 088/110] fix actions_test

---
 service/policy/actions/actions_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/service/policy/actions/actions_test.go b/service/policy/actions/actions_test.go
index d0393a5031..23c826b924 100644
--- a/service/policy/actions/actions_test.go
+++ b/service/policy/actions/actions_test.go
@@ -76,7 +76,7 @@ func (s *ActionSuite) Test_CreateActionRequest_Fails() {
 	}
 	err := s.v.Validate(req)
 	s.Require().Error(err)
-	s.Require().Contains(err.Error(), errMessageRequiredActionName)
+	s.Require().Contains(err.Error(), errMessageRequired)
 
 	// too long
 	req = &actions.CreateActionRequest{

From 8e7b77190c96a8105fc74a82e9713514b9239f2a Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 14 Apr 2025 15:50:16 -0700
Subject: [PATCH 089/110] update pinned commit

---
 service/go.mod | 2 +-
 service/go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/service/go.mod b/service/go.mod
index ea8262e77b..c7266a8325 100644
--- a/service/go.mod
+++ b/service/go.mod
@@ -4,7 +4,7 @@ go 1.24.0
 
 toolchain go1.24.2
 
-replace github.com/opentdf/platform/protocol/go => github.com/opentdf/platform/protocol/go v0.2.30-0.20250414223513-d97099d3b458
+replace github.com/opentdf/platform/protocol/go => github.com/opentdf/platform/protocol/go v0.2.30-0.20250414224813-c6a2040f3cf5
 
 require (
 	connectrpc.com/connect v1.18.1
diff --git a/service/go.sum b/service/go.sum
index c8146dc15a..52bd3ca1fb 100644
--- a/service/go.sum
+++ b/service/go.sum
@@ -279,8 +279,8 @@ github.com/opentdf/platform/lib/flattening v0.1.3 h1:IuOm/wJVXNrzOV676Ticgr0wyBk
 github.com/opentdf/platform/lib/flattening v0.1.3/go.mod h1:Gs/T+6FGZKk9OAdz2Jf1R8CTGeNRYrq1lZGDeYT3hrY=
 github.com/opentdf/platform/lib/ocrypto v0.1.9 h1:GvgPB7CoK7JmWvsSvJ0hc+RC0wezgcuRpy3q2oYKjdA=
 github.com/opentdf/platform/lib/ocrypto v0.1.9/go.mod h1:UTtqh8mvhAYA+sEnaMxpr/406e84L5Q1sAxtKGIXfu4=
-github.com/opentdf/platform/protocol/go v0.2.30-0.20250414223513-d97099d3b458 h1:1c+jF2jUoZX5WpcDhKv9CkMZybfZwYH3sU/YH9/tCf8=
-github.com/opentdf/platform/protocol/go v0.2.30-0.20250414223513-d97099d3b458/go.mod h1:3nolWMso+6FV8v1UgKO45EvxrVMPF7xHQq76/YRhR8I=
+github.com/opentdf/platform/protocol/go v0.2.30-0.20250414224813-c6a2040f3cf5 h1:zxcXmIczSefx4v80tKCDp7ygUIRqnP5KI4fcEbUbLEY=
+github.com/opentdf/platform/protocol/go v0.2.30-0.20250414224813-c6a2040f3cf5/go.mod h1:3nolWMso+6FV8v1UgKO45EvxrVMPF7xHQq76/YRhR8I=
 github.com/opentdf/platform/sdk v0.3.29 h1:ihTauf25sdgBKwBvK4GzFktSVINDLnwNch7xpLt88AY=
 github.com/opentdf/platform/sdk v0.3.29/go.mod h1:GeN7MqqIwop5sMBAPGR28ZIKXSOHAHaECma/ppsXoiw=
 github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=

From 06426f39a3916172d5459f07bce1627d871b2f73 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Thu, 17 Apr 2025 12:05:40 -0700
Subject: [PATCH 090/110] bump sdk

---
 service/go.mod | 11 ++++++-----
 service/go.sum | 10 ++++++----
 2 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/service/go.mod b/service/go.mod
index 67cae473fb..a07d1c9e79 100644
--- a/service/go.mod
+++ b/service/go.mod
@@ -4,8 +4,6 @@ go 1.24.0
 
 toolchain go1.24.2
 
-replace github.com/opentdf/platform/protocol/go => github.com/opentdf/platform/protocol/go v0.2.30-0.20250414224813-c6a2040f3cf5
-
 require (
 	connectrpc.com/connect v1.18.1
 	connectrpc.com/grpchealth v1.3.0
@@ -31,8 +29,8 @@ require (
 	github.com/opentdf/platform/lib/fixtures v0.2.10
 	github.com/opentdf/platform/lib/flattening v0.1.3
 	github.com/opentdf/platform/lib/ocrypto v0.1.9
-	github.com/opentdf/platform/protocol/go v0.2.29
-	github.com/opentdf/platform/sdk v0.3.29
+	github.com/opentdf/platform/protocol/go v0.3.0
+	github.com/opentdf/platform/sdk v0.4.2
 	github.com/pressly/goose/v3 v3.19.1
 	github.com/spf13/cobra v1.8.1
 	github.com/spf13/viper v1.18.2
@@ -50,7 +48,10 @@ require (
 	gopkg.in/yaml.v3 v3.0.1
 )
 
-require cel.dev/expr v0.19.1 // indirect
+require (
+	cel.dev/expr v0.19.1 // indirect
+	github.com/Masterminds/semver/v3 v3.3.1 // indirect
+)
 
 require (
 	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-20250307204501-0409229c3780.1 // indirect
diff --git a/service/go.sum b/service/go.sum
index f7490de188..c06c590700 100644
--- a/service/go.sum
+++ b/service/go.sum
@@ -20,6 +20,8 @@ github.com/ClickHouse/ch-go v0.58.2 h1:jSm2szHbT9MCAB1rJ3WuCJqmGLi5UTjlNu+f530UT
 github.com/ClickHouse/ch-go v0.58.2/go.mod h1:Ap/0bEmiLa14gYjCiRkYGbXvbe8vwdrfTYWhsuQ99aw=
 github.com/ClickHouse/clickhouse-go/v2 v2.17.1 h1:ZCmAYWpu75IyEi7+Yrs/uaAjiCGY5wfW5kXo64exkX4=
 github.com/ClickHouse/clickhouse-go/v2 v2.17.1/go.mod h1:rkGTvFDTLqLIm0ma+13xmcCfr/08Gvs7KmFt1tgiWHQ=
+github.com/Masterminds/semver/v3 v3.3.1 h1:QtNSWtVZ3nBfk8mAOu/B6v7FMJ+NHTIgUPi7rj+4nv4=
+github.com/Masterminds/semver/v3 v3.3.1/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Masterminds/squirrel v1.5.4 h1:uUcX/aBc8O7Fg9kaISIUsHXdKuqehiXAMQTYX8afzqM=
 github.com/Masterminds/squirrel v1.5.4/go.mod h1:NNaOrjSoIDfDA40n7sr2tPNZRfjzjA400rg+riTZj10=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
@@ -279,10 +281,10 @@ github.com/opentdf/platform/lib/flattening v0.1.3 h1:IuOm/wJVXNrzOV676Ticgr0wyBk
 github.com/opentdf/platform/lib/flattening v0.1.3/go.mod h1:Gs/T+6FGZKk9OAdz2Jf1R8CTGeNRYrq1lZGDeYT3hrY=
 github.com/opentdf/platform/lib/ocrypto v0.1.9 h1:GvgPB7CoK7JmWvsSvJ0hc+RC0wezgcuRpy3q2oYKjdA=
 github.com/opentdf/platform/lib/ocrypto v0.1.9/go.mod h1:UTtqh8mvhAYA+sEnaMxpr/406e84L5Q1sAxtKGIXfu4=
-github.com/opentdf/platform/protocol/go v0.2.30-0.20250414224813-c6a2040f3cf5 h1:zxcXmIczSefx4v80tKCDp7ygUIRqnP5KI4fcEbUbLEY=
-github.com/opentdf/platform/protocol/go v0.2.30-0.20250414224813-c6a2040f3cf5/go.mod h1:3nolWMso+6FV8v1UgKO45EvxrVMPF7xHQq76/YRhR8I=
-github.com/opentdf/platform/sdk v0.3.29 h1:ihTauf25sdgBKwBvK4GzFktSVINDLnwNch7xpLt88AY=
-github.com/opentdf/platform/sdk v0.3.29/go.mod h1:GeN7MqqIwop5sMBAPGR28ZIKXSOHAHaECma/ppsXoiw=
+github.com/opentdf/platform/protocol/go v0.3.0 h1:8m5r2d0drQsiKX/ztQ0ngI2N0EuBati7WQnKc6L1umY=
+github.com/opentdf/platform/protocol/go v0.3.0/go.mod h1:3nolWMso+6FV8v1UgKO45EvxrVMPF7xHQq76/YRhR8I=
+github.com/opentdf/platform/sdk v0.4.2 h1:pRtsLffsDHxt2EZTJQkjOdEFO87RfHkDdA3WMJWr1Pc=
+github.com/opentdf/platform/sdk v0.4.2/go.mod h1:N7wjlJbUqqZd0YQhv8BSR6uAw6wL3b+zU47kglQtw3Q=
 github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
 github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
 github.com/ory/dockertest/v3 v3.10.0 h1:4K3z2VMe8Woe++invjaTB7VRyQXQy5UY+loujO4aNE4=

From d01b5249468147ef3d9ff48718b33a90aee71fde Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Thu, 17 Apr 2025 13:52:25 -0700
Subject: [PATCH 091/110] typo

---
 service/internal/fixtures/fixtures.go | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/service/internal/fixtures/fixtures.go b/service/internal/fixtures/fixtures.go
index effc5c95ea..fe4e633aa6 100644
--- a/service/internal/fixtures/fixtures.go
+++ b/service/internal/fixtures/fixtures.go
@@ -81,7 +81,7 @@ type FixtureDataAction struct {
 }
 
 // Relation table intermediating subject mappings and actions
-type FixtueDataSubjectMappingsActionRelation struct {
+type FixtureDataSubjectMappingsActionRelation struct {
 	SubjectMappingID string `yaml:"subject_mapping_id"`
 	ActionName       string `yaml:"action_name"`
 }
@@ -158,8 +158,8 @@ type FixtureData struct {
 		Data     map[string]FixtureDataAction `yaml:"data"`
 	} `yaml:"custom_actions"`
 	SubjectMappingActions struct {
-		Metadata FixtureMetadata                                    `yaml:"metadata"`
-		Data     map[string]FixtueDataSubjectMappingsActionRelation `yaml:"data"`
+		Metadata FixtureMetadata                                     `yaml:"metadata"`
+		Data     map[string]FixtureDataSubjectMappingsActionRelation `yaml:"data"`
 	} `yaml:"subject_mapping_actions_relation"`
 	SubjectConditionSet struct {
 		Metadata FixtureMetadata                `yaml:"metadata"`

From c53f3595aeea9d7d86cc2055d1724ac5e2cf3005 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Thu, 17 Apr 2025 13:53:43 -0700
Subject: [PATCH 092/110] lint fix

---
 service/policy/db/subject_mappings.go | 1 -
 1 file changed, 1 deletion(-)

diff --git a/service/policy/db/subject_mappings.go b/service/policy/db/subject_mappings.go
index 42673f4356..bca6ebfefc 100644
--- a/service/policy/db/subject_mappings.go
+++ b/service/policy/db/subject_mappings.go
@@ -324,7 +324,6 @@ func (c PolicyDBClient) CreateSubjectMapping(ctx context.Context, s *subjectmapp
 		Actions:             actions,
 		Metadata:            metadata,
 	}, nil
-
 }
 
 func (c PolicyDBClient) GetSubjectMapping(ctx context.Context, id string) (*policy.SubjectMapping, error) {

From c8643d3b28a1c37b22ecc60f99c5b880172d6843 Mon Sep 17 00:00:00 2001
From: Jake Van Vorhis <83739412+jakedoublev@users.noreply.github.com>
Date: Thu, 17 Apr 2025 14:08:46 -0700
Subject: [PATCH 093/110] feat(policy): actions db CRUD handlers and
 integration tests (db part 2) (#2049)

- Improvements to sqlc queries
- wrapping go policy db client queries
- integration tests
---
 service/integration/actions_test.go          | 379 +++++++++++++++++++
 service/integration/attribute_fqns_test.go   |   6 +-
 service/integration/subject_mappings_test.go | 154 ++++++--
 service/policy/db/actions.go                 | 219 +++++++++++
 service/policy/db/query.sql                  |  62 +--
 service/policy/db/query.sql.go               | 143 ++-----
 service/policy/db/subject_mappings.go        |  16 +-
 7 files changed, 798 insertions(+), 181 deletions(-)
 create mode 100644 service/integration/actions_test.go
 create mode 100644 service/policy/db/actions.go

diff --git a/service/integration/actions_test.go b/service/integration/actions_test.go
new file mode 100644
index 0000000000..cc24a396c5
--- /dev/null
+++ b/service/integration/actions_test.go
@@ -0,0 +1,379 @@
+package integration
+
+import (
+	"context"
+	"log/slog"
+	"strings"
+	"testing"
+
+	"github.com/opentdf/platform/protocol/go/common"
+	"github.com/opentdf/platform/protocol/go/policy"
+	"github.com/opentdf/platform/protocol/go/policy/actions"
+	"github.com/opentdf/platform/service/internal/fixtures"
+	"github.com/opentdf/platform/service/pkg/db"
+	policydb "github.com/opentdf/platform/service/policy/db"
+	"github.com/stretchr/testify/suite"
+)
+
+type ActionsSuite struct {
+	suite.Suite
+	f   fixtures.Fixtures
+	db  fixtures.DBInterface
+	ctx context.Context //nolint:containedctx // context is used in the test suite
+}
+
+func (s *ActionsSuite) SetupSuite() {
+	slog.Info("setting up db.Actions test suite")
+	s.ctx = context.Background()
+	c := *Config
+
+	c.DB.Schema = "test_opentdf_actions"
+	s.db = fixtures.NewDBInterface(c)
+	s.f = fixtures.NewFixture(s.db)
+	s.f.Provision()
+}
+
+func (s *ActionsSuite) TearDownSuite() {
+	slog.Info("tearing down db.Actions test suite")
+	s.f.TearDown()
+}
+
+func (s *ActionsSuite) Test_ListActions_NoPagination_Succeeds() {
+	fixtureCustomAction1 := s.f.GetCustomActionKey("custom_action_1")
+	fixtureCustomAction2 := s.f.GetCustomActionKey("other_special_action")
+
+	list, err := s.db.PolicyClient.ListActions(s.ctx, &actions.ListActionsRequest{})
+	s.NotNil(list)
+	s.Require().NoError(err)
+
+	foundCustomAction1 := false
+	foundCustomAction2 := false
+	foundRead := false
+	foundCreate := false
+	foundUpdate := false
+	foundDelete := false
+
+	for _, action := range list.GetActionsCustom() {
+		switch action.Name {
+		case fixtureCustomAction1.Name:
+			foundCustomAction1 = true
+		case fixtureCustomAction2.Name:
+			foundCustomAction2 = true
+		}
+	}
+	for _, action := range list.GetActionsStandard() {
+		switch policydb.ActionStandard(action.Name) {
+		case policydb.ActionRead:
+			foundRead = true
+		case policydb.ActionCreate:
+			foundCreate = true
+		case policydb.ActionUpdate:
+			foundUpdate = true
+		case policydb.ActionDelete:
+			foundDelete = true
+		}
+	}
+	s.True(foundCustomAction1)
+	s.True(foundCustomAction2)
+	s.True(foundRead)
+	s.True(foundCreate)
+	s.True(foundUpdate)
+	s.True(foundDelete)
+}
+
+func (s *ActionsSuite) Test_ListActions_Pagination_Succeeds() {
+	list, err := s.db.PolicyClient.ListActions(s.ctx, &actions.ListActionsRequest{})
+	s.NotNil(list)
+	s.Require().NoError(err)
+	total := list.GetPagination().GetTotal()
+
+	higherOffsetThanListCount := total + 1
+	list, err = s.db.PolicyClient.ListActions(s.ctx, &actions.ListActionsRequest{
+		Pagination: &policy.PageRequest{
+			Offset: higherOffsetThanListCount,
+		},
+	})
+	s.NotNil(list)
+	s.Require().NoError(err)
+	s.Equal(int32(0), list.GetPagination().GetNextOffset())
+	s.Equal(higherOffsetThanListCount, list.GetPagination().GetCurrentOffset())
+
+	list, err = s.db.PolicyClient.ListActions(s.ctx, &actions.ListActionsRequest{
+		Pagination: &policy.PageRequest{
+			Offset: 0,
+			Limit:  total - 1,
+		},
+	})
+	s.NotNil(list)
+	s.Require().NoError(err)
+	s.Equal(int32(total), list.GetPagination().GetTotal())
+	s.Equal(int32(0), list.GetPagination().GetCurrentOffset())
+	s.Equal(int32(total-1), list.GetPagination().GetNextOffset())
+}
+
+func (s *ActionsSuite) Test_ListActions_LimitLargerThanConfigured_Fails() {
+	list, err := s.db.PolicyClient.ListActions(s.ctx, &actions.ListActionsRequest{
+		Pagination: &policy.PageRequest{
+			Limit: s.db.LimitMax + 1,
+		},
+	})
+	s.Nil(list)
+	s.Require().Error(err)
+	s.Require().ErrorIs(err, db.ErrListLimitTooLarge)
+}
+
+func (s *ActionsSuite) Test_GetAction_Id_Succeeds() {
+	fixtureCustomAction1 := s.f.GetCustomActionKey("custom_action_1")
+	actionRead := s.f.GetStandardAction(policydb.ActionRead.String())
+
+	action, err := s.db.PolicyClient.GetAction(s.ctx, &actions.GetActionRequest{
+		Identifier: &actions.GetActionRequest_Id{
+			Id: fixtureCustomAction1.ID,
+		},
+	})
+	s.NotNil(action)
+	s.Require().NoError(err)
+
+	s.Equal(fixtureCustomAction1.ID, action.GetId())
+	s.Equal(fixtureCustomAction1.Name, action.GetName())
+	s.NotNil(action.GetMetadata())
+
+	action, err = s.db.PolicyClient.GetAction(s.ctx, &actions.GetActionRequest{
+		Identifier: &actions.GetActionRequest_Id{
+			Id: actionRead.Id,
+		},
+	})
+	s.NotNil(action)
+	s.Require().NoError(err)
+	s.Equal(actionRead.Id, action.GetId())
+	s.Equal(actionRead.Name, action.GetName())
+	s.NotNil(action.GetMetadata())
+}
+
+func (s *ActionsSuite) Test_GetAction_Name_Succeeds() {
+	customAction := s.f.GetCustomActionKey("other_special_action")
+	actionCreate := s.f.GetStandardAction(policydb.ActionCreate.String())
+	action, err := s.db.PolicyClient.GetAction(s.ctx, &actions.GetActionRequest{
+		Identifier: &actions.GetActionRequest_Name{
+			Name: customAction.Name,
+		},
+	})
+	s.NotNil(action)
+	s.Require().NoError(err)
+	s.Equal(customAction.ID, action.GetId())
+	s.Equal(customAction.Name, action.GetName())
+	s.NotNil(action.GetMetadata())
+
+	action, err = s.db.PolicyClient.GetAction(s.ctx, &actions.GetActionRequest{
+		Identifier: &actions.GetActionRequest_Name{
+			Name: actionCreate.Name,
+		},
+	})
+	s.NotNil(action)
+	s.Require().NoError(err)
+	s.Equal(actionCreate.Name, action.GetName())
+	s.Equal(actionCreate.Id, action.GetId())
+	s.NotNil(action.GetMetadata())
+}
+
+func (s *ActionsSuite) Test_GetAction_NonExistent_Fails() {
+	action, err := s.db.PolicyClient.GetAction(s.ctx, &actions.GetActionRequest{
+		Identifier: &actions.GetActionRequest_Id{
+			Id: nonExistingActionUUID,
+		},
+	})
+	s.Nil(action)
+	s.Require().Error(err)
+	s.Require().ErrorIs(err, db.ErrNotFound)
+
+	action, err = s.db.PolicyClient.GetAction(s.ctx, &actions.GetActionRequest{
+		Identifier: &actions.GetActionRequest_Name{
+			Name: "totally_unknown_action",
+		},
+	})
+	s.Nil(action)
+	s.Require().Error(err)
+	s.Require().ErrorIs(err, db.ErrNotFound)
+}
+
+func (s *ActionsSuite) Test_CreateAction_Succeeds() {
+	newName := "new_custom_action_createaction"
+	action, err := s.db.PolicyClient.CreateAction(s.ctx, &actions.CreateActionRequest{
+		Name: newName,
+		Metadata: &common.MetadataMutable{
+			Labels: map[string]string{
+				"label1": "value1",
+				"label2": "value2",
+			},
+		},
+	})
+	s.NotNil(action)
+	s.Require().NoError(err)
+	s.NotEqual("", action.GetId())
+	s.Equal(newName, action.GetName())
+	s.NotNil(action.GetMetadata())
+	s.Equal("value1", action.GetMetadata().GetLabels()["label1"])
+	s.Equal("value2", action.GetMetadata().GetLabels()["label2"])
+}
+
+func (s *ActionsSuite) Test_CreateAction_Conflict_Fails() {
+	fixtureCustomAction := s.f.GetCustomActionKey("custom_action_1")
+	action, err := s.db.PolicyClient.CreateAction(s.ctx, &actions.CreateActionRequest{
+		Name: fixtureCustomAction.Name,
+	},
+	)
+	s.Nil(action)
+	s.Require().Error(err)
+	s.Require().ErrorIs(err, db.ErrUniqueConstraintViolation)
+}
+
+func (s *ActionsSuite) Test_CreateAction_NormalizesToLowerCase() {
+	newName := "New_Custom_Action_CreateAction_UPPER"
+	action, err := s.db.PolicyClient.CreateAction(s.ctx, &actions.CreateActionRequest{
+		Name: newName,
+	},
+	)
+	s.NotNil(action)
+	s.Require().NoError(err)
+	s.Equal(strings.ToLower(newName), action.GetName())
+}
+
+func (s *ActionsSuite) Test_UpdateAction_Succeeds() {
+	newAction, err := s.db.PolicyClient.CreateAction(s.ctx, &actions.CreateActionRequest{
+		Name: "new_custom_action_updateaction",
+		Metadata: &common.MetadataMutable{
+			Labels: map[string]string{
+				"original": "original_value",
+			},
+		},
+	})
+	s.NotNil(newAction)
+	s.Require().NoError(err)
+	s.NotEqual("", newAction.GetId())
+	s.Equal("new_custom_action_updateaction", newAction.GetName())
+
+	differentName := "new_custom_action_updateaction_renamed"
+	updatedAction, err := s.db.PolicyClient.UpdateAction(s.ctx, &actions.UpdateActionRequest{
+		Id:   newAction.GetId(),
+		Name: differentName,
+		Metadata: &common.MetadataMutable{
+			Labels: map[string]string{
+				"original": "replaced",
+			},
+		},
+		MetadataUpdateBehavior: common.MetadataUpdateEnum_METADATA_UPDATE_ENUM_REPLACE,
+	})
+	s.NotNil(updatedAction)
+	s.Require().NoError(err)
+
+	got, err := s.db.PolicyClient.GetAction(s.ctx, &actions.GetActionRequest{
+		Identifier: &actions.GetActionRequest_Id{
+			Id: updatedAction.GetId(),
+		},
+	})
+	s.NotNil(got)
+	s.Require().NoError(err)
+	s.Equal(differentName, got.GetName())
+	s.Equal("replaced", got.GetMetadata().GetLabels()["original"])
+}
+
+func (s *ActionsSuite) Test_UpdateAction_NormalizesToLowerCase() {
+	newAction, err := s.db.PolicyClient.CreateAction(s.ctx, &actions.CreateActionRequest{
+		Name: "testing_update_action_casing",
+	})
+	s.NotNil(newAction)
+	s.Require().NoError(err)
+	s.NotEqual("", newAction.GetId())
+	s.Equal("testing_update_action_casing", newAction.GetName())
+
+	differentName := "UppER_CasE_Change"
+	updatedAction, err := s.db.PolicyClient.UpdateAction(s.ctx, &actions.UpdateActionRequest{
+		Id:   newAction.GetId(),
+		Name: differentName,
+	})
+	s.NotNil(updatedAction)
+	s.Require().NoError(err)
+
+	got, err := s.db.PolicyClient.GetAction(s.ctx, &actions.GetActionRequest{
+		Identifier: &actions.GetActionRequest_Id{
+			Id: updatedAction.GetId(),
+		},
+	})
+	s.NotNil(got)
+	s.Require().NoError(err)
+	s.Equal(strings.ToLower(differentName), got.GetName())
+}
+
+func (s *ActionsSuite) Test_UpdateAction_Conflict_Fails() {
+	fixtureCustomAction := s.f.GetCustomActionKey("custom_action_1")
+	fixtureCustomAction2 := s.f.GetCustomActionKey("other_special_action")
+	action, err := s.db.PolicyClient.UpdateAction(s.ctx, &actions.UpdateActionRequest{
+		Id:   fixtureCustomAction.ID,
+		Name: fixtureCustomAction2.Name,
+	})
+	s.Nil(action)
+	s.Require().Error(err)
+	s.Require().ErrorIs(err, db.ErrUniqueConstraintViolation)
+}
+
+func (s *ActionsSuite) Test_UpdateAction_NonExistent_Fails() {
+	action, err := s.db.PolicyClient.UpdateAction(s.ctx, &actions.UpdateActionRequest{
+		Id:   nonExistingActionUUID,
+		Name: "new_name_nonexistent",
+	})
+	s.Nil(action)
+	s.Require().Error(err)
+	s.Require().ErrorIs(err, db.ErrNotFound)
+}
+
+func (s *ActionsSuite) Test_DeleteAction_Succeeds() {
+	created, err := s.db.PolicyClient.CreateAction(s.ctx, &actions.CreateActionRequest{
+		Name: "new_custom_action_deleteaction",
+	})
+	s.NotNil(created)
+	s.Require().NoError(err)
+	s.NotEqual("", created.GetId())
+
+	deleted, err := s.db.PolicyClient.DeleteAction(s.ctx, &actions.DeleteActionRequest{
+		Id: created.GetId(),
+	})
+	s.NotNil(deleted)
+	s.Require().NoError(err)
+	s.Equal(created.GetId(), deleted.GetId())
+
+	got, err := s.db.PolicyClient.GetAction(s.ctx, &actions.GetActionRequest{
+		Identifier: &actions.GetActionRequest_Id{
+			Id: created.GetId(),
+		},
+	})
+	s.Nil(got)
+	s.Require().Error(err)
+	s.Require().ErrorIs(err, db.ErrNotFound)
+}
+
+func (s *ActionsSuite) Test_DeleteAction_NonExistent_Fails() {
+	action, err := s.db.PolicyClient.DeleteAction(s.ctx, &actions.DeleteActionRequest{
+		Id: nonExistingActionUUID,
+	})
+	s.Nil(action)
+	s.Require().Error(err)
+	s.Require().ErrorIs(err, db.ErrNotFound)
+}
+
+func (s *ActionsSuite) Test_DeleteAction_StandardAction_Fails() {
+	actionRead := s.f.GetStandardAction(policydb.ActionRead.String())
+	action, err := s.db.PolicyClient.DeleteAction(s.ctx, &actions.DeleteActionRequest{
+		Id: actionRead.Id,
+	})
+	s.Nil(action)
+	s.Require().Error(err)
+	s.Require().ErrorIs(err, db.ErrRestrictViolation)
+	s.Contains(err.Error(), actionRead.Name)
+}
+
+func TestActionsSuite(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping actions integration tests")
+	}
+	suite.Run(t, new(ActionsSuite))
+}
diff --git a/service/integration/attribute_fqns_test.go b/service/integration/attribute_fqns_test.go
index 9e085ea67f..b26eec0b29 100644
--- a/service/integration/attribute_fqns_test.go
+++ b/service/integration/attribute_fqns_test.go
@@ -14,6 +14,7 @@ import (
 	"github.com/opentdf/platform/protocol/go/policy/subjectmapping"
 	"github.com/opentdf/platform/service/internal/fixtures"
 	"github.com/opentdf/platform/service/pkg/db"
+	policydb "github.com/opentdf/platform/service/policy/db"
 	"github.com/stretchr/testify/suite"
 	"google.golang.org/protobuf/proto"
 )
@@ -721,9 +722,8 @@ func (s *AttributeFqnSuite) bigTestSetup(namespaceName string) bigSetup {
 	s.Require().NoError(err)
 	s.NotNil(val2Grant)
 
-	actionRead := s.f.GetStandardAction("read")
-	actionCreate := s.f.GetStandardAction("create")
-
+	actionRead := s.f.GetStandardAction(policydb.ActionRead.String())
+	actionCreate := s.f.GetStandardAction(policydb.ActionCreate.String())
 	// give a subject mapping to the first value
 	val1SM, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              val1.GetId(),
diff --git a/service/integration/subject_mappings_test.go b/service/integration/subject_mappings_test.go
index 4382d84e32..2041f6f1cf 100644
--- a/service/integration/subject_mappings_test.go
+++ b/service/integration/subject_mappings_test.go
@@ -3,6 +3,7 @@ package integration
 import (
 	"context"
 	"log/slog"
+	"strings"
 	"testing"
 
 	"github.com/opentdf/platform/protocol/go/common"
@@ -10,11 +11,15 @@ import (
 	"github.com/opentdf/platform/protocol/go/policy/subjectmapping"
 	"github.com/opentdf/platform/service/internal/fixtures"
 	"github.com/opentdf/platform/service/pkg/db"
+	policydb "github.com/opentdf/platform/service/policy/db"
 	"github.com/stretchr/testify/suite"
 	"google.golang.org/protobuf/proto"
 )
 
-const nonExistentAttributeValueUUID = "78909865-8888-9999-9999-000000000000"
+const (
+	nonExistentAttributeValueUUID = "78909865-8888-9999-9999-000000000000"
+	nonExistingActionUUID         = "5dff18c8-1192-4f2e-aa21-2d793c9d97b2"
+)
 
 type SubjectMappingsSuite struct {
 	suite.Suite
@@ -56,9 +61,8 @@ var (
 func (s *SubjectMappingsSuite) TestCreateSubjectMapping_ExistingSubjectConditionSetId() {
 	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value2").ID
 	fixtureSCSId := s.f.GetSubjectConditionSetKey("subject_condition_set1").ID
-	actionRead := s.f.GetStandardAction("read")
-	actionCreate := s.f.GetStandardAction("create")
-
+	actionRead := s.f.GetStandardAction(policydb.ActionRead.String())
+	actionCreate := s.f.GetStandardAction(policydb.ActionCreate.String())
 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              fixtureAttrValID,
 		ExistingSubjectConditionSetId: fixtureSCSId,
@@ -91,8 +95,7 @@ func (s *SubjectMappingsSuite) TestCreateSubjectMapping_ExistingSubjectCondition
 
 func (s *SubjectMappingsSuite) TestCreateSubjectMapping_NewSubjectConditionSet() {
 	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value2").ID
-	actionCreate := s.f.GetStandardAction("create")
-
+	actionCreate := s.f.GetStandardAction(policydb.ActionCreate.String())
 	scs := &subjectmapping.SubjectConditionSetCreate{
 		SubjectSets: []*policy.SubjectSet{
 			{
@@ -142,7 +145,8 @@ func (s *SubjectMappingsSuite) TestCreateSubjectMapping_NewSubjectConditionSet()
 
 func (s *SubjectMappingsSuite) TestCreateSubjectMapping_NonExistentAttributeValueId_Fails() {
 	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set2")
-	actionCreate := s.f.GetStandardAction("create")
+	actionCreate := s.f.GetStandardAction(policydb.ActionCreate.String())
+
 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		Actions:                       []*policy.Action{actionCreate},
 		ExistingSubjectConditionSetId: fixtureScs.ID,
@@ -157,7 +161,7 @@ func (s *SubjectMappingsSuite) TestCreateSubjectMapping_NonExistentAttributeValu
 
 func (s *SubjectMappingsSuite) TestCreateSubjectMapping_NonExistentSubjectConditionSetId_Fails() {
 	fixtureAttrVal := s.f.GetAttributeValueKey("example.com/attr/attr2/value/value1")
-	actionRead := s.f.GetStandardAction("read")
+	actionRead := s.f.GetStandardAction(policydb.ActionRead.String())
 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              fixtureAttrVal.ID,
 		Actions:                       []*policy.Action{actionRead},
@@ -170,12 +174,74 @@ func (s *SubjectMappingsSuite) TestCreateSubjectMapping_NonExistentSubjectCondit
 	s.Require().ErrorIs(err, db.ErrNotFound)
 }
 
+func (s *SubjectMappingsSuite) TestCreateSubjectMapping_NonExistentActionId_Fails() {
+	fixtureAttrVal := s.f.GetAttributeValueKey("example.com/attr/attr2/value/value1")
+	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set3")
+
+	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
+		AttributeValueId: fixtureAttrVal.ID,
+		Actions: []*policy.Action{
+			{
+				Id: nonExistingActionUUID,
+			},
+		},
+		ExistingSubjectConditionSetId: fixtureScs.ID,
+	}
+
+	created, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, newSubjectMapping)
+	s.Require().Error(err)
+	s.Nil(created)
+	s.Require().ErrorIs(err, db.ErrForeignKeyViolation)
+}
+
+func (s *SubjectMappingsSuite) TestCreateSubjectMapping_BrandNewActionNames_Succeeds() {
+	fixtureAttrVal := s.f.GetAttributeValueKey("example.com/attr/attr1/value/value2")
+	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set1")
+	newNameOne := "NewAction-Testing-SMCreate-1"
+	newNameTwo := "NewAction_Testing_SMCreate_2"
+
+	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
+		AttributeValueId: fixtureAttrVal.ID,
+		Actions: []*policy.Action{
+			{
+				Name: newNameOne,
+			},
+			{
+				Name: newNameTwo,
+			},
+		},
+		ExistingSubjectConditionSetId: fixtureScs.ID,
+	}
+
+	created, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, newSubjectMapping)
+	s.NotNil(created)
+	s.Require().NoError(err)
+
+	got, err := s.db.PolicyClient.GetSubjectMapping(s.ctx, created.GetId())
+	s.Require().NoError(err)
+	s.NotNil(got)
+
+	foundNewActionOne := false
+	foundNewActionTwo := false
+	for _, a := range got.GetActions() {
+		if a.GetName() == strings.ToLower(newNameOne) {
+			foundNewActionOne = true
+		}
+		if a.GetName() == strings.ToLower(newNameTwo) {
+			foundNewActionTwo = true
+		}
+		s.NotEqual("", a.GetId())
+	}
+	s.True(foundNewActionOne)
+	s.True(foundNewActionTwo)
+}
+
 func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_Actions() {
 	// create a new one SM with actions, update it with different actions, and verify the update
 	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value2").ID
 	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set3")
-	actionUpdate := s.f.GetStandardAction("update")
-	actionDelete := s.f.GetStandardAction("delete")
+	actionUpdate := s.f.GetStandardAction(policydb.ActionUpdate.String())
+	actionDelete := s.f.GetStandardAction(policydb.ActionDelete.String())
 
 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              fixtureAttrValID,
@@ -221,10 +287,11 @@ func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_Actions() {
 	s.False(updatedAt.AsTime().IsZero())
 	s.True(updatedAt.AsTime().After(createdAt.AsTime()))
 
-	// update with an action not in the current
+	// update with actions not in the current
+	newActionName := "NewAction-Testing-SM-UPDATE"
 	update = &subjectmapping.UpdateSubjectMappingRequest{
 		Id:      created.GetId(),
-		Actions: []*policy.Action{actionDelete},
+		Actions: []*policy.Action{actionDelete, {Name: newActionName}},
 	}
 	updated, err = s.db.PolicyClient.UpdateSubjectMapping(s.ctx, update)
 	s.Require().NoError(err)
@@ -235,14 +302,56 @@ func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_Actions() {
 	s.Require().NoError(err)
 	s.NotNil(got)
 	s.Equal(len(update.GetActions()), len(got.GetActions()))
-	s.Equal(actionDelete.GetName(), got.GetActions()[0].GetName())
+	foundDelete := false
+	foundNewAction := false
+	for _, a := range got.GetActions() {
+		if a.GetName() == actionDelete.GetName() {
+			foundDelete = true
+		}
+		if a.GetName() == strings.ToLower(newActionName) {
+			foundNewAction = true
+		}
+	}
+	s.True(foundDelete)
+	s.True(foundNewAction)
+}
+
+func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_Actions_NonExistentActionID_Fails() {
+	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value1").ID
+	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set2")
+	actionRead := s.f.GetStandardAction(policydb.ActionRead.String())
+
+	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
+		AttributeValueId:              fixtureAttrValID,
+		Actions:                       []*policy.Action{actionRead},
+		ExistingSubjectConditionSetId: fixtureScs.ID,
+	}
+	created, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, newSubjectMapping)
+	s.Require().NoError(err)
+	s.NotNil(created)
+
+	got, err := s.db.PolicyClient.GetSubjectMapping(s.ctx, created.GetId())
+	s.Require().NoError(err)
+	s.NotNil(got)
+	s.Equal(len(newSubjectMapping.GetActions()), len(got.GetActions()))
+
+	// update with a non-existent action
+	update := &subjectmapping.UpdateSubjectMappingRequest{
+		Id:      created.GetId(),
+		Actions: []*policy.Action{{Id: nonExistingActionUUID}},
+	}
+
+	updated, err := s.db.PolicyClient.UpdateSubjectMapping(s.ctx, update)
+	s.Nil(updated)
+	s.Require().Error(err)
+	s.Require().ErrorIs(err, db.ErrForeignKeyViolation)
 }
 
 func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_SubjectConditionSetId() {
 	// create a new one, update it, and verify the update
 	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value1").ID
 	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set1")
-	actionDelete := s.f.GetStandardAction("delete")
+	actionDelete := s.f.GetStandardAction(policydb.ActionDelete.String())
 
 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              fixtureAttrValID,
@@ -281,8 +390,7 @@ func (s *SubjectMappingsSuite) Test_UpdateSubjectMapping_UpdateAllAllowedFields(
 	// create a new one, update it, and verify the update
 	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value1").ID
 	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set1")
-	actionCreate := s.f.GetStandardAction("create")
-
+	actionCreate := s.f.GetStandardAction(policydb.ActionCreate.String())
 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              fixtureAttrValID,
 		Actions:                       []*policy.Action{actionCreate},
@@ -558,7 +666,7 @@ func (s *SubjectMappingsSuite) TestDeleteSubjectMapping_DoesNotDeleteSubjectCond
 			},
 		},
 	}
-	actionRead := s.f.GetStandardAction("read")
+	actionRead := s.f.GetStandardAction(policydb.ActionRead.String())
 
 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:       fixtureAttrValID,
@@ -1221,7 +1329,7 @@ func (s *SubjectMappingsSuite) TestGetMatchedSubjectMappings_DeactivatedValueNot
 	// create a new subject mapping with a deactivated attribute value
 	fixtureAttrVal := s.f.GetAttributeValueKey("deactivated.io/attr/deactivated_attr/value/deactivated_value")
 	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set1")
-	actionRead := s.f.GetStandardAction("read")
+	actionRead := s.f.GetStandardAction(policydb.ActionRead.String())
 
 	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              fixtureAttrVal.ID,
@@ -1274,9 +1382,9 @@ func (s *SubjectMappingsSuite) TestGetMatchedSubjectMappings_ConditionSetReusedB
 	s.Require().NoError(err)
 	s.NotNil(createdSCS)
 
-	actionRead := s.f.GetStandardAction("read")
-	actionDelete := s.f.GetStandardAction("delete")
-	actionUpdate := s.f.GetStandardAction("update")
+	actionRead := s.f.GetStandardAction(policydb.ActionRead.String())
+	actionDelete := s.f.GetStandardAction(policydb.ActionDelete.String())
+	actionUpdate := s.f.GetStandardAction(policydb.ActionUpdate.String())
 
 	// Create two subject mappings across different values that reuse the same subject condition set
 	attrVal1 := s.f.GetAttributeValueKey("example.com/attr/attr1/value/value1").ID
@@ -1349,8 +1457,8 @@ func (s *SubjectMappingsSuite) TestGetMatchedSubjectMappings_OnlyMatchesOnePrope
 		},
 	}
 
-	actionCreate := s.f.GetStandardAction("create")
-	actionRead := s.f.GetStandardAction("read")
+	actionCreate := s.f.GetStandardAction(policydb.ActionCreate.String())
+	actionRead := s.f.GetStandardAction(policydb.ActionRead.String())
 
 	subjectMapping := &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:       fixtureAttrValID,
diff --git a/service/policy/db/actions.go b/service/policy/db/actions.go
new file mode 100644
index 0000000000..880560809c
--- /dev/null
+++ b/service/policy/db/actions.go
@@ -0,0 +1,219 @@
+package db
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/opentdf/platform/protocol/go/common"
+	"github.com/opentdf/platform/protocol/go/policy"
+	"github.com/opentdf/platform/protocol/go/policy/actions"
+	"github.com/opentdf/platform/service/pkg/db"
+	"google.golang.org/protobuf/encoding/protojson"
+)
+
+type ActionStandard string
+
+const (
+	ActionCreate ActionStandard = "create"
+	ActionRead   ActionStandard = "read"
+	ActionUpdate ActionStandard = "update"
+	ActionDelete ActionStandard = "delete"
+)
+
+// Add a validation method
+func (a ActionStandard) IsValid() bool {
+    switch a {
+    case ActionCreate, ActionRead, ActionUpdate, ActionDelete:
+        return true
+    }
+    return false
+}
+
+// If needed, implement the Stringer interface explicitly
+func (a ActionStandard) String() string {
+    return string(a)
+}
+
+func (c PolicyDBClient) GetAction(ctx context.Context, req *actions.GetActionRequest) (*policy.Action, error) {
+	getActionParams := getActionParams{}
+	if req.GetId() != "" {
+		getActionParams.ID = pgtypeUUID(req.GetId())
+	} else if req.GetName() != "" {
+		getActionParams.Name = pgtypeText(strings.ToLower(req.GetName()))
+	} else {
+		return nil, db.ErrSelectIdentifierInvalid
+	}
+
+	got, err := c.Queries.getAction(ctx, getActionParams)
+	if err != nil {
+		return nil, db.WrapIfKnownInvalidQueryErr(err)
+	}
+
+	metadata := &common.Metadata{}
+	if err := protojson.Unmarshal(got.Metadata, metadata); err != nil {
+		return nil, db.WrapIfKnownInvalidQueryErr(err)
+	}
+
+	return &policy.Action{
+		Id:       got.ID,
+		Name:     got.Name,
+		Metadata: metadata,
+	}, nil
+}
+
+func (c PolicyDBClient) ListActions(ctx context.Context, req *actions.ListActionsRequest) (*actions.ListActionsResponse, error) {
+	limit, offset := c.getRequestedLimitOffset(req.GetPagination())
+
+	maxLimit := c.listCfg.limitMax
+	if maxLimit > 0 && limit > maxLimit {
+		return nil, db.ErrListLimitTooLarge
+	}
+
+	list, err := c.Queries.listActions(ctx, listActionsParams{
+		Limit:  limit,
+		Offset: offset,
+	})
+	if err != nil {
+		return nil, db.WrapIfKnownInvalidQueryErr(err)
+	}
+
+	var (
+		actionsStandard []*policy.Action
+		actionsCustom   []*policy.Action
+	)
+	for _, a := range list {
+		metadata := &common.Metadata{}
+		if err := unmarshalMetadata(a.Metadata, metadata); err != nil {
+			return nil, err
+		}
+		action := &policy.Action{
+			Id:       a.ID,
+			Name:     a.Name,
+			Metadata: metadata,
+		}
+		if a.IsStandard {
+			actionsStandard = append(actionsStandard, action)
+		} else {
+			actionsCustom = append(actionsCustom, action)
+		}
+	}
+
+	var total int32
+	var nextOffset int32
+	if len(list) > 0 {
+		total = int32(list[0].Total)
+		nextOffset = getNextOffset(offset, limit, total)
+	}
+
+	return &actions.ListActionsResponse{
+		ActionsStandard: actionsStandard,
+		ActionsCustom:   actionsCustom,
+		Pagination: &policy.PageResponse{
+			CurrentOffset: offset,
+			NextOffset:    nextOffset,
+			Total:         total,
+		},
+	}, nil
+}
+
+func (c PolicyDBClient) CreateAction(ctx context.Context, req *actions.CreateActionRequest) (*policy.Action, error) {
+	metadataJSON, _, err := db.MarshalCreateMetadata(req.GetMetadata())
+	if err != nil {
+		return nil, err
+	}
+	createParams := createCustomActionParams{
+		Name:     strings.ToLower(req.GetName()),
+		Metadata: metadataJSON,
+	}
+
+	createdID, err := c.Queries.createCustomAction(ctx, createParams)
+	if err != nil {
+		return nil, db.WrapIfKnownInvalidQueryErr(err)
+	}
+
+	return c.GetAction(ctx, &actions.GetActionRequest{
+		Identifier: &actions.GetActionRequest_Id{
+			Id: createdID,
+		},
+	})
+}
+
+func (c PolicyDBClient) UpdateAction(ctx context.Context, req *actions.UpdateActionRequest) (*policy.Action, error) {
+	// if extend we need to merge the metadata
+	metadataJSON, metadata, err := db.MarshalUpdateMetadata(req.GetMetadata(), req.GetMetadataUpdateBehavior(), func() (*common.Metadata, error) {
+		a, err := c.GetAction(ctx, &actions.GetActionRequest{
+			Identifier: &actions.GetActionRequest_Id{
+				Id: req.GetId(),
+			},
+		})
+		if err != nil {
+			return nil, err
+		}
+		if a.GetMetadata() == nil {
+			return nil, nil //nolint:nilnil // no metadata does not mean no error
+		}
+		return a.GetMetadata(), nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	// Update what fields were patched to update
+	updateParams := updateCustomActionParams{
+		ID: req.GetId(),
+	}
+	if metadataJSON != nil {
+		updateParams.Metadata = metadataJSON
+	}
+	if req.GetName() != "" {
+		updateParams.Name = pgtypeText(strings.ToLower(req.GetName()))
+	}
+
+	count, err := c.Queries.updateCustomAction(ctx, updateParams)
+	if err != nil {
+		return nil, db.WrapIfKnownInvalidQueryErr(err)
+	}
+	if count == 0 {
+		return nil, db.ErrNotFound
+	}
+
+	return &policy.Action{
+		Id:       req.GetId(),
+		Name:     req.GetName(),
+		Metadata: metadata,
+	}, nil
+}
+
+func (c PolicyDBClient) DeleteAction(ctx context.Context, req *actions.DeleteActionRequest) (*policy.Action, error) {
+	count, err := c.Queries.deleteCustomAction(ctx, req.GetId())
+	if err != nil {
+		return nil, db.WrapIfKnownInvalidQueryErr(err)
+	}
+	// if did not delete, was either not found or was a standard action
+	if count == 0 {
+		got, err := c.GetAction(ctx, &actions.GetActionRequest{
+			Identifier: &actions.GetActionRequest_Id{
+				Id: req.GetId(),
+			},
+		})
+		// not found
+		if err != nil && errors.Is(err, db.ErrNotFound) {
+			return nil, err
+		}
+		// standard action
+		name := got.GetName()
+		if name == string(ActionCreate) ||
+			name == string(ActionRead) ||
+			name == string(ActionUpdate) ||
+			name == string(ActionDelete) {
+			return nil, fmt.Errorf("cannot delete standard action %s: %w", name, db.ErrRestrictViolation)
+		}
+		return nil, db.ErrNotFound
+	}
+
+	return &policy.Action{
+		Id: req.GetId(),
+	}, nil
+}
diff --git a/service/policy/db/query.sql b/service/policy/db/query.sql
index 0e1793985b..b85a28e176 100644
--- a/service/policy/db/query.sql
+++ b/service/policy/db/query.sql
@@ -1009,11 +1009,11 @@ WITH
             sqlc.arg('id'),
             a
         FROM unnest(sqlc.narg('action_ids')::UUID[]) AS a
-        WHERE 
+        WHERE
             sqlc.narg('action_ids')::UUID[] IS NOT NULL
             AND NOT EXISTS (
-                SELECT 1 
-                FROM subject_mapping_actions 
+                SELECT 1
+                FROM subject_mapping_actions
                 WHERE subject_mapping_id = sqlc.arg('id') AND action_id = a
             )
         RETURNING action_id
@@ -1022,12 +1022,8 @@ WITH
         SELECT COUNT(*) AS cnt
         FROM subject_mapping_update
     )
-SELECT
-    1 / CASE WHEN (
-            SELECT cnt FROM update_count
-        ) = 0 THEN 0
-        ELSE 1
-    END;
+SELECT cnt
+FROM update_count;
 
 -- name: deleteSubjectMapping :execrows
 DELETE FROM subject_mappings WHERE id = $1;
@@ -1247,37 +1243,17 @@ WITH counted AS (
     SELECT COUNT(id) AS total FROM actions
 )
 SELECT 
-    (
-        SELECT JSONB_AGG(
-            JSONB_BUILD_OBJECT(
-                'id', id,
-                'name', name,
-                'metadata', JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
-                    'labels', metadata -> 'labels', 
-                    'created_at', created_at, 
-                    'updated_at', updated_at
-                ))
-            )
-        )
-        FROM actions
-        WHERE is_standard = TRUE
-    ) AS standard_actions,
-    (
-        SELECT JSONB_AGG(
-            JSONB_BUILD_OBJECT(
-                'id', id,
-                'name', name,
-                'metadata', JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
-                    'labels', metadata -> 'labels', 
-                    'created_at', created_at, 
-                    'updated_at', updated_at
-                ))
-            )
-        )
-        FROM actions
-        WHERE is_standard = FALSE
-    ) AS custom_actions,
-    (SELECT total FROM counted) AS total
+    a.id,
+    a.name,
+    JSON_STRIP_NULLS(JSON_BUILD_OBJECT(
+        'labels', a.metadata -> 'labels', 
+        'created_at', a.created_at, 
+        'updated_at', a.updated_at
+    )) as metadata,
+    a.is_standard,
+    counted.total
+FROM actions a
+CROSS JOIN counted
 LIMIT @limit_ 
 OFFSET @offset_;
 
@@ -1344,12 +1320,6 @@ SET
 WHERE id = $1
   AND is_standard = FALSE;
 
--- name: updateStandardAction :execrows
-UPDATE actions
-SET metadata = metadata
-WHERE id = $1
-  AND is_standard = TRUE;
-
 -- name: deleteCustomAction :execrows
 DELETE FROM actions
 WHERE id = $1
diff --git a/service/policy/db/query.sql.go b/service/policy/db/query.sql.go
index d82b5111b3..84102abbc1 100644
--- a/service/policy/db/query.sql.go
+++ b/service/policy/db/query.sql.go
@@ -3138,37 +3138,17 @@ WITH counted AS (
     SELECT COUNT(id) AS total FROM actions
 )
 SELECT 
-    (
-        SELECT JSONB_AGG(
-            JSONB_BUILD_OBJECT(
-                'id', id,
-                'name', name,
-                'metadata', JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
-                    'labels', metadata -> 'labels', 
-                    'created_at', created_at, 
-                    'updated_at', updated_at
-                ))
-            )
-        )
-        FROM actions
-        WHERE is_standard = TRUE
-    ) AS standard_actions,
-    (
-        SELECT JSONB_AGG(
-            JSONB_BUILD_OBJECT(
-                'id', id,
-                'name', name,
-                'metadata', JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
-                    'labels', metadata -> 'labels', 
-                    'created_at', created_at, 
-                    'updated_at', updated_at
-                ))
-            )
-        )
-        FROM actions
-        WHERE is_standard = FALSE
-    ) AS custom_actions,
-    (SELECT total FROM counted) AS total
+    a.id,
+    a.name,
+    JSON_STRIP_NULLS(JSON_BUILD_OBJECT(
+        'labels', a.metadata -> 'labels', 
+        'created_at', a.created_at, 
+        'updated_at', a.updated_at
+    )) as metadata,
+    a.is_standard,
+    counted.total
+FROM actions a
+CROSS JOIN counted
 LIMIT $2 
 OFFSET $1
 `
@@ -3179,9 +3159,11 @@ type listActionsParams struct {
 }
 
 type listActionsRow struct {
-	StandardActions []byte `json:"standard_actions"`
-	CustomActions   []byte `json:"custom_actions"`
-	Total           int64  `json:"total"`
+	ID         string `json:"id"`
+	Name       string `json:"name"`
+	Metadata   []byte `json:"metadata"`
+	IsStandard bool   `json:"is_standard"`
+	Total      int64  `json:"total"`
 }
 
 // --------------------------------------------------------------
@@ -3193,37 +3175,17 @@ type listActionsRow struct {
 //	    SELECT COUNT(id) AS total FROM actions
 //	)
 //	SELECT
-//	    (
-//	        SELECT JSONB_AGG(
-//	            JSONB_BUILD_OBJECT(
-//	                'id', id,
-//	                'name', name,
-//	                'metadata', JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
-//	                    'labels', metadata -> 'labels',
-//	                    'created_at', created_at,
-//	                    'updated_at', updated_at
-//	                ))
-//	            )
-//	        )
-//	        FROM actions
-//	        WHERE is_standard = TRUE
-//	    ) AS standard_actions,
-//	    (
-//	        SELECT JSONB_AGG(
-//	            JSONB_BUILD_OBJECT(
-//	                'id', id,
-//	                'name', name,
-//	                'metadata', JSON_STRIP_NULLS(JSONB_BUILD_OBJECT(
-//	                    'labels', metadata -> 'labels',
-//	                    'created_at', created_at,
-//	                    'updated_at', updated_at
-//	                ))
-//	            )
-//	        )
-//	        FROM actions
-//	        WHERE is_standard = FALSE
-//	    ) AS custom_actions,
-//	    (SELECT total FROM counted) AS total
+//	    a.id,
+//	    a.name,
+//	    JSON_STRIP_NULLS(JSON_BUILD_OBJECT(
+//	        'labels', a.metadata -> 'labels',
+//	        'created_at', a.created_at,
+//	        'updated_at', a.updated_at
+//	    )) as metadata,
+//	    a.is_standard,
+//	    counted.total
+//	FROM actions a
+//	CROSS JOIN counted
 //	LIMIT $2
 //	OFFSET $1
 func (q *Queries) listActions(ctx context.Context, arg listActionsParams) ([]listActionsRow, error) {
@@ -3235,7 +3197,13 @@ func (q *Queries) listActions(ctx context.Context, arg listActionsParams) ([]lis
 	var items []listActionsRow
 	for rows.Next() {
 		var i listActionsRow
-		if err := rows.Scan(&i.StandardActions, &i.CustomActions, &i.Total); err != nil {
+		if err := rows.Scan(
+			&i.ID,
+			&i.Name,
+			&i.Metadata,
+			&i.IsStandard,
+			&i.Total,
+		); err != nil {
 			return nil, err
 		}
 		items = append(items, i)
@@ -4323,27 +4291,6 @@ func (q *Queries) updatePublicKey(ctx context.Context, arg updatePublicKeyParams
 	return i, err
 }
 
-const updateStandardAction = `-- name: updateStandardAction :execrows
-UPDATE actions
-SET metadata = metadata
-WHERE id = $1
-  AND is_standard = TRUE
-`
-
-// updateStandardAction
-//
-//	UPDATE actions
-//	SET metadata = metadata
-//	WHERE id = $1
-//	  AND is_standard = TRUE
-func (q *Queries) updateStandardAction(ctx context.Context, id string) (int64, error) {
-	result, err := q.db.Exec(ctx, updateStandardAction, id)
-	if err != nil {
-		return 0, err
-	}
-	return result.RowsAffected(), nil
-}
-
 const updateSubjectMapping = `-- name: updateSubjectMapping :execrows
 WITH
     subject_mapping_update AS (
@@ -4371,11 +4318,11 @@ WITH
             $3,
             a
         FROM unnest($4::UUID[]) AS a
-        WHERE 
+        WHERE
             $4::UUID[] IS NOT NULL
             AND NOT EXISTS (
-                SELECT 1 
-                FROM subject_mapping_actions 
+                SELECT 1
+                FROM subject_mapping_actions
                 WHERE subject_mapping_id = $3 AND action_id = a
             )
         RETURNING action_id
@@ -4384,12 +4331,8 @@ WITH
         SELECT COUNT(*) AS cnt
         FROM subject_mapping_update
     )
-SELECT
-    1 / CASE WHEN (
-            SELECT cnt FROM update_count
-        ) = 0 THEN 0
-        ELSE 1
-    END
+SELECT cnt
+FROM update_count
 `
 
 type updateSubjectMappingParams struct {
@@ -4440,12 +4383,8 @@ type updateSubjectMappingParams struct {
 //	        SELECT COUNT(*) AS cnt
 //	        FROM subject_mapping_update
 //	    )
-//	SELECT
-//	    1 / CASE WHEN (
-//	            SELECT cnt FROM update_count
-//	        ) = 0 THEN 0
-//	        ELSE 1
-//	    END
+//	SELECT cnt
+//	FROM update_count
 func (q *Queries) updateSubjectMapping(ctx context.Context, arg updateSubjectMappingParams) (int64, error) {
 	result, err := q.db.Exec(ctx, updateSubjectMapping,
 		arg.Metadata,
diff --git a/service/policy/db/subject_mappings.go b/service/policy/db/subject_mappings.go
index bca6ebfefc..7cdecc8bdc 100644
--- a/service/policy/db/subject_mappings.go
+++ b/service/policy/db/subject_mappings.go
@@ -263,7 +263,7 @@ func (c PolicyDBClient) CreateSubjectMapping(ctx context.Context, s *subjectmapp
 		case a.GetId() != "":
 			actionIDs = append(actionIDs, a.GetId())
 		case a.GetName() != "":
-			actionNames = append(actionNames, a.GetName())
+			actionNames = append(actionNames, strings.ToLower(a.GetName()))
 		default:
 			return nil, db.WrapIfKnownInvalidQueryErr(
 				errors.Join(db.ErrMissingValue, errors.New("action id or name is required when creating a subject mapping")),
@@ -434,13 +434,15 @@ func (c PolicyDBClient) UpdateSubjectMapping(ctx context.Context, r *subjectmapp
 	id := r.GetId()
 	subjectConditionSetID := r.GetSubjectConditionSetId()
 	actions := r.GetActions()
+
+	before, err := c.GetSubjectMapping(ctx, id)
+	if err != nil || before == nil {
+		return nil, db.WrapIfKnownInvalidQueryErr(err)
+	}
+
 	// if extend we need to merge the metadata
 	metadataJSON, metadata, err := db.MarshalUpdateMetadata(r.GetMetadata(), r.GetMetadataUpdateBehavior(), func() (*common.Metadata, error) {
-		a, err := c.GetSubjectMapping(ctx, id)
-		if err != nil {
-			return nil, err
-		}
-		return a.GetMetadata(), nil
+		return before.GetMetadata(), nil
 	})
 	if err != nil {
 		return nil, err
@@ -461,7 +463,7 @@ func (c PolicyDBClient) UpdateSubjectMapping(ctx context.Context, r *subjectmapp
 			case a.GetId() != "":
 				actionIDs = append(actionIDs, a.GetId())
 			case a.GetName() != "":
-				actionNames = append(actionNames, a.GetName())
+				actionNames = append(actionNames, strings.ToLower(a.GetName()))
 			default:
 				return nil, db.WrapIfKnownInvalidQueryErr(
 					errors.Join(db.ErrMissingValue, errors.New("action id or name is required when updating a subject mapping's actions")),

From e839876feedb3c6e06ad97878a28d25b26dd670b Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Thu, 17 Apr 2025 14:26:18 -0700
Subject: [PATCH 094/110] lint fixes

---
 service/integration/actions_test.go | 26 +++++++++++++-------------
 service/policy/db/actions.go        | 20 +++++++++++---------
 2 files changed, 24 insertions(+), 22 deletions(-)

diff --git a/service/integration/actions_test.go b/service/integration/actions_test.go
index cc24a396c5..3131dc076c 100644
--- a/service/integration/actions_test.go
+++ b/service/integration/actions_test.go
@@ -54,7 +54,7 @@ func (s *ActionsSuite) Test_ListActions_NoPagination_Succeeds() {
 	foundDelete := false
 
 	for _, action := range list.GetActionsCustom() {
-		switch action.Name {
+		switch action.GetName() {
 		case fixtureCustomAction1.Name:
 			foundCustomAction1 = true
 		case fixtureCustomAction2.Name:
@@ -62,7 +62,7 @@ func (s *ActionsSuite) Test_ListActions_NoPagination_Succeeds() {
 		}
 	}
 	for _, action := range list.GetActionsStandard() {
-		switch policydb.ActionStandard(action.Name) {
+		switch policydb.ActionStandard(action.GetName()) {
 		case policydb.ActionRead:
 			foundRead = true
 		case policydb.ActionCreate:
@@ -106,9 +106,9 @@ func (s *ActionsSuite) Test_ListActions_Pagination_Succeeds() {
 	})
 	s.NotNil(list)
 	s.Require().NoError(err)
-	s.Equal(int32(total), list.GetPagination().GetTotal())
-	s.Equal(int32(0), list.GetPagination().GetCurrentOffset())
-	s.Equal(int32(total-1), list.GetPagination().GetNextOffset())
+	s.Equal(total, list.GetPagination().GetTotal())
+	s.Equal(0, list.GetPagination().GetCurrentOffset())
+	s.Equal(total-1, list.GetPagination().GetNextOffset())
 }
 
 func (s *ActionsSuite) Test_ListActions_LimitLargerThanConfigured_Fails() {
@@ -140,13 +140,13 @@ func (s *ActionsSuite) Test_GetAction_Id_Succeeds() {
 
 	action, err = s.db.PolicyClient.GetAction(s.ctx, &actions.GetActionRequest{
 		Identifier: &actions.GetActionRequest_Id{
-			Id: actionRead.Id,
+			Id: actionRead.GetId(),
 		},
 	})
 	s.NotNil(action)
 	s.Require().NoError(err)
-	s.Equal(actionRead.Id, action.GetId())
-	s.Equal(actionRead.Name, action.GetName())
+	s.Equal(actionRead.GetId(), action.GetId())
+	s.Equal(actionRead.GetName(), action.GetName())
 	s.NotNil(action.GetMetadata())
 }
 
@@ -166,13 +166,13 @@ func (s *ActionsSuite) Test_GetAction_Name_Succeeds() {
 
 	action, err = s.db.PolicyClient.GetAction(s.ctx, &actions.GetActionRequest{
 		Identifier: &actions.GetActionRequest_Name{
-			Name: actionCreate.Name,
+			Name: actionCreate.GetName(),
 		},
 	})
 	s.NotNil(action)
 	s.Require().NoError(err)
-	s.Equal(actionCreate.Name, action.GetName())
-	s.Equal(actionCreate.Id, action.GetId())
+	s.Equal(actionCreate.GetName(), action.GetName())
+	s.Equal(actionCreate.GetId(), action.GetId())
 	s.NotNil(action.GetMetadata())
 }
 
@@ -363,12 +363,12 @@ func (s *ActionsSuite) Test_DeleteAction_NonExistent_Fails() {
 func (s *ActionsSuite) Test_DeleteAction_StandardAction_Fails() {
 	actionRead := s.f.GetStandardAction(policydb.ActionRead.String())
 	action, err := s.db.PolicyClient.DeleteAction(s.ctx, &actions.DeleteActionRequest{
-		Id: actionRead.Id,
+		Id: actionRead.GetId(),
 	})
 	s.Nil(action)
 	s.Require().Error(err)
 	s.Require().ErrorIs(err, db.ErrRestrictViolation)
-	s.Contains(err.Error(), actionRead.Name)
+	s.Contains(err.Error(), actionRead.GetName())
 }
 
 func TestActionsSuite(t *testing.T) {
diff --git a/service/policy/db/actions.go b/service/policy/db/actions.go
index 880560809c..53f9a9d49e 100644
--- a/service/policy/db/actions.go
+++ b/service/policy/db/actions.go
@@ -24,25 +24,27 @@ const (
 
 // Add a validation method
 func (a ActionStandard) IsValid() bool {
-    switch a {
-    case ActionCreate, ActionRead, ActionUpdate, ActionDelete:
-        return true
-    }
-    return false
+	switch a {
+	case ActionCreate, ActionRead, ActionUpdate, ActionDelete:
+		return true
+	}
+	return false
 }
 
 // If needed, implement the Stringer interface explicitly
 func (a ActionStandard) String() string {
-    return string(a)
+	return string(a)
 }
 
 func (c PolicyDBClient) GetAction(ctx context.Context, req *actions.GetActionRequest) (*policy.Action, error) {
 	getActionParams := getActionParams{}
-	if req.GetId() != "" {
+
+	switch {
+	case req.GetId() != "":
 		getActionParams.ID = pgtypeUUID(req.GetId())
-	} else if req.GetName() != "" {
+	case req.GetName() != "":
 		getActionParams.Name = pgtypeText(strings.ToLower(req.GetName()))
-	} else {
+	default:
 		return nil, db.ErrSelectIdentifierInvalid
 	}
 

From b84dade271643a7e1d900dfaf44e170518d99b73 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Thu, 17 Apr 2025 14:32:47 -0700
Subject: [PATCH 095/110] fix test

---
 service/integration/actions_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/service/integration/actions_test.go b/service/integration/actions_test.go
index 3131dc076c..e60c76a4a5 100644
--- a/service/integration/actions_test.go
+++ b/service/integration/actions_test.go
@@ -107,7 +107,7 @@ func (s *ActionsSuite) Test_ListActions_Pagination_Succeeds() {
 	s.NotNil(list)
 	s.Require().NoError(err)
 	s.Equal(total, list.GetPagination().GetTotal())
-	s.Equal(0, list.GetPagination().GetCurrentOffset())
+	s.Equal(int32(0), list.GetPagination().GetCurrentOffset())
 	s.Equal(total-1, list.GetPagination().GetNextOffset())
 }
 

From b5cfc1d34cfb13fe67ff561d4cdad10b458894fa Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 21 Apr 2025 11:51:05 -0700
Subject: [PATCH 096/110] improve migration

---
 .../policy/db/migrations/20250411000000_add_actions_table.sql   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/service/policy/db/migrations/20250411000000_add_actions_table.sql b/service/policy/db/migrations/20250411000000_add_actions_table.sql
index 05b2ebdcef..52b19c6ddf 100644
--- a/service/policy/db/migrations/20250411000000_add_actions_table.sql
+++ b/service/policy/db/migrations/20250411000000_add_actions_table.sql
@@ -29,7 +29,7 @@ CREATE TRIGGER actions_updated_at
   EXECUTE FUNCTION update_updated_at();
 
 -- 1a. Create intermediary table to hold the mapping of actions to subject_mappings (potentially many to many)
-CREATE TABLE subject_mapping_actions (
+CREATE TABLE IF NOT EXISTS subject_mapping_actions (
     subject_mapping_id UUID NOT NULL REFERENCES subject_mappings(id) ON DELETE CASCADE,
     action_id UUID NOT NULL REFERENCES actions(id) ON DELETE CASCADE,
     created_at TIMESTAMP NOT NULL DEFAULT NOW(),

From cdc32c0e9d2375ebf5d3a6bf8487137458f5d2d4 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 21 Apr 2025 11:54:18 -0700
Subject: [PATCH 097/110] re-export standard CRUDable action names and update
 roundtrip CI tests

---
 service/policy/actions/actions.go | 12 ++++++++++++
 service/rttests/rt_test.go        |  9 +++------
 2 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/service/policy/actions/actions.go b/service/policy/actions/actions.go
index d54a32541d..ea5f38577e 100644
--- a/service/policy/actions/actions.go
+++ b/service/policy/actions/actions.go
@@ -17,6 +17,18 @@ import (
 	policydb "github.com/opentdf/platform/service/policy/db"
 )
 
+// Re-exported action names for consumers of ActionService protos
+const (
+	// Stored name of the standard 'create' action
+	ActionNameCreate = string(policydb.ActionCreate)
+	// Stored name of the standard 'read' action
+	ActionNameRead = string(policydb.ActionRead)
+	// Stored name of the standard 'update' action
+	ActionNameUpdate = string(policydb.ActionUpdate)
+	// Stored name of the standard 'delete' action
+	ActionNameDelete = string(policydb.ActionDelete)
+)
+
 type ActionService struct {
 	dbClient policydb.PolicyDBClient
 	logger   *logger.Logger
diff --git a/service/rttests/rt_test.go b/service/rttests/rt_test.go
index f911fcfc4e..d4c99a002e 100644
--- a/service/rttests/rt_test.go
+++ b/service/rttests/rt_test.go
@@ -15,6 +15,7 @@ import (
 	"github.com/opentdf/platform/protocol/go/policy/namespaces"
 	"github.com/opentdf/platform/protocol/go/policy/subjectmapping"
 	"github.com/opentdf/platform/sdk"
+	"github.com/opentdf/platform/service/policy/actions"
 	"github.com/stretchr/testify/suite"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
@@ -288,12 +289,8 @@ func (s *RoundtripSuite) CreateTestData() error {
 		_, err = client.SubjectMapping.CreateSubjectMapping(context.Background(), &subjectmapping.CreateSubjectMappingRequest{
 			AttributeValueId: attributeID,
 			Actions: []*policy.Action{
-				{Value: &policy.Action_Standard{
-					Standard: policy.Action_STANDARD_ACTION_DECRYPT,
-				}},
-				{Value: &policy.Action_Standard{
-					Standard: policy.Action_STANDARD_ACTION_TRANSMIT,
-				}},
+				{Name: actions.ActionNameCreate},
+				{Name: actions.ActionNameRead},
 			},
 			NewSubjectConditionSet: &subjectmapping.SubjectConditionSetCreate{
 				SubjectSets: []*policy.SubjectSet{

From 52e975b79cdb494873cbd40c112688f2bce20565 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 21 Apr 2025 12:19:12 -0700
Subject: [PATCH 098/110] copilot suggestions

---
 service/policy/db/actions.go          | 8 +++-----
 service/policy/db/subject_mappings.go | 8 ++++----
 2 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/service/policy/db/actions.go b/service/policy/db/actions.go
index 53f9a9d49e..6275e513c8 100644
--- a/service/policy/db/actions.go
+++ b/service/policy/db/actions.go
@@ -205,11 +205,9 @@ func (c PolicyDBClient) DeleteAction(ctx context.Context, req *actions.DeleteAct
 			return nil, err
 		}
 		// standard action
-		name := got.GetName()
-		if name == string(ActionCreate) ||
-			name == string(ActionRead) ||
-			name == string(ActionUpdate) ||
-			name == string(ActionDelete) {
+		name := strings.ToLower(got.GetName())
+		isStandard := ActionStandard(name).IsValid()
+		if isStandard {
 			return nil, fmt.Errorf("cannot delete standard action %s: %w", name, db.ErrRestrictViolation)
 		}
 		return nil, db.ErrNotFound
diff --git a/service/policy/db/subject_mappings.go b/service/policy/db/subject_mappings.go
index 7cdecc8bdc..2793d9203e 100644
--- a/service/policy/db/subject_mappings.go
+++ b/service/policy/db/subject_mappings.go
@@ -258,7 +258,7 @@ func (c PolicyDBClient) CreateSubjectMapping(ctx context.Context, s *subjectmapp
 	actionIDs := make([]string, 0)
 	actionNames := make([]string, 0)
 	// Check for provided existing Action IDs and existing/new Action Names
-	for _, a := range actions {
+	for idx, a := range actions {
 		switch {
 		case a.GetId() != "":
 			actionIDs = append(actionIDs, a.GetId())
@@ -266,7 +266,7 @@ func (c PolicyDBClient) CreateSubjectMapping(ctx context.Context, s *subjectmapp
 			actionNames = append(actionNames, strings.ToLower(a.GetName()))
 		default:
 			return nil, db.WrapIfKnownInvalidQueryErr(
-				errors.Join(db.ErrMissingValue, errors.New("action id or name is required when creating a subject mapping")),
+				errors.Join(db.ErrMissingValue, fmt.Errorf("action at index %d missing requred 'id' or 'name' when creating a subject mapping; action details: %+v", idx, a)),
 			)
 		}
 	}
@@ -458,7 +458,7 @@ func (c PolicyDBClient) UpdateSubjectMapping(ctx context.Context, r *subjectmapp
 		actionIDs := make([]string, 0)
 		actionNames := make([]string, 0)
 		// Check for provided existing Action IDs and existing/new Action Names
-		for _, a := range actions {
+		for idx, a := range actions {
 			switch {
 			case a.GetId() != "":
 				actionIDs = append(actionIDs, a.GetId())
@@ -466,7 +466,7 @@ func (c PolicyDBClient) UpdateSubjectMapping(ctx context.Context, r *subjectmapp
 				actionNames = append(actionNames, strings.ToLower(a.GetName()))
 			default:
 				return nil, db.WrapIfKnownInvalidQueryErr(
-					errors.Join(db.ErrMissingValue, errors.New("action id or name is required when updating a subject mapping's actions")),
+					errors.Join(db.ErrMissingValue, fmt.Errorf("action at index %d missing requred 'id' or 'name' when creating a subject mapping; action details: %+v", idx, a)),
 				)
 			}
 		}

From 4003eff88c061db6b642067ae72aa908e4a00f42 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 21 Apr 2025 13:07:50 -0700
Subject: [PATCH 099/110] test resolving circular CI issues

---
 service/policy/db/subject_mappings.go | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/service/policy/db/subject_mappings.go b/service/policy/db/subject_mappings.go
index 2793d9203e..dcc79e1b07 100644
--- a/service/policy/db/subject_mappings.go
+++ b/service/policy/db/subject_mappings.go
@@ -264,6 +264,10 @@ func (c PolicyDBClient) CreateSubjectMapping(ctx context.Context, s *subjectmapp
 			actionIDs = append(actionIDs, a.GetId())
 		case a.GetName() != "":
 			actionNames = append(actionNames, strings.ToLower(a.GetName()))
+		case a.GetStandard().Enum() != nil:
+			// TODO: remove this support for interpreting standard action proto enums to new CRUDable actions once circular CI testing is resolved
+			c.logger.WarnContext(ctx, "standard action is deprecated, use 'id' or 'name' instead")
+			actionNames = append(actionIDs, strings.ToLower(a.GetStandard().Enum().String()))
 		default:
 			return nil, db.WrapIfKnownInvalidQueryErr(
 				errors.Join(db.ErrMissingValue, fmt.Errorf("action at index %d missing requred 'id' or 'name' when creating a subject mapping; action details: %+v", idx, a)),
@@ -464,6 +468,10 @@ func (c PolicyDBClient) UpdateSubjectMapping(ctx context.Context, r *subjectmapp
 				actionIDs = append(actionIDs, a.GetId())
 			case a.GetName() != "":
 				actionNames = append(actionNames, strings.ToLower(a.GetName()))
+			case a.GetStandard().Enum() != nil:
+				// TODO: remove this support for interpreting standard action proto enums to new CRUDable actions once circular CI testing is resolved
+				c.logger.WarnContext(ctx, "standard action is deprecated, use 'id' or 'name' instead")
+				actionNames = append(actionIDs, strings.ToLower(a.GetStandard().Enum().String()))
 			default:
 				return nil, db.WrapIfKnownInvalidQueryErr(
 					errors.Join(db.ErrMissingValue, fmt.Errorf("action at index %d missing requred 'id' or 'name' when creating a subject mapping; action details: %+v", idx, a)),

From 53697e34e793cd82fa90993759c2bae8db39957b Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 21 Apr 2025 13:16:47 -0700
Subject: [PATCH 100/110] different tweak to map subject mapping create/update
 with deprecated standard actions to new CRUD actions

---
 service/policy/db/subject_mappings.go | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/service/policy/db/subject_mappings.go b/service/policy/db/subject_mappings.go
index dcc79e1b07..1aad90a2b6 100644
--- a/service/policy/db/subject_mappings.go
+++ b/service/policy/db/subject_mappings.go
@@ -51,6 +51,12 @@ func unmarshalSubjectSetsProto(conditionJSON []byte) ([]*policy.SubjectSet, erro
 	return ss, nil
 }
 
+var (
+	// TODO: remove once circular CI is resolved
+	deprecatedStandardActionDecrypt  = policy.Action_STANDARD_ACTION_DECRYPT.Enum()
+	deprecatedStandardActionTransmit = policy.Action_STANDARD_ACTION_TRANSMIT.Enum()
+)
+
 /*
 	Subject Condition Sets
 */
@@ -264,10 +270,13 @@ func (c PolicyDBClient) CreateSubjectMapping(ctx context.Context, s *subjectmapp
 			actionIDs = append(actionIDs, a.GetId())
 		case a.GetName() != "":
 			actionNames = append(actionNames, strings.ToLower(a.GetName()))
-		case a.GetStandard().Enum() != nil:
-			// TODO: remove this support for interpreting standard action proto enums to new CRUDable actions once circular CI testing is resolved
+		// TODO: remove this support for interpreting standard action proto enums to new CRUDable actions once circular CI testing is resolved
+		case a.GetStandard().Enum() == deprecatedStandardActionDecrypt:
 			c.logger.WarnContext(ctx, "standard action is deprecated, use 'id' or 'name' instead")
-			actionNames = append(actionIDs, strings.ToLower(a.GetStandard().Enum().String()))
+			actionNames = append(actionNames, ActionRead.String())
+		case a.GetStandard().Enum() == deprecatedStandardActionTransmit:
+			c.logger.WarnContext(ctx, "standard action is deprecated, use 'id' or 'name' instead")
+			actionNames = append(actionNames, ActionCreate.String())
 		default:
 			return nil, db.WrapIfKnownInvalidQueryErr(
 				errors.Join(db.ErrMissingValue, fmt.Errorf("action at index %d missing requred 'id' or 'name' when creating a subject mapping; action details: %+v", idx, a)),
@@ -468,10 +477,13 @@ func (c PolicyDBClient) UpdateSubjectMapping(ctx context.Context, r *subjectmapp
 				actionIDs = append(actionIDs, a.GetId())
 			case a.GetName() != "":
 				actionNames = append(actionNames, strings.ToLower(a.GetName()))
-			case a.GetStandard().Enum() != nil:
 				// TODO: remove this support for interpreting standard action proto enums to new CRUDable actions once circular CI testing is resolved
+			case a.GetStandard().Enum() == deprecatedStandardActionDecrypt:
+				c.logger.WarnContext(ctx, "standard action is deprecated, use 'id' or 'name' instead")
+				actionNames = append(actionNames, ActionRead.String())
+			case a.GetStandard().Enum() == deprecatedStandardActionTransmit:
 				c.logger.WarnContext(ctx, "standard action is deprecated, use 'id' or 'name' instead")
-				actionNames = append(actionIDs, strings.ToLower(a.GetStandard().Enum().String()))
+				actionNames = append(actionNames, ActionCreate.String())
 			default:
 				return nil, db.WrapIfKnownInvalidQueryErr(
 					errors.Join(db.ErrMissingValue, fmt.Errorf("action at index %d missing requred 'id' or 'name' when creating a subject mapping; action details: %+v", idx, a)),

From 91e280ddd8ff6e9bff18390ac82ec6e7c5eed907 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 21 Apr 2025 13:41:19 -0700
Subject: [PATCH 101/110] tweak

---
 service/policy/db/subject_mappings.go | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/service/policy/db/subject_mappings.go b/service/policy/db/subject_mappings.go
index 1aad90a2b6..0285de5833 100644
--- a/service/policy/db/subject_mappings.go
+++ b/service/policy/db/subject_mappings.go
@@ -53,8 +53,8 @@ func unmarshalSubjectSetsProto(conditionJSON []byte) ([]*policy.SubjectSet, erro
 
 var (
 	// TODO: remove once circular CI is resolved
-	deprecatedStandardActionDecrypt  = policy.Action_STANDARD_ACTION_DECRYPT.Enum()
-	deprecatedStandardActionTransmit = policy.Action_STANDARD_ACTION_TRANSMIT.Enum()
+	deprecatedStandardActionDecrypt  = policy.Action_STANDARD_ACTION_DECRYPT.String()
+	deprecatedStandardActionTransmit = policy.Action_STANDARD_ACTION_TRANSMIT.String()
 )
 
 /*
@@ -271,10 +271,10 @@ func (c PolicyDBClient) CreateSubjectMapping(ctx context.Context, s *subjectmapp
 		case a.GetName() != "":
 			actionNames = append(actionNames, strings.ToLower(a.GetName()))
 		// TODO: remove this support for interpreting standard action proto enums to new CRUDable actions once circular CI testing is resolved
-		case a.GetStandard().Enum() == deprecatedStandardActionDecrypt:
+		case a.GetStandard().String() == deprecatedStandardActionDecrypt:
 			c.logger.WarnContext(ctx, "standard action is deprecated, use 'id' or 'name' instead")
 			actionNames = append(actionNames, ActionRead.String())
-		case a.GetStandard().Enum() == deprecatedStandardActionTransmit:
+		case a.GetStandard().String() == deprecatedStandardActionTransmit:
 			c.logger.WarnContext(ctx, "standard action is deprecated, use 'id' or 'name' instead")
 			actionNames = append(actionNames, ActionCreate.String())
 		default:
@@ -478,10 +478,10 @@ func (c PolicyDBClient) UpdateSubjectMapping(ctx context.Context, r *subjectmapp
 			case a.GetName() != "":
 				actionNames = append(actionNames, strings.ToLower(a.GetName()))
 				// TODO: remove this support for interpreting standard action proto enums to new CRUDable actions once circular CI testing is resolved
-			case a.GetStandard().Enum() == deprecatedStandardActionDecrypt:
+			case a.GetStandard().String() == deprecatedStandardActionDecrypt:
 				c.logger.WarnContext(ctx, "standard action is deprecated, use 'id' or 'name' instead")
 				actionNames = append(actionNames, ActionRead.String())
-			case a.GetStandard().Enum() == deprecatedStandardActionTransmit:
+			case a.GetStandard().String() == deprecatedStandardActionTransmit:
 				c.logger.WarnContext(ctx, "standard action is deprecated, use 'id' or 'name' instead")
 				actionNames = append(actionNames, ActionCreate.String())
 			default:

From 5c0508084a08fe702265d59c4c7493bed4fcb40d Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 21 Apr 2025 13:56:53 -0700
Subject: [PATCH 102/110] add skipped create/udpate tests to be removed when
 create/update SM with proto action is fully deprecated

---
 service/integration/subject_mappings_test.go | 77 ++++++++++++++++++++
 1 file changed, 77 insertions(+)

diff --git a/service/integration/subject_mappings_test.go b/service/integration/subject_mappings_test.go
index 2041f6f1cf..6bd8021bb0 100644
--- a/service/integration/subject_mappings_test.go
+++ b/service/integration/subject_mappings_test.go
@@ -236,6 +236,39 @@ func (s *SubjectMappingsSuite) TestCreateSubjectMapping_BrandNewActionNames_Succ
 	s.True(foundNewActionTwo)
 }
 
+func (s *SubjectMappingsSuite) TestCreateSubjectMapping_DeprecatedProtoEnums_Fails() {
+	s.T().Skip("Skipping test while deprecation of proto actions is in flight")
+
+	fixtureAttrVal := s.f.GetAttributeValueKey("example.com/attr/attr1/value/value1")
+	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set2")
+
+	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
+		AttributeValueId: fixtureAttrVal.ID,
+		Actions: []*policy.Action{
+			{
+				Value: &policy.Action_Standard{
+					Standard: policy.Action_STANDARD_ACTION_DECRYPT,
+				},
+			},
+		},
+		ExistingSubjectConditionSetId: fixtureScs.ID,
+	}
+
+	created, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, newSubjectMapping)
+	s.Nil(created)
+	s.Require().Error(err)
+	s.Require().ErrorIs(err, db.ErrMissingValue)
+
+	newSubjectMapping.GetActions()[0].Value = &policy.Action_Standard{
+		Standard: policy.Action_STANDARD_ACTION_TRANSMIT,
+	}
+
+	created, err = s.db.PolicyClient.CreateSubjectMapping(s.ctx, newSubjectMapping)
+	s.Nil(created)
+	s.Require().Error(err)
+	s.Require().ErrorIs(err, db.ErrMissingValue)
+}
+
 func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_Actions() {
 	// create a new one SM with actions, update it with different actions, and verify the update
 	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value2").ID
@@ -347,6 +380,50 @@ func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_Actions_NonExistentActio
 	s.Require().ErrorIs(err, db.ErrForeignKeyViolation)
 }
 
+func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_Actions_DeprecatedProtoEnums_Fails() {
+	s.T().Skip("Skipping test while deprecation of proto actions is in flight")
+
+	fixtureAttrVal := s.f.GetAttributeValueKey("example.com/attr/attr2/value/value1")
+	fixtureScs := s.f.GetSubjectConditionSetKey("subject_condition_set1")
+
+	newSubjectMapping := &subjectmapping.CreateSubjectMappingRequest{
+		AttributeValueId: fixtureAttrVal.ID,
+		Actions: []*policy.Action{
+			{Name: policydb.ActionRead.String()},
+		},
+		ExistingSubjectConditionSetId: fixtureScs.ID,
+	}
+
+	created, err := s.db.PolicyClient.CreateSubjectMapping(s.ctx, newSubjectMapping)
+	s.NotNil(created)
+	s.Require().NoError(err)
+
+	updateReq := &subjectmapping.UpdateSubjectMappingRequest{
+		Id: created.GetId(),
+		Actions: []*policy.Action{
+			{
+				Value: &policy.Action_Standard{
+					Standard: policy.Action_STANDARD_ACTION_DECRYPT,
+				},
+			},
+		},
+	}
+
+	updated, err := s.db.PolicyClient.UpdateSubjectMapping(s.ctx, updateReq)
+	s.Nil(updated)
+	s.Require().Error(err)
+	s.Require().ErrorIs(err, db.ErrMissingValue)
+
+	updateReq.Actions[0].Value = &policy.Action_Standard{
+		Standard: policy.Action_STANDARD_ACTION_TRANSMIT,
+	}
+
+	updated, err = s.db.PolicyClient.UpdateSubjectMapping(s.ctx, updateReq)
+	s.Nil(updated)
+	s.Require().Error(err)
+	s.Require().ErrorIs(err, db.ErrMissingValue)
+}
+
 func (s *SubjectMappingsSuite) TestUpdateSubjectMapping_SubjectConditionSetId() {
 	// create a new one, update it, and verify the update
 	fixtureAttrValID := s.f.GetAttributeValueKey("example.net/attr/attr1/value/value1").ID

From 0a4dbcdea9af71867355226b19856667e3487cbb Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Mon, 21 Apr 2025 14:00:42 -0700
Subject: [PATCH 103/110] typo

---
 service/policy/db/subject_mappings.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/service/policy/db/subject_mappings.go b/service/policy/db/subject_mappings.go
index 0285de5833..d83c00e145 100644
--- a/service/policy/db/subject_mappings.go
+++ b/service/policy/db/subject_mappings.go
@@ -279,7 +279,7 @@ func (c PolicyDBClient) CreateSubjectMapping(ctx context.Context, s *subjectmapp
 			actionNames = append(actionNames, ActionCreate.String())
 		default:
 			return nil, db.WrapIfKnownInvalidQueryErr(
-				errors.Join(db.ErrMissingValue, fmt.Errorf("action at index %d missing requred 'id' or 'name' when creating a subject mapping; action details: %+v", idx, a)),
+				errors.Join(db.ErrMissingValue, fmt.Errorf("action at index %d missing required 'id' or 'name' when creating a subject mapping; action details: %+v", idx, a)),
 			)
 		}
 	}
@@ -486,7 +486,7 @@ func (c PolicyDBClient) UpdateSubjectMapping(ctx context.Context, r *subjectmapp
 				actionNames = append(actionNames, ActionCreate.String())
 			default:
 				return nil, db.WrapIfKnownInvalidQueryErr(
-					errors.Join(db.ErrMissingValue, fmt.Errorf("action at index %d missing requred 'id' or 'name' when creating a subject mapping; action details: %+v", idx, a)),
+					errors.Join(db.ErrMissingValue, fmt.Errorf("action at index %d missing required 'id' or 'name' when creating a subject mapping; action details: %+v", idx, a)),
 				)
 			}
 		}

From d997c656dd74fa4ee439c8a9e643f656e950aee9 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Tue, 22 Apr 2025 08:24:32 -0700
Subject: [PATCH 104/110] add actions to SDK and alphabetize

---
 sdk/sdk.go | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/sdk/sdk.go b/sdk/sdk.go
index 95bbd1926d..d5a6547b38 100644
--- a/sdk/sdk.go
+++ b/sdk/sdk.go
@@ -18,6 +18,7 @@ import (
 	"github.com/opentdf/platform/protocol/go/authorization"
 	"github.com/opentdf/platform/protocol/go/entityresolution"
 	"github.com/opentdf/platform/protocol/go/policy"
+	"github.com/opentdf/platform/protocol/go/policy/actions"
 	"github.com/opentdf/platform/protocol/go/policy/attributes"
 	"github.com/opentdf/platform/protocol/go/policy/kasregistry"
 	"github.com/opentdf/platform/protocol/go/policy/namespaces"
@@ -63,14 +64,15 @@ type SDK struct {
 	conn                    *grpc.ClientConn
 	dialOptions             []grpc.DialOption
 	tokenSource             auth.AccessTokenSource
-	Namespaces              namespaces.NamespaceServiceClient
+	Actions                 actions.ActionServiceClient
 	Attributes              attributes.AttributesServiceClient
+	Authorization           authorization.AuthorizationServiceClient
+	EntityResoution         entityresolution.EntityResolutionServiceClient
+	KeyAccessServerRegistry kasregistry.KeyAccessServerRegistryServiceClient
+	Namespaces              namespaces.NamespaceServiceClient
 	ResourceMapping         resourcemapping.ResourceMappingServiceClient
 	SubjectMapping          subjectmapping.SubjectMappingServiceClient
-	KeyAccessServerRegistry kasregistry.KeyAccessServerRegistryServiceClient
 	Unsafe                  unsafe.UnsafeServiceClient
-	Authorization           authorization.AuthorizationServiceClient
-	EntityResoution         entityresolution.EntityResolutionServiceClient
 	wellknownConfiguration  wellknownconfiguration.WellKnownServiceClient
 }
 

From 1351cb3b269f0c69d998612b31dbda13e45c37ca Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Tue, 22 Apr 2025 12:49:21 -0700
Subject: [PATCH 105/110] fix service registry test

---
 service/pkg/server/services_test.go | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/service/pkg/server/services_test.go b/service/pkg/server/services_test.go
index 1640d87833..6752c9cdf3 100644
--- a/service/pkg/server/services_test.go
+++ b/service/pkg/server/services_test.go
@@ -26,6 +26,8 @@ type mockTestServiceOptions struct {
 	dbRegister         serviceregistry.DBRegister
 }
 
+const numExpectedServices = 7
+
 func mockTestServiceRegistry(opts mockTestServiceOptions) (serviceregistry.IService, *spyTestService) {
 	spy := &spyTestService{}
 	mockTestServiceDefaults := mockTestServiceOptions{
@@ -112,7 +114,7 @@ func (suite *ServiceTestSuite) Test_RegisterCoreServices_In_Mode_ALL_Expect_All_
 
 	policy, err := registry.GetNamespace(servicePolicy)
 	suite.Require().NoError(err)
-	suite.Len(policy.Services, 6)
+	suite.Len(policy.Services, numExpectedServices)
 	suite.Equal(modeCore, policy.Mode)
 
 	wellKnown, err := registry.GetNamespace(serviceWellKnown)
@@ -143,7 +145,7 @@ func (suite *ServiceTestSuite) Test_RegisterCoreServices_In_Mode_Core_Expect_Cor
 
 	policy, err := registry.GetNamespace(servicePolicy)
 	suite.Require().NoError(err)
-	suite.Len(policy.Services, 6)
+	suite.Len(policy.Services, numExpectedServices)
 	suite.Equal(modeCore, policy.Mode)
 
 	wellKnown, err := registry.GetNamespace(serviceWellKnown)
@@ -170,7 +172,7 @@ func (suite *ServiceTestSuite) Test_RegisterServices_In_Mode_Core_Plus_Kas_Expec
 
 	policy, err := registry.GetNamespace(servicePolicy)
 	suite.Require().NoError(err)
-	suite.Len(policy.Services, 6)
+	suite.Len(policy.Services, numExpectedServices)
 	suite.Equal(modeCore, policy.Mode)
 
 	wellKnown, err := registry.GetNamespace(serviceWellKnown)
@@ -197,7 +199,7 @@ func (suite *ServiceTestSuite) Test_RegisterServices_In_Mode_Core_Plus_Kas_Expec
 
 	policy, err := registry.GetNamespace(servicePolicy)
 	suite.Require().NoError(err)
-	suite.Len(policy.Services, 6)
+	suite.Len(policy.Services, numExpectedServices)
 	suite.Equal(modeCore, policy.Mode)
 
 	wellKnown, err := registry.GetNamespace(serviceWellKnown)

From 5bb5d0efd005674b122cdccb5f25eac9a492624a Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Tue, 22 Apr 2025 14:52:33 -0700
Subject: [PATCH 106/110] rm extraneous error check

---
 service/policy/db/subject_mappings.go | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/service/policy/db/subject_mappings.go b/service/policy/db/subject_mappings.go
index d83c00e145..235208e744 100644
--- a/service/policy/db/subject_mappings.go
+++ b/service/policy/db/subject_mappings.go
@@ -7,8 +7,6 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/jackc/pgerrcode"
-	"github.com/jackc/pgx/v5"
 	"github.com/opentdf/platform/protocol/go/common"
 	"github.com/opentdf/platform/protocol/go/policy"
 	"github.com/opentdf/platform/protocol/go/policy/subjectmapping"
@@ -508,10 +506,6 @@ func (c PolicyDBClient) UpdateSubjectMapping(ctx context.Context, r *subjectmapp
 
 	_, err = c.Queries.updateSubjectMapping(ctx, updateParams)
 	if err != nil {
-		// CTE behavior requires custom handling with divide by zero to detect 0 count
-		if strings.Contains(err.Error(), pgerrcode.DivisionByZero) {
-			err = pgx.ErrNoRows
-		}
 		return nil, db.WrapIfKnownInvalidQueryErr(err)
 	}
 

From 4e8b8cc3ac0481d9f2233974b0e48abf532d17f2 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Wed, 23 Apr 2025 08:36:43 -0700
Subject: [PATCH 107/110] pr comments

---
 service/pkg/server/services_test.go | 10 +++++-----
 service/policy/actions/actions.go   | 22 ++++++++--------------
 2 files changed, 13 insertions(+), 19 deletions(-)

diff --git a/service/pkg/server/services_test.go b/service/pkg/server/services_test.go
index 6752c9cdf3..00d2e0c2cd 100644
--- a/service/pkg/server/services_test.go
+++ b/service/pkg/server/services_test.go
@@ -26,7 +26,7 @@ type mockTestServiceOptions struct {
 	dbRegister         serviceregistry.DBRegister
 }
 
-const numExpectedServices = 7
+const numExpectedPolicyServices = 7
 
 func mockTestServiceRegistry(opts mockTestServiceOptions) (serviceregistry.IService, *spyTestService) {
 	spy := &spyTestService{}
@@ -114,7 +114,7 @@ func (suite *ServiceTestSuite) Test_RegisterCoreServices_In_Mode_ALL_Expect_All_
 
 	policy, err := registry.GetNamespace(servicePolicy)
 	suite.Require().NoError(err)
-	suite.Len(policy.Services, numExpectedServices)
+	suite.Len(policy.Services, numExpectedPolicyServices)
 	suite.Equal(modeCore, policy.Mode)
 
 	wellKnown, err := registry.GetNamespace(serviceWellKnown)
@@ -145,7 +145,7 @@ func (suite *ServiceTestSuite) Test_RegisterCoreServices_In_Mode_Core_Expect_Cor
 
 	policy, err := registry.GetNamespace(servicePolicy)
 	suite.Require().NoError(err)
-	suite.Len(policy.Services, numExpectedServices)
+	suite.Len(policy.Services, numExpectedPolicyServices)
 	suite.Equal(modeCore, policy.Mode)
 
 	wellKnown, err := registry.GetNamespace(serviceWellKnown)
@@ -172,7 +172,7 @@ func (suite *ServiceTestSuite) Test_RegisterServices_In_Mode_Core_Plus_Kas_Expec
 
 	policy, err := registry.GetNamespace(servicePolicy)
 	suite.Require().NoError(err)
-	suite.Len(policy.Services, numExpectedServices)
+	suite.Len(policy.Services, numExpectedPolicyServices)
 	suite.Equal(modeCore, policy.Mode)
 
 	wellKnown, err := registry.GetNamespace(serviceWellKnown)
@@ -199,7 +199,7 @@ func (suite *ServiceTestSuite) Test_RegisterServices_In_Mode_Core_Plus_Kas_Expec
 
 	policy, err := registry.GetNamespace(servicePolicy)
 	suite.Require().NoError(err)
-	suite.Len(policy.Services, numExpectedServices)
+	suite.Len(policy.Services, numExpectedPolicyServices)
 	suite.Equal(modeCore, policy.Mode)
 
 	wellKnown, err := registry.GetNamespace(serviceWellKnown)
diff --git a/service/policy/actions/actions.go b/service/policy/actions/actions.go
index 405d37107c..9ebbadd474 100644
--- a/service/policy/actions/actions.go
+++ b/service/policy/actions/actions.go
@@ -82,18 +82,11 @@ func NewRegistration(ns string, dbRegister serviceregistry.DBRegister) *servicer
 func (a *ActionService) GetAction(ctx context.Context, req *connect.Request[actions.GetActionRequest]) (*connect.Response[actions.GetActionResponse], error) {
 	rsp := &actions.GetActionResponse{}
 
-	var loggableIdentifier slog.Attr
-	if req.Msg.GetId() != "" {
-		loggableIdentifier = slog.String("id", req.Msg.GetId())
-	} else {
-		loggableIdentifier = slog.String("name", req.Msg.GetName())
-	}
-
-	a.logger.DebugContext(ctx, "getting action", loggableIdentifier)
+	a.logger.DebugContext(ctx, "getting action", slog.Any("identifier", req.Msg.GetIdentifier()))
 
 	action, err := a.dbClient.GetAction(ctx, req.Msg)
 	if err != nil {
-		return nil, db.StatusifyError(err, db.ErrTextGetRetrievalFailed, loggableIdentifier)
+		return nil, db.StatusifyError(err, db.ErrTextGetRetrievalFailed, slog.Any("identifier", req.Msg.GetIdentifier()))
 	}
 	rsp.Action = action
 
@@ -157,13 +150,13 @@ func (a *ActionService) UpdateAction(ctx context.Context, req *connect.Request[a
 		})
 		if err != nil {
 			a.logger.Audit.PolicyCRUDFailure(ctx, auditParams)
-			return db.StatusifyError(err, db.ErrTextGetRetrievalFailed, slog.String("id", actionID))
+			return db.StatusifyError(err, db.ErrTextGetRetrievalFailed, slog.String("action", req.Msg.String()))
 		}
 
 		updated, err := txClient.UpdateAction(ctx, req.Msg)
 		if err != nil {
 			a.logger.Audit.PolicyCRUDFailure(ctx, auditParams)
-			return db.StatusifyError(err, db.ErrTextUpdateFailed, slog.String("id", actionID))
+			return db.StatusifyError(err, db.ErrTextUpdateFailed, slog.String("action", req.Msg.String()))
 		}
 
 		auditParams.Original = original
@@ -174,7 +167,7 @@ func (a *ActionService) UpdateAction(ctx context.Context, req *connect.Request[a
 		return nil
 	})
 	if err != nil {
-		return nil, db.StatusifyError(err, db.ErrTextUpdateFailed, slog.String("id", actionID))
+		return nil, db.StatusifyError(err, db.ErrTextUpdateFailed, slog.String("action", req.Msg.String()))
 	}
 
 	return connect.NewResponse(rsp), nil
@@ -191,13 +184,14 @@ func (a *ActionService) DeleteAction(ctx context.Context, req *connect.Request[a
 	}
 	a.logger.DebugContext(ctx, "deleting action", slog.String("id", actionID))
 
-	_, err := a.dbClient.DeleteAction(ctx, req.Msg)
+	deleted, err := a.dbClient.DeleteAction(ctx, req.Msg)
 	if err != nil {
 		a.logger.Audit.PolicyCRUDFailure(ctx, auditParams)
-		return nil, db.StatusifyError(err, db.ErrTextDeletionFailed, slog.String("id", actionID))
+		return nil, db.StatusifyError(err, db.ErrTextDeletionFailed, slog.String("action", req.Msg.String()))
 	}
 
 	a.logger.Audit.PolicyCRUDSuccess(ctx, auditParams)
+	rsp.Action = deleted
 
 	return connect.NewResponse(rsp), nil
 }

From a04bc5644472a1a593b8fa4e090603b57f831d03 Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Wed, 23 Apr 2025 08:55:49 -0700
Subject: [PATCH 108/110] audit/logs cleanup around transactions

---
 service/policy/actions/actions.go | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/service/policy/actions/actions.go b/service/policy/actions/actions.go
index 9ebbadd474..6ecd5d78bd 100644
--- a/service/policy/actions/actions.go
+++ b/service/policy/actions/actions.go
@@ -114,18 +114,18 @@ func (a *ActionService) CreateAction(ctx context.Context, req *connect.Request[a
 	err := a.dbClient.RunInTx(ctx, func(txClient *policydb.PolicyDBClient) error {
 		action, err := txClient.CreateAction(ctx, req.Msg)
 		if err != nil {
-			a.logger.Audit.PolicyCRUDFailure(ctx, auditParams)
 			return err
 		}
-
+		
 		auditParams.ObjectID = action.GetId()
 		auditParams.Original = action
 		a.logger.Audit.PolicyCRUDSuccess(ctx, auditParams)
-
+		
 		rsp.Action = action
 		return nil
 	})
 	if err != nil {
+		a.logger.Audit.PolicyCRUDFailure(ctx, auditParams)
 		return nil, db.StatusifyError(err, db.ErrTextCreationFailed, slog.String("action", req.Msg.String()))
 	}
 	return connect.NewResponse(rsp), nil
@@ -149,24 +149,23 @@ func (a *ActionService) UpdateAction(ctx context.Context, req *connect.Request[a
 			},
 		})
 		if err != nil {
-			a.logger.Audit.PolicyCRUDFailure(ctx, auditParams)
-			return db.StatusifyError(err, db.ErrTextGetRetrievalFailed, slog.String("action", req.Msg.String()))
+			return err
 		}
-
+		
 		updated, err := txClient.UpdateAction(ctx, req.Msg)
 		if err != nil {
-			a.logger.Audit.PolicyCRUDFailure(ctx, auditParams)
-			return db.StatusifyError(err, db.ErrTextUpdateFailed, slog.String("action", req.Msg.String()))
+			return err
 		}
-
+		
 		auditParams.Original = original
 		auditParams.Updated = updated
 		a.logger.Audit.PolicyCRUDSuccess(ctx, auditParams)
-
+		
 		rsp.Action = updated
 		return nil
 	})
 	if err != nil {
+		a.logger.Audit.PolicyCRUDFailure(ctx, auditParams)
 		return nil, db.StatusifyError(err, db.ErrTextUpdateFailed, slog.String("action", req.Msg.String()))
 	}
 

From e91197698986895413bc32e0c7e0239560a38bcc Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Wed, 23 Apr 2025 09:11:13 -0700
Subject: [PATCH 109/110] fmt

---
 service/policy/actions/actions.go | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/service/policy/actions/actions.go b/service/policy/actions/actions.go
index 6ecd5d78bd..5a3d56dfd6 100644
--- a/service/policy/actions/actions.go
+++ b/service/policy/actions/actions.go
@@ -116,11 +116,11 @@ func (a *ActionService) CreateAction(ctx context.Context, req *connect.Request[a
 		if err != nil {
 			return err
 		}
-		
+
 		auditParams.ObjectID = action.GetId()
 		auditParams.Original = action
 		a.logger.Audit.PolicyCRUDSuccess(ctx, auditParams)
-		
+
 		rsp.Action = action
 		return nil
 	})
@@ -151,16 +151,16 @@ func (a *ActionService) UpdateAction(ctx context.Context, req *connect.Request[a
 		if err != nil {
 			return err
 		}
-		
+
 		updated, err := txClient.UpdateAction(ctx, req.Msg)
 		if err != nil {
 			return err
 		}
-		
+
 		auditParams.Original = original
 		auditParams.Updated = updated
 		a.logger.Audit.PolicyCRUDSuccess(ctx, auditParams)
-		
+
 		rsp.Action = updated
 		return nil
 	})

From dfa77820e3467879dd1457b532862bf914f3af2b Mon Sep 17 00:00:00 2001
From: jakedoublev <jake.vanvorhis@virtru.com>
Date: Wed, 23 Apr 2025 11:49:23 -0700
Subject: [PATCH 110/110] make sure actions service client is not nil

---
 sdk/sdk.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sdk/sdk.go b/sdk/sdk.go
index d5a6547b38..de82bc07a1 100644
--- a/sdk/sdk.go
+++ b/sdk/sdk.go
@@ -195,6 +195,7 @@ func New(platformEndpoint string, opts ...Option) (*SDK, error) {
 		conn:                    platformConn,
 		dialOptions:             dialOptions,
 		tokenSource:             accessTokenSource,
+		Actions:                 actions.NewActionServiceClient(platformConn),
 		Attributes:              attributes.NewAttributesServiceClient(platformConn),
 		Namespaces:              namespaces.NewNamespaceServiceClient(platformConn),
 		ResourceMapping:         resourcemapping.NewResourceMappingServiceClient(platformConn),