@structured-id/ui-core 1.2.0 → 2.0.0

package/src/generated/sid/v1/authz/authz.ts

@@ -11,6 +11,10 @@ import { UnknownFieldHandler } from "@protobuf-ts/runtime";
 import type { PartialMessage } from "@protobuf-ts/runtime";
 import { reflectionMergePartial } from "@protobuf-ts/runtime";
 import { MessageType } from "@protobuf-ts/runtime";
+import { MachineUserId } from "../ids/ids";
+import { ResourceId } from "../ids/ids";
+import { Duration } from "../../../google/protobuf/duration";
+import { ProvisioningConnectorId } from "../ids/ids";
 import { Timestamp } from "../../../google/protobuf/timestamp";
 // ── Messages ─────────────────────────────────────────────────────────
 
@@ -85,7 +89,9 @@ export interface Group {
     updatedAt?: Timestamp;
 }
 /**
- * RoleAssignment assigns a role to a profile, group, or machine user.
+ * RoleAssignment assigns a role to a profile, group, machine user, an
+ * independent OAuth client acting as a service, or a SCIM provisioning
+ * connector.
  *
  * @generated from protobuf message sid.v1.authz.RoleAssignment
  */
@@ -115,6 +121,25 @@ export interface RoleAssignment {
          * @generated from protobuf field: string machine_user_id = 8
          */
         machineUserId: string;
+    } | {
+        oneofKind: "oauthClientId";
+        /**
+         * `client_id` of an independent confidential OAuth client. A machine
+         * user's OAuth credentials resolve to the machine user, never to this
+         * principal.
+         *
+         * @generated from protobuf field: string oauth_client_id = 9
+         */
+        oauthClientId: string;
+    } | {
+        oneofKind: "provisioningConnectorId";
+        /**
+         * A SCIM provisioning connector. Its roles take effect only for SCIM
+         * actions on the protected directory resource named in `scope`.
+         *
+         * @generated from protobuf field: sid.v1.ids.ProvisioningConnectorId provisioning_connector_id = 10
+         */
+        provisioningConnectorId: ProvisioningConnectorId;
     } | {
         oneofKind: undefined;
     };
@@ -123,11 +148,14 @@ export interface RoleAssignment {
      */
     roleId: string;
     /**
-     * Optional scope (resource constraint).
+     * Optional scope (resource constraint): e.g. "project:<uuid>", or
+     * "oauth_resource:<resource_id>" for one registered protected resource
+     * (its issuer is the resource's). The token inspector role is assigned
+     * only with a protected-resource scope.
      *
      * @generated from protobuf field: optional string scope = 5
      */
-    scope?: string; // e.g., "project:abc123"
+    scope?: string;
     /**
      * Optional expiry (temporary role).
      *
@@ -138,6 +166,108 @@ export interface RoleAssignment {
      * @generated from protobuf field: google.protobuf.Timestamp created_at = 7
      */
     createdAt?: Timestamp;
+    /**
+     * Present on an administrative assignment: what its holder may administer
+     * within `scope`. Holding the role alone administers nothing.
+     *
+     * @generated from protobuf field: optional sid.v1.authz.AdminEnvelope admin = 11
+     */
+    admin?: AdminEnvelope;
+    /**
+     * Who granted the assignment and on what authority, recorded by the
+     * server; absent on assignments that predate provenance.
+     *
+     * @generated from protobuf field: optional sid.v1.authz.AssignmentProvenance provenance = 12
+     */
+    provenance?: AssignmentProvenance;
+}
+/**
+ * What an administrative assignment may administer. Every field is an
+ * explicit bound: an empty list permits nothing, never everything.
+ *
+ * @generated from protobuf message sid.v1.authz.AdminEnvelope
+ */
+export interface AdminEnvelope {
+    /**
+     * The permitted operations; UNSPECIFIED is refused.
+     *
+     * @generated from protobuf field: repeated sid.v1.authz.AdminOperation operations = 1
+     */
+    operations: AdminOperation[];
+    /**
+     * The roles that may be administered, by role id. A role is matched by
+     * identity and by its current content against `permission_ceiling`.
+     *
+     * @generated from protobuf field: repeated string role_ids = 2
+     */
+    roleIds: string[];
+    /**
+     * The permissions an administered role may hold at most: a role whose
+     * current permissions exceed it cannot be assigned, whatever its name.
+     *
+     * @generated from protobuf field: repeated string permission_ceiling = 3
+     */
+    permissionCeiling: string[];
+    /**
+     * The kinds of principal roles may be assigned to; UNSPECIFIED is refused.
+     *
+     * @generated from protobuf field: repeated sid.v1.authz.RecipientKind recipient_kinds = 4
+     */
+    recipientKinds: RecipientKind[];
+    /**
+     * When set, only this group and its members are eligible recipients. The
+     * group cannot be deleted while an envelope names it.
+     *
+     * @generated from protobuf field: optional string recipient_group_id = 5
+     */
+    recipientGroupId?: string;
+    /**
+     * The longest validity an administered assignment may be given; every
+     * administered assignment expires. Must be positive, whole seconds.
+     *
+     * @generated from protobuf field: google.protobuf.Duration max_validity = 6
+     */
+    maxValidity?: Duration;
+}
+/**
+ * Who granted a role assignment and on what authority. Set by the server
+ * from the authenticated caller; never accepted from a request.
+ *
+ * @generated from protobuf message sid.v1.authz.AssignmentProvenance
+ */
+export interface AssignmentProvenance {
+    /**
+     * The granting actor as the authorization engine names it:
+     * "user:<profile_id>", "machine:<machine_user_id>" or
+     * "oauth_client:<client_id>".
+     *
+     * @generated from protobuf field: string granted_by = 1
+     */
+    grantedBy: string;
+    /**
+     * The administrative assignment that authorized the grant; absent when the
+     * installation's administrator granted it as root of its scope.
+     *
+     * @generated from protobuf field: optional string basis_assignment_id = 2
+     */
+    basisAssignmentId?: string;
+    /**
+     * The administrative assignment this one depends on: set on a redelegated
+     * administrative assignment, which ends when that source ends. An ordinary
+     * assignment outlives the assignment that authorized it.
+     *
+     * @generated from protobuf field: optional string depends_on_assignment_id = 3
+     */
+    dependsOnAssignmentId?: string;
+    /**
+     * The permissions the role could hold at most when an envelope approved
+     * this working assignment. The role is never edited past them while the
+     * assignment exists; widening it needs the assignment reauthorized first.
+     * Empty when the root granted it, or on an administrative assignment.
+     *
+     * @generated from protobuf field: repeated string approved_ceiling = 4
+     */
+    approvedCeiling: string[];
 }
 /**
  * Policy represents a Cedar policy (ABAC).
@@ -192,56 +322,301 @@ export interface Policy {
 // ── Permission check ─────────────────────────────────────────────────
 
 /**
+ * One permission question: may a subject perform `action` on `target`.
+ *
+ * The caller authenticates as itself in the request metadata. Asking about
+ * any subject other than the caller's own needs the caller's current
+ * `authz.check` assignment on the target resource. Which subject is
+ * evaluated, and with what evidence, is stated explicitly by `evaluation`;
+ * a request whose evidence fails is refused, never re-evaluated in another
+ * mode.
+ *
  * @generated from protobuf message sid.v1.authz.CheckPermissionRequest
  */
 export interface CheckPermissionRequest {
     /**
-     * @generated from protobuf field: string subject = 1
+     * The application operation to decide, in the target application's own
+     * vocabulary (for example "orders.read"). The receiver maps its real
+     * operation to it; SID does not derive it from an HTTP method or path.
+     *
+     * @generated from protobuf field: string action = 2
      */
-    subject: string; // e.g., "user:alice", "service:payment"
+    action: string;
     /**
-     * @generated from protobuf field: string action = 2
+     * How fresh the decision must be; unspecified is CONSISTENCY_EVENTUAL.
+     *
+     * @generated from protobuf field: sid.v1.authz.Consistency consistency = 4
      */
-    action: string; // e.g., "edit", "view", "delete", "admin"
+    consistency: Consistency;
     /**
-     * @generated from protobuf field: string resource = 3
+     * Where the action would take effect.
+     *
+     * @generated from protobuf field: sid.v1.authz.PermissionTarget target = 6
      */
-    resource: string; // e.g., "document:123", "repo:my-app"
+    target?: PermissionTarget;
     /**
-     * @generated from protobuf field: sid.v1.authz.Consistency consistency = 4
+     * Whose permission is decided, and on what evidence.
+     *
+     * @generated from protobuf oneof: evaluation
      */
-    consistency: Consistency;
+    evaluation: {
+        oneofKind: "request";
+        /**
+         * The subject of one original request to the target, established from
+         * that request's own access token (request-bound evaluation).
+         *
+         * @generated from protobuf field: sid.v1.authz.RequestEvaluation request = 7
+         */
+        request: RequestEvaluation;
+    } | {
+        oneofKind: "namedSubject";
+        /**
+         * A named subject, evaluated by policy alone (abstract evaluation). It
+         * claims no presence, session, assurance or sender proof, and cannot
+         * satisfy a policy that requires them.
+         *
+         * @generated from protobuf field: sid.v1.authz.SubjectReference named_subject = 8
+         */
+        namedSubject: SubjectReference;
+    } | {
+        oneofKind: "self";
+        /**
+         * The caller itself, as its own credential authenticates it. Needs no
+         * checker assignment.
+         *
+         * @generated from protobuf field: sid.v1.authz.SelfEvaluation self = 9
+         */
+        self: SelfEvaluation;
+    } | {
+        oneofKind: undefined;
+    };
+}
+/**
+ * The place an action would take effect. Its issuer and recipient
+ * organization come from the resource's registration, never from the
+ * caller.
+ *
+ * @generated from protobuf message sid.v1.authz.PermissionTarget
+ */
+export interface PermissionTarget {
     /**
-     * @generated from protobuf field: map<string, string> context = 5
+     * @generated from protobuf oneof: scope
      */
-    context: {
-        [key: string]: string;
-    }; // Additional context (IP, time, etc.)
+    scope: {
+        oneofKind: "resource";
+        /**
+         * A registered protected resource of this installation.
+         *
+         * @generated from protobuf field: sid.v1.ids.ResourceId resource = 1
+         */
+        resource: ResourceId;
+    } | {
+        oneofKind: "projectId";
+        /**
+         * A project of this installation, for project-wide permissions (UUID
+         * text). Only the caller's own subject may be asked about a project.
+         *
+         * @generated from protobuf field: string project_id = 2
+         */
+        projectId: string;
+    } | {
+        oneofKind: undefined;
+    };
+    /**
+     * The object of the action inside the resource's application, in that
+     * application's own namespace (for example "order:8812"). Empty for the
+     * resource as a whole. Opaque to SID apart from the policies that name it.
+     *
+     * @generated from protobuf field: string object = 3
+     */
+    object: string;
 }
 /**
- * @generated from protobuf message sid.v1.authz.CheckPermissionResponse
+ * The subject of an original request, established by SID from the request's
+ * own access token. The token is evidence about its subject, never the
+ * caller's credential, and is not accepted at the authorization API itself.
+ *
+ * @generated from protobuf message sid.v1.authz.RequestEvaluation
  */
-export interface CheckPermissionResponse {
+export interface RequestEvaluation {
     /**
-     * @generated from protobuf field: bool allowed = 1
+     * The access token exactly as the original request presented it (JWS
+     * compact serialization or an opaque access token), unchanged. Its audience
+     * is the target resource. Refresh, ID, IdP session and exchange-only PAT
+     * parent tokens are refused. Never logged or echoed.
+     *
+     * @generated from protobuf field: string access_token = 1
      */
-    allowed: boolean;
+    accessToken: string;
+    /**
+     * Checks of the original request made at the resource boundary by the
+     * caller, when the caller is trusted to make them. Absent when the request
+     * carried no sender proof or nobody trusted to verify it did.
+     *
+     * @generated from protobuf field: sid.v1.authz.RequestConfirmation confirmation = 2
+     */
+    confirmation?: RequestConfirmation;
+}
+/**
+ * What the verifier at the resource boundary confirmed about one original
+ * request. It is bound to that request, its token and this query's target;
+ * it is the verifier's testimony, not a new proof, and the original sender
+ * proof is never sent or consumed again here.
+ *
+ * @generated from protobuf message sid.v1.authz.RequestConfirmation
+ */
+export interface RequestConfirmation {
+    /**
+     * Which kind of sender proof was verified.
+     *
+     * @generated from protobuf field: sid.v1.authz.SenderProofProfile profile = 1
+     */
+    profile: SenderProofProfile;
+    /**
+     * The original request's HTTP method, as received at the resource.
+     *
+     * @generated from protobuf field: string method = 2
+     */
+    method: string;
+    /**
+     * The original request's external URI without query and fragment, as
+     * reconstructed from authenticated ingress context (the DPoP `htu`,
+     * RFC 9449 §4.2).
+     *
+     * @generated from protobuf field: string uri = 3
+     */
+    uri: string;
+    /**
+     * The verifier's identifier of the original request: a retry of the same
+     * pending request carries the same value, a new request a new one.
+     * 16 random bytes.
+     *
+     * @generated from protobuf field: bytes request_id = 4
+     */
+    requestId: Uint8Array;
+    /**
+     * The JWK SHA-256 thumbprint (RFC 7638) of the key the proof was verified
+     * with; it must equal the token's `cnf.jkt` (RFC 9449 §6.1).
+     *
+     * @generated from protobuf field: string jkt = 5
+     */
+    jkt: string;
+    /**
+     * When the verifier checked the proof.
+     *
+     * @generated from protobuf field: google.protobuf.Timestamp verified_at = 6
+     */
+    verifiedAt?: Timestamp;
+    /**
+     * Until when the confirmation may be used for this request; never beyond
+     * the token's expiry.
+     *
+     * @generated from protobuf field: google.protobuf.Timestamp valid_until = 7
+     */
+    validUntil?: Timestamp;
+}
+/**
+ * A subject named for abstract evaluation.
+ *
+ * @generated from protobuf message sid.v1.authz.SubjectReference
+ */
+export interface SubjectReference {
+    /**
+     * @generated from protobuf oneof: kind
+     */
+    kind: {
+        oneofKind: "machineUserId";
+        /**
+         * A machine user of this installation.
+         *
+         * @generated from protobuf field: sid.v1.ids.MachineUserId machine_user_id = 1
+         */
+        machineUserId: MachineUserId;
+    } | {
+        oneofKind: "oauthClientId";
+        /**
+         * An independent confidential OAuth client of this installation, by its
+         * `client_id`.
+         *
+         * @generated from protobuf field: string oauth_client_id = 2
+         */
+        oauthClientId: string;
+    } | {
+        oneofKind: "issuerSubject";
+        /**
+         * A user as the target's issuer identifies them to the target's
+         * recipient: that issuer's opaque `sub` for it, resolved under the
+         * issuer's subject rule, never cast to an identifier by its shape.
+         *
+         * @generated from protobuf field: sid.v1.authz.IssuerSubject issuer_subject = 3
+         */
+        issuerSubject: IssuerSubject;
+    } | {
+        oneofKind: undefined;
+    };
+}
+/**
+ * A subject as one issuer names it.
+ *
+ * @generated from protobuf message sid.v1.authz.IssuerSubject
+ */
+export interface IssuerSubject {
     /**
+     * The issuer's identifier (its `iss`).
+     *
+     * @generated from protobuf field: string issuer = 1
+     */
+    issuer: string;
+    /**
+     * The issuer's subject identifier for the target's recipient (its `sub`).
+     *
+     * @generated from protobuf field: string subject = 2
+     */
+    subject: string;
+}
+/**
+ * The caller asks about itself.
+ *
+ * @generated from protobuf message sid.v1.authz.SelfEvaluation
+ */
+export interface SelfEvaluation {
+}
+/**
+ * @generated from protobuf message sid.v1.authz.CheckPermissionResponse
+ */
+export interface CheckPermissionResponse {
+    /**
+     * Explanation of the decision, for a caller asking about itself; absent
+     * for a checker, which gets the decision without policy internals.
+     *
      * @generated from protobuf field: optional string reason = 2
      */
-    reason?: string; // Explanation (for debugging/audit)
+    reason?: string;
     /**
      * Snapshot token for subsequent consistent checks.
      *
      * @generated from protobuf field: optional string zookie = 3
      */
     zookie?: string;
+    /**
+     * The decision.
+     *
+     * @generated from protobuf field: sid.v1.authz.PermissionOutcome outcome = 4
+     */
+    outcome: PermissionOutcome;
 }
 /**
+ * Several permission questions, answered together or refused together.
+ *
  * @generated from protobuf message sid.v1.authz.BatchCheckPermissionRequest
  */
 export interface BatchCheckPermissionRequest {
     /**
+     * At most 100 questions. Every one is admitted (caller, target, evidence)
+     * before any subject is evaluated; one refused question refuses the whole
+     * batch with no partial results. Questions about one original request
+     * carry the same `RequestEvaluation`.
+     *
      * @generated from protobuf field: repeated sid.v1.authz.CheckPermissionRequest checks = 1
      */
     checks: CheckPermissionRequest[];
@@ -251,6 +626,8 @@ export interface BatchCheckPermissionRequest {
  */
 export interface BatchCheckPermissionResponse {
     /**
+     * One answer per question, in the order asked.
+     *
      * @generated from protobuf field: repeated sid.v1.authz.CheckPermissionResponse results = 1
      */
     results: CheckPermissionResponse[];
@@ -384,18 +761,31 @@ export interface GetRoleResponse {
     role?: Role;
 }
 /**
+ * Changes a role on the caller's authority: the installation's administrator
+ * edits any role; anyone else needs an administrative assignment permitting
+ * edits of it whose ceiling admits the new permissions. A role never gains a
+ * permission beyond the approved ceiling of one of its assignments
+ * (FAILED_PRECONDITION, APPROVED_CEILING): that assignment is reauthorized
+ * first.
+ *
  * @generated from protobuf message sid.v1.authz.UpdateRoleRequest
  */
 export interface UpdateRoleRequest {
     /**
+     * The role to change.
+     *
      * @generated from protobuf field: string id = 1
      */
     id: string;
     /**
+     * New description; unset keeps the current one.
+     *
      * @generated from protobuf field: optional string description = 2
      */
     description?: string;
     /**
+     * The role's complete new permission list; empty keeps the current one.
+     *
      * @generated from protobuf field: repeated string permissions = 3
      */
     permissions: string[];
@@ -480,6 +870,26 @@ export interface AssignRoleRequest {
          * @generated from protobuf field: string machine_user_id = 6
          */
         machineUserId: string;
+    } | {
+        oneofKind: "oauthClientId";
+        /**
+         * `client_id` of an existing confidential OAuth client; a public or
+         * unknown client is refused (INVALID_ARGUMENT / NOT_FOUND).
+         *
+         * @generated from protobuf field: string oauth_client_id = 7
+         */
+        oauthClientId: string;
+    } | {
+        oneofKind: "provisioningConnectorId";
+        /**
+         * An existing, not retired SCIM provisioning connector. The assignment
+         * must be scoped to one protected resource ("oauth_resource:<resource_id>"),
+         * else INVALID_ARGUMENT; an unknown connector is NOT_FOUND, a retired one
+         * FAILED_PRECONDITION.
+         *
+         * @generated from protobuf field: sid.v1.ids.ProvisioningConnectorId provisioning_connector_id = 8
+         */
+        provisioningConnectorId: ProvisioningConnectorId;
     } | {
         oneofKind: undefined;
     };
@@ -488,6 +898,11 @@ export interface AssignRoleRequest {
      */
     roleId: string;
     /**
+     * Scope of the assignment, as in RoleAssignment.scope. For the token
+     * inspector role it must name an existing, not retired protected resource
+     * ("oauth_resource:<resource_id>"), else INVALID_ARGUMENT / NOT_FOUND /
+     * FAILED_PRECONDITION (RESOURCE_RETIRED).
+     *
      * @generated from protobuf field: optional string scope = 4
      */
     scope?: string;
@@ -495,6 +910,16 @@ export interface AssignRoleRequest {
      * @generated from protobuf field: optional google.protobuf.Timestamp expires_at = 5
      */
     expiresAt?: Timestamp;
+    /**
+     * Makes the assignment administrative, bounded by this envelope within
+     * `scope`. Granting it requires the root of the scope, or a redelegation
+     * right of the same administrative role whose envelope this one narrows;
+     * a redelegated one needs `expires_at` within that right's validity.
+     * A malformed envelope is INVALID_ARGUMENT naming the field.
+     *
+     * @generated from protobuf field: optional sid.v1.authz.AdminEnvelope admin = 9
+     */
+    admin?: AdminEnvelope;
 }
 /**
  * @generated from protobuf message sid.v1.authz.AssignRoleResponse
@@ -550,6 +975,22 @@ export interface ListRoleAssignmentsRequest {
          * @generated from protobuf field: string machine_user_id = 4
          */
         machineUserId: string;
+    } | {
+        oneofKind: "oauthClientId";
+        /**
+         * Assignments held by this OAuth client (`client_id`).
+         *
+         * @generated from protobuf field: string oauth_client_id = 5
+         */
+        oauthClientId: string;
+    } | {
+        oneofKind: "provisioningConnectorId";
+        /**
+         * Assignments held by this SCIM provisioning connector.
+         *
+         * @generated from protobuf field: sid.v1.ids.ProvisioningConnectorId provisioning_connector_id = 6
+         */
+        provisioningConnectorId: ProvisioningConnectorId;
     } | {
         oneofKind: undefined;
     };
@@ -1027,7 +1468,8 @@ export interface SodConflict {
      */
     description: string;
     /**
-     * Severity: "warning" (CE) or "block" (EE).
+     * Severity: "warning" (an administrator may override it) or "block" (the
+     * assignment needs an approved exception).
      *
      * @generated from protobuf field: string severity = 3
      */
@@ -1285,67 +1727,179 @@ export enum PolicyEffect {
     FORBID = 2
 }
 /**
- * Type of access change.
+ * A role administration operation an administrative assignment may permit.
+ * None implies another.
  *
- * @generated from protobuf enum sid.v1.authz.SimulationImpactType
+ * @generated from protobuf enum sid.v1.authz.AdminOperation
  */
-export enum SimulationImpactType {
+export enum AdminOperation {
     /**
-     * @generated from protobuf enum value: SIMULATION_IMPACT_TYPE_UNSPECIFIED = 0;
+     * @generated from protobuf enum value: ADMIN_OPERATION_UNSPECIFIED = 0;
      */
     UNSPECIFIED = 0,
     /**
-     * Current: deny → Proposed: allow.
+     * Create assignments of the envelope's roles.
      *
-     * @generated from protobuf enum value: SIMULATION_IMPACT_TYPE_GAINED = 1;
+     * @generated from protobuf enum value: ADMIN_OPERATION_ASSIGN = 1;
      */
-    GAINED = 1,
+    ASSIGN = 1,
     /**
-     * Current: allow → Proposed: deny.
+     * Remove assignments of the envelope's roles.
      *
-     * @generated from protobuf enum value: SIMULATION_IMPACT_TYPE_LOST = 2;
+     * @generated from protobuf enum value: ADMIN_OPERATION_REVOKE = 2;
      */
-    LOST = 2,
+    REVOKE = 2,
     /**
-     * No change (both allow or both deny).
+     * Change the definition of the envelope's roles, within its ceiling.
      *
-     * @generated from protobuf enum value: SIMULATION_IMPACT_TYPE_UNCHANGED = 3;
+     * @generated from protobuf enum value: ADMIN_OPERATION_EDIT_ROLE = 3;
      */
-    UNCHANGED = 3
+    EDIT_ROLE = 3,
+    /**
+     * Grant administrative assignments narrower than the holder's own.
+     *
+     * @generated from protobuf enum value: ADMIN_OPERATION_REDELEGATE = 4;
+     */
+    REDELEGATE = 4
 }
-// @generated message type with reflection information, may provide speed optimized methods
-class Role$Type extends MessageType<Role> {
-    constructor() {
-        super("sid.v1.authz.Role", [
-            { no: 1, name: "id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "project_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "name", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 4, name: "description", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
-            { no: 5, name: "permissions", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 6, name: "created_at", kind: "message", T: () => Timestamp },
-            { no: 7, name: "updated_at", kind: "message", T: () => Timestamp }
-        ]);
-    }
-    create(value?: PartialMessage<Role>): Role {
-        const message = globalThis.Object.create((this.messagePrototype!));
-        message.id = "";
-        message.projectId = "";
-        message.name = "";
-        message.permissions = [];
-        if (value !== undefined)
-            reflectionMergePartial<Role>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: Role): Role {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string id */ 1:
-                    message.id = reader.string();
-                    break;
-                case /* string project_id */ 2:
-                    message.projectId = reader.string();
+/**
+ * A kind of principal an administrative assignment lets its holder assign
+ * roles to. A SCIM provisioning connector is never an administered recipient.
+ *
+ * @generated from protobuf enum sid.v1.authz.RecipientKind
+ */
+export enum RecipientKind {
+    /**
+     * @generated from protobuf enum value: RECIPIENT_KIND_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from protobuf enum value: RECIPIENT_KIND_PROFILE = 1;
+     */
+    PROFILE = 1,
+    /**
+     * @generated from protobuf enum value: RECIPIENT_KIND_GROUP = 2;
+     */
+    GROUP = 2,
+    /**
+     * @generated from protobuf enum value: RECIPIENT_KIND_MACHINE_USER = 3;
+     */
+    MACHINE_USER = 3,
+    /**
+     * @generated from protobuf enum value: RECIPIENT_KIND_OAUTH_CLIENT = 4;
+     */
+    OAUTH_CLIENT = 4
+}
+/**
+ * The kind of sender proof a confirmation reports.
+ *
+ * @generated from protobuf enum sid.v1.authz.SenderProofProfile
+ */
+export enum SenderProofProfile {
+    /**
+     * @generated from protobuf enum value: SENDER_PROOF_PROFILE_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * A DPoP proof (RFC 9449).
+     *
+     * @generated from protobuf enum value: SENDER_PROOF_PROFILE_DPOP = 1;
+     */
+    DPOP = 1
+}
+/**
+ * What a permission question decided.
+ *
+ * @generated from protobuf enum sid.v1.authz.PermissionOutcome
+ */
+export enum PermissionOutcome {
+    /**
+     * @generated from protobuf enum value: PERMISSION_OUTCOME_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * The subject may perform the action on the target.
+     *
+     * @generated from protobuf enum value: PERMISSION_OUTCOME_ALLOWED = 1;
+     */
+    ALLOWED = 1,
+    /**
+     * The subject may not.
+     *
+     * @generated from protobuf enum value: PERMISSION_OUTCOME_DENIED = 2;
+     */
+    DENIED = 2,
+    /**
+     * A policy requires evidence the question did not carry (a session, an
+     * authentication level, a sender proof); with that evidence the decision
+     * may differ. Never an allow.
+     *
+     * @generated from protobuf enum value: PERMISSION_OUTCOME_EVIDENCE_REQUIRED = 3;
+     */
+    EVIDENCE_REQUIRED = 3
+}
+/**
+ * Type of access change.
+ *
+ * @generated from protobuf enum sid.v1.authz.SimulationImpactType
+ */
+export enum SimulationImpactType {
+    /**
+     * @generated from protobuf enum value: SIMULATION_IMPACT_TYPE_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * Current: deny → Proposed: allow.
+     *
+     * @generated from protobuf enum value: SIMULATION_IMPACT_TYPE_GAINED = 1;
+     */
+    GAINED = 1,
+    /**
+     * Current: allow → Proposed: deny.
+     *
+     * @generated from protobuf enum value: SIMULATION_IMPACT_TYPE_LOST = 2;
+     */
+    LOST = 2,
+    /**
+     * No change (both allow or both deny).
+     *
+     * @generated from protobuf enum value: SIMULATION_IMPACT_TYPE_UNCHANGED = 3;
+     */
+    UNCHANGED = 3
+}
+// @generated message type with reflection information, may provide speed optimized methods
+class Role$Type extends MessageType<Role> {
+    constructor() {
+        super("sid.v1.authz.Role", [
+            { no: 1, name: "id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "project_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "name", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "description", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 5, name: "permissions", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 6, name: "created_at", kind: "message", T: () => Timestamp },
+            { no: 7, name: "updated_at", kind: "message", T: () => Timestamp }
+        ]);
+    }
+    create(value?: PartialMessage<Role>): Role {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.id = "";
+        message.projectId = "";
+        message.name = "";
+        message.permissions = [];
+        if (value !== undefined)
+            reflectionMergePartial<Role>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: Role): Role {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string id */ 1:
+                    message.id = reader.string();
+                    break;
+                case /* string project_id */ 2:
+                    message.projectId = reader.string();
                     break;
                 case /* string name */ 3:
                     message.name = reader.string();
@@ -1437,17 +1991,741 @@ class Group$Type extends MessageType<Group> {
                 case /* string project_id */ 2:
                     message.projectId = reader.string();
                     break;
-                case /* string name */ 3:
-                    message.name = reader.string();
+                case /* string name */ 3:
+                    message.name = reader.string();
+                    break;
+                case /* optional string description */ 4:
+                    message.description = reader.string();
+                    break;
+                case /* google.protobuf.Timestamp created_at */ 5:
+                    message.createdAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.createdAt);
+                    break;
+                case /* google.protobuf.Timestamp updated_at */ 6:
+                    message.updatedAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.updatedAt);
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: Group, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string id = 1; */
+        if (message.id !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.id);
+        /* string project_id = 2; */
+        if (message.projectId !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.projectId);
+        /* string name = 3; */
+        if (message.name !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.name);
+        /* optional string description = 4; */
+        if (message.description !== undefined)
+            writer.tag(4, WireType.LengthDelimited).string(message.description);
+        /* google.protobuf.Timestamp created_at = 5; */
+        if (message.createdAt)
+            Timestamp.internalBinaryWrite(message.createdAt, writer.tag(5, WireType.LengthDelimited).fork(), options).join();
+        /* google.protobuf.Timestamp updated_at = 6; */
+        if (message.updatedAt)
+            Timestamp.internalBinaryWrite(message.updatedAt, writer.tag(6, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.authz.Group
+ */
+export const Group = new Group$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class RoleAssignment$Type extends MessageType<RoleAssignment> {
+    constructor() {
+        super("sid.v1.authz.RoleAssignment", [
+            { no: 1, name: "id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "profile_id", kind: "scalar", oneof: "principal", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "group_id", kind: "scalar", oneof: "principal", T: 9 /*ScalarType.STRING*/ },
+            { no: 8, name: "machine_user_id", kind: "scalar", oneof: "principal", T: 9 /*ScalarType.STRING*/ },
+            { no: 9, name: "oauth_client_id", kind: "scalar", oneof: "principal", T: 9 /*ScalarType.STRING*/ },
+            { no: 10, name: "provisioning_connector_id", kind: "message", oneof: "principal", T: () => ProvisioningConnectorId },
+            { no: 4, name: "role_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 5, name: "scope", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 6, name: "expires_at", kind: "message", T: () => Timestamp },
+            { no: 7, name: "created_at", kind: "message", T: () => Timestamp },
+            { no: 11, name: "admin", kind: "message", T: () => AdminEnvelope },
+            { no: 12, name: "provenance", kind: "message", T: () => AssignmentProvenance }
+        ]);
+    }
+    create(value?: PartialMessage<RoleAssignment>): RoleAssignment {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.id = "";
+        message.principal = { oneofKind: undefined };
+        message.roleId = "";
+        if (value !== undefined)
+            reflectionMergePartial<RoleAssignment>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: RoleAssignment): RoleAssignment {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string id */ 1:
+                    message.id = reader.string();
+                    break;
+                case /* string profile_id */ 2:
+                    message.principal = {
+                        oneofKind: "profileId",
+                        profileId: reader.string()
+                    };
+                    break;
+                case /* string group_id */ 3:
+                    message.principal = {
+                        oneofKind: "groupId",
+                        groupId: reader.string()
+                    };
+                    break;
+                case /* string machine_user_id */ 8:
+                    message.principal = {
+                        oneofKind: "machineUserId",
+                        machineUserId: reader.string()
+                    };
+                    break;
+                case /* string oauth_client_id */ 9:
+                    message.principal = {
+                        oneofKind: "oauthClientId",
+                        oauthClientId: reader.string()
+                    };
+                    break;
+                case /* sid.v1.ids.ProvisioningConnectorId provisioning_connector_id */ 10:
+                    message.principal = {
+                        oneofKind: "provisioningConnectorId",
+                        provisioningConnectorId: ProvisioningConnectorId.internalBinaryRead(reader, reader.uint32(), options, (message.principal as any).provisioningConnectorId)
+                    };
+                    break;
+                case /* string role_id */ 4:
+                    message.roleId = reader.string();
+                    break;
+                case /* optional string scope */ 5:
+                    message.scope = reader.string();
+                    break;
+                case /* optional google.protobuf.Timestamp expires_at */ 6:
+                    message.expiresAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.expiresAt);
+                    break;
+                case /* google.protobuf.Timestamp created_at */ 7:
+                    message.createdAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.createdAt);
+                    break;
+                case /* optional sid.v1.authz.AdminEnvelope admin */ 11:
+                    message.admin = AdminEnvelope.internalBinaryRead(reader, reader.uint32(), options, message.admin);
+                    break;
+                case /* optional sid.v1.authz.AssignmentProvenance provenance */ 12:
+                    message.provenance = AssignmentProvenance.internalBinaryRead(reader, reader.uint32(), options, message.provenance);
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: RoleAssignment, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string id = 1; */
+        if (message.id !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.id);
+        /* string profile_id = 2; */
+        if (message.principal.oneofKind === "profileId")
+            writer.tag(2, WireType.LengthDelimited).string(message.principal.profileId);
+        /* string group_id = 3; */
+        if (message.principal.oneofKind === "groupId")
+            writer.tag(3, WireType.LengthDelimited).string(message.principal.groupId);
+        /* string role_id = 4; */
+        if (message.roleId !== "")
+            writer.tag(4, WireType.LengthDelimited).string(message.roleId);
+        /* optional string scope = 5; */
+        if (message.scope !== undefined)
+            writer.tag(5, WireType.LengthDelimited).string(message.scope);
+        /* optional google.protobuf.Timestamp expires_at = 6; */
+        if (message.expiresAt)
+            Timestamp.internalBinaryWrite(message.expiresAt, writer.tag(6, WireType.LengthDelimited).fork(), options).join();
+        /* google.protobuf.Timestamp created_at = 7; */
+        if (message.createdAt)
+            Timestamp.internalBinaryWrite(message.createdAt, writer.tag(7, WireType.LengthDelimited).fork(), options).join();
+        /* string machine_user_id = 8; */
+        if (message.principal.oneofKind === "machineUserId")
+            writer.tag(8, WireType.LengthDelimited).string(message.principal.machineUserId);
+        /* string oauth_client_id = 9; */
+        if (message.principal.oneofKind === "oauthClientId")
+            writer.tag(9, WireType.LengthDelimited).string(message.principal.oauthClientId);
+        /* sid.v1.ids.ProvisioningConnectorId provisioning_connector_id = 10; */
+        if (message.principal.oneofKind === "provisioningConnectorId")
+            ProvisioningConnectorId.internalBinaryWrite(message.principal.provisioningConnectorId, writer.tag(10, WireType.LengthDelimited).fork(), options).join();
+        /* optional sid.v1.authz.AdminEnvelope admin = 11; */
+        if (message.admin)
+            AdminEnvelope.internalBinaryWrite(message.admin, writer.tag(11, WireType.LengthDelimited).fork(), options).join();
+        /* optional sid.v1.authz.AssignmentProvenance provenance = 12; */
+        if (message.provenance)
+            AssignmentProvenance.internalBinaryWrite(message.provenance, writer.tag(12, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.authz.RoleAssignment
+ */
+export const RoleAssignment = new RoleAssignment$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class AdminEnvelope$Type extends MessageType<AdminEnvelope> {
+    constructor() {
+        super("sid.v1.authz.AdminEnvelope", [
+            { no: 1, name: "operations", kind: "enum", repeat: 1 /*RepeatType.PACKED*/, T: () => ["sid.v1.authz.AdminOperation", AdminOperation, "ADMIN_OPERATION_"] },
+            { no: 2, name: "role_ids", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "permission_ceiling", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "recipient_kinds", kind: "enum", repeat: 1 /*RepeatType.PACKED*/, T: () => ["sid.v1.authz.RecipientKind", RecipientKind, "RECIPIENT_KIND_"] },
+            { no: 5, name: "recipient_group_id", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 6, name: "max_validity", kind: "message", T: () => Duration }
+        ]);
+    }
+    create(value?: PartialMessage<AdminEnvelope>): AdminEnvelope {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.operations = [];
+        message.roleIds = [];
+        message.permissionCeiling = [];
+        message.recipientKinds = [];
+        if (value !== undefined)
+            reflectionMergePartial<AdminEnvelope>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: AdminEnvelope): AdminEnvelope {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* repeated sid.v1.authz.AdminOperation operations */ 1:
+                    if (wireType === WireType.LengthDelimited)
+                        for (let e = reader.int32() + reader.pos; reader.pos < e;)
+                            message.operations.push(reader.int32());
+                    else
+                        message.operations.push(reader.int32());
+                    break;
+                case /* repeated string role_ids */ 2:
+                    message.roleIds.push(reader.string());
+                    break;
+                case /* repeated string permission_ceiling */ 3:
+                    message.permissionCeiling.push(reader.string());
+                    break;
+                case /* repeated sid.v1.authz.RecipientKind recipient_kinds */ 4:
+                    if (wireType === WireType.LengthDelimited)
+                        for (let e = reader.int32() + reader.pos; reader.pos < e;)
+                            message.recipientKinds.push(reader.int32());
+                    else
+                        message.recipientKinds.push(reader.int32());
+                    break;
+                case /* optional string recipient_group_id */ 5:
+                    message.recipientGroupId = reader.string();
+                    break;
+                case /* google.protobuf.Duration max_validity */ 6:
+                    message.maxValidity = Duration.internalBinaryRead(reader, reader.uint32(), options, message.maxValidity);
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: AdminEnvelope, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* repeated sid.v1.authz.AdminOperation operations = 1; */
+        if (message.operations.length) {
+            writer.tag(1, WireType.LengthDelimited).fork();
+            for (let i = 0; i < message.operations.length; i++)
+                writer.int32(message.operations[i]);
+            writer.join();
+        }
+        /* repeated string role_ids = 2; */
+        for (let i = 0; i < message.roleIds.length; i++)
+            writer.tag(2, WireType.LengthDelimited).string(message.roleIds[i]);
+        /* repeated string permission_ceiling = 3; */
+        for (let i = 0; i < message.permissionCeiling.length; i++)
+            writer.tag(3, WireType.LengthDelimited).string(message.permissionCeiling[i]);
+        /* repeated sid.v1.authz.RecipientKind recipient_kinds = 4; */
+        if (message.recipientKinds.length) {
+            writer.tag(4, WireType.LengthDelimited).fork();
+            for (let i = 0; i < message.recipientKinds.length; i++)
+                writer.int32(message.recipientKinds[i]);
+            writer.join();
+        }
+        /* optional string recipient_group_id = 5; */
+        if (message.recipientGroupId !== undefined)
+            writer.tag(5, WireType.LengthDelimited).string(message.recipientGroupId);
+        /* google.protobuf.Duration max_validity = 6; */
+        if (message.maxValidity)
+            Duration.internalBinaryWrite(message.maxValidity, writer.tag(6, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.authz.AdminEnvelope
+ */
+export const AdminEnvelope = new AdminEnvelope$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class AssignmentProvenance$Type extends MessageType<AssignmentProvenance> {
+    constructor() {
+        super("sid.v1.authz.AssignmentProvenance", [
+            { no: 1, name: "granted_by", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "basis_assignment_id", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "depends_on_assignment_id", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "approved_ceiling", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<AssignmentProvenance>): AssignmentProvenance {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.grantedBy = "";
+        message.approvedCeiling = [];
+        if (value !== undefined)
+            reflectionMergePartial<AssignmentProvenance>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: AssignmentProvenance): AssignmentProvenance {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string granted_by */ 1:
+                    message.grantedBy = reader.string();
+                    break;
+                case /* optional string basis_assignment_id */ 2:
+                    message.basisAssignmentId = reader.string();
+                    break;
+                case /* optional string depends_on_assignment_id */ 3:
+                    message.dependsOnAssignmentId = reader.string();
+                    break;
+                case /* repeated string approved_ceiling */ 4:
+                    message.approvedCeiling.push(reader.string());
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: AssignmentProvenance, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string granted_by = 1; */
+        if (message.grantedBy !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.grantedBy);
+        /* optional string basis_assignment_id = 2; */
+        if (message.basisAssignmentId !== undefined)
+            writer.tag(2, WireType.LengthDelimited).string(message.basisAssignmentId);
+        /* optional string depends_on_assignment_id = 3; */
+        if (message.dependsOnAssignmentId !== undefined)
+            writer.tag(3, WireType.LengthDelimited).string(message.dependsOnAssignmentId);
+        /* repeated string approved_ceiling = 4; */
+        for (let i = 0; i < message.approvedCeiling.length; i++)
+            writer.tag(4, WireType.LengthDelimited).string(message.approvedCeiling[i]);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.authz.AssignmentProvenance
+ */
+export const AssignmentProvenance = new AssignmentProvenance$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class Policy$Type extends MessageType<Policy> {
+    constructor() {
+        super("sid.v1.authz.Policy", [
+            { no: 1, name: "id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "project_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "name", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "description", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 5, name: "policy_text", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 6, name: "effect", kind: "enum", T: () => ["sid.v1.authz.PolicyEffect", PolicyEffect, "POLICY_EFFECT_"] },
+            { no: 7, name: "enabled", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 8, name: "created_at", kind: "message", T: () => Timestamp },
+            { no: 9, name: "updated_at", kind: "message", T: () => Timestamp }
+        ]);
+    }
+    create(value?: PartialMessage<Policy>): Policy {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.id = "";
+        message.projectId = "";
+        message.name = "";
+        message.policyText = "";
+        message.effect = 0;
+        message.enabled = false;
+        if (value !== undefined)
+            reflectionMergePartial<Policy>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: Policy): Policy {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string id */ 1:
+                    message.id = reader.string();
+                    break;
+                case /* string project_id */ 2:
+                    message.projectId = reader.string();
+                    break;
+                case /* string name */ 3:
+                    message.name = reader.string();
+                    break;
+                case /* optional string description */ 4:
+                    message.description = reader.string();
+                    break;
+                case /* string policy_text */ 5:
+                    message.policyText = reader.string();
+                    break;
+                case /* sid.v1.authz.PolicyEffect effect */ 6:
+                    message.effect = reader.int32();
+                    break;
+                case /* bool enabled */ 7:
+                    message.enabled = reader.bool();
+                    break;
+                case /* google.protobuf.Timestamp created_at */ 8:
+                    message.createdAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.createdAt);
+                    break;
+                case /* google.protobuf.Timestamp updated_at */ 9:
+                    message.updatedAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.updatedAt);
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: Policy, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string id = 1; */
+        if (message.id !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.id);
+        /* string project_id = 2; */
+        if (message.projectId !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.projectId);
+        /* string name = 3; */
+        if (message.name !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.name);
+        /* optional string description = 4; */
+        if (message.description !== undefined)
+            writer.tag(4, WireType.LengthDelimited).string(message.description);
+        /* string policy_text = 5; */
+        if (message.policyText !== "")
+            writer.tag(5, WireType.LengthDelimited).string(message.policyText);
+        /* sid.v1.authz.PolicyEffect effect = 6; */
+        if (message.effect !== 0)
+            writer.tag(6, WireType.Varint).int32(message.effect);
+        /* bool enabled = 7; */
+        if (message.enabled !== false)
+            writer.tag(7, WireType.Varint).bool(message.enabled);
+        /* google.protobuf.Timestamp created_at = 8; */
+        if (message.createdAt)
+            Timestamp.internalBinaryWrite(message.createdAt, writer.tag(8, WireType.LengthDelimited).fork(), options).join();
+        /* google.protobuf.Timestamp updated_at = 9; */
+        if (message.updatedAt)
+            Timestamp.internalBinaryWrite(message.updatedAt, writer.tag(9, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.authz.Policy
+ */
+export const Policy = new Policy$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class CheckPermissionRequest$Type extends MessageType<CheckPermissionRequest> {
+    constructor() {
+        super("sid.v1.authz.CheckPermissionRequest", [
+            { no: 2, name: "action", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "consistency", kind: "enum", T: () => ["sid.v1.authz.Consistency", Consistency, "CONSISTENCY_"] },
+            { no: 6, name: "target", kind: "message", T: () => PermissionTarget },
+            { no: 7, name: "request", kind: "message", oneof: "evaluation", T: () => RequestEvaluation },
+            { no: 8, name: "named_subject", kind: "message", oneof: "evaluation", T: () => SubjectReference },
+            { no: 9, name: "self", kind: "message", oneof: "evaluation", T: () => SelfEvaluation }
+        ]);
+    }
+    create(value?: PartialMessage<CheckPermissionRequest>): CheckPermissionRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.action = "";
+        message.consistency = 0;
+        message.evaluation = { oneofKind: undefined };
+        if (value !== undefined)
+            reflectionMergePartial<CheckPermissionRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: CheckPermissionRequest): CheckPermissionRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string action */ 2:
+                    message.action = reader.string();
+                    break;
+                case /* sid.v1.authz.Consistency consistency */ 4:
+                    message.consistency = reader.int32();
+                    break;
+                case /* sid.v1.authz.PermissionTarget target */ 6:
+                    message.target = PermissionTarget.internalBinaryRead(reader, reader.uint32(), options, message.target);
+                    break;
+                case /* sid.v1.authz.RequestEvaluation request */ 7:
+                    message.evaluation = {
+                        oneofKind: "request",
+                        request: RequestEvaluation.internalBinaryRead(reader, reader.uint32(), options, (message.evaluation as any).request)
+                    };
+                    break;
+                case /* sid.v1.authz.SubjectReference named_subject */ 8:
+                    message.evaluation = {
+                        oneofKind: "namedSubject",
+                        namedSubject: SubjectReference.internalBinaryRead(reader, reader.uint32(), options, (message.evaluation as any).namedSubject)
+                    };
+                    break;
+                case /* sid.v1.authz.SelfEvaluation self */ 9:
+                    message.evaluation = {
+                        oneofKind: "self",
+                        self: SelfEvaluation.internalBinaryRead(reader, reader.uint32(), options, (message.evaluation as any).self)
+                    };
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: CheckPermissionRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string action = 2; */
+        if (message.action !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.action);
+        /* sid.v1.authz.Consistency consistency = 4; */
+        if (message.consistency !== 0)
+            writer.tag(4, WireType.Varint).int32(message.consistency);
+        /* sid.v1.authz.PermissionTarget target = 6; */
+        if (message.target)
+            PermissionTarget.internalBinaryWrite(message.target, writer.tag(6, WireType.LengthDelimited).fork(), options).join();
+        /* sid.v1.authz.RequestEvaluation request = 7; */
+        if (message.evaluation.oneofKind === "request")
+            RequestEvaluation.internalBinaryWrite(message.evaluation.request, writer.tag(7, WireType.LengthDelimited).fork(), options).join();
+        /* sid.v1.authz.SubjectReference named_subject = 8; */
+        if (message.evaluation.oneofKind === "namedSubject")
+            SubjectReference.internalBinaryWrite(message.evaluation.namedSubject, writer.tag(8, WireType.LengthDelimited).fork(), options).join();
+        /* sid.v1.authz.SelfEvaluation self = 9; */
+        if (message.evaluation.oneofKind === "self")
+            SelfEvaluation.internalBinaryWrite(message.evaluation.self, writer.tag(9, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.authz.CheckPermissionRequest
+ */
+export const CheckPermissionRequest = new CheckPermissionRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class PermissionTarget$Type extends MessageType<PermissionTarget> {
+    constructor() {
+        super("sid.v1.authz.PermissionTarget", [
+            { no: 1, name: "resource", kind: "message", oneof: "scope", T: () => ResourceId },
+            { no: 2, name: "project_id", kind: "scalar", oneof: "scope", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "object", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<PermissionTarget>): PermissionTarget {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.scope = { oneofKind: undefined };
+        message.object = "";
+        if (value !== undefined)
+            reflectionMergePartial<PermissionTarget>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: PermissionTarget): PermissionTarget {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* sid.v1.ids.ResourceId resource */ 1:
+                    message.scope = {
+                        oneofKind: "resource",
+                        resource: ResourceId.internalBinaryRead(reader, reader.uint32(), options, (message.scope as any).resource)
+                    };
+                    break;
+                case /* string project_id */ 2:
+                    message.scope = {
+                        oneofKind: "projectId",
+                        projectId: reader.string()
+                    };
+                    break;
+                case /* string object */ 3:
+                    message.object = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: PermissionTarget, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* sid.v1.ids.ResourceId resource = 1; */
+        if (message.scope.oneofKind === "resource")
+            ResourceId.internalBinaryWrite(message.scope.resource, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        /* string project_id = 2; */
+        if (message.scope.oneofKind === "projectId")
+            writer.tag(2, WireType.LengthDelimited).string(message.scope.projectId);
+        /* string object = 3; */
+        if (message.object !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.object);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.authz.PermissionTarget
+ */
+export const PermissionTarget = new PermissionTarget$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class RequestEvaluation$Type extends MessageType<RequestEvaluation> {
+    constructor() {
+        super("sid.v1.authz.RequestEvaluation", [
+            { no: 1, name: "access_token", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "confirmation", kind: "message", T: () => RequestConfirmation }
+        ]);
+    }
+    create(value?: PartialMessage<RequestEvaluation>): RequestEvaluation {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.accessToken = "";
+        if (value !== undefined)
+            reflectionMergePartial<RequestEvaluation>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: RequestEvaluation): RequestEvaluation {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string access_token */ 1:
+                    message.accessToken = reader.string();
+                    break;
+                case /* sid.v1.authz.RequestConfirmation confirmation */ 2:
+                    message.confirmation = RequestConfirmation.internalBinaryRead(reader, reader.uint32(), options, message.confirmation);
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: RequestEvaluation, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string access_token = 1; */
+        if (message.accessToken !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.accessToken);
+        /* sid.v1.authz.RequestConfirmation confirmation = 2; */
+        if (message.confirmation)
+            RequestConfirmation.internalBinaryWrite(message.confirmation, writer.tag(2, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.authz.RequestEvaluation
+ */
+export const RequestEvaluation = new RequestEvaluation$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class RequestConfirmation$Type extends MessageType<RequestConfirmation> {
+    constructor() {
+        super("sid.v1.authz.RequestConfirmation", [
+            { no: 1, name: "profile", kind: "enum", T: () => ["sid.v1.authz.SenderProofProfile", SenderProofProfile, "SENDER_PROOF_PROFILE_"] },
+            { no: 2, name: "method", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "uri", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "request_id", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
+            { no: 5, name: "jkt", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 6, name: "verified_at", kind: "message", T: () => Timestamp },
+            { no: 7, name: "valid_until", kind: "message", T: () => Timestamp }
+        ]);
+    }
+    create(value?: PartialMessage<RequestConfirmation>): RequestConfirmation {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.profile = 0;
+        message.method = "";
+        message.uri = "";
+        message.requestId = new Uint8Array(0);
+        message.jkt = "";
+        if (value !== undefined)
+            reflectionMergePartial<RequestConfirmation>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: RequestConfirmation): RequestConfirmation {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* sid.v1.authz.SenderProofProfile profile */ 1:
+                    message.profile = reader.int32();
+                    break;
+                case /* string method */ 2:
+                    message.method = reader.string();
+                    break;
+                case /* string uri */ 3:
+                    message.uri = reader.string();
+                    break;
+                case /* bytes request_id */ 4:
+                    message.requestId = reader.bytes();
                     break;
-                case /* optional string description */ 4:
-                    message.description = reader.string();
+                case /* string jkt */ 5:
+                    message.jkt = reader.string();
                     break;
-                case /* google.protobuf.Timestamp created_at */ 5:
-                    message.createdAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.createdAt);
+                case /* google.protobuf.Timestamp verified_at */ 6:
+                    message.verifiedAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.verifiedAt);
                     break;
-                case /* google.protobuf.Timestamp updated_at */ 6:
-                    message.updatedAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.updatedAt);
+                case /* google.protobuf.Timestamp valid_until */ 7:
+                    message.validUntil = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.validUntil);
                     break;
                 default:
                     let u = options.readUnknownField;
@@ -1460,25 +2738,28 @@ class Group$Type extends MessageType<Group> {
         }
         return message;
     }
-    internalBinaryWrite(message: Group, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string id = 1; */
-        if (message.id !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.id);
-        /* string project_id = 2; */
-        if (message.projectId !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.projectId);
-        /* string name = 3; */
-        if (message.name !== "")
-            writer.tag(3, WireType.LengthDelimited).string(message.name);
-        /* optional string description = 4; */
-        if (message.description !== undefined)
-            writer.tag(4, WireType.LengthDelimited).string(message.description);
-        /* google.protobuf.Timestamp created_at = 5; */
-        if (message.createdAt)
-            Timestamp.internalBinaryWrite(message.createdAt, writer.tag(5, WireType.LengthDelimited).fork(), options).join();
-        /* google.protobuf.Timestamp updated_at = 6; */
-        if (message.updatedAt)
-            Timestamp.internalBinaryWrite(message.updatedAt, writer.tag(6, WireType.LengthDelimited).fork(), options).join();
+    internalBinaryWrite(message: RequestConfirmation, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* sid.v1.authz.SenderProofProfile profile = 1; */
+        if (message.profile !== 0)
+            writer.tag(1, WireType.Varint).int32(message.profile);
+        /* string method = 2; */
+        if (message.method !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.method);
+        /* string uri = 3; */
+        if (message.uri !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.uri);
+        /* bytes request_id = 4; */
+        if (message.requestId.length)
+            writer.tag(4, WireType.LengthDelimited).bytes(message.requestId);
+        /* string jkt = 5; */
+        if (message.jkt !== "")
+            writer.tag(5, WireType.LengthDelimited).string(message.jkt);
+        /* google.protobuf.Timestamp verified_at = 6; */
+        if (message.verifiedAt)
+            Timestamp.internalBinaryWrite(message.verifiedAt, writer.tag(6, WireType.LengthDelimited).fork(), options).join();
+        /* google.protobuf.Timestamp valid_until = 7; */
+        if (message.validUntil)
+            Timestamp.internalBinaryWrite(message.validUntil, writer.tag(7, WireType.LengthDelimited).fork(), options).join();
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -1486,70 +2767,48 @@ class Group$Type extends MessageType<Group> {
     }
 }
 /**
- * @generated MessageType for protobuf message sid.v1.authz.Group
+ * @generated MessageType for protobuf message sid.v1.authz.RequestConfirmation
  */
-export const Group = new Group$Type();
+export const RequestConfirmation = new RequestConfirmation$Type();
 // @generated message type with reflection information, may provide speed optimized methods
-class RoleAssignment$Type extends MessageType<RoleAssignment> {
+class SubjectReference$Type extends MessageType<SubjectReference> {
     constructor() {
-        super("sid.v1.authz.RoleAssignment", [
-            { no: 1, name: "id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "profile_id", kind: "scalar", oneof: "principal", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "group_id", kind: "scalar", oneof: "principal", T: 9 /*ScalarType.STRING*/ },
-            { no: 8, name: "machine_user_id", kind: "scalar", oneof: "principal", T: 9 /*ScalarType.STRING*/ },
-            { no: 4, name: "role_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 5, name: "scope", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
-            { no: 6, name: "expires_at", kind: "message", T: () => Timestamp },
-            { no: 7, name: "created_at", kind: "message", T: () => Timestamp }
+        super("sid.v1.authz.SubjectReference", [
+            { no: 1, name: "machine_user_id", kind: "message", oneof: "kind", T: () => MachineUserId },
+            { no: 2, name: "oauth_client_id", kind: "scalar", oneof: "kind", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "issuer_subject", kind: "message", oneof: "kind", T: () => IssuerSubject }
         ]);
     }
-    create(value?: PartialMessage<RoleAssignment>): RoleAssignment {
+    create(value?: PartialMessage<SubjectReference>): SubjectReference {
         const message = globalThis.Object.create((this.messagePrototype!));
-        message.id = "";
-        message.principal = { oneofKind: undefined };
-        message.roleId = "";
+        message.kind = { oneofKind: undefined };
         if (value !== undefined)
-            reflectionMergePartial<RoleAssignment>(this, message, value);
+            reflectionMergePartial<SubjectReference>(this, message, value);
         return message;
     }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: RoleAssignment): RoleAssignment {
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: SubjectReference): SubjectReference {
         let message = target ?? this.create(), end = reader.pos + length;
         while (reader.pos < end) {
             let [fieldNo, wireType] = reader.tag();
             switch (fieldNo) {
-                case /* string id */ 1:
-                    message.id = reader.string();
-                    break;
-                case /* string profile_id */ 2:
-                    message.principal = {
-                        oneofKind: "profileId",
-                        profileId: reader.string()
+                case /* sid.v1.ids.MachineUserId machine_user_id */ 1:
+                    message.kind = {
+                        oneofKind: "machineUserId",
+                        machineUserId: MachineUserId.internalBinaryRead(reader, reader.uint32(), options, (message.kind as any).machineUserId)
                     };
                     break;
-                case /* string group_id */ 3:
-                    message.principal = {
-                        oneofKind: "groupId",
-                        groupId: reader.string()
+                case /* string oauth_client_id */ 2:
+                    message.kind = {
+                        oneofKind: "oauthClientId",
+                        oauthClientId: reader.string()
                     };
                     break;
-                case /* string machine_user_id */ 8:
-                    message.principal = {
-                        oneofKind: "machineUserId",
-                        machineUserId: reader.string()
+                case /* sid.v1.authz.IssuerSubject issuer_subject */ 3:
+                    message.kind = {
+                        oneofKind: "issuerSubject",
+                        issuerSubject: IssuerSubject.internalBinaryRead(reader, reader.uint32(), options, (message.kind as any).issuerSubject)
                     };
                     break;
-                case /* string role_id */ 4:
-                    message.roleId = reader.string();
-                    break;
-                case /* optional string scope */ 5:
-                    message.scope = reader.string();
-                    break;
-                case /* optional google.protobuf.Timestamp expires_at */ 6:
-                    message.expiresAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.expiresAt);
-                    break;
-                case /* google.protobuf.Timestamp created_at */ 7:
-                    message.createdAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.createdAt);
-                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -1561,31 +2820,16 @@ class RoleAssignment$Type extends MessageType<RoleAssignment> {
         }
         return message;
     }
-    internalBinaryWrite(message: RoleAssignment, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string id = 1; */
-        if (message.id !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.id);
-        /* string profile_id = 2; */
-        if (message.principal.oneofKind === "profileId")
-            writer.tag(2, WireType.LengthDelimited).string(message.principal.profileId);
-        /* string group_id = 3; */
-        if (message.principal.oneofKind === "groupId")
-            writer.tag(3, WireType.LengthDelimited).string(message.principal.groupId);
-        /* string role_id = 4; */
-        if (message.roleId !== "")
-            writer.tag(4, WireType.LengthDelimited).string(message.roleId);
-        /* optional string scope = 5; */
-        if (message.scope !== undefined)
-            writer.tag(5, WireType.LengthDelimited).string(message.scope);
-        /* optional google.protobuf.Timestamp expires_at = 6; */
-        if (message.expiresAt)
-            Timestamp.internalBinaryWrite(message.expiresAt, writer.tag(6, WireType.LengthDelimited).fork(), options).join();
-        /* google.protobuf.Timestamp created_at = 7; */
-        if (message.createdAt)
-            Timestamp.internalBinaryWrite(message.createdAt, writer.tag(7, WireType.LengthDelimited).fork(), options).join();
-        /* string machine_user_id = 8; */
-        if (message.principal.oneofKind === "machineUserId")
-            writer.tag(8, WireType.LengthDelimited).string(message.principal.machineUserId);
+    internalBinaryWrite(message: SubjectReference, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* sid.v1.ids.MachineUserId machine_user_id = 1; */
+        if (message.kind.oneofKind === "machineUserId")
+            MachineUserId.internalBinaryWrite(message.kind.machineUserId, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        /* string oauth_client_id = 2; */
+        if (message.kind.oneofKind === "oauthClientId")
+            writer.tag(2, WireType.LengthDelimited).string(message.kind.oauthClientId);
+        /* sid.v1.authz.IssuerSubject issuer_subject = 3; */
+        if (message.kind.oneofKind === "issuerSubject")
+            IssuerSubject.internalBinaryWrite(message.kind.issuerSubject, writer.tag(3, WireType.LengthDelimited).fork(), options).join();
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -1593,67 +2837,35 @@ class RoleAssignment$Type extends MessageType<RoleAssignment> {
     }
 }
 /**
- * @generated MessageType for protobuf message sid.v1.authz.RoleAssignment
+ * @generated MessageType for protobuf message sid.v1.authz.SubjectReference
  */
-export const RoleAssignment = new RoleAssignment$Type();
+export const SubjectReference = new SubjectReference$Type();
 // @generated message type with reflection information, may provide speed optimized methods
-class Policy$Type extends MessageType<Policy> {
+class IssuerSubject$Type extends MessageType<IssuerSubject> {
     constructor() {
-        super("sid.v1.authz.Policy", [
-            { no: 1, name: "id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "project_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "name", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 4, name: "description", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
-            { no: 5, name: "policy_text", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 6, name: "effect", kind: "enum", T: () => ["sid.v1.authz.PolicyEffect", PolicyEffect, "POLICY_EFFECT_"] },
-            { no: 7, name: "enabled", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 8, name: "created_at", kind: "message", T: () => Timestamp },
-            { no: 9, name: "updated_at", kind: "message", T: () => Timestamp }
+        super("sid.v1.authz.IssuerSubject", [
+            { no: 1, name: "issuer", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "subject", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
         ]);
     }
-    create(value?: PartialMessage<Policy>): Policy {
+    create(value?: PartialMessage<IssuerSubject>): IssuerSubject {
         const message = globalThis.Object.create((this.messagePrototype!));
-        message.id = "";
-        message.projectId = "";
-        message.name = "";
-        message.policyText = "";
-        message.effect = 0;
-        message.enabled = false;
+        message.issuer = "";
+        message.subject = "";
         if (value !== undefined)
-            reflectionMergePartial<Policy>(this, message, value);
+            reflectionMergePartial<IssuerSubject>(this, message, value);
         return message;
     }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: Policy): Policy {
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: IssuerSubject): IssuerSubject {
         let message = target ?? this.create(), end = reader.pos + length;
         while (reader.pos < end) {
             let [fieldNo, wireType] = reader.tag();
             switch (fieldNo) {
-                case /* string id */ 1:
-                    message.id = reader.string();
-                    break;
-                case /* string project_id */ 2:
-                    message.projectId = reader.string();
-                    break;
-                case /* string name */ 3:
-                    message.name = reader.string();
+                case /* string issuer */ 1:
+                    message.issuer = reader.string();
                     break;
-                case /* optional string description */ 4:
-                    message.description = reader.string();
-                    break;
-                case /* string policy_text */ 5:
-                    message.policyText = reader.string();
-                    break;
-                case /* sid.v1.authz.PolicyEffect effect */ 6:
-                    message.effect = reader.int32();
-                    break;
-                case /* bool enabled */ 7:
-                    message.enabled = reader.bool();
-                    break;
-                case /* google.protobuf.Timestamp created_at */ 8:
-                    message.createdAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.createdAt);
-                    break;
-                case /* google.protobuf.Timestamp updated_at */ 9:
-                    message.updatedAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.updatedAt);
+                case /* string subject */ 2:
+                    message.subject = reader.string();
                     break;
                 default:
                     let u = options.readUnknownField;
@@ -1666,34 +2878,13 @@ class Policy$Type extends MessageType<Policy> {
         }
         return message;
     }
-    internalBinaryWrite(message: Policy, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string id = 1; */
-        if (message.id !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.id);
-        /* string project_id = 2; */
-        if (message.projectId !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.projectId);
-        /* string name = 3; */
-        if (message.name !== "")
-            writer.tag(3, WireType.LengthDelimited).string(message.name);
-        /* optional string description = 4; */
-        if (message.description !== undefined)
-            writer.tag(4, WireType.LengthDelimited).string(message.description);
-        /* string policy_text = 5; */
-        if (message.policyText !== "")
-            writer.tag(5, WireType.LengthDelimited).string(message.policyText);
-        /* sid.v1.authz.PolicyEffect effect = 6; */
-        if (message.effect !== 0)
-            writer.tag(6, WireType.Varint).int32(message.effect);
-        /* bool enabled = 7; */
-        if (message.enabled !== false)
-            writer.tag(7, WireType.Varint).bool(message.enabled);
-        /* google.protobuf.Timestamp created_at = 8; */
-        if (message.createdAt)
-            Timestamp.internalBinaryWrite(message.createdAt, writer.tag(8, WireType.LengthDelimited).fork(), options).join();
-        /* google.protobuf.Timestamp updated_at = 9; */
-        if (message.updatedAt)
-            Timestamp.internalBinaryWrite(message.updatedAt, writer.tag(9, WireType.LengthDelimited).fork(), options).join();
+    internalBinaryWrite(message: IssuerSubject, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string issuer = 1; */
+        if (message.issuer !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.issuer);
+        /* string subject = 2; */
+        if (message.subject !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.subject);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -1701,51 +2892,25 @@ class Policy$Type extends MessageType<Policy> {
     }
 }
 /**
- * @generated MessageType for protobuf message sid.v1.authz.Policy
+ * @generated MessageType for protobuf message sid.v1.authz.IssuerSubject
  */
-export const Policy = new Policy$Type();
+export const IssuerSubject = new IssuerSubject$Type();
 // @generated message type with reflection information, may provide speed optimized methods
-class CheckPermissionRequest$Type extends MessageType<CheckPermissionRequest> {
+class SelfEvaluation$Type extends MessageType<SelfEvaluation> {
     constructor() {
-        super("sid.v1.authz.CheckPermissionRequest", [
-            { no: 1, name: "subject", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "action", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "resource", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 4, name: "consistency", kind: "enum", T: () => ["sid.v1.authz.Consistency", Consistency, "CONSISTENCY_"] },
-            { no: 5, name: "context", kind: "map", K: 9 /*ScalarType.STRING*/, V: { kind: "scalar", T: 9 /*ScalarType.STRING*/ } }
-        ]);
+        super("sid.v1.authz.SelfEvaluation", []);
     }
-    create(value?: PartialMessage<CheckPermissionRequest>): CheckPermissionRequest {
+    create(value?: PartialMessage<SelfEvaluation>): SelfEvaluation {
         const message = globalThis.Object.create((this.messagePrototype!));
-        message.subject = "";
-        message.action = "";
-        message.resource = "";
-        message.consistency = 0;
-        message.context = {};
         if (value !== undefined)
-            reflectionMergePartial<CheckPermissionRequest>(this, message, value);
+            reflectionMergePartial<SelfEvaluation>(this, message, value);
         return message;
     }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: CheckPermissionRequest): CheckPermissionRequest {
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: SelfEvaluation): SelfEvaluation {
         let message = target ?? this.create(), end = reader.pos + length;
         while (reader.pos < end) {
             let [fieldNo, wireType] = reader.tag();
             switch (fieldNo) {
-                case /* string subject */ 1:
-                    message.subject = reader.string();
-                    break;
-                case /* string action */ 2:
-                    message.action = reader.string();
-                    break;
-                case /* string resource */ 3:
-                    message.resource = reader.string();
-                    break;
-                case /* sid.v1.authz.Consistency consistency */ 4:
-                    message.consistency = reader.int32();
-                    break;
-                case /* map<string, string> context */ 5:
-                    this.binaryReadMap5(message.context, reader, options);
-                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -1757,38 +2922,7 @@ class CheckPermissionRequest$Type extends MessageType<CheckPermissionRequest> {
         }
         return message;
     }
-    private binaryReadMap5(map: CheckPermissionRequest["context"], reader: IBinaryReader, options: BinaryReadOptions): void {
-        let len = reader.uint32(), end = reader.pos + len, key: keyof CheckPermissionRequest["context"] | undefined, val: CheckPermissionRequest["context"][any] | undefined;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case 1:
-                    key = reader.string();
-                    break;
-                case 2:
-                    val = reader.string();
-                    break;
-                default: throw new globalThis.Error("unknown map entry field for sid.v1.authz.CheckPermissionRequest.context");
-            }
-        }
-        map[key ?? ""] = val ?? "";
-    }
-    internalBinaryWrite(message: CheckPermissionRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string subject = 1; */
-        if (message.subject !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.subject);
-        /* string action = 2; */
-        if (message.action !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.action);
-        /* string resource = 3; */
-        if (message.resource !== "")
-            writer.tag(3, WireType.LengthDelimited).string(message.resource);
-        /* sid.v1.authz.Consistency consistency = 4; */
-        if (message.consistency !== 0)
-            writer.tag(4, WireType.Varint).int32(message.consistency);
-        /* map<string, string> context = 5; */
-        for (let k of globalThis.Object.keys(message.context))
-            writer.tag(5, WireType.LengthDelimited).fork().tag(1, WireType.LengthDelimited).string(k).tag(2, WireType.LengthDelimited).string(message.context[k]).join();
+    internalBinaryWrite(message: SelfEvaluation, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -1796,21 +2930,21 @@ class CheckPermissionRequest$Type extends MessageType<CheckPermissionRequest> {
     }
 }
 /**
- * @generated MessageType for protobuf message sid.v1.authz.CheckPermissionRequest
+ * @generated MessageType for protobuf message sid.v1.authz.SelfEvaluation
  */
-export const CheckPermissionRequest = new CheckPermissionRequest$Type();
+export const SelfEvaluation = new SelfEvaluation$Type();
 // @generated message type with reflection information, may provide speed optimized methods
 class CheckPermissionResponse$Type extends MessageType<CheckPermissionResponse> {
     constructor() {
         super("sid.v1.authz.CheckPermissionResponse", [
-            { no: 1, name: "allowed", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
             { no: 2, name: "reason", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "zookie", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ }
+            { no: 3, name: "zookie", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "outcome", kind: "enum", T: () => ["sid.v1.authz.PermissionOutcome", PermissionOutcome, "PERMISSION_OUTCOME_"] }
         ]);
     }
     create(value?: PartialMessage<CheckPermissionResponse>): CheckPermissionResponse {
         const message = globalThis.Object.create((this.messagePrototype!));
-        message.allowed = false;
+        message.outcome = 0;
         if (value !== undefined)
             reflectionMergePartial<CheckPermissionResponse>(this, message, value);
         return message;
@@ -1820,15 +2954,15 @@ class CheckPermissionResponse$Type extends MessageType<CheckPermissionResponse>
         while (reader.pos < end) {
             let [fieldNo, wireType] = reader.tag();
             switch (fieldNo) {
-                case /* bool allowed */ 1:
-                    message.allowed = reader.bool();
-                    break;
                 case /* optional string reason */ 2:
                     message.reason = reader.string();
                     break;
                 case /* optional string zookie */ 3:
                     message.zookie = reader.string();
                     break;
+                case /* sid.v1.authz.PermissionOutcome outcome */ 4:
+                    message.outcome = reader.int32();
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -1841,15 +2975,15 @@ class CheckPermissionResponse$Type extends MessageType<CheckPermissionResponse>
         return message;
     }
     internalBinaryWrite(message: CheckPermissionResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* bool allowed = 1; */
-        if (message.allowed !== false)
-            writer.tag(1, WireType.Varint).bool(message.allowed);
         /* optional string reason = 2; */
         if (message.reason !== undefined)
             writer.tag(2, WireType.LengthDelimited).string(message.reason);
         /* optional string zookie = 3; */
         if (message.zookie !== undefined)
             writer.tag(3, WireType.LengthDelimited).string(message.zookie);
+        /* sid.v1.authz.PermissionOutcome outcome = 4; */
+        if (message.outcome !== 0)
+            writer.tag(4, WireType.Varint).int32(message.outcome);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -2729,9 +3863,12 @@ class AssignRoleRequest$Type extends MessageType<AssignRoleRequest> {
             { no: 1, name: "profile_id", kind: "scalar", oneof: "principal", T: 9 /*ScalarType.STRING*/ },
             { no: 2, name: "group_id", kind: "scalar", oneof: "principal", T: 9 /*ScalarType.STRING*/ },
             { no: 6, name: "machine_user_id", kind: "scalar", oneof: "principal", T: 9 /*ScalarType.STRING*/ },
+            { no: 7, name: "oauth_client_id", kind: "scalar", oneof: "principal", T: 9 /*ScalarType.STRING*/ },
+            { no: 8, name: "provisioning_connector_id", kind: "message", oneof: "principal", T: () => ProvisioningConnectorId },
             { no: 3, name: "role_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
             { no: 4, name: "scope", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
-            { no: 5, name: "expires_at", kind: "message", T: () => Timestamp }
+            { no: 5, name: "expires_at", kind: "message", T: () => Timestamp },
+            { no: 9, name: "admin", kind: "message", T: () => AdminEnvelope }
         ]);
     }
     create(value?: PartialMessage<AssignRoleRequest>): AssignRoleRequest {
@@ -2765,6 +3902,18 @@ class AssignRoleRequest$Type extends MessageType<AssignRoleRequest> {
                         machineUserId: reader.string()
                     };
                     break;
+                case /* string oauth_client_id */ 7:
+                    message.principal = {
+                        oneofKind: "oauthClientId",
+                        oauthClientId: reader.string()
+                    };
+                    break;
+                case /* sid.v1.ids.ProvisioningConnectorId provisioning_connector_id */ 8:
+                    message.principal = {
+                        oneofKind: "provisioningConnectorId",
+                        provisioningConnectorId: ProvisioningConnectorId.internalBinaryRead(reader, reader.uint32(), options, (message.principal as any).provisioningConnectorId)
+                    };
+                    break;
                 case /* string role_id */ 3:
                     message.roleId = reader.string();
                     break;
@@ -2774,6 +3923,9 @@ class AssignRoleRequest$Type extends MessageType<AssignRoleRequest> {
                 case /* optional google.protobuf.Timestamp expires_at */ 5:
                     message.expiresAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.expiresAt);
                     break;
+                case /* optional sid.v1.authz.AdminEnvelope admin */ 9:
+                    message.admin = AdminEnvelope.internalBinaryRead(reader, reader.uint32(), options, message.admin);
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -2804,6 +3956,15 @@ class AssignRoleRequest$Type extends MessageType<AssignRoleRequest> {
         /* string machine_user_id = 6; */
         if (message.principal.oneofKind === "machineUserId")
             writer.tag(6, WireType.LengthDelimited).string(message.principal.machineUserId);
+        /* string oauth_client_id = 7; */
+        if (message.principal.oneofKind === "oauthClientId")
+            writer.tag(7, WireType.LengthDelimited).string(message.principal.oauthClientId);
+        /* sid.v1.ids.ProvisioningConnectorId provisioning_connector_id = 8; */
+        if (message.principal.oneofKind === "provisioningConnectorId")
+            ProvisioningConnectorId.internalBinaryWrite(message.principal.provisioningConnectorId, writer.tag(8, WireType.LengthDelimited).fork(), options).join();
+        /* optional sid.v1.authz.AdminEnvelope admin = 9; */
+        if (message.admin)
+            AdminEnvelope.internalBinaryWrite(message.admin, writer.tag(9, WireType.LengthDelimited).fork(), options).join();
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -2952,7 +4113,9 @@ class ListRoleAssignmentsRequest$Type extends MessageType<ListRoleAssignmentsReq
             { no: 1, name: "profile_id", kind: "scalar", oneof: "filter", T: 9 /*ScalarType.STRING*/ },
             { no: 2, name: "group_id", kind: "scalar", oneof: "filter", T: 9 /*ScalarType.STRING*/ },
             { no: 3, name: "role_id", kind: "scalar", oneof: "filter", T: 9 /*ScalarType.STRING*/ },
-            { no: 4, name: "machine_user_id", kind: "scalar", oneof: "filter", T: 9 /*ScalarType.STRING*/ }
+            { no: 4, name: "machine_user_id", kind: "scalar", oneof: "filter", T: 9 /*ScalarType.STRING*/ },
+            { no: 5, name: "oauth_client_id", kind: "scalar", oneof: "filter", T: 9 /*ScalarType.STRING*/ },
+            { no: 6, name: "provisioning_connector_id", kind: "message", oneof: "filter", T: () => ProvisioningConnectorId }
         ]);
     }
     create(value?: PartialMessage<ListRoleAssignmentsRequest>): ListRoleAssignmentsRequest {
@@ -2991,6 +4154,18 @@ class ListRoleAssignmentsRequest$Type extends MessageType<ListRoleAssignmentsReq
                         machineUserId: reader.string()
                     };
                     break;
+                case /* string oauth_client_id */ 5:
+                    message.filter = {
+                        oneofKind: "oauthClientId",
+                        oauthClientId: reader.string()
+                    };
+                    break;
+                case /* sid.v1.ids.ProvisioningConnectorId provisioning_connector_id */ 6:
+                    message.filter = {
+                        oneofKind: "provisioningConnectorId",
+                        provisioningConnectorId: ProvisioningConnectorId.internalBinaryRead(reader, reader.uint32(), options, (message.filter as any).provisioningConnectorId)
+                    };
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -3015,6 +4190,12 @@ class ListRoleAssignmentsRequest$Type extends MessageType<ListRoleAssignmentsReq
         /* string machine_user_id = 4; */
         if (message.filter.oneofKind === "machineUserId")
             writer.tag(4, WireType.LengthDelimited).string(message.filter.machineUserId);
+        /* string oauth_client_id = 5; */
+        if (message.filter.oneofKind === "oauthClientId")
+            writer.tag(5, WireType.LengthDelimited).string(message.filter.oauthClientId);
+        /* sid.v1.ids.ProvisioningConnectorId provisioning_connector_id = 6; */
+        if (message.filter.oneofKind === "provisioningConnectorId")
+            ProvisioningConnectorId.internalBinaryWrite(message.filter.provisioningConnectorId, writer.tag(6, WireType.LengthDelimited).fork(), options).join();
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);