diff --git a/Makefile b/Makefile
index 464ecf64..c2e8011a 100644
--- a/Makefile
+++ b/Makefile
@@ -46,3 +46,13 @@ format license-check lint test: ci
 
 doc:
 	cd lib && npm run doc
+
+toolcheck:
+	@echo "Checking for required tools..."
+	@which buf > /dev/null || (echo "buf not found, please install it from https://docs.buf.build/installation" && exit 1)
+	@which protoc-gen-grpc-gateway-ts > /dev/null || (echo "protoc-gen-grpc-gateway-ts not found, run  'go install github.com/grpc-ecosystem/protoc-gen-grpc-gateway-ts@v1.1.2'" && exit 1)
+	@golangci-lint --version | grep "version v\?1.5[67]" > /dev/null || (echo "golangci-lint version must be v1.55 [$$(golangci-lint --version)]" && exit 1)
+
+proto-generate:
+	rm -rf lib/proto
+	buf generate https://github.com/opentdf/platform.git\#branch\=main,subdir\=service --exclude-path authorization/idp_plugin.proto
diff --git a/buf.gen.yaml b/buf.gen.yaml
new file mode 100644
index 00000000..ff1ee1b6
--- /dev/null
+++ b/buf.gen.yaml
@@ -0,0 +1,6 @@
+version: v1
+managed:
+  enabled: false
+plugins:
+  - plugin: grpc-gateway-ts
+    out: lib/proto
\ No newline at end of file
diff --git a/lib/proto/authorization/authorization.pb.ts b/lib/proto/authorization/authorization.pb.ts
new file mode 100644
index 00000000..0c123926
--- /dev/null
+++ b/lib/proto/authorization/authorization.pb.ts
@@ -0,0 +1,93 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+
+import * as fm from "../fetch.pb"
+import * as GoogleProtobufAny from "../google/protobuf/any.pb"
+import * as PolicyObjects from "../policy/objects.pb"
+
+type Absent<T, K extends keyof T> = { [k in Exclude<keyof T, K>]?: undefined };
+type OneOf<T> =
+  | { [k in keyof T]?: undefined }
+  | (
+    keyof T extends infer K ?
+      (K extends string & keyof T ? { [k in K]: T[K] } & Absent<T, K>
+        : never)
+    : never);
+
+export enum DecisionResponseDecision {
+  DECISION_UNSPECIFIED = "DECISION_UNSPECIFIED",
+  DECISION_DENY = "DECISION_DENY",
+  DECISION_PERMIT = "DECISION_PERMIT",
+}
+
+
+type BaseEntity = {
+  id?: string
+}
+
+export type Entity = BaseEntity
+  & OneOf<{ emailAddress: string; userName: string; remoteClaimsUrl: string; jwt: string; claims: GoogleProtobufAny.Any; custom: EntityCustom; clientId: string }>
+
+export type EntityCustom = {
+  extension?: GoogleProtobufAny.Any
+}
+
+export type EntityChain = {
+  id?: string
+  entities?: Entity[]
+}
+
+export type DecisionRequest = {
+  actions?: PolicyObjects.Action[]
+  entityChains?: EntityChain[]
+  resourceAttributes?: ResourceAttribute[]
+}
+
+export type DecisionResponse = {
+  entityChainId?: string
+  resourceAttributesId?: string
+  action?: PolicyObjects.Action
+  decision?: DecisionResponseDecision
+  obligations?: string[]
+}
+
+export type GetDecisionsRequest = {
+  decisionRequests?: DecisionRequest[]
+}
+
+export type GetDecisionsResponse = {
+  decisionResponses?: DecisionResponse[]
+}
+
+
+type BaseGetEntitlementsRequest = {
+  entities?: Entity[]
+}
+
+export type GetEntitlementsRequest = BaseGetEntitlementsRequest
+  & OneOf<{ scope: ResourceAttribute }>
+
+export type EntityEntitlements = {
+  entityId?: string
+  attributeValueFqns?: string[]
+}
+
+export type ResourceAttribute = {
+  attributeValueFqns?: string[]
+}
+
+export type GetEntitlementsResponse = {
+  entitlements?: EntityEntitlements[]
+}
+
+export class AuthorizationService {
+  static GetDecisions(req: GetDecisionsRequest, initReq?: fm.InitReq): Promise<GetDecisionsResponse> {
+    return fm.fetchReq<GetDecisionsRequest, GetDecisionsResponse>(`/v1/authorization`, {...initReq, method: "POST"})
+  }
+  static GetEntitlements(req: GetEntitlementsRequest, initReq?: fm.InitReq): Promise<GetEntitlementsResponse> {
+    return fm.fetchReq<GetEntitlementsRequest, GetEntitlementsResponse>(`/v1/entitlements`, {...initReq, method: "POST"})
+  }
+}
\ No newline at end of file
diff --git a/lib/proto/common/common.pb.ts b/lib/proto/common/common.pb.ts
new file mode 100644
index 00000000..c334b9e0
--- /dev/null
+++ b/lib/proto/common/common.pb.ts
@@ -0,0 +1,30 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+
+import * as GoogleProtobufTimestamp from "../google/protobuf/timestamp.pb"
+
+export enum MetadataUpdateEnum {
+  METADATA_UPDATE_ENUM_UNSPECIFIED = "METADATA_UPDATE_ENUM_UNSPECIFIED",
+  METADATA_UPDATE_ENUM_EXTEND = "METADATA_UPDATE_ENUM_EXTEND",
+  METADATA_UPDATE_ENUM_REPLACE = "METADATA_UPDATE_ENUM_REPLACE",
+}
+
+export enum ActiveStateEnum {
+  ACTIVE_STATE_ENUM_UNSPECIFIED = "ACTIVE_STATE_ENUM_UNSPECIFIED",
+  ACTIVE_STATE_ENUM_ACTIVE = "ACTIVE_STATE_ENUM_ACTIVE",
+  ACTIVE_STATE_ENUM_INACTIVE = "ACTIVE_STATE_ENUM_INACTIVE",
+  ACTIVE_STATE_ENUM_ANY = "ACTIVE_STATE_ENUM_ANY",
+}
+
+export type Metadata = {
+  createdAt?: GoogleProtobufTimestamp.Timestamp
+  updatedAt?: GoogleProtobufTimestamp.Timestamp
+  labels?: {[key: string]: string}
+}
+
+export type MetadataMutable = {
+  labels?: {[key: string]: string}
+}
\ No newline at end of file
diff --git a/lib/proto/fetch.pb.ts b/lib/proto/fetch.pb.ts
new file mode 100644
index 00000000..82736361
--- /dev/null
+++ b/lib/proto/fetch.pb.ts
@@ -0,0 +1,341 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+
+/**
+ * base64 encoder and decoder
+ * Copied and adapted from https://github.com/protobufjs/protobuf.js/blob/master/lib/base64/index.js
+ */
+// Base64 encoding table
+const b64 = new Array(64);
+
+// Base64 decoding table
+const s64 = new Array(123);
+
+// 65..90, 97..122, 48..57, 43, 47
+for (let i = 0; i < 64;)
+    s64[b64[i] = i < 26 ? i + 65 : i < 52 ? i + 71 : i < 62 ? i - 4 : i - 59 | 43] = i++;
+
+export function b64Encode(buffer: Uint8Array, start: number, end: number): string {
+	let parts: string[] = null;
+  const chunk = [];
+  let i = 0, // output index
+    j = 0, // goto index
+    t;     // temporary
+  while (start < end) {
+    const b = buffer[start++];
+    switch (j) {
+      case 0:
+        chunk[i++] = b64[b >> 2];
+        t = (b & 3) << 4;
+        j = 1;
+        break;
+      case 1:
+        chunk[i++] = b64[t | b >> 4];
+        t = (b & 15) << 2;
+        j = 2;
+        break;
+      case 2:
+        chunk[i++] = b64[t | b >> 6];
+        chunk[i++] = b64[b & 63];
+        j = 0;
+        break;
+    }
+    if (i > 8191) {
+      (parts || (parts = [])).push(String.fromCharCode.apply(String, chunk));
+      i = 0;
+    }
+  }
+  if (j) {
+    chunk[i++] = b64[t];
+    chunk[i++] = 61;
+    if (j === 1)
+      chunk[i++] = 61;
+  }
+  if (parts) {
+    if (i)
+      parts.push(String.fromCharCode.apply(String, chunk.slice(0, i)));
+    return parts.join("");
+  }
+  return String.fromCharCode.apply(String, chunk.slice(0, i));
+}
+
+const invalidEncoding = "invalid encoding";
+
+export function b64Decode(s: string): Uint8Array {
+	const buffer = [];
+	let offset = 0;
+  let j = 0, // goto index
+      t;     // temporary
+  for (let i = 0; i < s.length;) {
+    let c = s.charCodeAt(i++);
+    if (c === 61 && j > 1)
+        break;
+    if ((c = s64[c]) === undefined)
+        throw Error(invalidEncoding);
+    switch (j) {
+      case 0:
+        t = c;
+        j = 1;
+        break;
+      case 1:
+        buffer[offset++] = t << 2 | (c & 48) >> 4;
+        t = c;
+        j = 2;
+        break;
+      case 2:
+        buffer[offset++] = (t & 15) << 4 | (c & 60) >> 2;
+        t = c;
+        j = 3;
+        break;
+      case 3:
+        buffer[offset++] = (t & 3) << 6 | c;
+        j = 0;
+        break;
+    }
+  }
+  if (j === 1)
+      throw Error(invalidEncoding);
+  return new Uint8Array(buffer);
+}
+
+function b64Test(s: string): boolean {
+	return /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(s);
+}
+
+export interface InitReq extends RequestInit {
+  pathPrefix?: string
+}
+
+export function replacer(key: any, value: any): any {
+  if(value && value.constructor === Uint8Array) {
+    return b64Encode(value, 0, value.length);
+  }
+
+  return value;
+}
+
+export function fetchReq<I, O>(path: string, init?: InitReq): Promise<O> {
+  const {pathPrefix, ...req} = init || {}
+
+  const url = pathPrefix ? `${pathPrefix}${path}` : path
+
+  return fetch(url, req).then(r => r.json().then((body: O) => {
+    if (!r.ok) { throw body; }
+    return body;
+  })) as Promise<O>
+}
+
+// NotifyStreamEntityArrival is a callback that will be called on streaming entity arrival
+export type NotifyStreamEntityArrival<T> = (resp: T) => void
+
+/**
+ * fetchStreamingRequest is able to handle grpc-gateway server side streaming call
+ * it takes NotifyStreamEntityArrival that lets users respond to entity arrival during the call
+ * all entities will be returned as an array after the call finishes.
+ **/
+export async function fetchStreamingRequest<S, R>(path: string, callback?: NotifyStreamEntityArrival<R>, init?: InitReq) {
+  const {pathPrefix, ...req} = init || {}
+  const url = pathPrefix ?`${pathPrefix}${path}` : path
+  const result = await fetch(url, req)
+  // needs to use the .ok to check the status of HTTP status code
+  // http other than 200 will not throw an error, instead the .ok will become false.
+  // see https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API/Using_Fetch#
+  if (!result.ok) {
+    const resp = await result.json()
+    const errMsg = resp.error && resp.error.message ? resp.error.message : ""
+    throw new Error(errMsg)
+  }
+
+  if (!result.body) {
+    throw new Error("response doesnt have a body")
+  }
+
+  await result.body
+    .pipeThrough(new TextDecoderStream())
+    .pipeThrough<R>(getNewLineDelimitedJSONDecodingStream<R>())
+    .pipeTo(getNotifyEntityArrivalSink((e: R) => {
+      if (callback) {
+        callback(e)
+      }
+    }))
+
+  // wait for the streaming to finish and return the success respond
+  return
+}
+
+/**
+ * JSONStringStreamController represents the transform controller that's able to transform the incoming
+ * new line delimited json content stream into entities and able to push the entity to the down stream
+ */
+interface JSONStringStreamController<T> extends TransformStreamDefaultController {
+  buf?: string
+  pos?: number
+  enqueue: (s: T) => void
+}
+
+/**
+ * getNewLineDelimitedJSONDecodingStream returns a TransformStream that's able to handle new line delimited json stream content into parsed entities
+ */
+function getNewLineDelimitedJSONDecodingStream<T>(): TransformStream<string, T> {
+  return new TransformStream({
+    start(controller: JSONStringStreamController<T>) {
+      controller.buf = ''
+      controller.pos = 0
+    },
+
+    transform(chunk: string, controller: JSONStringStreamController<T>) {
+      if (controller.buf === undefined) {
+        controller.buf = ''
+      }
+      if (controller.pos === undefined) {
+        controller.pos = 0
+      }
+      controller.buf += chunk
+      while (controller.pos < controller.buf.length) {
+        if (controller.buf[controller.pos] === '\n') {
+          const line = controller.buf.substring(0, controller.pos)
+          const response = JSON.parse(line)
+          controller.enqueue(response.result)
+          controller.buf = controller.buf.substring(controller.pos + 1)
+          controller.pos = 0
+        } else {
+          ++controller.pos
+        }
+      }
+    }
+  })
+
+}
+
+/**
+ * getNotifyEntityArrivalSink takes the NotifyStreamEntityArrival callback and return
+ * a sink that will call the callback on entity arrival
+ * @param notifyCallback
+ */
+function getNotifyEntityArrivalSink<T>(notifyCallback: NotifyStreamEntityArrival<T>) {
+  return new WritableStream<T>({
+    write(entity: T) {
+      notifyCallback(entity)
+    }
+  })
+}
+
+type Primitive = string | boolean | number;
+type RequestPayload = Record<string, unknown>;
+type FlattenedRequestPayload = Record<string, Primitive | Array<Primitive>>;
+
+/**
+ * Checks if given value is a plain object
+ * Logic copied and adapted from below source: 
+ * https://github.com/char0n/ramda-adjunct/blob/master/src/isPlainObj.js
+ * @param  {unknown} value
+ * @return {boolean}
+ */
+function isPlainObject(value: unknown): boolean {
+  const isObject =
+    Object.prototype.toString.call(value).slice(8, -1) === "Object";
+  const isObjLike = value !== null && isObject;
+
+  if (!isObjLike || !isObject) {
+    return false;
+  }
+
+  const proto = Object.getPrototypeOf(value);
+
+  const hasObjectConstructor =
+    typeof proto === "object" &&
+    proto.constructor === Object.prototype.constructor;
+
+  return hasObjectConstructor;
+}
+
+/**
+ * Checks if given value is of a primitive type
+ * @param  {unknown} value
+ * @return {boolean}
+ */
+function isPrimitive(value: unknown): boolean {
+  return ["string", "number", "boolean"].some(t => typeof value === t);
+}
+
+/**
+ * Checks if given primitive is zero-value
+ * @param  {Primitive} value
+ * @return {boolean}
+ */
+function isZeroValuePrimitive(value: Primitive): boolean {
+  return value === false || value === 0 || value === "";
+}
+
+/**
+ * Flattens a deeply nested request payload and returns an object
+ * with only primitive values and non-empty array of primitive values
+ * as per https://github.com/googleapis/googleapis/blob/master/google/api/http.proto
+ * @param  {RequestPayload} requestPayload
+ * @param  {String} path
+ * @return {FlattenedRequestPayload>}
+ */
+function flattenRequestPayload<T extends RequestPayload>(
+  requestPayload: T,
+  path: string = ""
+): FlattenedRequestPayload {
+  return Object.keys(requestPayload).reduce(
+    (acc: T, key: string): T => {
+      const value = requestPayload[key];
+      const newPath = path ? [path, key].join(".") : key;
+
+      const isNonEmptyPrimitiveArray =
+        Array.isArray(value) &&
+        value.every(v => isPrimitive(v)) &&
+        value.length > 0;
+
+      const isNonZeroValuePrimitive =
+        isPrimitive(value) && !isZeroValuePrimitive(value as Primitive);
+
+      let objectToMerge = {};
+
+      if (isPlainObject(value)) {
+        objectToMerge = flattenRequestPayload(value as RequestPayload, newPath);
+      } else if (isNonZeroValuePrimitive || isNonEmptyPrimitiveArray) {
+        objectToMerge = { [newPath]: value };
+      }
+
+      return { ...acc, ...objectToMerge };
+    },
+    {} as T
+  ) as FlattenedRequestPayload;
+}
+
+/**
+ * Renders a deeply nested request payload into a string of URL search
+ * parameters by first flattening the request payload and then removing keys
+ * which are already present in the URL path.
+ * @param  {RequestPayload} requestPayload
+ * @param  {string[]} urlPathParams
+ * @return {string}
+ */
+export function renderURLSearchParams<T extends RequestPayload>(
+  requestPayload: T,
+  urlPathParams: string[] = []
+): string {
+  const flattenedRequestPayload = flattenRequestPayload(requestPayload);
+
+  const urlSearchParams = Object.keys(flattenedRequestPayload).reduce(
+    (acc: string[][], key: string): string[][] => {
+      // key should not be present in the url path as a parameter
+      const value = flattenedRequestPayload[key];
+      if (urlPathParams.find(f => f === key)) {
+        return acc;
+      }
+      return Array.isArray(value)
+        ? [...acc, ...value.map(m => [key, m.toString()])]
+        : (acc = [...acc, [key, value.toString()]]);
+    },
+    [] as string[][]
+  );
+
+  return new URLSearchParams(urlSearchParams).toString();
+}
\ No newline at end of file
diff --git a/lib/proto/kas/kas.pb.ts b/lib/proto/kas/kas.pb.ts
new file mode 100644
index 00000000..372841d8
--- /dev/null
+++ b/lib/proto/kas/kas.pb.ts
@@ -0,0 +1,55 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+
+import * as fm from "../fetch.pb"
+import * as GoogleProtobufStruct from "../google/protobuf/struct.pb"
+import * as GoogleProtobufWrappers from "../google/protobuf/wrappers.pb"
+export type InfoRequest = {
+}
+
+export type InfoResponse = {
+  version?: string
+}
+
+export type LegacyPublicKeyRequest = {
+  algorithm?: string
+}
+
+export type PublicKeyRequest = {
+  algorithm?: string
+  fmt?: string
+  v?: string
+}
+
+export type PublicKeyResponse = {
+  publicKey?: string
+}
+
+export type RewrapRequest = {
+  signedRequestToken?: string
+}
+
+export type RewrapResponse = {
+  metadata?: {[key: string]: GoogleProtobufStruct.Value}
+  entityWrappedKey?: Uint8Array
+  sessionPublicKey?: string
+  schemaVersion?: string
+}
+
+export class AccessService {
+  static Info(req: InfoRequest, initReq?: fm.InitReq): Promise<InfoResponse> {
+    return fm.fetchReq<InfoRequest, InfoResponse>(`/kas?${fm.renderURLSearchParams(req, [])}`, {...initReq, method: "GET"})
+  }
+  static PublicKey(req: PublicKeyRequest, initReq?: fm.InitReq): Promise<PublicKeyResponse> {
+    return fm.fetchReq<PublicKeyRequest, PublicKeyResponse>(`/kas/v2/kas_public_key?${fm.renderURLSearchParams(req, [])}`, {...initReq, method: "GET"})
+  }
+  static LegacyPublicKey(req: LegacyPublicKeyRequest, initReq?: fm.InitReq): Promise<GoogleProtobufWrappers.StringValue> {
+    return fm.fetchReq<LegacyPublicKeyRequest, GoogleProtobufWrappers.StringValue>(`/kas/kas_public_key?${fm.renderURLSearchParams(req, [])}`, {...initReq, method: "GET"})
+  }
+  static Rewrap(req: RewrapRequest, initReq?: fm.InitReq): Promise<RewrapResponse> {
+    return fm.fetchReq<RewrapRequest, RewrapResponse>(`/kas/v2/rewrap`, {...initReq, method: "POST", body: JSON.stringify(req, fm.replacer)})
+  }
+}
\ No newline at end of file
diff --git a/lib/proto/policy/attributes/attributes.pb.ts b/lib/proto/policy/attributes/attributes.pb.ts
new file mode 100644
index 00000000..53bf7ae8
--- /dev/null
+++ b/lib/proto/policy/attributes/attributes.pb.ts
@@ -0,0 +1,207 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+
+import * as CommonCommon from "../../common/common.pb"
+import * as fm from "../../fetch.pb"
+import * as PolicyObjects from "../objects.pb"
+import * as PolicySelectors from "../selectors.pb"
+export type AttributeKeyAccessServer = {
+  attributeId?: string
+  keyAccessServerId?: string
+}
+
+export type ValueKeyAccessServer = {
+  valueId?: string
+  keyAccessServerId?: string
+}
+
+export type ListAttributesRequest = {
+  state?: CommonCommon.ActiveStateEnum
+  namespace?: string
+}
+
+export type ListAttributesResponse = {
+  attributes?: PolicyObjects.Attribute[]
+}
+
+export type GetAttributeRequest = {
+  id?: string
+}
+
+export type GetAttributeResponse = {
+  attribute?: PolicyObjects.Attribute
+}
+
+export type CreateAttributeRequest = {
+  namespaceId?: string
+  name?: string
+  rule?: PolicyObjects.AttributeRuleTypeEnum
+  values?: string[]
+  metadata?: CommonCommon.MetadataMutable
+}
+
+export type CreateAttributeResponse = {
+  attribute?: PolicyObjects.Attribute
+}
+
+export type UpdateAttributeRequest = {
+  id?: string
+  metadata?: CommonCommon.MetadataMutable
+  metadataUpdateBehavior?: CommonCommon.MetadataUpdateEnum
+}
+
+export type UpdateAttributeResponse = {
+  attribute?: PolicyObjects.Attribute
+}
+
+export type DeactivateAttributeRequest = {
+  id?: string
+}
+
+export type DeactivateAttributeResponse = {
+  attribute?: PolicyObjects.Attribute
+}
+
+export type GetAttributeValueRequest = {
+  id?: string
+}
+
+export type GetAttributeValueResponse = {
+  value?: PolicyObjects.Value
+}
+
+export type ListAttributeValuesRequest = {
+  attributeId?: string
+  state?: CommonCommon.ActiveStateEnum
+}
+
+export type ListAttributeValuesResponse = {
+  values?: PolicyObjects.Value[]
+}
+
+export type CreateAttributeValueRequest = {
+  attributeId?: string
+  value?: string
+  members?: string[]
+  metadata?: CommonCommon.MetadataMutable
+}
+
+export type CreateAttributeValueResponse = {
+  value?: PolicyObjects.Value
+}
+
+export type UpdateAttributeValueRequest = {
+  id?: string
+  members?: string[]
+  metadata?: CommonCommon.MetadataMutable
+  metadataUpdateBehavior?: CommonCommon.MetadataUpdateEnum
+}
+
+export type UpdateAttributeValueResponse = {
+  value?: PolicyObjects.Value
+}
+
+export type DeactivateAttributeValueRequest = {
+  id?: string
+}
+
+export type DeactivateAttributeValueResponse = {
+  value?: PolicyObjects.Value
+}
+
+export type GetAttributeValuesByFqnsRequest = {
+  fqns?: string[]
+  withValue?: PolicySelectors.AttributeValueSelector
+}
+
+export type GetAttributeValuesByFqnsResponseAttributeAndValue = {
+  attribute?: PolicyObjects.Attribute
+  value?: PolicyObjects.Value
+}
+
+export type GetAttributeValuesByFqnsResponse = {
+  fqnAttributeValues?: {[key: string]: GetAttributeValuesByFqnsResponseAttributeAndValue}
+}
+
+export type AssignKeyAccessServerToAttributeRequest = {
+  attributeKeyAccessServer?: AttributeKeyAccessServer
+}
+
+export type AssignKeyAccessServerToAttributeResponse = {
+  attributeKeyAccessServer?: AttributeKeyAccessServer
+}
+
+export type RemoveKeyAccessServerFromAttributeRequest = {
+  attributeKeyAccessServer?: AttributeKeyAccessServer
+}
+
+export type RemoveKeyAccessServerFromAttributeResponse = {
+  attributeKeyAccessServer?: AttributeKeyAccessServer
+}
+
+export type AssignKeyAccessServerToValueRequest = {
+  valueKeyAccessServer?: ValueKeyAccessServer
+}
+
+export type AssignKeyAccessServerToValueResponse = {
+  valueKeyAccessServer?: ValueKeyAccessServer
+}
+
+export type RemoveKeyAccessServerFromValueRequest = {
+  valueKeyAccessServer?: ValueKeyAccessServer
+}
+
+export type RemoveKeyAccessServerFromValueResponse = {
+  valueKeyAccessServer?: ValueKeyAccessServer
+}
+
+export class AttributesService {
+  static ListAttributes(req: ListAttributesRequest, initReq?: fm.InitReq): Promise<ListAttributesResponse> {
+    return fm.fetchReq<ListAttributesRequest, ListAttributesResponse>(`/attributes?${fm.renderURLSearchParams(req, [])}`, {...initReq, method: "GET"})
+  }
+  static ListAttributeValues(req: ListAttributeValuesRequest, initReq?: fm.InitReq): Promise<ListAttributeValuesResponse> {
+    return fm.fetchReq<ListAttributeValuesRequest, ListAttributeValuesResponse>(`/attributes/*/values?${fm.renderURLSearchParams(req, [])}`, {...initReq, method: "GET"})
+  }
+  static GetAttribute(req: GetAttributeRequest, initReq?: fm.InitReq): Promise<GetAttributeResponse> {
+    return fm.fetchReq<GetAttributeRequest, GetAttributeResponse>(`/attributes/${req["id"]}?${fm.renderURLSearchParams(req, ["id"])}`, {...initReq, method: "GET"})
+  }
+  static GetAttributeValuesByFqns(req: GetAttributeValuesByFqnsRequest, initReq?: fm.InitReq): Promise<GetAttributeValuesByFqnsResponse> {
+    return fm.fetchReq<GetAttributeValuesByFqnsRequest, GetAttributeValuesByFqnsResponse>(`/attributes/*/fqn?${fm.renderURLSearchParams(req, [])}`, {...initReq, method: "GET"})
+  }
+  static CreateAttribute(req: CreateAttributeRequest, initReq?: fm.InitReq): Promise<CreateAttributeResponse> {
+    return fm.fetchReq<CreateAttributeRequest, CreateAttributeResponse>(`/attributes`, {...initReq, method: "POST", body: JSON.stringify(req, fm.replacer)})
+  }
+  static UpdateAttribute(req: UpdateAttributeRequest, initReq?: fm.InitReq): Promise<UpdateAttributeResponse> {
+    return fm.fetchReq<UpdateAttributeRequest, UpdateAttributeResponse>(`/attributes/${req["id"]}`, {...initReq, method: "PATCH", body: JSON.stringify(req, fm.replacer)})
+  }
+  static DeactivateAttribute(req: DeactivateAttributeRequest, initReq?: fm.InitReq): Promise<DeactivateAttributeResponse> {
+    return fm.fetchReq<DeactivateAttributeRequest, DeactivateAttributeResponse>(`/attributes/${req["id"]}`, {...initReq, method: "DELETE"})
+  }
+  static GetAttributeValue(req: GetAttributeValueRequest, initReq?: fm.InitReq): Promise<GetAttributeValueResponse> {
+    return fm.fetchReq<GetAttributeValueRequest, GetAttributeValueResponse>(`/attributes/*/values/${req["id"]}?${fm.renderURLSearchParams(req, ["id"])}`, {...initReq, method: "GET"})
+  }
+  static CreateAttributeValue(req: CreateAttributeValueRequest, initReq?: fm.InitReq): Promise<CreateAttributeValueResponse> {
+    return fm.fetchReq<CreateAttributeValueRequest, CreateAttributeValueResponse>(`/attributes/${req["attributeId"]}/values`, {...initReq, method: "POST", body: JSON.stringify(req, fm.replacer)})
+  }
+  static UpdateAttributeValue(req: UpdateAttributeValueRequest, initReq?: fm.InitReq): Promise<UpdateAttributeValueResponse> {
+    return fm.fetchReq<UpdateAttributeValueRequest, UpdateAttributeValueResponse>(`/attributes/*/values/${req["id"]}`, {...initReq, method: "PATCH", body: JSON.stringify(req, fm.replacer)})
+  }
+  static DeactivateAttributeValue(req: DeactivateAttributeValueRequest, initReq?: fm.InitReq): Promise<DeactivateAttributeValueResponse> {
+    return fm.fetchReq<DeactivateAttributeValueRequest, DeactivateAttributeValueResponse>(`/attributes/*/values/${req["id"]}`, {...initReq, method: "DELETE"})
+  }
+  static AssignKeyAccessServerToAttribute(req: AssignKeyAccessServerToAttributeRequest, initReq?: fm.InitReq): Promise<AssignKeyAccessServerToAttributeResponse> {
+    return fm.fetchReq<AssignKeyAccessServerToAttributeRequest, AssignKeyAccessServerToAttributeResponse>(`/attributes/keyaccessserver/assign`, {...initReq, method: "POST", body: JSON.stringify(req["attribute_key_access_server"], fm.replacer)})
+  }
+  static RemoveKeyAccessServerFromAttribute(req: RemoveKeyAccessServerFromAttributeRequest, initReq?: fm.InitReq): Promise<RemoveKeyAccessServerFromAttributeResponse> {
+    return fm.fetchReq<RemoveKeyAccessServerFromAttributeRequest, RemoveKeyAccessServerFromAttributeResponse>(`/attributes/keyaccessserver/remove`, {...initReq, method: "POST", body: JSON.stringify(req["attribute_key_access_server"], fm.replacer)})
+  }
+  static AssignKeyAccessServerToValue(req: AssignKeyAccessServerToValueRequest, initReq?: fm.InitReq): Promise<AssignKeyAccessServerToValueResponse> {
+    return fm.fetchReq<AssignKeyAccessServerToValueRequest, AssignKeyAccessServerToValueResponse>(`/attributes/values/keyaccessserver/assign`, {...initReq, method: "POST", body: JSON.stringify(req["value_key_access_server"], fm.replacer)})
+  }
+  static RemoveKeyAccessServerFromValue(req: RemoveKeyAccessServerFromValueRequest, initReq?: fm.InitReq): Promise<RemoveKeyAccessServerFromValueResponse> {
+    return fm.fetchReq<RemoveKeyAccessServerFromValueRequest, RemoveKeyAccessServerFromValueResponse>(`/attributes/values/keyaccessserver/remove`, {...initReq, method: "POST", body: JSON.stringify(req["value_key_access_server"], fm.replacer)})
+  }
+}
\ No newline at end of file
diff --git a/lib/proto/policy/kasregistry/key_access_server_registry.pb.ts b/lib/proto/policy/kasregistry/key_access_server_registry.pb.ts
new file mode 100644
index 00000000..d3140c41
--- /dev/null
+++ b/lib/proto/policy/kasregistry/key_access_server_registry.pb.ts
@@ -0,0 +1,71 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+
+import * as CommonCommon from "../../common/common.pb"
+import * as fm from "../../fetch.pb"
+import * as PolicyObjects from "../objects.pb"
+export type GetKeyAccessServerRequest = {
+  id?: string
+}
+
+export type GetKeyAccessServerResponse = {
+  keyAccessServer?: PolicyObjects.KeyAccessServer
+}
+
+export type ListKeyAccessServersRequest = {
+}
+
+export type ListKeyAccessServersResponse = {
+  keyAccessServers?: PolicyObjects.KeyAccessServer[]
+}
+
+export type CreateKeyAccessServerRequest = {
+  uri?: string
+  publicKey?: PolicyObjects.PublicKey
+  metadata?: CommonCommon.MetadataMutable
+}
+
+export type CreateKeyAccessServerResponse = {
+  keyAccessServer?: PolicyObjects.KeyAccessServer
+}
+
+export type UpdateKeyAccessServerRequest = {
+  id?: string
+  uri?: string
+  publicKey?: PolicyObjects.PublicKey
+  metadata?: CommonCommon.MetadataMutable
+  metadataUpdateBehavior?: CommonCommon.MetadataUpdateEnum
+}
+
+export type UpdateKeyAccessServerResponse = {
+  keyAccessServer?: PolicyObjects.KeyAccessServer
+}
+
+export type DeleteKeyAccessServerRequest = {
+  id?: string
+}
+
+export type DeleteKeyAccessServerResponse = {
+  keyAccessServer?: PolicyObjects.KeyAccessServer
+}
+
+export class KeyAccessServerRegistryService {
+  static ListKeyAccessServers(req: ListKeyAccessServersRequest, initReq?: fm.InitReq): Promise<ListKeyAccessServersResponse> {
+    return fm.fetchReq<ListKeyAccessServersRequest, ListKeyAccessServersResponse>(`/key-access-servers?${fm.renderURLSearchParams(req, [])}`, {...initReq, method: "GET"})
+  }
+  static GetKeyAccessServer(req: GetKeyAccessServerRequest, initReq?: fm.InitReq): Promise<GetKeyAccessServerResponse> {
+    return fm.fetchReq<GetKeyAccessServerRequest, GetKeyAccessServerResponse>(`/key-access-servers/${req["id"]}?${fm.renderURLSearchParams(req, ["id"])}`, {...initReq, method: "GET"})
+  }
+  static CreateKeyAccessServer(req: CreateKeyAccessServerRequest, initReq?: fm.InitReq): Promise<CreateKeyAccessServerResponse> {
+    return fm.fetchReq<CreateKeyAccessServerRequest, CreateKeyAccessServerResponse>(`/key-access-servers`, {...initReq, method: "POST", body: JSON.stringify(req, fm.replacer)})
+  }
+  static UpdateKeyAccessServer(req: UpdateKeyAccessServerRequest, initReq?: fm.InitReq): Promise<UpdateKeyAccessServerResponse> {
+    return fm.fetchReq<UpdateKeyAccessServerRequest, UpdateKeyAccessServerResponse>(`/key-access-servers/${req["id"]}`, {...initReq, method: "PATCH", body: JSON.stringify(req, fm.replacer)})
+  }
+  static DeleteKeyAccessServer(req: DeleteKeyAccessServerRequest, initReq?: fm.InitReq): Promise<DeleteKeyAccessServerResponse> {
+    return fm.fetchReq<DeleteKeyAccessServerRequest, DeleteKeyAccessServerResponse>(`/key-access-servers/${req["id"]}`, {...initReq, method: "DELETE"})
+  }
+}
\ No newline at end of file
diff --git a/lib/proto/policy/namespaces/namespaces.pb.ts b/lib/proto/policy/namespaces/namespaces.pb.ts
new file mode 100644
index 00000000..8c613ef4
--- /dev/null
+++ b/lib/proto/policy/namespaces/namespaces.pb.ts
@@ -0,0 +1,68 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+
+import * as CommonCommon from "../../common/common.pb"
+import * as fm from "../../fetch.pb"
+import * as PolicyObjects from "../objects.pb"
+export type GetNamespaceRequest = {
+  id?: string
+}
+
+export type GetNamespaceResponse = {
+  namespace?: PolicyObjects.Namespace
+}
+
+export type ListNamespacesRequest = {
+  state?: CommonCommon.ActiveStateEnum
+}
+
+export type ListNamespacesResponse = {
+  namespaces?: PolicyObjects.Namespace[]
+}
+
+export type CreateNamespaceRequest = {
+  name?: string
+  metadata?: CommonCommon.MetadataMutable
+}
+
+export type CreateNamespaceResponse = {
+  namespace?: PolicyObjects.Namespace
+}
+
+export type UpdateNamespaceRequest = {
+  id?: string
+  metadata?: CommonCommon.MetadataMutable
+  metadataUpdateBehavior?: CommonCommon.MetadataUpdateEnum
+}
+
+export type UpdateNamespaceResponse = {
+  namespace?: PolicyObjects.Namespace
+}
+
+export type DeactivateNamespaceRequest = {
+  id?: string
+}
+
+export type DeactivateNamespaceResponse = {
+}
+
+export class NamespaceService {
+  static GetNamespace(req: GetNamespaceRequest, initReq?: fm.InitReq): Promise<GetNamespaceResponse> {
+    return fm.fetchReq<GetNamespaceRequest, GetNamespaceResponse>(`/attributes/namespaces/${req["id"]}?${fm.renderURLSearchParams(req, ["id"])}`, {...initReq, method: "GET"})
+  }
+  static ListNamespaces(req: ListNamespacesRequest, initReq?: fm.InitReq): Promise<ListNamespacesResponse> {
+    return fm.fetchReq<ListNamespacesRequest, ListNamespacesResponse>(`/attributes/namespaces?${fm.renderURLSearchParams(req, [])}`, {...initReq, method: "GET"})
+  }
+  static CreateNamespace(req: CreateNamespaceRequest, initReq?: fm.InitReq): Promise<CreateNamespaceResponse> {
+    return fm.fetchReq<CreateNamespaceRequest, CreateNamespaceResponse>(`/attributes/namespaces`, {...initReq, method: "POST", body: JSON.stringify(req, fm.replacer)})
+  }
+  static UpdateNamespace(req: UpdateNamespaceRequest, initReq?: fm.InitReq): Promise<UpdateNamespaceResponse> {
+    return fm.fetchReq<UpdateNamespaceRequest, UpdateNamespaceResponse>(`/attributes/namespaces/${req["id"]}`, {...initReq, method: "PATCH", body: JSON.stringify(req, fm.replacer)})
+  }
+  static DeactivateNamespace(req: DeactivateNamespaceRequest, initReq?: fm.InitReq): Promise<DeactivateNamespaceResponse> {
+    return fm.fetchReq<DeactivateNamespaceRequest, DeactivateNamespaceResponse>(`/attributes/namespaces/${req["id"]}`, {...initReq, method: "DELETE"})
+  }
+}
\ No newline at end of file
diff --git a/lib/proto/policy/objects.pb.ts b/lib/proto/policy/objects.pb.ts
new file mode 100644
index 00000000..5382be08
--- /dev/null
+++ b/lib/proto/policy/objects.pb.ts
@@ -0,0 +1,136 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+
+import * as CommonCommon from "../common/common.pb"
+import * as GoogleProtobufWrappers from "../google/protobuf/wrappers.pb"
+
+type Absent<T, K extends keyof T> = { [k in Exclude<keyof T, K>]?: undefined };
+type OneOf<T> =
+  | { [k in keyof T]?: undefined }
+  | (
+    keyof T extends infer K ?
+      (K extends string & keyof T ? { [k in K]: T[K] } & Absent<T, K>
+        : never)
+    : never);
+
+export enum AttributeRuleTypeEnum {
+  ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED = "ATTRIBUTE_RULE_TYPE_ENUM_UNSPECIFIED",
+  ATTRIBUTE_RULE_TYPE_ENUM_ALL_OF = "ATTRIBUTE_RULE_TYPE_ENUM_ALL_OF",
+  ATTRIBUTE_RULE_TYPE_ENUM_ANY_OF = "ATTRIBUTE_RULE_TYPE_ENUM_ANY_OF",
+  ATTRIBUTE_RULE_TYPE_ENUM_HIERARCHY = "ATTRIBUTE_RULE_TYPE_ENUM_HIERARCHY",
+}
+
+export enum SubjectMappingOperatorEnum {
+  SUBJECT_MAPPING_OPERATOR_ENUM_UNSPECIFIED = "SUBJECT_MAPPING_OPERATOR_ENUM_UNSPECIFIED",
+  SUBJECT_MAPPING_OPERATOR_ENUM_IN = "SUBJECT_MAPPING_OPERATOR_ENUM_IN",
+  SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN = "SUBJECT_MAPPING_OPERATOR_ENUM_NOT_IN",
+}
+
+export enum ConditionBooleanTypeEnum {
+  CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED = "CONDITION_BOOLEAN_TYPE_ENUM_UNSPECIFIED",
+  CONDITION_BOOLEAN_TYPE_ENUM_AND = "CONDITION_BOOLEAN_TYPE_ENUM_AND",
+  CONDITION_BOOLEAN_TYPE_ENUM_OR = "CONDITION_BOOLEAN_TYPE_ENUM_OR",
+}
+
+export enum ActionStandardAction {
+  STANDARD_ACTION_UNSPECIFIED = "STANDARD_ACTION_UNSPECIFIED",
+  STANDARD_ACTION_DECRYPT = "STANDARD_ACTION_DECRYPT",
+  STANDARD_ACTION_TRANSMIT = "STANDARD_ACTION_TRANSMIT",
+}
+
+export type Namespace = {
+  id?: string
+  name?: string
+  fqn?: string
+  active?: GoogleProtobufWrappers.BoolValue
+  metadata?: CommonCommon.Metadata
+}
+
+export type Attribute = {
+  id?: string
+  namespace?: Namespace
+  name?: string
+  rule?: AttributeRuleTypeEnum
+  values?: Value[]
+  grants?: KeyAccessServer[]
+  fqn?: string
+  active?: GoogleProtobufWrappers.BoolValue
+  metadata?: CommonCommon.Metadata
+}
+
+export type Value = {
+  id?: string
+  attribute?: Attribute
+  value?: string
+  members?: Value[]
+  grants?: KeyAccessServer[]
+  fqn?: string
+  active?: GoogleProtobufWrappers.BoolValue
+  subjectMappings?: SubjectMapping[]
+  metadata?: CommonCommon.Metadata
+}
+
+
+type BaseAction = {
+}
+
+export type Action = BaseAction
+  & OneOf<{ standard: ActionStandardAction; custom: string }>
+
+export type SubjectMapping = {
+  id?: string
+  attributeValue?: Value
+  subjectConditionSet?: SubjectConditionSet
+  actions?: Action[]
+  metadata?: CommonCommon.Metadata
+}
+
+export type Condition = {
+  subjectExternalSelectorValue?: string
+  operator?: SubjectMappingOperatorEnum
+  subjectExternalValues?: string[]
+}
+
+export type ConditionGroup = {
+  conditions?: Condition[]
+  booleanOperator?: ConditionBooleanTypeEnum
+}
+
+export type SubjectSet = {
+  conditionGroups?: ConditionGroup[]
+}
+
+export type SubjectConditionSet = {
+  id?: string
+  subjectSets?: SubjectSet[]
+  metadata?: CommonCommon.Metadata
+}
+
+export type SubjectProperty = {
+  externalSelectorValue?: string
+  externalValue?: string
+}
+
+export type ResourceMapping = {
+  id?: string
+  metadata?: CommonCommon.Metadata
+  attributeValue?: Value
+  terms?: string[]
+}
+
+export type KeyAccessServer = {
+  id?: string
+  uri?: string
+  publicKey?: PublicKey
+  metadata?: CommonCommon.Metadata
+}
+
+
+type BasePublicKey = {
+}
+
+export type PublicKey = BasePublicKey
+  & OneOf<{ remote: string; local: string }>
\ No newline at end of file
diff --git a/lib/proto/policy/resourcemapping/resource_mapping.pb.ts b/lib/proto/policy/resourcemapping/resource_mapping.pb.ts
new file mode 100644
index 00000000..b9aa4fda
--- /dev/null
+++ b/lib/proto/policy/resourcemapping/resource_mapping.pb.ts
@@ -0,0 +1,71 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+
+import * as CommonCommon from "../../common/common.pb"
+import * as fm from "../../fetch.pb"
+import * as PolicyObjects from "../objects.pb"
+export type ListResourceMappingsRequest = {
+}
+
+export type ListResourceMappingsResponse = {
+  resourceMappings?: PolicyObjects.ResourceMapping[]
+}
+
+export type GetResourceMappingRequest = {
+  id?: string
+}
+
+export type GetResourceMappingResponse = {
+  resourceMapping?: PolicyObjects.ResourceMapping
+}
+
+export type CreateResourceMappingRequest = {
+  attributeValueId?: string
+  terms?: string[]
+  metadata?: CommonCommon.MetadataMutable
+}
+
+export type CreateResourceMappingResponse = {
+  resourceMapping?: PolicyObjects.ResourceMapping
+}
+
+export type UpdateResourceMappingRequest = {
+  id?: string
+  attributeValueId?: string
+  terms?: string[]
+  metadata?: CommonCommon.MetadataMutable
+  metadataUpdateBehavior?: CommonCommon.MetadataUpdateEnum
+}
+
+export type UpdateResourceMappingResponse = {
+  resourceMapping?: PolicyObjects.ResourceMapping
+}
+
+export type DeleteResourceMappingRequest = {
+  id?: string
+}
+
+export type DeleteResourceMappingResponse = {
+  resourceMapping?: PolicyObjects.ResourceMapping
+}
+
+export class ResourceMappingService {
+  static ListResourceMappings(req: ListResourceMappingsRequest, initReq?: fm.InitReq): Promise<ListResourceMappingsResponse> {
+    return fm.fetchReq<ListResourceMappingsRequest, ListResourceMappingsResponse>(`/resource-mappings?${fm.renderURLSearchParams(req, [])}`, {...initReq, method: "GET"})
+  }
+  static GetResourceMapping(req: GetResourceMappingRequest, initReq?: fm.InitReq): Promise<GetResourceMappingResponse> {
+    return fm.fetchReq<GetResourceMappingRequest, GetResourceMappingResponse>(`/resource-mappings/${req["id"]}?${fm.renderURLSearchParams(req, ["id"])}`, {...initReq, method: "GET"})
+  }
+  static CreateResourceMapping(req: CreateResourceMappingRequest, initReq?: fm.InitReq): Promise<CreateResourceMappingResponse> {
+    return fm.fetchReq<CreateResourceMappingRequest, CreateResourceMappingResponse>(`/resource-mappings`, {...initReq, method: "POST", body: JSON.stringify(req, fm.replacer)})
+  }
+  static UpdateResourceMapping(req: UpdateResourceMappingRequest, initReq?: fm.InitReq): Promise<UpdateResourceMappingResponse> {
+    return fm.fetchReq<UpdateResourceMappingRequest, UpdateResourceMappingResponse>(`/resource-mappings/${req["id"]}`, {...initReq, method: "POST", body: JSON.stringify(req, fm.replacer)})
+  }
+  static DeleteResourceMapping(req: DeleteResourceMappingRequest, initReq?: fm.InitReq): Promise<DeleteResourceMappingResponse> {
+    return fm.fetchReq<DeleteResourceMappingRequest, DeleteResourceMappingResponse>(`/resource-mappings/${req["id"]}`, {...initReq, method: "DELETE"})
+  }
+}
\ No newline at end of file
diff --git a/lib/proto/policy/selectors.pb.ts b/lib/proto/policy/selectors.pb.ts
new file mode 100644
index 00000000..9728603b
--- /dev/null
+++ b/lib/proto/policy/selectors.pb.ts
@@ -0,0 +1,49 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+export type AttributeNamespaceSelectorAttributeSelectorValueSelector = {
+  withKeyAccessGrants?: boolean
+  withSubjectMaps?: boolean
+  withResourceMaps?: boolean
+}
+
+export type AttributeNamespaceSelectorAttributeSelector = {
+  withKeyAccessGrants?: boolean
+  withValues?: AttributeNamespaceSelectorAttributeSelectorValueSelector
+}
+
+export type AttributeNamespaceSelector = {
+  withAttributes?: AttributeNamespaceSelectorAttributeSelector
+}
+
+export type AttributeDefinitionSelectorNamespaceSelector = {
+}
+
+export type AttributeDefinitionSelectorValueSelector = {
+  withKeyAccessGrants?: boolean
+  withSubjectMaps?: boolean
+  withResourceMaps?: boolean
+}
+
+export type AttributeDefinitionSelector = {
+  withKeyAccessGrants?: boolean
+  withNamespace?: AttributeDefinitionSelectorNamespaceSelector
+  withValues?: AttributeDefinitionSelectorValueSelector
+}
+
+export type AttributeValueSelectorAttributeSelectorNamespaceSelector = {
+}
+
+export type AttributeValueSelectorAttributeSelector = {
+  withKeyAccessGrants?: boolean
+  withNamespace?: AttributeValueSelectorAttributeSelectorNamespaceSelector
+}
+
+export type AttributeValueSelector = {
+  withKeyAccessGrants?: boolean
+  withSubjectMaps?: boolean
+  withResourceMaps?: boolean
+  withAttribute?: AttributeValueSelectorAttributeSelector
+}
\ No newline at end of file
diff --git a/lib/proto/policy/subjectmapping/subject_mapping.pb.ts b/lib/proto/policy/subjectmapping/subject_mapping.pb.ts
new file mode 100644
index 00000000..26d109c9
--- /dev/null
+++ b/lib/proto/policy/subjectmapping/subject_mapping.pb.ts
@@ -0,0 +1,147 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+
+import * as CommonCommon from "../../common/common.pb"
+import * as fm from "../../fetch.pb"
+import * as PolicyObjects from "../objects.pb"
+export type MatchSubjectMappingsRequest = {
+  subjectProperties?: PolicyObjects.SubjectProperty[]
+}
+
+export type MatchSubjectMappingsResponse = {
+  subjectMappings?: PolicyObjects.SubjectMapping[]
+}
+
+export type GetSubjectMappingRequest = {
+  id?: string
+}
+
+export type GetSubjectMappingResponse = {
+  subjectMapping?: PolicyObjects.SubjectMapping
+}
+
+export type ListSubjectMappingsRequest = {
+}
+
+export type ListSubjectMappingsResponse = {
+  subjectMappings?: PolicyObjects.SubjectMapping[]
+}
+
+export type CreateSubjectMappingRequest = {
+  attributeValueId?: string
+  actions?: PolicyObjects.Action[]
+  existingSubjectConditionSetId?: string
+  newSubjectConditionSet?: SubjectConditionSetCreate
+  metadata?: CommonCommon.MetadataMutable
+}
+
+export type CreateSubjectMappingResponse = {
+  subjectMapping?: PolicyObjects.SubjectMapping
+}
+
+export type UpdateSubjectMappingRequest = {
+  id?: string
+  subjectConditionSetId?: string
+  actions?: PolicyObjects.Action[]
+  metadata?: CommonCommon.MetadataMutable
+  metadataUpdateBehavior?: CommonCommon.MetadataUpdateEnum
+}
+
+export type UpdateSubjectMappingResponse = {
+  subjectMapping?: PolicyObjects.SubjectMapping
+}
+
+export type DeleteSubjectMappingRequest = {
+  id?: string
+}
+
+export type DeleteSubjectMappingResponse = {
+  subjectMapping?: PolicyObjects.SubjectMapping
+}
+
+export type GetSubjectConditionSetRequest = {
+  id?: string
+}
+
+export type GetSubjectConditionSetResponse = {
+  subjectConditionSet?: PolicyObjects.SubjectConditionSet
+  associatedSubjectMappings?: PolicyObjects.SubjectMapping[]
+}
+
+export type ListSubjectConditionSetsRequest = {
+}
+
+export type ListSubjectConditionSetsResponse = {
+  subjectConditionSets?: PolicyObjects.SubjectConditionSet[]
+}
+
+export type SubjectConditionSetCreate = {
+  subjectSets?: PolicyObjects.SubjectSet[]
+  metadata?: CommonCommon.MetadataMutable
+}
+
+export type CreateSubjectConditionSetRequest = {
+  subjectConditionSet?: SubjectConditionSetCreate
+}
+
+export type CreateSubjectConditionSetResponse = {
+  subjectConditionSet?: PolicyObjects.SubjectConditionSet
+}
+
+export type UpdateSubjectConditionSetRequest = {
+  id?: string
+  subjectSets?: PolicyObjects.SubjectSet[]
+  metadata?: CommonCommon.MetadataMutable
+  metadataUpdateBehavior?: CommonCommon.MetadataUpdateEnum
+}
+
+export type UpdateSubjectConditionSetResponse = {
+  subjectConditionSet?: PolicyObjects.SubjectConditionSet
+}
+
+export type DeleteSubjectConditionSetRequest = {
+  id?: string
+}
+
+export type DeleteSubjectConditionSetResponse = {
+  subjectConditionSet?: PolicyObjects.SubjectConditionSet
+}
+
+export class SubjectMappingService {
+  static MatchSubjectMappings(req: MatchSubjectMappingsRequest, initReq?: fm.InitReq): Promise<MatchSubjectMappingsResponse> {
+    return fm.fetchReq<MatchSubjectMappingsRequest, MatchSubjectMappingsResponse>(`/subject-mappings/match`, {...initReq, method: "POST", body: JSON.stringify(req["subject_properties"], fm.replacer)})
+  }
+  static ListSubjectMappings(req: ListSubjectMappingsRequest, initReq?: fm.InitReq): Promise<ListSubjectMappingsResponse> {
+    return fm.fetchReq<ListSubjectMappingsRequest, ListSubjectMappingsResponse>(`/subject-mappings?${fm.renderURLSearchParams(req, [])}`, {...initReq, method: "GET"})
+  }
+  static GetSubjectMapping(req: GetSubjectMappingRequest, initReq?: fm.InitReq): Promise<GetSubjectMappingResponse> {
+    return fm.fetchReq<GetSubjectMappingRequest, GetSubjectMappingResponse>(`/subject-mappings/${req["id"]}?${fm.renderURLSearchParams(req, ["id"])}`, {...initReq, method: "GET"})
+  }
+  static CreateSubjectMapping(req: CreateSubjectMappingRequest, initReq?: fm.InitReq): Promise<CreateSubjectMappingResponse> {
+    return fm.fetchReq<CreateSubjectMappingRequest, CreateSubjectMappingResponse>(`/subject-mappings`, {...initReq, method: "POST", body: JSON.stringify(req, fm.replacer)})
+  }
+  static UpdateSubjectMapping(req: UpdateSubjectMappingRequest, initReq?: fm.InitReq): Promise<UpdateSubjectMappingResponse> {
+    return fm.fetchReq<UpdateSubjectMappingRequest, UpdateSubjectMappingResponse>(`/subject-mappings/${req["id"]}`, {...initReq, method: "PATCH", body: JSON.stringify(req, fm.replacer)})
+  }
+  static DeleteSubjectMapping(req: DeleteSubjectMappingRequest, initReq?: fm.InitReq): Promise<DeleteSubjectMappingResponse> {
+    return fm.fetchReq<DeleteSubjectMappingRequest, DeleteSubjectMappingResponse>(`/subject-mappings/${req["id"]}`, {...initReq, method: "DELETE"})
+  }
+  static ListSubjectConditionSets(req: ListSubjectConditionSetsRequest, initReq?: fm.InitReq): Promise<ListSubjectConditionSetsResponse> {
+    return fm.fetchReq<ListSubjectConditionSetsRequest, ListSubjectConditionSetsResponse>(`/subject-condition-sets?${fm.renderURLSearchParams(req, [])}`, {...initReq, method: "GET"})
+  }
+  static GetSubjectConditionSet(req: GetSubjectConditionSetRequest, initReq?: fm.InitReq): Promise<GetSubjectConditionSetResponse> {
+    return fm.fetchReq<GetSubjectConditionSetRequest, GetSubjectConditionSetResponse>(`/subject-condition-sets/${req["id"]}?${fm.renderURLSearchParams(req, ["id"])}`, {...initReq, method: "GET"})
+  }
+  static CreateSubjectConditionSet(req: CreateSubjectConditionSetRequest, initReq?: fm.InitReq): Promise<CreateSubjectConditionSetResponse> {
+    return fm.fetchReq<CreateSubjectConditionSetRequest, CreateSubjectConditionSetResponse>(`/subject-condition-sets`, {...initReq, method: "POST", body: JSON.stringify(req, fm.replacer)})
+  }
+  static UpdateSubjectConditionSet(req: UpdateSubjectConditionSetRequest, initReq?: fm.InitReq): Promise<UpdateSubjectConditionSetResponse> {
+    return fm.fetchReq<UpdateSubjectConditionSetRequest, UpdateSubjectConditionSetResponse>(`/subject-condition-sets/${req["id"]}`, {...initReq, method: "PATCH", body: JSON.stringify(req, fm.replacer)})
+  }
+  static DeleteSubjectConditionSet(req: DeleteSubjectConditionSetRequest, initReq?: fm.InitReq): Promise<DeleteSubjectConditionSetResponse> {
+    return fm.fetchReq<DeleteSubjectConditionSetRequest, DeleteSubjectConditionSetResponse>(`/subject-condition-sets/${req["id"]}`, {...initReq, method: "DELETE"})
+  }
+}
\ No newline at end of file
diff --git a/lib/proto/wellknownconfiguration/wellknown_configuration.pb.ts b/lib/proto/wellknownconfiguration/wellknown_configuration.pb.ts
new file mode 100644
index 00000000..1b7e44d3
--- /dev/null
+++ b/lib/proto/wellknownconfiguration/wellknown_configuration.pb.ts
@@ -0,0 +1,24 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+
+import * as fm from "../fetch.pb"
+import * as GoogleProtobufStruct from "../google/protobuf/struct.pb"
+export type WellKnownConfig = {
+  configuration?: {[key: string]: GoogleProtobufStruct.Struct}
+}
+
+export type GetWellKnownConfigurationRequest = {
+}
+
+export type GetWellKnownConfigurationResponse = {
+  configuration?: GoogleProtobufStruct.Struct
+}
+
+export class WellKnownService {
+  static GetWellKnownConfiguration(req: GetWellKnownConfigurationRequest, initReq?: fm.InitReq): Promise<GetWellKnownConfigurationResponse> {
+    return fm.fetchReq<GetWellKnownConfigurationRequest, GetWellKnownConfigurationResponse>(`/.well-known/opentdf-configuration?${fm.renderURLSearchParams(req, [])}`, {...initReq, method: "GET"})
+  }
+}
\ No newline at end of file
diff --git a/remote-store/package-lock.json b/remote-store/package-lock.json
index 1a795b12..04a8e49d 100644
--- a/remote-store/package-lock.json
+++ b/remote-store/package-lock.json
@@ -1649,7 +1649,7 @@
     "node_modules/@opentdf/client": {
       "version": "2.0.0",
       "resolved": "file:../lib/opentdf-client-2.0.0.tgz",
-      "integrity": "sha512-o0Dhfj6sgBH7G/Fyov0m0oyZHLoWC7c7Fgarrbq5u/R+iODUzo4QHaOzmcBjTMG0rJhBjJTnLxWtNASoIhXbAQ==",
+      "integrity": "sha512-LqH1FK17EryhKS1Gg3EIe4+Tgk9fbQ7O040UllhVG8AO6lHjqCfffQN1pCxIVu1e0yMYslYdyIB2Hot/QHxNoA==",
       "license": "BSD-3-Clause-Clear",
       "dependencies": {
         "ajv": "^8.12.0",
diff --git a/web-app/package-lock.json b/web-app/package-lock.json
index 9ec0923d..211e59aa 100644
--- a/web-app/package-lock.json
+++ b/web-app/package-lock.json
@@ -602,7 +602,7 @@
     "node_modules/@opentdf/client": {
       "version": "2.0.0",
       "resolved": "file:../lib/opentdf-client-2.0.0.tgz",
-      "integrity": "sha512-o0Dhfj6sgBH7G/Fyov0m0oyZHLoWC7c7Fgarrbq5u/R+iODUzo4QHaOzmcBjTMG0rJhBjJTnLxWtNASoIhXbAQ==",
+      "integrity": "sha512-LqH1FK17EryhKS1Gg3EIe4+Tgk9fbQ7O040UllhVG8AO6lHjqCfffQN1pCxIVu1e0yMYslYdyIB2Hot/QHxNoA==",
       "license": "BSD-3-Clause-Clear",
       "dependencies": {
         "ajv": "^8.12.0",
@@ -4098,7 +4098,7 @@
     },
     "@opentdf/client": {
       "version": "file:../lib/opentdf-client-2.0.0.tgz",
-      "integrity": "sha512-o0Dhfj6sgBH7G/Fyov0m0oyZHLoWC7c7Fgarrbq5u/R+iODUzo4QHaOzmcBjTMG0rJhBjJTnLxWtNASoIhXbAQ==",
+      "integrity": "sha512-LqH1FK17EryhKS1Gg3EIe4+Tgk9fbQ7O040UllhVG8AO6lHjqCfffQN1pCxIVu1e0yMYslYdyIB2Hot/QHxNoA==",
       "requires": {
         "ajv": "^8.12.0",
         "axios": "^1.6.1",