otdf-python 0.4.4__tar.gz → 0.6.0__tar.gz

otdf_python-0.6.0/.gemini/config.yaml

@@ -0,0 +1,4 @@
+code_review:
+  ignore_patterns:
+    - "otdf-python-proto/proto-files/**/*"
+    - "otdf-python-proto/src/otdf_python_proto/**/*"

otdf_python-0.6.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+    ".": "0.6.0"
+}

{otdf_python-0.4.4 → otdf_python-0.6.0}/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.6.0](https://github.com/b-long/opentdf-python-sdk/compare/otdf-python-v0.5.0...otdf-python-v0.6.0) (2026-05-21)
+
+
+### Features
+
+* **main:** update to service v 0.12.0 ([#139](https://github.com/b-long/opentdf-python-sdk/issues/139)) ([125b12b](https://github.com/b-long/opentdf-python-sdk/commit/125b12b24aa89fceeca56e5878728ac329dd8659))
+
+## [0.5.0](https://github.com/b-long/opentdf-python-sdk/compare/otdf-python-v0.4.4...otdf-python-v0.5.0) (2026-05-08)
+
+
+### Features
+
+* **main:** update proto GIT_TAG to service/v0.8.0 ([#137](https://github.com/b-long/opentdf-python-sdk/issues/137)) ([05ea9a4](https://github.com/b-long/opentdf-python-sdk/commit/05ea9a4c2dcf23d2a709e421802f45ddb89d2ace))
+
 ## [0.4.4](https://github.com/b-long/opentdf-python-sdk/compare/otdf-python-v0.4.3...otdf-python-v0.4.4) (2026-04-30)
 
 

{otdf_python-0.4.4 → otdf_python-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: otdf-python
-Version: 0.4.4
+Version: 0.6.0
 Summary: Unofficial OpenTDF SDK for Python
 Project-URL: Homepage, https://github.com/b-long/opentdf-python-sdk
 Project-URL: Repository, https://github.com/b-long/opentdf-python-sdk

{otdf_python-0.4.4 → otdf_python-0.6.0}/otdf-python-proto/proto-files/authorization/v2/authorization.proto

@@ -11,7 +11,6 @@ enum Decision {
   DECISION_UNSPECIFIED = 0;
   DECISION_DENY = 1;
   DECISION_PERMIT = 2;
-  // DECISION_OBLIGATED = 3;
 }
 
 // The EntityIdentifier specifies the actor in an entitlement or decision request - the PE, NPE, or PE+NPE being authorized.
@@ -21,11 +20,11 @@ message EntityIdentifier {
   oneof identifier {
     option (buf.validate.oneof).required = true;
 
-    // chain of one or more entities
+    // chain of one or more entities and at most 10
     entity.EntityChain entity_chain = 1 [(buf.validate.field).cel = {
       id: "entity_chain_required"
-      message: "entities must be provided"
-      expression: "has(this.entities) && this.entities.size() > 0"
+      message: "entities must be provided and between 1 and 10 in count"
+      expression: "has(this.entities) && this.entities.size() > 0 && this.entities.size() <= 10"
     }];
 
     // fully qualified name of the registered resource value stored in platform policy, where in
@@ -41,6 +40,13 @@ message EntityIdentifier {
       message: "token must be provided"
       expression: "has(this.jwt) && this.jwt.size() > 0"
     }];
+
+    // derive the entity from the request's authorization access token JWT, rather than passing in the body
+    google.protobuf.BoolValue with_request_token = 4 [(buf.validate.field).cel = {
+      id: "with_request_token_must_be_true"
+      message: "with_request_token must be true when set"
+      expression: "this == true"
+    }];
   }
 }
 
@@ -65,11 +71,13 @@ message Resource {
   }
 
   oneof resource {
+    // a set of attribute value FQNs, such as those on a TDF, between 1 and 20 in count
     AttributeValues attribute_values = 2 [(buf.validate.field).cel = {
       id: "attribute_values_required"
-      message: "if provided, resource.attribute_values must not be empty"
-      expression: "this.fqns.size() > 0 && this.fqns.all(item, item.isUri())"
+      message: "if provided, resource.attribute_values must be between 1 and 20 in count with all valid FQNs"
+      expression: "this.fqns.size() > 0 && this.fqns.size() <= 20 && this.fqns.all(item, item.isUri())"
     }];
+    // fully qualified name of the registered resource value stored in platform policy
     string registered_resource_value_fqn = 3 [(buf.validate.field).string = {
       min_len: 1
       uri: true
@@ -82,12 +90,17 @@ message ResourceDecision {
   string ephemeral_resource_id = 1;
   // decision result
   Decision decision = 2;
+  // obligations (fully qualified values) the PEP is required to fulfill on the given resource
+  // i.e. https://<namespace>/obl/<definition name>/value/<value>
+  repeated string required_obligations = 3;
 }
 
 // Can the identified entity/entities access?
 // 1. one entity reference (actor)
 // 2. one action
 // 3. one resource
+//
+// If entitled, checks obligation policy: fulfillable obligations must satisfy all triggered.
 message GetDecisionRequest {
   // an entity must be identified for authorization decisioning
   EntityIdentifier entity_identifier = 1 [(buf.validate.field).required = true];
@@ -95,6 +108,14 @@ message GetDecisionRequest {
   policy.Action action = 2 [(buf.validate.field).required = true];
   Resource resource = 3 [(buf.validate.field).required = true];
 
+  // obligations (fully qualified values) the requester is capable of fulfilling
+  // i.e. https://<namespace>/obl/<definition name>/value/<value>
+  repeated string fulfillable_obligation_fqns = 4 [(buf.validate.field).cel = {
+    id: "obligation_value_fqns_valid"
+    message: "if provided, fulfillable_obligation_fqns must be between 1 and 50 in count with all valid FQNs"
+    expression: "this.size() == 0 || (this.size() <= 50 && this.all(item, item.isUri()))"
+  }];
+
   option (buf.validate.message).cel = {
     id: "get_decision_request.action_name_required"
     message: "action.name must be provided"
@@ -104,24 +125,33 @@ message GetDecisionRequest {
 message GetDecisionResponse {
   // decision on the resource
   ResourceDecision decision = 1;
-  // optional list of obligations represented in URI format
-  // repeated string obligations = 2;
 }
 
 // Can the identified entity/entities access?
 // 1. one entity reference (actor)
 // 2. one action
 // 3. multiple resources
-// Note: this is a more performant bulk request for multiple resource decisions
+//
+// If entitled, checks obligation policy: fulfillable obligations must satisfy all triggered.
+//
+// Note: this is a more performant bulk request for multiple resource decisions, up to 1000 per request
 message GetDecisionMultiResourceRequest {
   // an entity must be identified for authorization decisioning
   EntityIdentifier entity_identifier = 1 [(buf.validate.field).required = true];
   // name on action is required
   policy.Action action = 2 [(buf.validate.field).required = true];
-  repeated Resource resources = 3 [
-    (buf.validate.field).required = true,
-    (buf.validate.field).repeated = {min_items: 1}
-  ];
+  repeated Resource resources = 3 [(buf.validate.field).repeated = {
+    min_items: 1
+    max_items: 1000
+  }];
+
+  // obligations (fully qualified values) the requester is capable of fulfilling
+  // i.e. https://<namespace>/obl/<definition name>/value/<value>
+  repeated string fulfillable_obligation_fqns = 4 [(buf.validate.field).cel = {
+    id: "obligation_value_fqns_valid"
+    message: "if provided, fulfillable_obligation_fqns must be between 1 and 50 in count with all valid FQNs"
+    expression: "this.size() == 0 || (this.size() <= 50 && this.all(item, item.isUri()))"
+  }];
 
   option (buf.validate.message).cel = {
     id: "get_decision_multi_request.action_name_required"
@@ -141,7 +171,10 @@ message GetDecisionMultiResourceResponse {
 // This is a more performant bulk request for complex decisioning (i.e. multiple entity chains or actions on
 // multiple resources)
 message GetDecisionBulkRequest {
-  repeated GetDecisionMultiResourceRequest decision_requests = 1;
+  repeated GetDecisionMultiResourceRequest decision_requests = 1 [(buf.validate.field).repeated = {
+    min_items: 1
+    max_items: 200
+  }];
 }
 message GetDecisionBulkResponse {
   repeated GetDecisionMultiResourceResponse decision_responses = 1;

{otdf_python-0.4.4 → otdf_python-0.6.0}/otdf-python-proto/proto-files/common/common.proto

@@ -3,6 +3,30 @@ syntax = "proto3";
 package common;
 
 import "google/protobuf/timestamp.proto";
+import "buf/validate/validate.proto";
+
+message IdNameIdentifier {
+    option (buf.validate.message).oneof = { fields: ["id", "name"], required: true };
+    string id = 1 [(buf.validate.field).string.uuid = true];
+    string name = 2 [
+      (buf.validate.field).string.min_len = 1,
+      (buf.validate.field).string.max_len = 253,
+      (buf.validate.field).cel = {
+        id: "name_format"
+        message: "Name must be an alphanumeric string, allowing hyphens and underscores but not as the first or last character. The stored name will be normalized to lower case."
+        expression: "this.matches('^[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?$')"
+      }
+    ];
+}
+
+message IdFqnIdentifier {
+    option (buf.validate.message).oneof = { fields: ["id", "fqn"], required: true };
+    string id = 1 [(buf.validate.field).string.uuid = true];
+    string fqn = 2 [(buf.validate.field).string = {
+        min_len: 1
+        uri: true
+    }];
+}
 
 // Struct to uniquely identify a resource with optional additional metadata
 message Metadata {

{otdf_python-0.4.4 → otdf_python-0.6.0}/otdf-python-proto/proto-files/entityresolution/v2/entity_resolution.proto

@@ -6,11 +6,20 @@ import "buf/validate/validate.proto";
 import "entity/entity.proto";
 import "google/protobuf/any.proto";
 import "google/protobuf/struct.proto";
+import "authorization/v2/authorization.proto";
+
+// Entity Entitlements that do not require subject mappings (experimental)
+message DirectEntitlement {
+  string attribute_value_fqn = 1;
+  repeated string actions = 2;
+}
 
 message EntityRepresentation {
   // ephemeral entity id from the request
   string original_id = 1;
   repeated google.protobuf.Struct additional_props = 2;
+  // direct entitlements applied to Entity (experimental)
+  repeated DirectEntitlement direct_entitlements = 3;
 }
 
 // Resolve a set of entities to their representations.
@@ -34,6 +43,8 @@ message EntityNotFoundError {
 // Create an entity chain for each token (JWT) in the request.
 message CreateEntityChainsFromTokensRequest {
   repeated entity.Token tokens = 1;
+  // resources to consider for direct entitlements (experimental)
+  repeated authorization.v2.Resource resources = 2;
 }
 
 message CreateEntityChainsFromTokensResponse {

otdf_python-0.6.0/otdf-python-proto/proto-files/kas/kas.proto

@@ -0,0 +1,311 @@
+syntax = "proto3";
+
+package kas;
+
+import "google/api/annotations.proto";
+import "google/protobuf/struct.proto";
+import "google/protobuf/wrappers.proto";
+import "protoc-gen-openapiv2/options/annotations.proto";
+
+option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_swagger) = {
+  info: {
+    title: "OpenTDF Key Access Service";
+    version: "1.5.0";
+    license: {
+      name: "BSD 3-Clause Clear";
+      url: "https://github.com/opentdf/backend/blob/master/LICENSE";
+    };
+  };
+};
+
+message InfoRequest {
+  // Intentionally empty. May include features later.
+}
+
+// Service application level metadata
+message InfoResponse {
+  string version = 1;
+}
+
+message LegacyPublicKeyRequest {
+  string algorithm = 1;
+}
+
+// Policy binding ensures cryptographic integrity between policy and wrapped key
+// Prevents policy tampering by binding the policy hash to the encrypted key
+message PolicyBinding {
+  // Cryptographic hashing algorithm used for policy binding
+  // Optional: ZTDF (when policy_binding is an object)
+  // Value: Always "HS256" (HMAC-SHA256) - other algorithms not supported
+  // Example: "HS256"
+  string algorithm = 1 [json_name = "alg"];
+  
+  // HMAC-SHA256 hash of the base64-encoded policy using the DEK as the secret key
+  // 4.2.2 TDFs are hex and base64 encoded before HMAC computation
+  // Required: ZTDF (when policy_binding is an object)
+  // Links the policy content to the wrapped DEK cryptographically via HMAC
+  // Computed as HMAC-SHA256(DEK, base64_policy) then hex-encoded and base64-encoded
+  string hash = 2;
+}
+
+// Key Access Object containing cryptographic material and metadata for TDF decryption
+message KeyAccess {
+  // Base64-encoded encrypted metadata containing additional key information
+  // Optional: Not used during KAS rewrap operations (client-side only)
+  // KAS service passes this through without processing or validation
+  string encrypted_metadata = 1;
+  
+  // Policy binding ensuring cryptographic integrity between policy and wrapped key
+  // Required: ZTDF (contains hash and algorithm)
+  // Links the policy to the wrapped key cryptographically
+  PolicyBinding policy_binding = 2;
+  
+  // Protocol identifier for the key access mechanism
+  // Optional: Defaults to 'kas'
+  // Typically: 'kas' for standard Key Access Service protocol
+  // Example: "kas"
+  string protocol = 3;
+  
+  // Type of key wrapping used for the data encryption key
+  // Required: Always
+  // Values: 'wrapped' (RSA-wrapped for ZTDF), 'ec-wrapped' (experimental ECDH-wrapped)
+  string key_type = 4 [json_name = "type"];
+  
+  // URL of the Key Access Server that can unwrap this key
+  // Optional: May be omitted if KAS URL is known from context
+  // Used to route rewrap requests to the correct KAS instance
+  // Example: "https://kas.example.com"
+  string kas_url = 5 [json_name = "url"];
+  
+  // Key identifier for the KAS public key used for wrapping
+  // Optional: ZTDF (may specify which KAS key to use, required if present in the TDF)
+  // References a specific public key in the KAS key storage (either local keyring or KAS Registry service)
+  // Example: "k1", "ec-key-2024"
+  string kid = 6;
+  
+  // Split identifier for key splitting scenarios
+  // Optional: ZTDF (used in advanced key splitting configurations)
+  // Used when keys are split across multiple parties for enhanced security
+  string split_id = 7 [json_name = "sid"];
+  
+  // Client-generated data encryption key wrapped by KAS
+  // Required: Always
+  // Contains the actual DEK encrypted with KAS's public key
+  // This is the core cryptographic material needed for TDF decryption
+  bytes wrapped_key = 8;
+  
+  // Complete header containing all metadata and policy information (for formats that embed it)
+  // Optional: Not used by ZTDF (policy and metadata are separate)
+  // Contains magic bytes, version, algorithm, policy, and ephemeral key information
+  bytes header = 9;
+  
+  // Ephemeral public key for ECDH key derivation (ec-wrapped type only)
+  // Required: When key_type="ec-wrapped" (experimental ECDH-based ZTDF)
+  // Omitted: When key_type="wrapped" (RSA-based ZTDF)
+  // Should be a PEM-encoded PKCS#8 (ASN.1) formatted public key
+  // Used to derive the symmetric key for unwrapping the DEK
+  string ephemeral_public_key = 10;
+}
+
+// Bulk-style Rewrap request structure that is serialized into JSON and signed
+// within a Rewrap flow. This message represents the unsigned payload that gets
+// embedded in a JWT as the 'requestBody' claim and signed with a DPoP key.
+message UnsignedRewrapRequest {
+  // Policy metadata and content for a group of KeyAccessObjects
+  message WithPolicy {
+    // An identifier unique within the scope of the rewrap request
+    // Used for mapping between request and response items.
+    // Required: Always
+    // Example: "policy", "policy-0", "policy-1"
+    string id = 1;
+    
+    // Policy content - format varies by TDF type:
+    // ZTDF: Base64-encoded JSON policy object containing attributes and other policy data
+    // Required: ZTDF (base64-encoded policy JSON)
+    string body = 2;
+  }
+  
+  // Key Access Object wrapper with identifier
+  message WithKeyAccessObject {
+    // Ephemeral, unique identifier for this KAO within the request
+    // Required: Always
+    // Example: "kao-0", "kao-1", "key-access-object-uuid"
+    string key_access_object_id = 1;
+    
+    // The actual Key Access Object containing cryptographic material and metadata
+    // Required: Always
+    KeyAccess key_access_object = 2;
+  }
+
+  // Request grouping policy with associated key access objects
+  message WithPolicyRequest {
+    // List of Key Access Objects associated with this policy
+    // Required: Always (at least one)
+    // Some formats require exactly one KAO per policy
+    repeated WithKeyAccessObject key_access_objects = 1;
+    
+    // Policy information for this group of KAOs
+    // Required: Always
+    WithPolicy policy = 2;
+    
+    // Cryptographic algorithm identifier for the TDF type
+    // Optional: Defaults to rsa:2048 if omitted
+    // Values: "ec:secp256r1" (EC-based), "rsa:2048" (RSA-based), "" (defaults to rsa:2048)
+    // Example: "ec:secp256r1"
+    string algorithm = 3;
+  }
+
+  // Client's public key in PEM format for establishing a session key
+  // Required: Always
+  // Used by KAS to generate an ephemeral session key for secure key exchange
+  string client_public_key = 1;
+  
+  // List of policy requests to be processed
+  // Required: Always (at least one)
+  // Each request represents a policy with its associated key access objects
+  repeated WithPolicyRequest requests = 2;
+
+  // Deprecated: Legacy single Key Access Object
+  // Used for legacy non-bulk requests (v1 API)
+  // Modern clients should use the 'requests' field instead
+  KeyAccess key_access = 3 [deprecated = true];
+  
+  // Deprecated: Legacy single policy
+  // Used for legacy non-bulk requests (v1 API)
+  // Modern clients should use the 'requests' field instead
+  string policy = 4 [deprecated = true];
+  
+  // Deprecated: Legacy algorithm specification
+  // Used for legacy non-bulk requests (v1 API)  
+  // Modern clients should use the 'requests' field instead
+  string algorithm = 5 [deprecated = true];
+}
+message PublicKeyRequest {
+  string algorithm = 1 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "algorithm type rsa:<keysize> or ec:<curvename>"}];
+  string fmt = 2 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "response format"}];
+  string v = 3 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {description: "request version"}];
+}
+
+message PublicKeyResponse {
+  string public_key = 1;
+  string kid = 2;
+}
+
+// Request to rewrap (decrypt and re-encrypt) TDF keys for client access
+message RewrapRequest {
+  reserved 2;
+  reserved "bearer";
+
+  // A JWT signed by the DPoP (Demonstration of Proof of Possession) private key
+  // Required: Always
+  // Version differences:
+  // - v1 (legacy): Uses existing TDF spec schema in requestBody
+  // - v2 (bulk): Uses UnsignedRewrapRequest proto serialized as JSON in requestBody
+  string signed_request_token = 1;
+}
+
+
+// Result of a key access object rewrap operation
+message KeyAccessRewrapResult {
+  // Metadata associated with this KAO result (e.g., required obligations)
+  // Optional: May contain obligation requirements or other policy metadata
+  // Common keys: "X-Required-Obligations" with array of obligation FQNs
+  map<string, google.protobuf.Value> metadata = 1;
+  
+  // Identifier matching the key_access_object_id from the request
+  // Required: Always matches the ID from UnsignedRewrapRequest_WithKeyAccessObject
+  string key_access_object_id = 2;
+  
+  // Status of the rewrap operation for this KAO
+  // Required: Always
+  // Values: "permit" (success), "fail" (failure)
+  string status = 3;
+  
+  // Result of the rewrap operation - either success or error
+  oneof result {
+    // Successfully rewrapped key encrypted with the session key
+    // Present when status="permit"
+    // Contains the DEK encrypted with the ephemeral session key
+    bytes kas_wrapped_key = 4;
+    
+    // Error message when rewrap failed
+    // Present when status="fail"
+    // Human-readable description of the failure reason
+    string error = 5;
+  }
+}
+
+// Result for all KAOs associated with a single policy
+message PolicyRewrapResult {
+  // Policy identifier matching the policy.id from the request
+  // Required: Always matches the ID from UnsignedRewrapRequest_WithPolicy
+  string policy_id = 1;
+  
+  // Results for each KAO under this policy
+  // Required: One result per KAO in the original request
+  repeated KeyAccessRewrapResult results = 2;
+}
+
+// Response containing rewrapped keys and session information
+message RewrapResponse {
+  // Deprecated: Legacy metadata field
+  // Modern responses use metadata in individual KeyAccessRewrapResult
+  map<string, google.protobuf.Value> metadata = 1 [deprecated = true];
+  
+  // Deprecated: Legacy single entity wrapped key
+  // Modern responses use kas_wrapped_key in KeyAccessRewrapResult
+  bytes entity_wrapped_key = 2 [deprecated = true];
+  
+  // KAS's ephemeral session public key in PEM format
+  // Required: For EC-based operations (key_type="ec-wrapped")
+  // Optional: Empty for RSA-based ZTDF (key_type="wrapped")
+  // Used by client to perform ECDH key agreement and decrypt the kas_wrapped_key values
+  string session_public_key = 3;
+  
+  // Deprecated: Legacy schema version identifier
+  // Modern responses use implicit versioning
+  string schema_version = 4 [deprecated = true];
+  
+  // Policy-grouped rewrap results for the bulk API
+  // Required: Modern v2 API responses
+  // Each PolicyRewrapResult contains results for all KAOs under that policy
+  repeated PolicyRewrapResult responses = 5;
+}
+
+// Get app info from the root path
+service AccessService {
+  rpc PublicKey(PublicKeyRequest) returns (PublicKeyResponse) {
+    option (google.api.http) = {get: "/kas/v2/kas_public_key"};
+
+    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
+      responses: {key: "200"}
+    };
+    option idempotency_level = NO_SIDE_EFFECTS;
+  }
+
+  // Endpoint intended for gRPC Gateway's REST endpoint to provide v1 compatibility with older TDF clients
+  //
+  // This endpoint is not recommended for use in new applications, prefer the v2 endpoint ('PublicKey') instead.
+  //
+  // buf:lint:ignore RPC_RESPONSE_STANDARD_NAME
+  rpc LegacyPublicKey(LegacyPublicKeyRequest) returns (google.protobuf.StringValue) {
+    option (google.api.http) = {get: "/kas/kas_public_key"};
+
+    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
+      responses: {key: "200"}
+    };
+    option idempotency_level = NO_SIDE_EFFECTS;
+    option deprecated = true;
+  }
+
+  rpc Rewrap(RewrapRequest) returns (RewrapResponse) {
+    option (google.api.http) = {
+      post: "/kas/v2/rewrap"
+      body: "*";
+    };
+
+    option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
+      responses: {key: "200"}
+    };
+  }
+}

{otdf_python-0.4.4 → otdf_python-0.6.0}/otdf-python-proto/proto-files/policy/attributes/attributes.proto

@@ -5,6 +5,7 @@ package policy.attributes;
 import "buf/validate/validate.proto";
 import "common/common.proto";
 import "google/api/annotations.proto";
+import "google/protobuf/wrappers.proto";
 import "policy/objects.proto";
 import "policy/selectors.proto";
 
@@ -93,7 +94,7 @@ message GetAttributeRequest {
     message: "Either id or one of attribute_id or fqn must be set"
   };
 
-  // Deprecated
+  // Deprecated: utilize identifier
   string id = 1 [
     deprecated = true,
     (buf.validate.field).ignore = IGNORE_IF_ZERO_VALUE,
@@ -145,6 +146,14 @@ message CreateAttributeRequest {
     }
   }];
 
+  // Optional
+  // Setting allow_traversal=true allows TDF creation to be front-loaded, meaning a customer
+  // can create encrypted content with an attribute definitions key mapping before
+  // creating the attribute values needed to decrypt.
+  // Content will be able to be encrypted with missing attribute values,
+  // but will not be able to be decrypted until such attribute values exist.
+  google.protobuf.BoolValue allow_traversal = 5;
+
   // Optional
   common.MetadataMutable metadata = 100;
 }
@@ -189,7 +198,7 @@ message GetAttributeValueRequest {
     message: "Either id or one of value_id or fqn must be set"
   };
 
-  // Deprecated
+  // Deprecated: utilize identifier
   string id = 1 [
     deprecated = true,
     (buf.validate.field).ignore = IGNORE_IF_ZERO_VALUE,
@@ -284,9 +293,8 @@ message GetAttributeValuesByFqnsRequest {
     max_items: 250
   }];
 
-  // Optional
-  // This attribute value selector is not used currently, but left here for future use.
-  policy.AttributeValueSelector with_value = 2;
+  reserved 2;
+  reserved "with_value";
 }
 message GetAttributeValuesByFqnsResponse {
   message AttributeAndValue {
@@ -301,6 +309,7 @@ message GetAttributeValuesByFqnsResponse {
    Assign Key Access Server (KAS Grant) to Attribute and Value
 */
 
+// Deprecated: utilize AssignPublicKeyToAttributeRequest
 message AssignKeyAccessServerToAttributeRequest {
   option deprecated = true;
 
@@ -313,6 +322,7 @@ message AssignKeyAccessServerToAttributeResponse {
   AttributeKeyAccessServer attribute_key_access_server = 1;
 }
 
+// Deprecated: utilize RemovePublicKeyFromAttributeRequest
 message RemoveKeyAccessServerFromAttributeRequest {
   option deprecated = true;
   // Required
@@ -324,6 +334,7 @@ message RemoveKeyAccessServerFromAttributeResponse {
   AttributeKeyAccessServer attribute_key_access_server = 1;
 }
 
+// Deprecated: utilize AssignPublicKeyToValueRequest
 message AssignKeyAccessServerToValueRequest {
   option deprecated = true;
   // Required
@@ -335,6 +346,7 @@ message AssignKeyAccessServerToValueResponse {
   ValueKeyAccessServer value_key_access_server = 1;
 }
 
+// Deprecated: utilize RemovePublicKeyFromValueRequest
 message RemoveKeyAccessServerFromValueRequest {
   option deprecated = true;
   // Required
@@ -434,18 +446,22 @@ service AttributesService {
   /*--------------------------------------*
    * Attribute <> Key Access Server RPCs
    *---------------------------------------*/
+  // Deprecated: utilize AssignPublicKeyToAttribute
   rpc AssignKeyAccessServerToAttribute(AssignKeyAccessServerToAttributeRequest) returns (AssignKeyAccessServerToAttributeResponse) {
     option deprecated = true;
   }
 
+  // Deprecated: utilize RemovePublicKeyFromAttribute
   rpc RemoveKeyAccessServerFromAttribute(RemoveKeyAccessServerFromAttributeRequest) returns (RemoveKeyAccessServerFromAttributeResponse) {
     option deprecated = true;
   }
 
+  // Deprecated: utilize AssignPublicKeyToValue
   rpc AssignKeyAccessServerToValue(AssignKeyAccessServerToValueRequest) returns (AssignKeyAccessServerToValueResponse) {
     option deprecated = true;
   }
 
+  // Deprecated: utilize RemovePublicKeyFromValue
   rpc RemoveKeyAccessServerFromValue(RemoveKeyAccessServerFromValueRequest) returns (RemoveKeyAccessServerFromValueResponse) {
     option deprecated = true;
   }