Repository: googleapis/python-access-context-manager (language: python)

Issue:
Update protos in google/identity/accesscontextmanager/v1 
The protos in https://github.com/googleapis/python-access-context-manager/tree/main/google/identity/accesscontextmanager are out of date. They should be updating automatically using [owlbot.py](https://github.com/googleapis/python-access-context-manager/blob/main/owlbot.py) but the automation is not working as expected.

For example,
see https://github.com/googleapis/python-access-context-manager/blob/main/google/identity/accesscontextmanager/v1/service_perimeter.proto which hasn't been updated in 4 years whereas https://github.com/googleapis/googleapis/blob/master/google/identity/accesscontextmanager/v1/service_perimeter.proto has been updated in the last year.


Discussion / hints:

Fix patch:
diff --git a/google/identity/accesscontextmanager/type/device_resources.proto b/google/identity/accesscontextmanager/type/device_resources.proto
index f057910..a3f000c 100644
--- a/google/identity/accesscontextmanager/type/device_resources.proto
+++ b/google/identity/accesscontextmanager/type/device_resources.proto
@@ -16,10 +16,8 @@ syntax = "proto3";
 
 package google.identity.accesscontextmanager.type;
 
-import "google/api/annotations.proto";
-
 option csharp_namespace = "Google.Identity.AccessContextManager.Type";
-option go_package = "google.golang.org/genproto/googleapis/identity/accesscontextmanager/type;type";
+option go_package = "google.golang.org/genproto/googleapis/identity/accesscontextmanager/type";
 option java_package = "com.google.identity.accesscontextmanager.type";
 option java_multiple_files = true;
 option java_outer_classname = "TypeProto";
diff --git a/google/identity/accesscontextmanager/type/device_resources_pb2.py b/google/identity/accesscontextmanager/type/device_resources_pb2.py
index 82ff78a..cb48d1e 100644
--- a/google/identity/accesscontextmanager/type/device_resources_pb2.py
+++ b/google/identity/accesscontextmanager/type/device_resources_pb2.py
@@ -29,11 +29,8 @@
 _sym_db = _symbol_database.Default()
 
 
-from google.api import annotations_pb2 as google_dot_api_dot_annotations__pb2
-
-
 DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(
-    b"\n@google/identity/accesscontextmanager/type/device_resources.proto\x12)google.identity.accesscontextmanager.type\x1a\x1cgoogle/api/annotations.proto*p\n\x16\x44\x65viceEncryptionStatus\x12\x1a\n\x16\x45NCRYPTION_UNSPECIFIED\x10\x00\x12\x1a\n\x16\x45NCRYPTION_UNSUPPORTED\x10\x01\x12\x0f\n\x0bUNENCRYPTED\x10\x02\x12\r\n\tENCRYPTED\x10\x03*\x82\x01\n\x06OsType\x12\x12\n\x0eOS_UNSPECIFIED\x10\x00\x12\x0f\n\x0b\x44\x45SKTOP_MAC\x10\x01\x12\x13\n\x0f\x44\x45SKTOP_WINDOWS\x10\x02\x12\x11\n\rDESKTOP_LINUX\x10\x03\x12\x15\n\x11\x44\x45SKTOP_CHROME_OS\x10\x06\x12\x0b\n\x07\x41NDROID\x10\x04\x12\x07\n\x03IOS\x10\x05*V\n\x15\x44\x65viceManagementLevel\x12\x1a\n\x16MANAGEMENT_UNSPECIFIED\x10\x00\x12\x08\n\x04NONE\x10\x01\x12\t\n\x05\x42\x41SIC\x10\x02\x12\x0c\n\x08\x43OMPLETE\x10\x03\x42\x92\x02\n-com.google.identity.accesscontextmanager.typeB\tTypeProtoP\x01ZMgoogle.golang.org/genproto/googleapis/identity/accesscontextmanager/type;type\xaa\x02)Google.Identity.AccessContextManager.Type\xca\x02)Google\\Identity\\AccessContextManager\\Type\xea\x02,Google::Identity::AccessContextManager::Typeb\x06proto3"
+    b"\n@google/identity/accesscontextmanager/type/device_resources.proto\x12)google.identity.accesscontextmanager.type*p\n\x16\x44\x65viceEncryptionStatus\x12\x1a\n\x16\x45NCRYPTION_UNSPECIFIED\x10\x00\x12\x1a\n\x16\x45NCRYPTION_UNSUPPORTED\x10\x01\x12\x0f\n\x0bUNENCRYPTED\x10\x02\x12\r\n\tENCRYPTED\x10\x03*\x82\x01\n\x06OsType\x12\x12\n\x0eOS_UNSPECIFIED\x10\x00\x12\x0f\n\x0b\x44\x45SKTOP_MAC\x10\x01\x12\x13\n\x0f\x44\x45SKTOP_WINDOWS\x10\x02\x12\x11\n\rDESKTOP_LINUX\x10\x03\x12\x15\n\x11\x44\x45SKTOP_CHROME_OS\x10\x06\x12\x0b\n\x07\x41NDROID\x10\x04\x12\x07\n\x03IOS\x10\x05*V\n\x15\x44\x65viceManagementLevel\x12\x1a\n\x16MANAGEMENT_UNSPECIFIED\x10\x00\x12\x08\n\x04NONE\x10\x01\x12\t\n\x05\x42\x41SIC\x10\x02\x12\x0c\n\x08\x43OMPLETE\x10\x03\x42\x8d\x02\n-com.google.identity.accesscontextmanager.typeB\tTypeProtoP\x01ZHgoogle.golang.org/genproto/googleapis/identity/accesscontextmanager/type\xaa\x02)Google.Identity.AccessContextManager.Type\xca\x02)Google\\Identity\\AccessContextManager\\Type\xea\x02,Google::Identity::AccessContextManager::Typeb\x06proto3"
 )
 
 _DEVICEENCRYPTIONSTATUS = DESCRIPTOR.enum_types_by_name["DeviceEncryptionStatus"]
@@ -62,11 +59,11 @@
 if _descriptor._USE_C_DESCRIPTORS == False:
 
     DESCRIPTOR._options = None
-    DESCRIPTOR._serialized_options = b"\n-com.google.identity.accesscontextmanager.typeB\tTypeProtoP\001ZMgoogle.golang.org/genproto/googleapis/identity/accesscontextmanager/type;type\252\002)Google.Identity.AccessContextManager.Type\312\002)Google\\Identity\\AccessContextManager\\Type\352\002,Google::Identity::AccessContextManager::Type"
-    _DEVICEENCRYPTIONSTATUS._serialized_start = 141
-    _DEVICEENCRYPTIONSTATUS._serialized_end = 253
-    _OSTYPE._serialized_start = 256
-    _OSTYPE._serialized_end = 386
-    _DEVICEMANAGEMENTLEVEL._serialized_start = 388
-    _DEVICEMANAGEMENTLEVEL._serialized_end = 474
+    DESCRIPTOR._serialized_options = b"\n-com.google.identity.accesscontextmanager.typeB\tTypeProtoP\001ZHgoogle.golang.org/genproto/googleapis/identity/accesscontextmanager/type\252\002)Google.Identity.AccessContextManager.Type\312\002)Google\\Identity\\AccessContextManager\\Type\352\002,Google::Identity::AccessContextManager::Type"
+    _DEVICEENCRYPTIONSTATUS._serialized_start = 111
+    _DEVICEENCRYPTIONSTATUS._serialized_end = 223
+    _OSTYPE._serialized_start = 226
+    _OSTYPE._serialized_end = 356
+    _DEVICEMANAGEMENTLEVEL._serialized_start = 358
+    _DEVICEMANAGEMENTLEVEL._serialized_end = 444
 # @@protoc_insertion_point(module_scope)
diff --git a/google/identity/accesscontextmanager/v1/access_context_manager.proto b/google/identity/accesscontextmanager/v1/access_context_manager.proto
new file mode 100644
index 0000000..c2ea610
--- /dev/null
+++ b/google/identity/accesscontextmanager/v1/access_context_manager.proto
@@ -0,0 +1,986 @@
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.identity.accesscontextmanager.v1;
+
+import "google/api/annotations.proto";
+import "google/api/client.proto";
+import "google/api/field_behavior.proto";
+import "google/api/resource.proto";
+import "google/iam/v1/iam_policy.proto";
+import "google/iam/v1/policy.proto";
+import "google/identity/accesscontextmanager/v1/access_level.proto";
+import "google/identity/accesscontextmanager/v1/access_policy.proto";
+import "google/identity/accesscontextmanager/v1/gcp_user_access_binding.proto";
+import "google/identity/accesscontextmanager/v1/service_perimeter.proto";
+import "google/longrunning/operations.proto";
+import "google/protobuf/field_mask.proto";
+
+option csharp_namespace = "Google.Identity.AccessContextManager.V1";
+option go_package = "cloud.google.com/go/accesscontextmanager/apiv1/accesscontextmanagerpb;accesscontextmanagerpb";
+option java_multiple_files = true;
+option java_outer_classname = "AccessContextManagerProto";
+option java_package = "com.google.identity.accesscontextmanager.v1";
+option objc_class_prefix = "GACM";
+option php_namespace = "Google\\Identity\\AccessContextManager\\V1";
+option ruby_package = "Google::Identity::AccessContextManager::V1";
+
+// API for setting [access levels]
+// [google.identity.accesscontextmanager.v1.AccessLevel] and [service
+// perimeters] [google.identity.accesscontextmanager.v1.ServicePerimeter]
+// for Google Cloud projects. Each organization has one [access policy]
+// [google.identity.accesscontextmanager.v1.AccessPolicy] that contains the
+// [access levels] [google.identity.accesscontextmanager.v1.AccessLevel]
+// and [service perimeters]
+// [google.identity.accesscontextmanager.v1.ServicePerimeter]. This
+// [access policy] [google.identity.accesscontextmanager.v1.AccessPolicy] is
+// applicable to all resources in the organization.
+// AccessPolicies
+service AccessContextManager {
+  option (google.api.default_host) = "accesscontextmanager.googleapis.com";
+  option (google.api.oauth_scopes) = "https://www.googleapis.com/auth/cloud-platform";
+
+  // Lists all [access policies]
+  // [google.identity.accesscontextmanager.v1.AccessPolicy] in an
+  // organization.
+  rpc ListAccessPolicies(ListAccessPoliciesRequest) returns (ListAccessPoliciesResponse) {
+    option (google.api.http) = {
+      get: "/v1/accessPolicies"
+    };
+  }
+
+  // Returns an [access policy]
+  // [google.identity.accesscontextmanager.v1.AccessPolicy] based on the name.
+  rpc GetAccessPolicy(GetAccessPolicyRequest) returns (AccessPolicy) {
+    option (google.api.http) = {
+      get: "/v1/{name=accessPolicies/*}"
+    };
+    option (google.api.method_signature) = "name";
+  }
+
+  // Creates an access policy. This method fails if the organization already has
+  // an access policy. The long-running operation has a successful status
+  // after the access policy propagates to long-lasting storage.
+  // Syntactic and basic semantic errors are returned in `metadata` as a
+  // BadRequest proto.
+  rpc CreateAccessPolicy(AccessPolicy) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      post: "/v1/accessPolicies"
+      body: "*"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "AccessPolicy"
+      metadata_type: "AccessContextManagerOperationMetadata"
+    };
+  }
+
+  // Updates an [access policy]
+  // [google.identity.accesscontextmanager.v1.AccessPolicy]. The
+  // long-running operation from this RPC has a successful status after the
+  // changes to the [access policy]
+  // [google.identity.accesscontextmanager.v1.AccessPolicy] propagate
+  // to long-lasting storage.
+  rpc UpdateAccessPolicy(UpdateAccessPolicyRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      patch: "/v1/{policy.name=accessPolicies/*}"
+      body: "policy"
+    };
+    option (google.api.method_signature) = "policy,update_mask";
+    option (google.longrunning.operation_info) = {
+      response_type: "AccessPolicy"
+      metadata_type: "AccessContextManagerOperationMetadata"
+    };
+  }
+
+  // Deletes an [access policy]
+  // [google.identity.accesscontextmanager.v1.AccessPolicy] based on the
+  // resource name. The long-running operation has a successful status after the
+  // [access policy] [google.identity.accesscontextmanager.v1.AccessPolicy]
+  // is removed from long-lasting storage.
+  rpc DeleteAccessPolicy(DeleteAccessPolicyRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      delete: "/v1/{name=accessPolicies/*}"
+    };
+    option (google.api.method_signature) = "name";
+    option (google.longrunning.operation_info) = {
+      response_type: "google.protobuf.Empty"
+      metadata_type: "AccessContextManagerOperationMetadata"
+    };
+  }
+
+  // Lists all [access levels]
+  // [google.identity.accesscontextmanager.v1.AccessLevel] for an access
+  // policy.
+  rpc ListAccessLevels(ListAccessLevelsRequest) returns (ListAccessLevelsResponse) {
+    option (google.api.http) = {
+      get: "/v1/{parent=accessPolicies/*}/accessLevels"
+    };
+    option (google.api.method_signature) = "parent";
+  }
+
+  // Gets an [access level]
+  // [google.identity.accesscontextmanager.v1.AccessLevel] based on the resource
+  // name.
+  rpc GetAccessLevel(GetAccessLevelRequest) returns (AccessLevel) {
+    option (google.api.http) = {
+      get: "/v1/{name=accessPolicies/*/accessLevels/*}"
+    };
+    option (google.api.method_signature) = "name";
+  }
+
+  // Creates an [access level]
+  // [google.identity.accesscontextmanager.v1.AccessLevel]. The long-running
+  // operation from this RPC has a successful status after the [access
+  // level] [google.identity.accesscontextmanager.v1.AccessLevel]
+  // propagates to long-lasting storage. If [access levels]
+  // [google.identity.accesscontextmanager.v1.AccessLevel] contain
+  // errors, an error response is returned for the first error encountered.
+  rpc CreateAccessLevel(CreateAccessLevelRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      post: "/v1/{parent=accessPolicies/*}/accessLevels"
+      body: "access_level"
+    };
+    option (google.api.method_signature) = "parent,access_level";
+    option (google.longrunning.operation_info) = {
+      response_type: "AccessLevel"
+      metadata_type: "AccessContextManagerOperationMetadata"
+    };
+  }
+
+  // Updates an [access level]
+  // [google.identity.accesscontextmanager.v1.AccessLevel]. The long-running
+  // operation from this RPC has a successful status after the changes to
+  // the [access level]
+  // [google.identity.accesscontextmanager.v1.AccessLevel] propagate
+  // to long-lasting storage. If [access levels]
+  // [google.identity.accesscontextmanager.v1.AccessLevel] contain
+  // errors, an error response is returned for the first error encountered.
+  rpc UpdateAccessLevel(UpdateAccessLevelRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      patch: "/v1/{access_level.name=accessPolicies/*/accessLevels/*}"
+      body: "access_level"
+    };
+    option (google.api.method_signature) = "access_level,update_mask";
+    option (google.longrunning.operation_info) = {
+      response_type: "AccessLevel"
+      metadata_type: "AccessContextManagerOperationMetadata"
+    };
+  }
+
+  // Deletes an [access level]
+  // [google.identity.accesscontextmanager.v1.AccessLevel] based on the resource
+  // name. The long-running operation from this RPC has a successful status
+  // after the [access level]
+  // [google.identity.accesscontextmanager.v1.AccessLevel] has been removed
+  // from long-lasting storage.
+  rpc DeleteAccessLevel(DeleteAccessLevelRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      delete: "/v1/{name=accessPolicies/*/accessLevels/*}"
+    };
+    option (google.api.method_signature) = "name";
+    option (google.longrunning.operation_info) = {
+      response_type: "google.protobuf.Empty"
+      metadata_type: "AccessContextManagerOperationMetadata"
+    };
+  }
+
+  // Replaces all existing [access levels]
+  // [google.identity.accesscontextmanager.v1.AccessLevel] in an [access
+  // policy] [google.identity.accesscontextmanager.v1.AccessPolicy] with
+  // the [access levels]
+  // [google.identity.accesscontextmanager.v1.AccessLevel] provided. This
+  // is done atomically. The long-running operation from this RPC has a
+  // successful status after all replacements propagate to long-lasting
+  // storage. If the replacement contains errors, an error response is returned
+  // for the first error encountered.  Upon error, the replacement is cancelled,
+  // and existing [access levels]
+  // [google.identity.accesscontextmanager.v1.AccessLevel] are not
+  // affected. The Operation.response field contains
+  // ReplaceAccessLevelsResponse. Removing [access levels]
+  // [google.identity.accesscontextmanager.v1.AccessLevel] contained in existing
+  // [service perimeters]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] result in an
+  // error.
+  rpc ReplaceAccessLevels(ReplaceAccessLevelsRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      post: "/v1/{parent=accessPolicies/*}/accessLevels:replaceAll"
+      body: "*"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "ReplaceAccessLevelsResponse"
+      metadata_type: "AccessContextManagerOperationMetadata"
+    };
+  }
+
+  // Lists all [service perimeters]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] for an
+  // access policy.
+  rpc ListServicePerimeters(ListServicePerimetersRequest) returns (ListServicePerimetersResponse) {
+    option (google.api.http) = {
+      get: "/v1/{parent=accessPolicies/*}/servicePerimeters"
+    };
+    option (google.api.method_signature) = "parent";
+  }
+
+  // Gets a [service perimeter]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] based on the
+  // resource name.
+  rpc GetServicePerimeter(GetServicePerimeterRequest) returns (ServicePerimeter) {
+    option (google.api.http) = {
+      get: "/v1/{name=accessPolicies/*/servicePerimeters/*}"
+    };
+    option (google.api.method_signature) = "name";
+  }
+
+  // Creates a [service perimeter]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter]. The
+  // long-running operation from this RPC has a successful status after the
+  // [service perimeter]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter]
+  // propagates to long-lasting storage. If a [service perimeter]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] contains
+  // errors, an error response is returned for the first error encountered.
+  rpc CreateServicePerimeter(CreateServicePerimeterRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      post: "/v1/{parent=accessPolicies/*}/servicePerimeters"
+      body: "service_perimeter"
+    };
+    option (google.api.method_signature) = "parent,service_perimeter";
+    option (google.longrunning.operation_info) = {
+      response_type: "ServicePerimeter"
+      metadata_type: "AccessContextManagerOperationMetadata"
+    };
+  }
+
+  // Updates a [service perimeter]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter]. The
+  // long-running operation from this RPC has a successful status after the
+  // [service perimeter]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter]
+  // propagates to long-lasting storage. If a [service perimeter]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] contains
+  // errors, an error response is returned for the first error encountered.
+  rpc UpdateServicePerimeter(UpdateServicePerimeterRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      patch: "/v1/{service_perimeter.name=accessPolicies/*/servicePerimeters/*}"
+      body: "service_perimeter"
+    };
+    option (google.api.method_signature) = "service_perimeter,update_mask";
+    option (google.longrunning.operation_info) = {
+      response_type: "ServicePerimeter"
+      metadata_type: "AccessContextManagerOperationMetadata"
+    };
+  }
+
+  // Deletes a [service perimeter]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] based on the
+  // resource name. The long-running operation from this RPC has a successful
+  // status after the [service perimeter]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] is removed from
+  // long-lasting storage.
+  rpc DeleteServicePerimeter(DeleteServicePerimeterRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      delete: "/v1/{name=accessPolicies/*/servicePerimeters/*}"
+    };
+    option (google.api.method_signature) = "name";
+    option (google.longrunning.operation_info) = {
+      response_type: "google.protobuf.Empty"
+      metadata_type: "AccessContextManagerOperationMetadata"
+    };
+  }
+
+  // Replace all existing [service perimeters]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] in an [access
+  // policy] [google.identity.accesscontextmanager.v1.AccessPolicy] with the
+  // [service perimeters]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] provided. This
+  // is done atomically. The long-running operation from this RPC has a
+  // successful status after all replacements propagate to long-lasting storage.
+  // Replacements containing errors result in an error response for the first
+  // error encountered. Upon an error, replacement are cancelled and existing
+  // [service perimeters]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] are not
+  // affected. The Operation.response field contains
+  // ReplaceServicePerimetersResponse.
+  rpc ReplaceServicePerimeters(ReplaceServicePerimetersRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      post: "/v1/{parent=accessPolicies/*}/servicePerimeters:replaceAll"
+      body: "*"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "ReplaceServicePerimetersResponse"
+      metadata_type: "AccessContextManagerOperationMetadata"
+    };
+  }
+
+  // Commits the dry-run specification for all the [service perimeters]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] in an
+  // [access policy][google.identity.accesscontextmanager.v1.AccessPolicy].
+  // A commit operation on a service perimeter involves copying its `spec` field
+  // to the `status` field of the service perimeter. Only [service perimeters]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] with
+  // `use_explicit_dry_run_spec` field set to true are affected by a commit
+  // operation. The long-running operation from this RPC has a successful
+  // status after the dry-run specifications for all the [service perimeters]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] have been
+  // committed. If a commit fails, it causes the long-running operation to
+  // return an error response and the entire commit operation is cancelled.
+  // When successful, the Operation.response field contains
+  // CommitServicePerimetersResponse. The `dry_run` and the `spec` fields are
+  // cleared after a successful commit operation.
+  rpc CommitServicePerimeters(CommitServicePerimetersRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      post: "/v1/{parent=accessPolicies/*}/servicePerimeters:commit"
+      body: "*"
+    };
+    option (google.longrunning.operation_info) = {
+      response_type: "CommitServicePerimetersResponse"
+      metadata_type: "AccessContextManagerOperationMetadata"
+    };
+  }
+
+  // Lists all [GcpUserAccessBindings]
+  // [google.identity.accesscontextmanager.v1.GcpUserAccessBinding] for a
+  // Google Cloud organization.
+  rpc ListGcpUserAccessBindings(ListGcpUserAccessBindingsRequest) returns (ListGcpUserAccessBindingsResponse) {
+    option (google.api.http) = {
+      get: "/v1/{parent=organizations/*}/gcpUserAccessBindings"
+    };
+    option (google.api.method_signature) = "parent";
+  }
+
+  // Gets the [GcpUserAccessBinding]
+  // [google.identity.accesscontextmanager.v1.GcpUserAccessBinding] with
+  // the given name.
+  rpc GetGcpUserAccessBinding(GetGcpUserAccessBindingRequest) returns (GcpUserAccessBinding) {
+    option (google.api.http) = {
+      get: "/v1/{name=organizations/*/gcpUserAccessBindings/*}"
+    };
+    option (google.api.method_signature) = "name";
+  }
+
+  // Creates a [GcpUserAccessBinding]
+  // [google.identity.accesscontextmanager.v1.GcpUserAccessBinding]. If the
+  // client specifies a [name]
+  // [google.identity.accesscontextmanager.v1.GcpUserAccessBinding.name],
+  // the server ignores it. Fails if a resource already exists with the same
+  // [group_key]
+  // [google.identity.accesscontextmanager.v1.GcpUserAccessBinding.group_key].
+  // Completion of this long-running operation does not necessarily signify that
+  // the new binding is deployed onto all affected users, which may take more
+  // time.
+  rpc CreateGcpUserAccessBinding(CreateGcpUserAccessBindingRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      post: "/v1/{parent=organizations/*}/gcpUserAccessBindings"
+      body: "gcp_user_access_binding"
+    };
+    option (google.api.method_signature) = "parent,gcp_user_access_binding";
+    option (google.longrunning.operation_info) = {
+      response_type: "GcpUserAccessBinding"
+      metadata_type: "GcpUserAccessBindingOperationMetadata"
+    };
+  }
+
+  // Updates a [GcpUserAccessBinding]
+  // [google.identity.accesscontextmanager.v1.GcpUserAccessBinding].
+  // Completion of this long-running operation does not necessarily signify that
+  // the changed binding is deployed onto all affected users, which may take
+  // more time.
+  rpc UpdateGcpUserAccessBinding(UpdateGcpUserAccessBindingRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      patch: "/v1/{gcp_user_access_binding.name=organizations/*/gcpUserAccessBindings/*}"
+      body: "gcp_user_access_binding"
+    };
+    option (google.api.method_signature) = "gcp_user_access_binding,update_mask";
+    option (google.longrunning.operation_info) = {
+      response_type: "GcpUserAccessBinding"
+      metadata_type: "GcpUserAccessBindingOperationMetadata"
+    };
+  }
+
+  // Deletes a [GcpUserAccessBinding]
+  // [google.identity.accesscontextmanager.v1.GcpUserAccessBinding].
+  // Completion of this long-running operation does not necessarily signify that
+  // the binding deletion is deployed onto all affected users, which may take
+  // more time.
+  rpc DeleteGcpUserAccessBinding(DeleteGcpUserAccessBindingRequest) returns (google.longrunning.Operation) {
+    option (google.api.http) = {
+      delete: "/v1/{name=organizations/*/gcpUserAccessBindings/*}"
+    };
+    option (google.api.method_signature) = "name";
+    option (google.longrunning.operation_info) = {
+      response_type: "google.protobuf.Empty"
+      metadata_type: "GcpUserAccessBindingOperationMetadata"
+    };
+  }
+
+  // Sets the IAM policy for the specified Access Context Manager
+  // [access policy][google.identity.accesscontextmanager.v1.AccessPolicy].
+  // This method replaces the existing IAM policy on the access policy. The IAM
+  // policy controls the set of users who can perform specific operations on the
+  // Access Context Manager [access
+  // policy][google.identity.accesscontextmanager.v1.AccessPolicy].
+  rpc SetIamPolicy(google.iam.v1.SetIamPolicyRequest) returns (google.iam.v1.Policy) {
+    option (google.api.http) = {
+      post: "/v1/{resource=accessPolicies/*}:setIamPolicy"
+      body: "*"
+    };
+  }
+
+  // Gets the IAM policy for the specified Access Context Manager
+  // [access policy][google.identity.accesscontextmanager.v1.AccessPolicy].
+  rpc GetIamPolicy(google.iam.v1.GetIamPolicyRequest) returns (google.iam.v1.Policy) {
+    option (google.api.http) = {
+      post: "/v1/{resource=accessPolicies/*}:getIamPolicy"
+      body: "*"
+    };
+  }
+
+  // Returns the IAM permissions that the caller has on the specified Access
+  // Context Manager resource. The resource can be an
+  // [AccessPolicy][google.identity.accesscontextmanager.v1.AccessPolicy],
+  // [AccessLevel][google.identity.accesscontextmanager.v1.AccessLevel], or
+  // [ServicePerimeter][google.identity.accesscontextmanager.v1.ServicePerimeter
+  // ]. This method does not support other resources.
+  rpc TestIamPermissions(google.iam.v1.TestIamPermissionsRequest) returns (google.iam.v1.TestIamPermissionsResponse) {
+    option (google.api.http) = {
+      post: "/v1/{resource=accessPolicies/*}:testIamPermissions"
+      body: "*"
+      additional_bindings {
+        post: "/v1/{resource=accessPolicies/*/accessLevels/*}:testIamPermissions"
+        body: "*"
+      }
+      additional_bindings {
+        post: "/v1/{resource=accessPolicies/*/servicePerimeters/*}:testIamPermissions"
+        body: "*"
+      }
+    };
+  }
+}
+
+// A request to list all `AccessPolicies` for a container.
+message ListAccessPoliciesRequest {
+  // Required. Resource name for the container to list AccessPolicy instances
+  // from.
+  //
+  // Format:
+  // `organizations/{org_id}`
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "cloudresourcemanager.googleapis.com/Organization"
+    }
+  ];
+
+  // Number of AccessPolicy instances to include in the list. Default 100.
+  int32 page_size = 2;
+
+  // Next page token for the next batch of AccessPolicy instances. Defaults to
+  // the first page of results.
+  string page_token = 3;
+}
+
+// A response to `ListAccessPoliciesRequest`.
+message ListAccessPoliciesResponse {
+  // List of the AccessPolicy instances.
+  repeated AccessPolicy access_policies = 1;
+
+  // The pagination token to retrieve the next page of results. If the value is
+  // empty, no further results remain.
+  string next_page_token = 2;
+}
+
+// A request to get a particular `AccessPolicy`.
+message GetAccessPolicyRequest {
+  // Required. Resource name for the access policy to get.
+  //
+  // Format `accessPolicies/{policy_id}`
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "accesscontextmanager.googleapis.com/AccessPolicy"
+    }
+  ];
+}
+
+// A request to update an `AccessPolicy`.
+message UpdateAccessPolicyRequest {
+  // Required. The updated AccessPolicy.
+  AccessPolicy policy = 1 [(google.api.field_behavior) = REQUIRED];
+
+  // Required. Mask to control which fields get updated. Must be non-empty.
+  google.protobuf.FieldMask update_mask = 2 [(google.api.field_behavior) = REQUIRED];
+}
+
+// A request to delete an `AccessPolicy`.
+message DeleteAccessPolicyRequest {
+  // Required. Resource name for the access policy to delete.
+  //
+  // Format `accessPolicies/{policy_id}`
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "accesscontextmanager.googleapis.com/AccessPolicy"
+    }
+  ];
+}
+
+// A request to list all `AccessLevels` in an `AccessPolicy`.
+message ListAccessLevelsRequest {
+  // Required. Resource name for the access policy to list [Access Levels]
+  // [google.identity.accesscontextmanager.v1.AccessLevel] from.
+  //
+  // Format:
+  // `accessPolicies/{policy_id}`
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      child_type: "accesscontextmanager.googleapis.com/AccessLevel"
+    }
+  ];
+
+  // Number of [Access Levels]
+  // [google.identity.accesscontextmanager.v1.AccessLevel] to include in
+  // the list. Default 100.
+  int32 page_size = 2;
+
+  // Next page token for the next batch of [Access Level]
+  // [google.identity.accesscontextmanager.v1.AccessLevel] instances.
+  // Defaults to the first page of results.
+  string page_token = 3;
+
+  // Whether to return `BasicLevels` in the Cloud Common Expression language, as
+  // `CustomLevels`, rather than as `BasicLevels`. Defaults to returning
+  // `AccessLevels` in the format they were defined.
+  LevelFormat access_level_format = 4;
+}
+
+// A response to `ListAccessLevelsRequest`.
+message ListAccessLevelsResponse {
+  // List of the [Access Level]
+  // [google.identity.accesscontextmanager.v1.AccessLevel] instances.
+  repeated AccessLevel access_levels = 1;
+
+  // The pagination token to retrieve the next page of results. If the value is
+  // empty, no further results remain.
+  string next_page_token = 2;
+}
+
+// A request to get a particular `AccessLevel`.
+message GetAccessLevelRequest {
+  // Required. Resource name for the [Access Level]
+  // [google.identity.accesscontextmanager.v1.AccessLevel].
+  //
+  // Format:
+  // `accessPolicies/{policy_id}/accessLevels/{access_level_id}`
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "accesscontextmanager.googleapis.com/AccessLevel"
+    }
+  ];
+
+  // Whether to return `BasicLevels` in the Cloud Common Expression
+  // Language rather than as `BasicLevels`. Defaults to AS_DEFINED, where
+  // [Access Levels] [google.identity.accesscontextmanager.v1.AccessLevel]
+  // are returned as `BasicLevels` or `CustomLevels` based on how they were
+  // created. If set to CEL, all [Access Levels]
+  // [google.identity.accesscontextmanager.v1.AccessLevel] are returned as
+  // `CustomLevels`. In the CEL case, `BasicLevels` are translated to equivalent
+  // `CustomLevels`.
+  LevelFormat access_level_format = 2;
+}
+
+// A request to create an `AccessLevel`.
+message CreateAccessLevelRequest {
+  // Required. Resource name for the access policy which owns this [Access
+  // Level] [google.identity.accesscontextmanager.v1.AccessLevel].
+  //
+  // Format: `accessPolicies/{policy_id}`
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      child_type: "accesscontextmanager.googleapis.com/AccessLevel"
+    }
+  ];
+
+  // Required. The [Access Level]
+  // [google.identity.accesscontextmanager.v1.AccessLevel] to create.
+  // Syntactic correctness of the [Access Level]
+  // [google.identity.accesscontextmanager.v1.AccessLevel] is a
+  // precondition for creation.
+  AccessLevel access_level = 2 [(google.api.field_behavior) = REQUIRED];
+}
+
+// A request to update an `AccessLevel`.
+message UpdateAccessLevelRequest {
+  // Required. The updated [Access Level]
+  // [google.identity.accesscontextmanager.v1.AccessLevel]. Syntactic
+  // correctness of the [Access Level]
+  // [google.identity.accesscontextmanager.v1.AccessLevel] is a
+  // precondition for creation.
+  AccessLevel access_level = 1 [(google.api.field_behavior) = REQUIRED];
+
+  // Required. Mask to control which fields get updated. Must be non-empty.
+  google.protobuf.FieldMask update_mask = 2 [(google.api.field_behavior) = REQUIRED];
+}
+
+// A request to delete an `AccessLevel`.
+message DeleteAccessLevelRequest {
+  // Required. Resource name for the [Access Level]
+  // [google.identity.accesscontextmanager.v1.AccessLevel].
+  //
+  // Format:
+  // `accessPolicies/{policy_id}/accessLevels/{access_level_id}`
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "accesscontextmanager.googleapis.com/AccessLevel"
+    }
+  ];
+}
+
+// A request to replace all existing Access Levels in an Access Policy with
+// the Access Levels provided. This is done atomically.
+message ReplaceAccessLevelsRequest {
+  // Required. Resource name for the access policy which owns these
+  // [Access Levels]
+  // [google.identity.accesscontextmanager.v1.AccessLevel].
+  //
+  // Format: `accessPolicies/{policy_id}`
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      child_type: "accesscontextmanager.googleapis.com/AccessLevel"
+    }
+  ];
+
+  // Required. The desired [Access Levels]
+  // [google.identity.accesscontextmanager.v1.AccessLevel] that should
+  // replace all existing [Access Levels]
+  // [google.identity.accesscontextmanager.v1.AccessLevel] in the
+  // [Access Policy]
+  // [google.identity.accesscontextmanager.v1.AccessPolicy].
+  repeated AccessLevel access_levels = 2 [(google.api.field_behavior) = REQUIRED];
+
+  // Optional. The etag for the version of the [Access Policy]
+  // [google.identity.accesscontextmanager.v1.AccessPolicy] that this
+  // replace operation is to be performed on. If, at the time of replace, the
+  // etag for the Access Policy stored in Access Context Manager is different
+  // from the specified etag, then the replace operation will not be performed
+  // and the call will fail. This field is not required. If etag is not
+  // provided, the operation will be performed as if a valid etag is provided.
+  string etag = 4;
+}
+
+// A response to ReplaceAccessLevelsRequest. This will be put inside of
+// Operation.response field.
+message ReplaceAccessLevelsResponse {
+  // List of the [Access Level]
+  // [google.identity.accesscontextmanager.v1.AccessLevel] instances.
+  repeated AccessLevel access_levels = 1;
+}
+
+// A request to list all `ServicePerimeters` in an `AccessPolicy`.
+message ListServicePerimetersRequest {
+  // Required. Resource name for the access policy to list [Service Perimeters]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] from.
+  //
+  // Format:
+  // `accessPolicies/{policy_id}`
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      child_type: "accesscontextmanager.googleapis.com/ServicePerimeter"
+    }
+  ];
+
+  // Number of [Service Perimeters]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] to include
+  // in the list. Default 100.
+  int32 page_size = 2;
+
+  // Next page token for the next batch of [Service Perimeter]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] instances.
+  // Defaults to the first page of results.
+  string page_token = 3;
+}
+
+// A response to `ListServicePerimetersRequest`.
+message ListServicePerimetersResponse {
+  // List of the [Service Perimeter]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] instances.
+  repeated ServicePerimeter service_perimeters = 1;
+
+  // The pagination token to retrieve the next page of results. If the value is
+  // empty, no further results remain.
+  string next_page_token = 2;
+}
+
+// A request to get a particular `ServicePerimeter`.
+message GetServicePerimeterRequest {
+  // Required. Resource name for the [Service Perimeter]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter].
+  //
+  // Format:
+  // `accessPolicies/{policy_id}/servicePerimeters/{service_perimeters_id}`
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "accesscontextmanager.googleapis.com/ServicePerimeter"
+    }
+  ];
+}
+
+// A request to create a `ServicePerimeter`.
+message CreateServicePerimeterRequest {
+  // Required. Resource name for the access policy which owns this [Service
+  // Perimeter] [google.identity.accesscontextmanager.v1.ServicePerimeter].
+  //
+  // Format: `accessPolicies/{policy_id}`
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      child_type: "accesscontextmanager.googleapis.com/ServicePerimeter"
+    }
+  ];
+
+  // Required. The [Service Perimeter]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] to create.
+  // Syntactic correctness of the [Service Perimeter]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] is a
+  // precondition for creation.
+  ServicePerimeter service_perimeter = 2 [(google.api.field_behavior) = REQUIRED];
+}
+
+// A request to update a `ServicePerimeter`.
+message UpdateServicePerimeterRequest {
+  // Required. The updated `ServicePerimeter`. Syntactic correctness of the
+  // `ServicePerimeter` is a precondition for creation.
+  ServicePerimeter service_perimeter = 1 [(google.api.field_behavior) = REQUIRED];
+
+  // Required. Mask to control which fields get updated. Must be non-empty.
+  google.protobuf.FieldMask update_mask = 2 [(google.api.field_behavior) = REQUIRED];
+}
+
+// A request to delete a `ServicePerimeter`.
+message DeleteServicePerimeterRequest {
+  // Required. Resource name for the [Service Perimeter]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter].
+  //
+  // Format:
+  // `accessPolicies/{policy_id}/servicePerimeters/{service_perimeter_id}`
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "accesscontextmanager.googleapis.com/ServicePerimeter"
+    }
+  ];
+}
+
+// A request to replace all existing Service Perimeters in an Access Policy
+// with the Service Perimeters provided. This is done atomically.
+message ReplaceServicePerimetersRequest {
+  // Required. Resource name for the access policy which owns these
+  // [Service Perimeters]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter].
+  //
+  // Format: `accessPolicies/{policy_id}`
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      child_type: "accesscontextmanager.googleapis.com/ServicePerimeter"
+    }
+  ];
+
+  // Required. The desired [Service Perimeters]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] that should
+  // replace all existing [Service Perimeters]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] in the
+  // [Access Policy]
+  // [google.identity.accesscontextmanager.v1.AccessPolicy].
+  repeated ServicePerimeter service_perimeters = 2 [(google.api.field_behavior) = REQUIRED];
+
+  // Optional. The etag for the version of the [Access Policy]
+  // [google.identity.accesscontextmanager.v1.AccessPolicy] that this
+  // replace operation is to be performed on. If, at the time of replace, the
+  // etag for the Access Policy stored in Access Context Manager is different
+  // from the specified etag, then the replace operation will not be performed
+  // and the call will fail. This field is not required. If etag is not
+  // provided, the operation will be performed as if a valid etag is provided.
+  string etag = 3;
+}
+
+// A response to ReplaceServicePerimetersRequest. This will be put inside of
+// Operation.response field.
+message ReplaceServicePerimetersResponse {
+  // List of the [Service Perimeter]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] instances.
+  repeated ServicePerimeter service_perimeters = 1;
+}
+
+// A request to commit dry-run specs in all [Service Perimeters]
+// [google.identity.accesscontextmanager.v1.ServicePerimeter] belonging to
+// an [Access Policy][google.identity.accesscontextmanager.v1.AccessPolicy].
+message CommitServicePerimetersRequest {
+  // Required. Resource name for the parent [Access Policy]
+  // [google.identity.accesscontextmanager.v1.AccessPolicy] which owns all
+  // [Service Perimeters]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] in scope for
+  // the commit operation.
+  //
+  // Format: `accessPolicies/{policy_id}`
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      child_type: "accesscontextmanager.googleapis.com/ServicePerimeter"
+    }
+  ];
+
+  // Optional. The etag for the version of the [Access Policy]
+  // [google.identity.accesscontextmanager.v1.AccessPolicy] that this
+  // commit operation is to be performed on. If, at the time of commit, the
+  // etag for the Access Policy stored in Access Context Manager is different
+  // from the specified etag, then the commit operation will not be performed
+  // and the call will fail. This field is not required. If etag is not
+  // provided, the operation will be performed as if a valid etag is provided.
+  string etag = 2;
+}
+
+// A response to CommitServicePerimetersRequest. This will be put inside of
+// Operation.response field.
+message CommitServicePerimetersResponse {
+  // List of all the [Service Perimeter]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] instances in
+  // the [Access Policy]
+  // [google.identity.accesscontextmanager.v1.AccessPolicy].
+  repeated ServicePerimeter service_perimeters = 1;
+}
+
+// The format used in an `AccessLevel`.
+enum LevelFormat {
+  // The format was not specified.
+  LEVEL_FORMAT_UNSPECIFIED = 0;
+
+  // Uses the format the resource was defined in. BasicLevels are returned as
+  // BasicLevels, CustomLevels are returned as CustomLevels.
+  AS_DEFINED = 1;
+
+  // Use Cloud Common Expression Language when returning the resource.  Both
+  // BasicLevels and CustomLevels are returned as CustomLevels.
+  CEL = 2;
+}
+
+// Request of [ListGcpUserAccessBindings]
+// [google.identity.accesscontextmanager.v1.AccessContextManager.ListGcpUserAccessBindings].
+message ListGcpUserAccessBindingsRequest {
+  // Required. Example: "organizations/256"
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "cloudresourcemanager.googleapis.com/Organization"
+    }
+  ];
+
+  // Optional. Maximum number of items to return. The server may return fewer items.
+  // If left blank, the server may return any number of items.
+  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. If left blank, returns the first page. To enumerate all items, use the
+  // [next_page_token]
+  // [google.identity.accesscontextmanager.v1.ListGcpUserAccessBindingsResponse.next_page_token]
+  // from your previous list operation.
+  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
+}
+
+// Response of [ListGcpUserAccessBindings]
+// [google.identity.accesscontextmanager.v1.AccessContextManager.ListGcpUserAccessBindings].
+message ListGcpUserAccessBindingsResponse {
+  // [GcpUserAccessBinding]
+  // [google.identity.accesscontextmanager.v1.GcpUserAccessBinding]
+  repeated GcpUserAccessBinding gcp_user_access_bindings = 1;
+
+  // Token to get the next page of items. If blank, there are no more items.
+  string next_page_token = 2;
+}
+
+// Request of [GetGcpUserAccessBinding]
+// [google.identity.accesscontextmanager.v1.AccessContextManager.GetGcpUserAccessBinding].
+message GetGcpUserAccessBindingRequest {
+  // Required. Example: "organizations/256/gcpUserAccessBindings/b3-BhcX_Ud5N"
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "accesscontextmanager.googleapis.com/GcpUserAccessBinding"
+    }
+  ];
+}
+
+// Request of [CreateGcpUserAccessBinding]
+// [google.identity.accesscontextmanager.v1.AccessContextManager.CreateGcpUserAccessBinding].
+message CreateGcpUserAccessBindingRequest {
+  // Required. Example: "organizations/256"
+  string parent = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "cloudresourcemanager.googleapis.com/Organization"
+    }
+  ];
+
+  // Required. [GcpUserAccessBinding]
+  // [google.identity.accesscontextmanager.v1.GcpUserAccessBinding]
+  GcpUserAccessBinding gcp_user_access_binding = 2 [(google.api.field_behavior) = REQUIRED];
+}
+
+// Request of [UpdateGcpUserAccessBinding]
+// [google.identity.accesscontextmanager.v1.AccessContextManager.UpdateGcpUserAccessBinding].
+message UpdateGcpUserAccessBindingRequest {
+  // Required. [GcpUserAccessBinding]
+  // [google.identity.accesscontextmanager.v1.GcpUserAccessBinding]
+  GcpUserAccessBinding gcp_user_access_binding = 1 [(google.api.field_behavior) = REQUIRED];
+
+  // Required. Only the fields specified in this mask are updated. Because name and
+  // group_key cannot be changed, update_mask is required and must always be:
+  //
+  // update_mask {
+  // paths: "access_levels"
+  // }
+  google.protobuf.FieldMask update_mask = 2 [(google.api.field_behavior) = REQUIRED];
+}
+
+// Request of [DeleteGcpUserAccessBinding]
+// [google.identity.accesscontextmanager.v1.AccessContextManager.DeleteGcpUserAccessBinding].
+message DeleteGcpUserAccessBindingRequest {
+  // Required. Example: "organizations/256/gcpUserAccessBindings/b3-BhcX_Ud5N"
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "accesscontextmanager.googleapis.com/GcpUserAccessBinding"
+    }
+  ];
+}
+
+// Currently, a completed operation means nothing. In the future, this metadata
+// and a completed operation may indicate that the binding has taken effect and
+// is affecting access decisions for all users.
+message GcpUserAccessBindingOperationMetadata {
+
+}
+
+// Metadata of Access Context Manager's Long Running Operations.
+message AccessContextManagerOperationMetadata {
+
+}
diff --git a/google/identity/accesscontextmanager/v1/access_context_manager_pb2.py b/google/identity/accesscontextmanager/v1/access_context_manager_pb2.py
new file mode 100644
index 0000000..c0ccd6e
--- /dev/null
+++ b/google/identity/accesscontextmanager/v1/access_context_manager_pb2.py
@@ -0,0 +1,844 @@
+# -*- coding: utf-8 -*-
+
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# source: google/identity/accesscontextmanager/v1/access_context_manager.proto
+"""Generated protocol buffer code."""
+from google.protobuf.internal import enum_type_wrapper
+from google.protobuf import descriptor as _descriptor
+from google.protobuf import descriptor_pool as _descriptor_pool
+from google.protobuf import message as _message
+from google.protobuf import reflection as _reflection
+from google.protobuf import symbol_database as _symbol_database
+
+# @@protoc_insertion_point(imports)
+
+_sym_db = _symbol_database.Default()
+
+
+from google.api import annotations_pb2 as google_dot_api_dot_annotations__pb2
+from google.api import client_pb2 as google_dot_api_dot_client__pb2
+from google.api import field_behavior_pb2 as google_dot_api_dot_field__behavior__pb2
+from google.api import resource_pb2 as google_dot_api_dot_resource__pb2
+from google.iam.v1 import iam_policy_pb2 as google_dot_iam_dot_v1_dot_iam__policy__pb2
+from google.iam.v1 import policy_pb2 as google_dot_iam_dot_v1_dot_policy__pb2
+from google.identity.accesscontextmanager.v1 import (
+    access_level_pb2 as google_dot_identity_dot_accesscontextmanager_dot_v1_dot_access__level__pb2,
+)
+from google.identity.accesscontextmanager.v1 import (
+    access_policy_pb2 as google_dot_identity_dot_accesscontextmanager_dot_v1_dot_access__policy__pb2,
+)
+from google.identity.accesscontextmanager.v1 import (
+    gcp_user_access_binding_pb2 as google_dot_identity_dot_accesscontextmanager_dot_v1_dot_gcp__user__access__binding__pb2,
+)
+from google.identity.accesscontextmanager.v1 import (
+    service_perimeter_pb2 as google_dot_identity_dot_accesscontextmanager_dot_v1_dot_service__perimeter__pb2,
+)
+from google.longrunning import (
+    operations_pb2 as google_dot_longrunning_dot_operations__pb2,
+)
+from google.protobuf import field_mask_pb2 as google_dot_protobuf_dot_field__mask__pb2
+
+
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(
+    b'\nDgoogle/identity/accesscontextmanager/v1/access_context_manager.proto\x12\'google.identity.accesscontextmanager.v1\x1a\x1cgoogle/api/annotations.proto\x1a\x17google/api/client.proto\x1a\x1fgoogle/api/field_behavior.proto\x1a\x19google/api/resource.proto\x1a\x1egoogle/iam/v1/iam_policy.proto\x1a\x1agoogle/iam/v1/policy.proto\x1a:google/identity/accesscontextmanager/v1/access_level.proto\x1a;google/identity/accesscontextmanager/v1/access_policy.proto\x1a\x45google/identity/accesscontextmanager/v1/gcp_user_access_binding.proto\x1a?google/identity/accesscontextmanager/v1/service_perimeter.proto\x1a#google/longrunning/operations.proto\x1a google/protobuf/field_mask.proto"\x8c\x01\n\x19ListAccessPoliciesRequest\x12H\n\x06parent\x18\x01 \x01(\tB8\xe0\x41\x02\xfa\x41\x32\n0cloudresourcemanager.googleapis.com/Organization\x12\x11\n\tpage_size\x18\x02 \x01(\x05\x12\x12\n\npage_token\x18\x03 \x01(\t"\x85\x01\n\x1aListAccessPoliciesResponse\x12N\n\x0f\x61\x63\x63\x65ss_policies\x18\x01 \x03(\x0b\x32\x35.google.identity.accesscontextmanager.v1.AccessPolicy\x12\x17\n\x0fnext_page_token\x18\x02 \x01(\t"`\n\x16GetAccessPolicyRequest\x12\x46\n\x04name\x18\x01 \x01(\tB8\xe0\x41\x02\xfa\x41\x32\n0accesscontextmanager.googleapis.com/AccessPolicy"\x9d\x01\n\x19UpdateAccessPolicyRequest\x12J\n\x06policy\x18\x01 \x01(\x0b\x32\x35.google.identity.accesscontextmanager.v1.AccessPolicyB\x03\xe0\x41\x02\x12\x34\n\x0bupdate_mask\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.FieldMaskB\x03\xe0\x41\x02"c\n\x19\x44\x65leteAccessPolicyRequest\x12\x46\n\x04name\x18\x01 \x01(\tB8\xe0\x41\x02\xfa\x41\x32\n0accesscontextmanager.googleapis.com/AccessPolicy"\xdc\x01\n\x17ListAccessLevelsRequest\x12G\n\x06parent\x18\x01 \x01(\tB7\xe0\x41\x02\xfa\x41\x31\x12/accesscontextmanager.googleapis.com/AccessLevel\x12\x11\n\tpage_size\x18\x02 \x01(\x05\x12\x12\n\npage_token\x18\x03 \x01(\t\x12Q\n\x13\x61\x63\x63\x65ss_level_format\x18\x04 \x01(\x0e\x32\x34.google.identity.accesscontextmanager.v1.LevelFormat"\x80\x01\n\x18ListAccessLevelsResponse\x12K\n\raccess_levels\x18\x01 \x03(\x0b\x32\x34.google.identity.accesscontextmanager.v1.AccessLevel\x12\x17\n\x0fnext_page_token\x18\x02 \x01(\t"\xb1\x01\n\x15GetAccessLevelRequest\x12\x45\n\x04name\x18\x01 \x01(\tB7\xe0\x41\x02\xfa\x41\x31\n/accesscontextmanager.googleapis.com/AccessLevel\x12Q\n\x13\x61\x63\x63\x65ss_level_format\x18\x02 \x01(\x0e\x32\x34.google.identity.accesscontextmanager.v1.LevelFormat"\xb4\x01\n\x18\x43reateAccessLevelRequest\x12G\n\x06parent\x18\x01 \x01(\tB7\xe0\x41\x02\xfa\x41\x31\x12/accesscontextmanager.googleapis.com/AccessLevel\x12O\n\x0c\x61\x63\x63\x65ss_level\x18\x02 \x01(\x0b\x32\x34.google.identity.accesscontextmanager.v1.AccessLevelB\x03\xe0\x41\x02"\xa1\x01\n\x18UpdateAccessLevelRequest\x12O\n\x0c\x61\x63\x63\x65ss_level\x18\x01 \x01(\x0b\x32\x34.google.identity.accesscontextmanager.v1.AccessLevelB\x03\xe0\x41\x02\x12\x34\n\x0bupdate_mask\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.FieldMaskB\x03\xe0\x41\x02"a\n\x18\x44\x65leteAccessLevelRequest\x12\x45\n\x04name\x18\x01 \x01(\tB7\xe0\x41\x02\xfa\x41\x31\n/accesscontextmanager.googleapis.com/AccessLevel"\xc5\x01\n\x1aReplaceAccessLevelsRequest\x12G\n\x06parent\x18\x01 \x01(\tB7\xe0\x41\x02\xfa\x41\x31\x12/accesscontextmanager.googleapis.com/AccessLevel\x12P\n\raccess_levels\x18\x02 \x03(\x0b\x32\x34.google.identity.accesscontextmanager.v1.AccessLevelB\x03\xe0\x41\x02\x12\x0c\n\x04\x65tag\x18\x04 \x01(\t"j\n\x1bReplaceAccessLevelsResponse\x12K\n\raccess_levels\x18\x01 \x03(\x0b\x32\x34.google.identity.accesscontextmanager.v1.AccessLevel"\x93\x01\n\x1cListServicePerimetersRequest\x12L\n\x06parent\x18\x01 \x01(\tB<\xe0\x41\x02\xfa\x41\x36\x12\x34\x61\x63\x63\x65sscontextmanager.googleapis.com/ServicePerimeter\x12\x11\n\tpage_size\x18\x02 \x01(\x05\x12\x12\n\npage_token\x18\x03 \x01(\t"\x8f\x01\n\x1dListServicePerimetersResponse\x12U\n\x12service_perimeters\x18\x01 \x03(\x0b\x32\x39.google.identity.accesscontextmanager.v1.ServicePerimeter\x12\x17\n\x0fnext_page_token\x18\x02 \x01(\t"h\n\x1aGetServicePerimeterRequest\x12J\n\x04name\x18\x01 \x01(\tB<\xe0\x41\x02\xfa\x41\x36\n4accesscontextmanager.googleapis.com/ServicePerimeter"\xc8\x01\n\x1d\x43reateServicePerimeterRequest\x12L\n\x06parent\x18\x01 \x01(\tB<\xe0\x41\x02\xfa\x41\x36\x12\x34\x61\x63\x63\x65sscontextmanager.googleapis.com/ServicePerimeter\x12Y\n\x11service_perimeter\x18\x02 \x01(\x0b\x32\x39.google.identity.accesscontextmanager.v1.ServicePerimeterB\x03\xe0\x41\x02"\xb0\x01\n\x1dUpdateServicePerimeterRequest\x12Y\n\x11service_perimeter\x18\x01 \x01(\x0b\x32\x39.google.identity.accesscontextmanager.v1.ServicePerimeterB\x03\xe0\x41\x02\x12\x34\n\x0bupdate_mask\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.FieldMaskB\x03\xe0\x41\x02"k\n\x1d\x44\x65leteServicePerimeterRequest\x12J\n\x04name\x18\x01 \x01(\tB<\xe0\x41\x02\xfa\x41\x36\n4accesscontextmanager.googleapis.com/ServicePerimeter"\xd9\x01\n\x1fReplaceServicePerimetersRequest\x12L\n\x06parent\x18\x01 \x01(\tB<\xe0\x41\x02\xfa\x41\x36\x12\x34\x61\x63\x63\x65sscontextmanager.googleapis.com/ServicePerimeter\x12Z\n\x12service_perimeters\x18\x02 \x03(\x0b\x32\x39.google.identity.accesscontextmanager.v1.ServicePerimeterB\x03\xe0\x41\x02\x12\x0c\n\x04\x65tag\x18\x03 \x01(\t"y\n ReplaceServicePerimetersResponse\x12U\n\x12service_perimeters\x18\x01 \x03(\x0b\x32\x39.google.identity.accesscontextmanager.v1.ServicePerimeter"|\n\x1e\x43ommitServicePerimetersRequest\x12L\n\x06parent\x18\x01 \x01(\tB<\xe0\x41\x02\xfa\x41\x36\x12\x34\x61\x63\x63\x65sscontextmanager.googleapis.com/ServicePerimeter\x12\x0c\n\x04\x65tag\x18\x02 \x01(\t"x\n\x1f\x43ommitServicePerimetersResponse\x12U\n\x12service_perimeters\x18\x01 \x03(\x0b\x32\x39.google.identity.accesscontextmanager.v1.ServicePerimeter"\x9d\x01\n ListGcpUserAccessBindingsRequest\x12H\n\x06parent\x18\x01 \x01(\tB8\xe0\x41\x02\xfa\x41\x32\n0cloudresourcemanager.googleapis.com/Organization\x12\x16\n\tpage_size\x18\x02 \x01(\x05\x42\x03\xe0\x41\x01\x12\x17\n\npage_token\x18\x03 \x01(\tB\x03\xe0\x41\x01"\x9d\x01\n!ListGcpUserAccessBindingsResponse\x12_\n\x18gcp_user_access_bindings\x18\x01 \x03(\x0b\x32=.google.identity.accesscontextmanager.v1.GcpUserAccessBinding\x12\x17\n\x0fnext_page_token\x18\x02 \x01(\t"p\n\x1eGetGcpUserAccessBindingRequest\x12N\n\x04name\x18\x01 \x01(\tB@\xe0\x41\x02\xfa\x41:\n8accesscontextmanager.googleapis.com/GcpUserAccessBinding"\xd2\x01\n!CreateGcpUserAccessBindingRequest\x12H\n\x06parent\x18\x01 \x01(\tB8\xe0\x41\x02\xfa\x41\x32\n0cloudresourcemanager.googleapis.com/Organization\x12\x63\n\x17gcp_user_access_binding\x18\x02 \x01(\x0b\x32=.google.identity.accesscontextmanager.v1.GcpUserAccessBindingB\x03\xe0\x41\x02"\xbe\x01\n!UpdateGcpUserAccessBindingRequest\x12\x63\n\x17gcp_user_access_binding\x18\x01 \x01(\x0b\x32=.google.identity.accesscontextmanager.v1.GcpUserAccessBindingB\x03\xe0\x41\x02\x12\x34\n\x0bupdate_mask\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.FieldMaskB\x03\xe0\x41\x02"s\n!DeleteGcpUserAccessBindingRequest\x12N\n\x04name\x18\x01 \x01(\tB@\xe0\x41\x02\xfa\x41:\n8accesscontextmanager.googleapis.com/GcpUserAccessBinding"\'\n%GcpUserAccessBindingOperationMetadata"\'\n%AccessContextManagerOperationMetadata*D\n\x0bLevelFormat\x12\x1c\n\x18LEVEL_FORMAT_UNSPECIFIED\x10\x00\x12\x0e\n\nAS_DEFINED\x10\x01\x12\x07\n\x03\x43\x45L\x10\x02\x32\xf1\x32\n\x14\x41\x63\x63\x65ssContextManager\x12\xb9\x01\n\x12ListAccessPolicies\x12\x42.google.identity.accesscontextmanager.v1.ListAccessPoliciesRequest\x1a\x43.google.identity.accesscontextmanager.v1.ListAccessPoliciesResponse"\x1a\x82\xd3\xe4\x93\x02\x14\x12\x12/v1/accessPolicies\x12\xb5\x01\n\x0fGetAccessPolicy\x12?.google.identity.accesscontextmanager.v1.GetAccessPolicyRequest\x1a\x35.google.identity.accesscontextmanager.v1.AccessPolicy"*\x82\xd3\xe4\x93\x02\x1d\x12\x1b/v1/{name=accessPolicies/*}\xda\x41\x04name\x12\xc1\x01\n\x12\x43reateAccessPolicy\x12\x35.google.identity.accesscontextmanager.v1.AccessPolicy\x1a\x1d.google.longrunning.Operation"U\x82\xd3\xe4\x93\x02\x17"\x12/v1/accessPolicies:\x01*\xca\x41\x35\n\x0c\x41\x63\x63\x65ssPolicy\x12%AccessContextManagerOperationMetadata\x12\xf8\x01\n\x12UpdateAccessPolicy\x12\x42.google.identity.accesscontextmanager.v1.UpdateAccessPolicyRequest\x1a\x1d.google.longrunning.Operation"\x7f\x82\xd3\xe4\x93\x02,2"/v1/{policy.name=accessPolicies/*}:\x06policy\xda\x41\x12policy,update_mask\xca\x41\x35\n\x0c\x41\x63\x63\x65ssPolicy\x12%AccessContextManagerOperationMetadata\x12\xe4\x01\n\x12\x44\x65leteAccessPolicy\x12\x42.google.identity.accesscontextmanager.v1.DeleteAccessPolicyRequest\x1a\x1d.google.longrunning.Operation"k\x82\xd3\xe4\x93\x02\x1d*\x1b/v1/{name=accessPolicies/*}\xda\x41\x04name\xca\x41>\n\x15google.protobuf.Empty\x12%AccessContextManagerOperationMetadata\x12\xd4\x01\n\x10ListAccessLevels\x12@.google.identity.accesscontextmanager.v1.ListAccessLevelsRequest\x1a\x41.google.identity.accesscontextmanager.v1.ListAccessLevelsResponse";\x82\xd3\xe4\x93\x02,\x12*/v1/{parent=accessPolicies/*}/accessLevels\xda\x41\x06parent\x12\xc1\x01\n\x0eGetAccessLevel\x12>.google.identity.accesscontextmanager.v1.GetAccessLevelRequest\x1a\x34.google.identity.accesscontextmanager.v1.AccessLevel"9\x82\xd3\xe4\x93\x02,\x12*/v1/{name=accessPolicies/*/accessLevels/*}\xda\x41\x04name\x12\x85\x02\n\x11\x43reateAccessLevel\x12\x41.google.identity.accesscontextmanager.v1.CreateAccessLevelRequest\x1a\x1d.google.longrunning.Operation"\x8d\x01\x82\xd3\xe4\x93\x02:"*/v1/{parent=accessPolicies/*}/accessLevels:\x0c\x61\x63\x63\x65ss_level\xda\x41\x13parent,access_level\xca\x41\x34\n\x0b\x41\x63\x63\x65ssLevel\x12%AccessContextManagerOperationMetadata\x12\x97\x02\n\x11UpdateAccessLevel\x12\x41.google.identity.accesscontextmanager.v1.UpdateAccessLevelRequest\x1a\x1d.google.longrunning.Operation"\x9f\x01\x82\xd3\xe4\x93\x02G27/v1/{access_level.name=accessPolicies/*/accessLevels/*}:\x0c\x61\x63\x63\x65ss_level\xda\x41\x18\x61\x63\x63\x65ss_level,update_mask\xca\x41\x34\n\x0b\x41\x63\x63\x65ssLevel\x12%AccessContextManagerOperationMetadata\x12\xf1\x01\n\x11\x44\x65leteAccessLevel\x12\x41.google.identity.accesscontextmanager.v1.DeleteAccessLevelRequest\x1a\x1d.google.longrunning.Operation"z\x82\xd3\xe4\x93\x02,**/v1/{name=accessPolicies/*/accessLevels/*}\xda\x41\x04name\xca\x41>\n\x15google.protobuf.Empty\x12%AccessContextManagerOperationMetadata\x12\x83\x02\n\x13ReplaceAccessLevels\x12\x43.google.identity.accesscontextmanager.v1.ReplaceAccessLevelsRequest\x1a\x1d.google.longrunning.Operation"\x87\x01\x82\xd3\xe4\x93\x02:"5/v1/{parent=accessPolicies/*}/accessLevels:replaceAll:\x01*\xca\x41\x44\n\x1bReplaceAccessLevelsResponse\x12%AccessContextManagerOperationMetadata\x12\xe8\x01\n\x15ListServicePerimeters\x12\x45.google.identity.accesscontextmanager.v1.ListServicePerimetersRequest\x1a\x46.google.identity.accesscontextmanager.v1.ListServicePerimetersResponse"@\x82\xd3\xe4\x93\x02\x31\x12//v1/{parent=accessPolicies/*}/servicePerimeters\xda\x41\x06parent\x12\xd5\x01\n\x13GetServicePerimeter\x12\x43.google.identity.accesscontextmanager.v1.GetServicePerimeterRequest\x1a\x39.google.identity.accesscontextmanager.v1.ServicePerimeter">\x82\xd3\xe4\x93\x02\x31\x12//v1/{name=accessPolicies/*/servicePerimeters/*}\xda\x41\x04name\x12\xa3\x02\n\x16\x43reateServicePerimeter\x12\x46.google.identity.accesscontextmanager.v1.CreateServicePerimeterRequest\x1a\x1d.google.longrunning.Operation"\xa1\x01\x82\xd3\xe4\x93\x02\x44"//v1/{parent=accessPolicies/*}/servicePerimeters:\x11service_perimeter\xda\x41\x18parent,service_perimeter\xca\x41\x39\n\x10ServicePerimeter\x12%AccessContextManagerOperationMetadata\x12\xba\x02\n\x16UpdateServicePerimeter\x12\x46.google.identity.accesscontextmanager.v1.UpdateServicePerimeterRequest\x1a\x1d.google.longrunning.Operation"\xb8\x01\x82\xd3\xe4\x93\x02V2A/v1/{service_perimeter.name=accessPolicies/*/servicePerimeters/*}:\x11service_perimeter\xda\x41\x1dservice_perimeter,update_mask\xca\x41\x39\n\x10ServicePerimeter\x12%AccessContextManagerOperationMetadata\x12\x80\x02\n\x16\x44\x65leteServicePerimeter\x12\x46.google.identity.accesscontextmanager.v1.DeleteServicePerimeterRequest\x1a\x1d.google.longrunning.Operation"\x7f\x82\xd3\xe4\x93\x02\x31*//v1/{name=accessPolicies/*/servicePerimeters/*}\xda\x41\x04name\xca\x41>\n\x15google.protobuf.Empty\x12%AccessContextManagerOperationMetadata\x12\x97\x02\n\x18ReplaceServicePerimeters\x12H.google.identity.accesscontextmanager.v1.ReplaceServicePerimetersRequest\x1a\x1d.google.longrunning.Operation"\x91\x01\x82\xd3\xe4\x93\x02?":/v1/{parent=accessPolicies/*}/servicePerimeters:replaceAll:\x01*\xca\x41I\n ReplaceServicePerimetersResponse\x12%AccessContextManagerOperationMetadata\x12\x90\x02\n\x17\x43ommitServicePerimeters\x12G.google.identity.accesscontextmanager.v1.CommitServicePerimetersRequest\x1a\x1d.google.longrunning.Operation"\x8c\x01\x82\xd3\xe4\x93\x02;"6/v1/{parent=accessPolicies/*}/servicePerimeters:commit:\x01*\xca\x41H\n\x1f\x43ommitServicePerimetersResponse\x12%AccessContextManagerOperationMetadata\x12\xf7\x01\n\x19ListGcpUserAccessBindings\x12I.google.identity.accesscontextmanager.v1.ListGcpUserAccessBindingsRequest\x1aJ.google.identity.accesscontextmanager.v1.ListGcpUserAccessBindingsResponse"C\x82\xd3\xe4\x93\x02\x34\x12\x32/v1/{parent=organizations/*}/gcpUserAccessBindings\xda\x41\x06parent\x12\xe4\x01\n\x17GetGcpUserAccessBinding\x12G.google.identity.accesscontextmanager.v1.GetGcpUserAccessBindingRequest\x1a=.google.identity.accesscontextmanager.v1.GcpUserAccessBinding"A\x82\xd3\xe4\x93\x02\x34\x12\x32/v1/{name=organizations/*/gcpUserAccessBindings/*}\xda\x41\x04name\x12\xbe\x02\n\x1a\x43reateGcpUserAccessBinding\x12J.google.identity.accesscontextmanager.v1.CreateGcpUserAccessBindingRequest\x1a\x1d.google.longrunning.Operation"\xb4\x01\x82\xd3\xe4\x93\x02M"2/v1/{parent=organizations/*}/gcpUserAccessBindings:\x17gcp_user_access_binding\xda\x41\x1eparent,gcp_user_access_binding\xca\x41=\n\x14GcpUserAccessBinding\x12%GcpUserAccessBindingOperationMetadata\x12\xdb\x02\n\x1aUpdateGcpUserAccessBinding\x12J.google.identity.accesscontextmanager.v1.UpdateGcpUserAccessBindingRequest\x1a\x1d.google.longrunning.Operation"\xd1\x01\x82\xd3\xe4\x93\x02\x65\x32J/v1/{gcp_user_access_binding.name=organizations/*/gcpUserAccessBindings/*}:\x17gcp_user_access_binding\xda\x41#gcp_user_access_binding,update_mask\xca\x41=\n\x14GcpUserAccessBinding\x12%GcpUserAccessBindingOperationMetadata\x12\x8c\x02\n\x1a\x44\x65leteGcpUserAccessBinding\x12J.google.identity.accesscontextmanager.v1.DeleteGcpUserAccessBindingRequest\x1a\x1d.google.longrunning.Operation"\x82\x01\x82\xd3\xe4\x93\x02\x34*2/v1/{name=organizations/*/gcpUserAccessBindings/*}\xda\x41\x04name\xca\x41>\n\x15google.protobuf.Empty\x12%GcpUserAccessBindingOperationMetadata\x12\x82\x01\n\x0cSetIamPolicy\x12".google.iam.v1.SetIamPolicyRequest\x1a\x15.google.iam.v1.Policy"7\x82\xd3\xe4\x93\x02\x31",/v1/{resource=accessPolicies/*}:setIamPolicy:\x01*\x12\x82\x01\n\x0cGetIamPolicy\x12".google.iam.v1.GetIamPolicyRequest\x1a\x15.google.iam.v1.Policy"7\x82\xd3\xe4\x93\x02\x31",/v1/{resource=accessPolicies/*}:getIamPolicy:\x01*\x12\xbf\x02\n\x12TestIamPermissions\x12(.google.iam.v1.TestIamPermissionsRequest\x1a).google.iam.v1.TestIamPermissionsResponse"\xd3\x01\x82\xd3\xe4\x93\x02\xcc\x01"2/v1/{resource=accessPolicies/*}:testIamPermissions:\x01*ZF"A/v1/{resource=accessPolicies/*/accessLevels/*}:testIamPermissions:\x01*ZK"F/v1/{resource=accessPolicies/*/servicePerimeters/*}:testIamPermissions:\x01*\x1aW\xca\x41#accesscontextmanager.googleapis.com\xd2\x41.https://www.googleapis.com/auth/cloud-platformB\xb0\x02\n+com.google.identity.accesscontextmanager.v1B\x19\x41\x63\x63\x65ssContextManagerProtoP\x01Z\\cloud.google.com/go/accesscontextmanager/apiv1/accesscontextmanagerpb;accesscontextmanagerpb\xa2\x02\x04GACM\xaa\x02\'Google.Identity.AccessContextManager.V1\xca\x02\'Google\\Identity\\AccessContextManager\\V1\xea\x02*Google::Identity::AccessContextManager::V1b\x06proto3'
+)
+
+_LEVELFORMAT = DESCRIPTOR.enum_types_by_name["LevelFormat"]
+LevelFormat = enum_type_wrapper.EnumTypeWrapper(_LEVELFORMAT)
+LEVEL_FORMAT_UNSPECIFIED = 0
+AS_DEFINED = 1
+CEL = 2
+
+
+_LISTACCESSPOLICIESREQUEST = DESCRIPTOR.message_types_by_name[
+    "ListAccessPoliciesRequest"
+]
+_LISTACCESSPOLICIESRESPONSE = DESCRIPTOR.message_types_by_name[
+    "ListAccessPoliciesResponse"
+]
+_GETACCESSPOLICYREQUEST = DESCRIPTOR.message_types_by_name["GetAccessPolicyRequest"]
+_UPDATEACCESSPOLICYREQUEST = DESCRIPTOR.message_types_by_name[
+    "UpdateAccessPolicyRequest"
+]
+_DELETEACCESSPOLICYREQUEST = DESCRIPTOR.message_types_by_name[
+    "DeleteAccessPolicyRequest"
+]
+_LISTACCESSLEVELSREQUEST = DESCRIPTOR.message_types_by_name["ListAccessLevelsRequest"]
+_LISTACCESSLEVELSRESPONSE = DESCRIPTOR.message_types_by_name["ListAccessLevelsResponse"]
+_GETACCESSLEVELREQUEST = DESCRIPTOR.message_types_by_name["GetAccessLevelRequest"]
+_CREATEACCESSLEVELREQUEST = DESCRIPTOR.message_types_by_name["CreateAccessLevelRequest"]
+_UPDATEACCESSLEVELREQUEST = DESCRIPTOR.message_types_by_name["UpdateAccessLevelRequest"]
+_DELETEACCESSLEVELREQUEST = DESCRIPTOR.message_types_by_name["DeleteAccessLevelRequest"]
+_REPLACEACCESSLEVELSREQUEST = DESCRIPTOR.message_types_by_name[
+    "ReplaceAccessLevelsRequest"
+]
+_REPLACEACCESSLEVELSRESPONSE = DESCRIPTOR.message_types_by_name[
+    "ReplaceAccessLevelsResponse"
+]
+_LISTSERVICEPERIMETERSREQUEST = DESCRIPTOR.message_types_by_name[
+    "ListServicePerimetersRequest"
+]
+_LISTSERVICEPERIMETERSRESPONSE = DESCRIPTOR.message_types_by_name[
+    "ListServicePerimetersResponse"
+]
+_GETSERVICEPERIMETERREQUEST = DESCRIPTOR.message_types_by_name[
+    "GetServicePerimeterRequest"
+]
+_CREATESERVICEPERIMETERREQUEST = DESCRIPTOR.message_types_by_name[
+    "CreateServicePerimeterRequest"
+]
+_UPDATESERVICEPERIMETERREQUEST = DESCRIPTOR.message_types_by_name[
+    "UpdateServicePerimeterRequest"
+]
+_DELETESERVICEPERIMETERREQUEST = DESCRIPTOR.message_types_by_name[
+    "DeleteServicePerimeterRequest"
+]
+_REPLACESERVICEPERIMETERSREQUEST = DESCRIPTOR.message_types_by_name[
+    "ReplaceServicePerimetersRequest"
+]
+_REPLACESERVICEPERIMETERSRESPONSE = DESCRIPTOR.message_types_by_name[
+    "ReplaceServicePerimetersResponse"
+]
+_COMMITSERVICEPERIMETERSREQUEST = DESCRIPTOR.message_types_by_name[
+    "CommitServicePerimetersRequest"
+]
+_COMMITSERVICEPERIMETERSRESPONSE = DESCRIPTOR.message_types_by_name[
+    "CommitServicePerimetersResponse"
+]
+_LISTGCPUSERACCESSBINDINGSREQUEST = DESCRIPTOR.message_types_by_name[
+    "ListGcpUserAccessBindingsRequest"
+]
+_LISTGCPUSERACCESSBINDINGSRESPONSE = DESCRIPTOR.message_types_by_name[
+    "ListGcpUserAccessBindingsResponse"
+]
+_GETGCPUSERACCESSBINDINGREQUEST = DESCRIPTOR.message_types_by_name[
+    "GetGcpUserAccessBindingRequest"
+]
+_CREATEGCPUSERACCESSBINDINGREQUEST = DESCRIPTOR.message_types_by_name[
+    "CreateGcpUserAccessBindingRequest"
+]
+_UPDATEGCPUSERACCESSBINDINGREQUEST = DESCRIPTOR.message_types_by_name[
+    "UpdateGcpUserAccessBindingRequest"
+]
+_DELETEGCPUSERACCESSBINDINGREQUEST = DESCRIPTOR.message_types_by_name[
+    "DeleteGcpUserAccessBindingRequest"
+]
+_GCPUSERACCESSBINDINGOPERATIONMETADATA = DESCRIPTOR.message_types_by_name[
+    "GcpUserAccessBindingOperationMetadata"
+]
+_ACCESSCONTEXTMANAGEROPERATIONMETADATA = DESCRIPTOR.message_types_by_name[
+    "AccessContextManagerOperationMetadata"
+]
+ListAccessPoliciesRequest = _reflection.GeneratedProtocolMessageType(
+    "ListAccessPoliciesRequest",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _LISTACCESSPOLICIESREQUEST,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.ListAccessPoliciesRequest)
+    },
+)
+_sym_db.RegisterMessage(ListAccessPoliciesRequest)
+
+ListAccessPoliciesResponse = _reflection.GeneratedProtocolMessageType(
+    "ListAccessPoliciesResponse",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _LISTACCESSPOLICIESRESPONSE,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.ListAccessPoliciesResponse)
+    },
+)
+_sym_db.RegisterMessage(ListAccessPoliciesResponse)
+
+GetAccessPolicyRequest = _reflection.GeneratedProtocolMessageType(
+    "GetAccessPolicyRequest",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _GETACCESSPOLICYREQUEST,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.GetAccessPolicyRequest)
+    },
+)
+_sym_db.RegisterMessage(GetAccessPolicyRequest)
+
+UpdateAccessPolicyRequest = _reflection.GeneratedProtocolMessageType(
+    "UpdateAccessPolicyRequest",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _UPDATEACCESSPOLICYREQUEST,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.UpdateAccessPolicyRequest)
+    },
+)
+_sym_db.RegisterMessage(UpdateAccessPolicyRequest)
+
+DeleteAccessPolicyRequest = _reflection.GeneratedProtocolMessageType(
+    "DeleteAccessPolicyRequest",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _DELETEACCESSPOLICYREQUEST,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.DeleteAccessPolicyRequest)
+    },
+)
+_sym_db.RegisterMessage(DeleteAccessPolicyRequest)
+
+ListAccessLevelsRequest = _reflection.GeneratedProtocolMessageType(
+    "ListAccessLevelsRequest",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _LISTACCESSLEVELSREQUEST,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.ListAccessLevelsRequest)
+    },
+)
+_sym_db.RegisterMessage(ListAccessLevelsRequest)
+
+ListAccessLevelsResponse = _reflection.GeneratedProtocolMessageType(
+    "ListAccessLevelsResponse",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _LISTACCESSLEVELSRESPONSE,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.ListAccessLevelsResponse)
+    },
+)
+_sym_db.RegisterMessage(ListAccessLevelsResponse)
+
+GetAccessLevelRequest = _reflection.GeneratedProtocolMessageType(
+    "GetAccessLevelRequest",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _GETACCESSLEVELREQUEST,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.GetAccessLevelRequest)
+    },
+)
+_sym_db.RegisterMessage(GetAccessLevelRequest)
+
+CreateAccessLevelRequest = _reflection.GeneratedProtocolMessageType(
+    "CreateAccessLevelRequest",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _CREATEACCESSLEVELREQUEST,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.CreateAccessLevelRequest)
+    },
+)
+_sym_db.RegisterMessage(CreateAccessLevelRequest)
+
+UpdateAccessLevelRequest = _reflection.GeneratedProtocolMessageType(
+    "UpdateAccessLevelRequest",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _UPDATEACCESSLEVELREQUEST,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.UpdateAccessLevelRequest)
+    },
+)
+_sym_db.RegisterMessage(UpdateAccessLevelRequest)
+
+DeleteAccessLevelRequest = _reflection.GeneratedProtocolMessageType(
+    "DeleteAccessLevelRequest",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _DELETEACCESSLEVELREQUEST,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.DeleteAccessLevelRequest)
+    },
+)
+_sym_db.RegisterMessage(DeleteAccessLevelRequest)
+
+ReplaceAccessLevelsRequest = _reflection.GeneratedProtocolMessageType(
+    "ReplaceAccessLevelsRequest",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _REPLACEACCESSLEVELSREQUEST,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.ReplaceAccessLevelsRequest)
+    },
+)
+_sym_db.RegisterMessage(ReplaceAccessLevelsRequest)
+
+ReplaceAccessLevelsResponse = _reflection.GeneratedProtocolMessageType(
+    "ReplaceAccessLevelsResponse",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _REPLACEACCESSLEVELSRESPONSE,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.ReplaceAccessLevelsResponse)
+    },
+)
+_sym_db.RegisterMessage(ReplaceAccessLevelsResponse)
+
+ListServicePerimetersRequest = _reflection.GeneratedProtocolMessageType(
+    "ListServicePerimetersRequest",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _LISTSERVICEPERIMETERSREQUEST,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.ListServicePerimetersRequest)
+    },
+)
+_sym_db.RegisterMessage(ListServicePerimetersRequest)
+
+ListServicePerimetersResponse = _reflection.GeneratedProtocolMessageType(
+    "ListServicePerimetersResponse",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _LISTSERVICEPERIMETERSRESPONSE,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.ListServicePerimetersResponse)
+    },
+)
+_sym_db.RegisterMessage(ListServicePerimetersResponse)
+
+GetServicePerimeterRequest = _reflection.GeneratedProtocolMessageType(
+    "GetServicePerimeterRequest",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _GETSERVICEPERIMETERREQUEST,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.GetServicePerimeterRequest)
+    },
+)
+_sym_db.RegisterMessage(GetServicePerimeterRequest)
+
+CreateServicePerimeterRequest = _reflection.GeneratedProtocolMessageType(
+    "CreateServicePerimeterRequest",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _CREATESERVICEPERIMETERREQUEST,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.CreateServicePerimeterRequest)
+    },
+)
+_sym_db.RegisterMessage(CreateServicePerimeterRequest)
+
+UpdateServicePerimeterRequest = _reflection.GeneratedProtocolMessageType(
+    "UpdateServicePerimeterRequest",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _UPDATESERVICEPERIMETERREQUEST,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.UpdateServicePerimeterRequest)
+    },
+)
+_sym_db.RegisterMessage(UpdateServicePerimeterRequest)
+
+DeleteServicePerimeterRequest = _reflection.GeneratedProtocolMessageType(
+    "DeleteServicePerimeterRequest",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _DELETESERVICEPERIMETERREQUEST,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.DeleteServicePerimeterRequest)
+    },
+)
+_sym_db.RegisterMessage(DeleteServicePerimeterRequest)
+
+ReplaceServicePerimetersRequest = _reflection.GeneratedProtocolMessageType(
+    "ReplaceServicePerimetersRequest",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _REPLACESERVICEPERIMETERSREQUEST,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.ReplaceServicePerimetersRequest)
+    },
+)
+_sym_db.RegisterMessage(ReplaceServicePerimetersRequest)
+
+ReplaceServicePerimetersResponse = _reflection.GeneratedProtocolMessageType(
+    "ReplaceServicePerimetersResponse",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _REPLACESERVICEPERIMETERSRESPONSE,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.ReplaceServicePerimetersResponse)
+    },
+)
+_sym_db.RegisterMessage(ReplaceServicePerimetersResponse)
+
+CommitServicePerimetersRequest = _reflection.GeneratedProtocolMessageType(
+    "CommitServicePerimetersRequest",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _COMMITSERVICEPERIMETERSREQUEST,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.CommitServicePerimetersRequest)
+    },
+)
+_sym_db.RegisterMessage(CommitServicePerimetersRequest)
+
+CommitServicePerimetersResponse = _reflection.GeneratedProtocolMessageType(
+    "CommitServicePerimetersResponse",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _COMMITSERVICEPERIMETERSRESPONSE,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.CommitServicePerimetersResponse)
+    },
+)
+_sym_db.RegisterMessage(CommitServicePerimetersResponse)
+
+ListGcpUserAccessBindingsRequest = _reflection.GeneratedProtocolMessageType(
+    "ListGcpUserAccessBindingsRequest",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _LISTGCPUSERACCESSBINDINGSREQUEST,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.ListGcpUserAccessBindingsRequest)
+    },
+)
+_sym_db.RegisterMessage(ListGcpUserAccessBindingsRequest)
+
+ListGcpUserAccessBindingsResponse = _reflection.GeneratedProtocolMessageType(
+    "ListGcpUserAccessBindingsResponse",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _LISTGCPUSERACCESSBINDINGSRESPONSE,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.ListGcpUserAccessBindingsResponse)
+    },
+)
+_sym_db.RegisterMessage(ListGcpUserAccessBindingsResponse)
+
+GetGcpUserAccessBindingRequest = _reflection.GeneratedProtocolMessageType(
+    "GetGcpUserAccessBindingRequest",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _GETGCPUSERACCESSBINDINGREQUEST,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.GetGcpUserAccessBindingRequest)
+    },
+)
+_sym_db.RegisterMessage(GetGcpUserAccessBindingRequest)
+
+CreateGcpUserAccessBindingRequest = _reflection.GeneratedProtocolMessageType(
+    "CreateGcpUserAccessBindingRequest",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _CREATEGCPUSERACCESSBINDINGREQUEST,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.CreateGcpUserAccessBindingRequest)
+    },
+)
+_sym_db.RegisterMessage(CreateGcpUserAccessBindingRequest)
+
+UpdateGcpUserAccessBindingRequest = _reflection.GeneratedProtocolMessageType(
+    "UpdateGcpUserAccessBindingRequest",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _UPDATEGCPUSERACCESSBINDINGREQUEST,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.UpdateGcpUserAccessBindingRequest)
+    },
+)
+_sym_db.RegisterMessage(UpdateGcpUserAccessBindingRequest)
+
+DeleteGcpUserAccessBindingRequest = _reflection.GeneratedProtocolMessageType(
+    "DeleteGcpUserAccessBindingRequest",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _DELETEGCPUSERACCESSBINDINGREQUEST,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.DeleteGcpUserAccessBindingRequest)
+    },
+)
+_sym_db.RegisterMessage(DeleteGcpUserAccessBindingRequest)
+
+GcpUserAccessBindingOperationMetadata = _reflection.GeneratedProtocolMessageType(
+    "GcpUserAccessBindingOperationMetadata",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _GCPUSERACCESSBINDINGOPERATIONMETADATA,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.GcpUserAccessBindingOperationMetadata)
+    },
+)
+_sym_db.RegisterMessage(GcpUserAccessBindingOperationMetadata)
+
+AccessContextManagerOperationMetadata = _reflection.GeneratedProtocolMessageType(
+    "AccessContextManagerOperationMetadata",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _ACCESSCONTEXTMANAGEROPERATIONMETADATA,
+        "__module__": "google.identity.accesscontextmanager.v1.access_context_manager_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.AccessContextManagerOperationMetadata)
+    },
+)
+_sym_db.RegisterMessage(AccessContextManagerOperationMetadata)
+
+_ACCESSCONTEXTMANAGER = DESCRIPTOR.services_by_name["AccessContextManager"]
+if _descriptor._USE_C_DESCRIPTORS == False:
+
+    DESCRIPTOR._options = None
+    DESCRIPTOR._serialized_options = b"\n+com.google.identity.accesscontextmanager.v1B\031AccessContextManagerProtoP\001Z\\cloud.google.com/go/accesscontextmanager/apiv1/accesscontextmanagerpb;accesscontextmanagerpb\242\002\004GACM\252\002'Google.Identity.AccessContextManager.V1\312\002'Google\\Identity\\AccessContextManager\\V1\352\002*Google::Identity::AccessContextManager::V1"
+    _LISTACCESSPOLICIESREQUEST.fields_by_name["parent"]._options = None
+    _LISTACCESSPOLICIESREQUEST.fields_by_name[
+        "parent"
+    ]._serialized_options = (
+        b"\340A\002\372A2\n0cloudresourcemanager.googleapis.com/Organization"
+    )
+    _GETACCESSPOLICYREQUEST.fields_by_name["name"]._options = None
+    _GETACCESSPOLICYREQUEST.fields_by_name[
+        "name"
+    ]._serialized_options = (
+        b"\340A\002\372A2\n0accesscontextmanager.googleapis.com/AccessPolicy"
+    )
+    _UPDATEACCESSPOLICYREQUEST.fields_by_name["policy"]._options = None
+    _UPDATEACCESSPOLICYREQUEST.fields_by_name[
+        "policy"
+    ]._serialized_options = b"\340A\002"
+    _UPDATEACCESSPOLICYREQUEST.fields_by_name["update_mask"]._options = None
+    _UPDATEACCESSPOLICYREQUEST.fields_by_name[
+        "update_mask"
+    ]._serialized_options = b"\340A\002"
+    _DELETEACCESSPOLICYREQUEST.fields_by_name["name"]._options = None
+    _DELETEACCESSPOLICYREQUEST.fields_by_name[
+        "name"
+    ]._serialized_options = (
+        b"\340A\002\372A2\n0accesscontextmanager.googleapis.com/AccessPolicy"
+    )
+    _LISTACCESSLEVELSREQUEST.fields_by_name["parent"]._options = None
+    _LISTACCESSLEVELSREQUEST.fields_by_name[
+        "parent"
+    ]._serialized_options = (
+        b"\340A\002\372A1\022/accesscontextmanager.googleapis.com/AccessLevel"
+    )
+    _GETACCESSLEVELREQUEST.fields_by_name["name"]._options = None
+    _GETACCESSLEVELREQUEST.fields_by_name[
+        "name"
+    ]._serialized_options = (
+        b"\340A\002\372A1\n/accesscontextmanager.googleapis.com/AccessLevel"
+    )
+    _CREATEACCESSLEVELREQUEST.fields_by_name["parent"]._options = None
+    _CREATEACCESSLEVELREQUEST.fields_by_name[
+        "parent"
+    ]._serialized_options = (
+        b"\340A\002\372A1\022/accesscontextmanager.googleapis.com/AccessLevel"
+    )
+    _CREATEACCESSLEVELREQUEST.fields_by_name["access_level"]._options = None
+    _CREATEACCESSLEVELREQUEST.fields_by_name[
+        "access_level"
+    ]._serialized_options = b"\340A\002"
+    _UPDATEACCESSLEVELREQUEST.fields_by_name["access_level"]._options = None
+    _UPDATEACCESSLEVELREQUEST.fields_by_name[
+        "access_level"
+    ]._serialized_options = b"\340A\002"
+    _UPDATEACCESSLEVELREQUEST.fields_by_name["update_mask"]._options = None
+    _UPDATEACCESSLEVELREQUEST.fields_by_name[
+        "update_mask"
+    ]._serialized_options = b"\340A\002"
+    _DELETEACCESSLEVELREQUEST.fields_by_name["name"]._options = None
+    _DELETEACCESSLEVELREQUEST.fields_by_name[
+        "name"
+    ]._serialized_options = (
+        b"\340A\002\372A1\n/accesscontextmanager.googleapis.com/AccessLevel"
+    )
+    _REPLACEACCESSLEVELSREQUEST.fields_by_name["parent"]._options = None
+    _REPLACEACCESSLEVELSREQUEST.fields_by_name[
+        "parent"
+    ]._serialized_options = (
+        b"\340A\002\372A1\022/accesscontextmanager.googleapis.com/AccessLevel"
+    )
+    _REPLACEACCESSLEVELSREQUEST.fields_by_name["access_levels"]._options = None
+    _REPLACEACCESSLEVELSREQUEST.fields_by_name[
+        "access_levels"
+    ]._serialized_options = b"\340A\002"
+    _LISTSERVICEPERIMETERSREQUEST.fields_by_name["parent"]._options = None
+    _LISTSERVICEPERIMETERSREQUEST.fields_by_name[
+        "parent"
+    ]._serialized_options = (
+        b"\340A\002\372A6\0224accesscontextmanager.googleapis.com/ServicePerimeter"
+    )
+    _GETSERVICEPERIMETERREQUEST.fields_by_name["name"]._options = None
+    _GETSERVICEPERIMETERREQUEST.fields_by_name[
+        "name"
+    ]._serialized_options = (
+        b"\340A\002\372A6\n4accesscontextmanager.googleapis.com/ServicePerimeter"
+    )
+    _CREATESERVICEPERIMETERREQUEST.fields_by_name["parent"]._options = None
+    _CREATESERVICEPERIMETERREQUEST.fields_by_name[
+        "parent"
+    ]._serialized_options = (
+        b"\340A\002\372A6\0224accesscontextmanager.googleapis.com/ServicePerimeter"
+    )
+    _CREATESERVICEPERIMETERREQUEST.fields_by_name["service_perimeter"]._options = None
+    _CREATESERVICEPERIMETERREQUEST.fields_by_name[
+        "service_perimeter"
+    ]._serialized_options = b"\340A\002"
+    _UPDATESERVICEPERIMETERREQUEST.fields_by_name["service_perimeter"]._options = None
+    _UPDATESERVICEPERIMETERREQUEST.fields_by_name[
+        "service_perimeter"
+    ]._serialized_options = b"\340A\002"
+    _UPDATESERVICEPERIMETERREQUEST.fields_by_name["update_mask"]._options = None
+    _UPDATESERVICEPERIMETERREQUEST.fields_by_name[
+        "update_mask"
+    ]._serialized_options = b"\340A\002"
+    _DELETESERVICEPERIMETERREQUEST.fields_by_name["name"]._options = None
+    _DELETESERVICEPERIMETERREQUEST.fields_by_name[
+        "name"
+    ]._serialized_options = (
+        b"\340A\002\372A6\n4accesscontextmanager.googleapis.com/ServicePerimeter"
+    )
+    _REPLACESERVICEPERIMETERSREQUEST.fields_by_name["parent"]._options = None
+    _REPLACESERVICEPERIMETERSREQUEST.fields_by_name[
+        "parent"
+    ]._serialized_options = (
+        b"\340A\002\372A6\0224accesscontextmanager.googleapis.com/ServicePerimeter"
+    )
+    _REPLACESERVICEPERIMETERSREQUEST.fields_by_name[
+        "service_perimeters"
+    ]._options = None
+    _REPLACESERVICEPERIMETERSREQUEST.fields_by_name[
+        "service_perimeters"
+    ]._serialized_options = b"\340A\002"
+    _COMMITSERVICEPERIMETERSREQUEST.fields_by_name["parent"]._options = None
+    _COMMITSERVICEPERIMETERSREQUEST.fields_by_name[
+        "parent"
+    ]._serialized_options = (
+        b"\340A\002\372A6\0224accesscontextmanager.googleapis.com/ServicePerimeter"
+    )
+    _LISTGCPUSERACCESSBINDINGSREQUEST.fields_by_name["parent"]._options = None
+    _LISTGCPUSERACCESSBINDINGSREQUEST.fields_by_name[
+        "parent"
+    ]._serialized_options = (
+        b"\340A\002\372A2\n0cloudresourcemanager.googleapis.com/Organization"
+    )
+    _LISTGCPUSERACCESSBINDINGSREQUEST.fields_by_name["page_size"]._options = None
+    _LISTGCPUSERACCESSBINDINGSREQUEST.fields_by_name[
+        "page_size"
+    ]._serialized_options = b"\340A\001"
+    _LISTGCPUSERACCESSBINDINGSREQUEST.fields_by_name["page_token"]._options = None
+    _LISTGCPUSERACCESSBINDINGSREQUEST.fields_by_name[
+        "page_token"
+    ]._serialized_options = b"\340A\001"
+    _GETGCPUSERACCESSBINDINGREQUEST.fields_by_name["name"]._options = None
+    _GETGCPUSERACCESSBINDINGREQUEST.fields_by_name[
+        "name"
+    ]._serialized_options = (
+        b"\340A\002\372A:\n8accesscontextmanager.googleapis.com/GcpUserAccessBinding"
+    )
+    _CREATEGCPUSERACCESSBINDINGREQUEST.fields_by_name["parent"]._options = None
+    _CREATEGCPUSERACCESSBINDINGREQUEST.fields_by_name[
+        "parent"
+    ]._serialized_options = (
+        b"\340A\002\372A2\n0cloudresourcemanager.googleapis.com/Organization"
+    )
+    _CREATEGCPUSERACCESSBINDINGREQUEST.fields_by_name[
+        "gcp_user_access_binding"
+    ]._options = None
+    _CREATEGCPUSERACCESSBINDINGREQUEST.fields_by_name[
+        "gcp_user_access_binding"
+    ]._serialized_options = b"\340A\002"
+    _UPDATEGCPUSERACCESSBINDINGREQUEST.fields_by_name[
+        "gcp_user_access_binding"
+    ]._options = None
+    _UPDATEGCPUSERACCESSBINDINGREQUEST.fields_by_name[
+        "gcp_user_access_binding"
+    ]._serialized_options = b"\340A\002"
+    _UPDATEGCPUSERACCESSBINDINGREQUEST.fields_by_name["update_mask"]._options = None
+    _UPDATEGCPUSERACCESSBINDINGREQUEST.fields_by_name[
+        "update_mask"
+    ]._serialized_options = b"\340A\002"
+    _DELETEGCPUSERACCESSBINDINGREQUEST.fields_by_name["name"]._options = None
+    _DELETEGCPUSERACCESSBINDINGREQUEST.fields_by_name[
+        "name"
+    ]._serialized_options = (
+        b"\340A\002\372A:\n8accesscontextmanager.googleapis.com/GcpUserAccessBinding"
+    )
+    _ACCESSCONTEXTMANAGER._options = None
+    _ACCESSCONTEXTMANAGER._serialized_options = b"\312A#accesscontextmanager.googleapis.com\322A.https://www.googleapis.com/auth/cloud-platform"
+    _ACCESSCONTEXTMANAGER.methods_by_name["ListAccessPolicies"]._options = None
+    _ACCESSCONTEXTMANAGER.methods_by_name[
+        "ListAccessPolicies"
+    ]._serialized_options = b"\202\323\344\223\002\024\022\022/v1/accessPolicies"
+    _ACCESSCONTEXTMANAGER.methods_by_name["GetAccessPolicy"]._options = None
+    _ACCESSCONTEXTMANAGER.methods_by_name[
+        "GetAccessPolicy"
+    ]._serialized_options = (
+        b"\202\323\344\223\002\035\022\033/v1/{name=accessPolicies/*}\332A\004name"
+    )
+    _ACCESSCONTEXTMANAGER.methods_by_name["CreateAccessPolicy"]._options = None
+    _ACCESSCONTEXTMANAGER.methods_by_name[
+        "CreateAccessPolicy"
+    ]._serialized_options = b'\202\323\344\223\002\027"\022/v1/accessPolicies:\001*\312A5\n\014AccessPolicy\022%AccessContextManagerOperationMetadata'
+    _ACCESSCONTEXTMANAGER.methods_by_name["UpdateAccessPolicy"]._options = None
+    _ACCESSCONTEXTMANAGER.methods_by_name[
+        "UpdateAccessPolicy"
+    ]._serialized_options = b'\202\323\344\223\002,2"/v1/{policy.name=accessPolicies/*}:\006policy\332A\022policy,update_mask\312A5\n\014AccessPolicy\022%AccessContextManagerOperationMetadata'
+    _ACCESSCONTEXTMANAGER.methods_by_name["DeleteAccessPolicy"]._options = None
+    _ACCESSCONTEXTMANAGER.methods_by_name[
+        "DeleteAccessPolicy"
+    ]._serialized_options = b"\202\323\344\223\002\035*\033/v1/{name=accessPolicies/*}\332A\004name\312A>\n\025google.protobuf.Empty\022%AccessContextManagerOperationMetadata"
+    _ACCESSCONTEXTMANAGER.methods_by_name["ListAccessLevels"]._options = None
+    _ACCESSCONTEXTMANAGER.methods_by_name[
+        "ListAccessLevels"
+    ]._serialized_options = b"\202\323\344\223\002,\022*/v1/{parent=accessPolicies/*}/accessLevels\332A\006parent"
+    _ACCESSCONTEXTMANAGER.methods_by_name["GetAccessLevel"]._options = None
+    _ACCESSCONTEXTMANAGER.methods_by_name[
+        "GetAccessLevel"
+    ]._serialized_options = b"\202\323\344\223\002,\022*/v1/{name=accessPolicies/*/accessLevels/*}\332A\004name"
+    _ACCESSCONTEXTMANAGER.methods_by_name["CreateAccessLevel"]._options = None
+    _ACCESSCONTEXTMANAGER.methods_by_name[
+        "CreateAccessLevel"
+    ]._serialized_options = b'\202\323\344\223\002:"*/v1/{parent=accessPolicies/*}/accessLevels:\014access_level\332A\023parent,access_level\312A4\n\013AccessLevel\022%AccessContextManagerOperationMetadata'
+    _ACCESSCONTEXTMANAGER.methods_by_name["UpdateAccessLevel"]._options = None
+    _ACCESSCONTEXTMANAGER.methods_by_name[
+        "UpdateAccessLevel"
+    ]._serialized_options = b"\202\323\344\223\002G27/v1/{access_level.name=accessPolicies/*/accessLevels/*}:\014access_level\332A\030access_level,update_mask\312A4\n\013AccessLevel\022%AccessContextManagerOperationMetadata"
+    _ACCESSCONTEXTMANAGER.methods_by_name["DeleteAccessLevel"]._options = None
+    _ACCESSCONTEXTMANAGER.methods_by_name[
+        "DeleteAccessLevel"
+    ]._serialized_options = b"\202\323\344\223\002,**/v1/{name=accessPolicies/*/accessLevels/*}\332A\004name\312A>\n\025google.protobuf.Empty\022%AccessContextManagerOperationMetadata"
+    _ACCESSCONTEXTMANAGER.methods_by_name["ReplaceAccessLevels"]._options = None
+    _ACCESSCONTEXTMANAGER.methods_by_name[
+        "ReplaceAccessLevels"
+    ]._serialized_options = b'\202\323\344\223\002:"5/v1/{parent=accessPolicies/*}/accessLevels:replaceAll:\001*\312AD\n\033ReplaceAccessLevelsResponse\022%AccessContextManagerOperationMetadata'
+    _ACCESSCONTEXTMANAGER.methods_by_name["ListServicePerimeters"]._options = None
+    _ACCESSCONTEXTMANAGER.methods_by_name[
+        "ListServicePerimeters"
+    ]._serialized_options = b"\202\323\344\223\0021\022//v1/{parent=accessPolicies/*}/servicePerimeters\332A\006parent"
+    _ACCESSCONTEXTMANAGER.methods_by_name["GetServicePerimeter"]._options = None
+    _ACCESSCONTEXTMANAGER.methods_by_name[
+        "GetServicePerimeter"
+    ]._serialized_options = b"\202\323\344\223\0021\022//v1/{name=accessPolicies/*/servicePerimeters/*}\332A\004name"
+    _ACCESSCONTEXTMANAGER.methods_by_name["CreateServicePerimeter"]._options = None
+    _ACCESSCONTEXTMANAGER.methods_by_name[
+        "CreateServicePerimeter"
+    ]._serialized_options = b'\202\323\344\223\002D"//v1/{parent=accessPolicies/*}/servicePerimeters:\021service_perimeter\332A\030parent,service_perimeter\312A9\n\020ServicePerimeter\022%AccessContextManagerOperationMetadata'
+    _ACCESSCONTEXTMANAGER.methods_by_name["UpdateServicePerimeter"]._options = None
+    _ACCESSCONTEXTMANAGER.methods_by_name[
+        "UpdateServicePerimeter"
+    ]._serialized_options = b"\202\323\344\223\002V2A/v1/{service_perimeter.name=accessPolicies/*/servicePerimeters/*}:\021service_perimeter\332A\035service_perimeter,update_mask\312A9\n\020ServicePerimeter\022%AccessContextManagerOperationMetadata"
+    _ACCESSCONTEXTMANAGER.methods_by_name["DeleteServicePerimeter"]._options = None
+    _ACCESSCONTEXTMANAGER.methods_by_name[
+        "DeleteServicePerimeter"
+    ]._serialized_options = b"\202\323\344\223\0021*//v1/{name=accessPolicies/*/servicePerimeters/*}\332A\004name\312A>\n\025google.protobuf.Empty\022%AccessContextManagerOperationMetadata"
+    _ACCESSCONTEXTMANAGER.methods_by_name["ReplaceServicePerimeters"]._options = None
+    _ACCESSCONTEXTMANAGER.methods_by_name[
+        "ReplaceServicePerimeters"
+    ]._serialized_options = b'\202\323\344\223\002?":/v1/{parent=accessPolicies/*}/servicePerimeters:replaceAll:\001*\312AI\n ReplaceServicePerimetersResponse\022%AccessContextManagerOperationMetadata'
+    _ACCESSCONTEXTMANAGER.methods_by_name["CommitServicePerimeters"]._options = None
+    _ACCESSCONTEXTMANAGER.methods_by_name[
+        "CommitServicePerimeters"
+    ]._serialized_options = b'\202\323\344\223\002;"6/v1/{parent=accessPolicies/*}/servicePerimeters:commit:\001*\312AH\n\037CommitServicePerimetersResponse\022%AccessContextManagerOperationMetadata'
+    _ACCESSCONTEXTMANAGER.methods_by_name["ListGcpUserAccessBindings"]._options = None
+    _ACCESSCONTEXTMANAGER.methods_by_name[
+        "ListGcpUserAccessBindings"
+    ]._serialized_options = b"\202\323\344\223\0024\0222/v1/{parent=organizations/*}/gcpUserAccessBindings\332A\006parent"
+    _ACCESSCONTEXTMANAGER.methods_by_name["GetGcpUserAccessBinding"]._options = None
+    _ACCESSCONTEXTMANAGER.methods_by_name[
+        "GetGcpUserAccessBinding"
+    ]._serialized_options = b"\202\323\344\223\0024\0222/v1/{name=organizations/*/gcpUserAccessBindings/*}\332A\004name"
+    _ACCESSCONTEXTMANAGER.methods_by_name["CreateGcpUserAccessBinding"]._options = None
+    _ACCESSCONTEXTMANAGER.methods_by_name[
+        "CreateGcpUserAccessBinding"
+    ]._serialized_options = b'\202\323\344\223\002M"2/v1/{parent=organizations/*}/gcpUserAccessBindings:\027gcp_user_access_binding\332A\036parent,gcp_user_access_binding\312A=\n\024GcpUserAccessBinding\022%GcpUserAccessBindingOperationMetadata'
+    _ACCESSCONTEXTMANAGER.methods_by_name["UpdateGcpUserAccessBinding"]._options = None
+    _ACCESSCONTEXTMANAGER.methods_by_name[
+        "UpdateGcpUserAccessBinding"
+    ]._serialized_options = b"\202\323\344\223\002e2J/v1/{gcp_user_access_binding.name=organizations/*/gcpUserAccessBindings/*}:\027gcp_user_access_binding\332A#gcp_user_access_binding,update_mask\312A=\n\024GcpUserAccessBinding\022%GcpUserAccessBindingOperationMetadata"
+    _ACCESSCONTEXTMANAGER.methods_by_name["DeleteGcpUserAccessBinding"]._options = None
+    _ACCESSCONTEXTMANAGER.methods_by_name[
+        "DeleteGcpUserAccessBinding"
+    ]._serialized_options = b"\202\323\344\223\0024*2/v1/{name=organizations/*/gcpUserAccessBindings/*}\332A\004name\312A>\n\025google.protobuf.Empty\022%GcpUserAccessBindingOperationMetadata"
+    _ACCESSCONTEXTMANAGER.methods_by_name["SetIamPolicy"]._options = None
+    _ACCESSCONTEXTMANAGER.methods_by_name[
+        "SetIamPolicy"
+    ]._serialized_options = (
+        b'\202\323\344\223\0021",/v1/{resource=accessPolicies/*}:setIamPolicy:\001*'
+    )
+    _ACCESSCONTEXTMANAGER.methods_by_name["GetIamPolicy"]._options = None
+    _ACCESSCONTEXTMANAGER.methods_by_name[
+        "GetIamPolicy"
+    ]._serialized_options = (
+        b'\202\323\344\223\0021",/v1/{resource=accessPolicies/*}:getIamPolicy:\001*'
+    )
+    _ACCESSCONTEXTMANAGER.methods_by_name["TestIamPermissions"]._options = None
+    _ACCESSCONTEXTMANAGER.methods_by_name[
+        "TestIamPermissions"
+    ]._serialized_options = b'\202\323\344\223\002\314\001"2/v1/{resource=accessPolicies/*}:testIamPermissions:\001*ZF"A/v1/{resource=accessPolicies/*/accessLevels/*}:testIamPermissions:\001*ZK"F/v1/{resource=accessPolicies/*/servicePerimeters/*}:testIamPermissions:\001*'
+    _LEVELFORMAT._serialized_start = 5065
+    _LEVELFORMAT._serialized_end = 5133
+    _LISTACCESSPOLICIESREQUEST._serialized_start = 617
+    _LISTACCESSPOLICIESREQUEST._serialized_end = 757
+    _LISTACCESSPOLICIESRESPONSE._serialized_start = 760
+    _LISTACCESSPOLICIESRESPONSE._serialized_end = 893
+    _GETACCESSPOLICYREQUEST._serialized_start = 895
+    _GETACCESSPOLICYREQUEST._serialized_end = 991
+    _UPDATEACCESSPOLICYREQUEST._serialized_start = 994
+    _UPDATEACCESSPOLICYREQUEST._serialized_end = 1151
+    _DELETEACCESSPOLICYREQUEST._serialized_start = 1153
+    _DELETEACCESSPOLICYREQUEST._serialized_end = 1252
+    _LISTACCESSLEVELSREQUEST._serialized_start = 1255
+    _LISTACCESSLEVELSREQUEST._serialized_end = 1475
+    _LISTACCESSLEVELSRESPONSE._serialized_start = 1478
+    _LISTACCESSLEVELSRESPONSE._serialized_end = 1606
+    _GETACCESSLEVELREQUEST._serialized_start = 1609
+    _GETACCESSLEVELREQUEST._serialized_end = 1786
+    _CREATEACCESSLEVELREQUEST._serialized_start = 1789
+    _CREATEACCESSLEVELREQUEST._serialized_end = 1969
+    _UPDATEACCESSLEVELREQUEST._serialized_start = 1972
+    _UPDATEACCESSLEVELREQUEST._serialized_end = 2133
+    _DELETEACCESSLEVELREQUEST._serialized_start = 2135
+    _DELETEACCESSLEVELREQUEST._serialized_end = 2232
+    _REPLACEACCESSLEVELSREQUEST._serialized_start = 2235
+    _REPLACEACCESSLEVELSREQUEST._serialized_end = 2432
+    _REPLACEACCESSLEVELSRESPONSE._serialized_start = 2434
+    _REPLACEACCESSLEVELSRESPONSE._serialized_end = 2540
+    _LISTSERVICEPERIMETERSREQUEST._serialized_start = 2543
+    _LISTSERVICEPERIMETERSREQUEST._serialized_end = 2690
+    _LISTSERVICEPERIMETERSRESPONSE._serialized_start = 2693
+    _LISTSERVICEPERIMETERSRESPONSE._serialized_end = 2836
+    _GETSERVICEPERIMETERREQUEST._serialized_start = 2838
+    _GETSERVICEPERIMETERREQUEST._serialized_end = 2942
+    _CREATESERVICEPERIMETERREQUEST._serialized_start = 2945
+    _CREATESERVICEPERIMETERREQUEST._serialized_end = 3145
+    _UPDATESERVICEPERIMETERREQUEST._serialized_start = 3148
+    _UPDATESERVICEPERIMETERREQUEST._serialized_end = 3324
+    _DELETESERVICEPERIMETERREQUEST._serialized_start = 3326
+    _DELETESERVICEPERIMETERREQUEST._serialized_end = 3433
+    _REPLACESERVICEPERIMETERSREQUEST._serialized_start = 3436
+    _REPLACESERVICEPERIMETERSREQUEST._serialized_end = 3653
+    _REPLACESERVICEPERIMETERSRESPONSE._serialized_start = 3655
+    _REPLACESERVICEPERIMETERSRESPONSE._serialized_end = 3776
+    _COMMITSERVICEPERIMETERSREQUEST._serialized_start = 3778
+    _COMMITSERVICEPERIMETERSREQUEST._serialized_end = 3902
+    _COMMITSERVICEPERIMETERSRESPONSE._serialized_start = 3904
+    _COMMITSERVICEPERIMETERSRESPONSE._serialized_end = 4024
+    _LISTGCPUSERACCESSBINDINGSREQUEST._serialized_start = 4027
+    _LISTGCPUSERACCESSBINDINGSREQUEST._serialized_end = 4184
+    _LISTGCPUSERACCESSBINDINGSRESPONSE._serialized_start = 4187
+    _LISTGCPUSERACCESSBINDINGSRESPONSE._serialized_end = 4344
+    _GETGCPUSERACCESSBINDINGREQUEST._serialized_start = 4346
+    _GETGCPUSERACCESSBINDINGREQUEST._serialized_end = 4458
+    _CREATEGCPUSERACCESSBINDINGREQUEST._serialized_start = 4461
+    _CREATEGCPUSERACCESSBINDINGREQUEST._serialized_end = 4671
+    _UPDATEGCPUSERACCESSBINDINGREQUEST._serialized_start = 4674
+    _UPDATEGCPUSERACCESSBINDINGREQUEST._serialized_end = 4864
+    _DELETEGCPUSERACCESSBINDINGREQUEST._serialized_start = 4866
+    _DELETEGCPUSERACCESSBINDINGREQUEST._serialized_end = 4981
+    _GCPUSERACCESSBINDINGOPERATIONMETADATA._serialized_start = 4983
+    _GCPUSERACCESSBINDINGOPERATIONMETADATA._serialized_end = 5022
+    _ACCESSCONTEXTMANAGEROPERATIONMETADATA._serialized_start = 5024
+    _ACCESSCONTEXTMANAGEROPERATIONMETADATA._serialized_end = 5063
+    _ACCESSCONTEXTMANAGER._serialized_start = 5136
+    _ACCESSCONTEXTMANAGER._serialized_end = 11649
+# @@protoc_insertion_point(module_scope)
diff --git a/google/identity/accesscontextmanager/v1/access_level.proto b/google/identity/accesscontextmanager/v1/access_level.proto
index 0ebd193..9c2db6c 100644
--- a/google/identity/accesscontextmanager/v1/access_level.proto
+++ b/google/identity/accesscontextmanager/v1/access_level.proto
@@ -1,4 +1,4 @@
-// Copyright 2020 Google LLC
+// Copyright 2022 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -16,28 +16,33 @@ syntax = "proto3";
 
 package google.identity.accesscontextmanager.v1;
 
+import "google/api/resource.proto";
 import "google/identity/accesscontextmanager/type/device_resources.proto";
 import "google/protobuf/timestamp.proto";
 import "google/type/expr.proto";
-import "google/api/annotations.proto";
 
 option csharp_namespace = "Google.Identity.AccessContextManager.V1";
-option go_package = "google.golang.org/genproto/googleapis/identity/accesscontextmanager/v1;accesscontextmanager";
+option go_package = "cloud.google.com/go/accesscontextmanager/apiv1/accesscontextmanagerpb;accesscontextmanagerpb";
 option java_multiple_files = true;
 option java_outer_classname = "AccessLevelProto";
 option java_package = "com.google.identity.accesscontextmanager.v1";
+option objc_class_prefix = "GACM";
 option php_namespace = "Google\\Identity\\AccessContextManager\\V1";
 option ruby_package = "Google::Identity::AccessContextManager::V1";
-option objc_class_prefix = "GACM";
 
 // An `AccessLevel` is a label that can be applied to requests to Google Cloud
 // services, along with a list of requirements necessary for the label to be
 // applied.
 message AccessLevel {
+  option (google.api.resource) = {
+    type: "accesscontextmanager.googleapis.com/AccessLevel"
+    pattern: "accessPolicies/{access_policy}/accessLevels/{access_level}"
+  };
+
   // Required. Resource name for the Access Level. The `short_name` component
   // must begin with a letter and only include alphanumeric and '_'. Format:
-  // `accessPolicies/{policy_id}/accessLevels/{short_name}`. The maximum length
-  // of the `short_name` component is 50 characters.
+  // `accessPolicies/{access_policy}/accessLevels/{access_level}`. The maximum
+  // length of the `access_level` component is 50 characters.
   string name = 1;
 
   // Human readable title. Must be unique within the Policy.
diff --git a/google/identity/accesscontextmanager/v1/access_level_pb2.py b/google/identity/accesscontextmanager/v1/access_level_pb2.py
index 88e96cc..35b4624 100644
--- a/google/identity/accesscontextmanager/v1/access_level_pb2.py
+++ b/google/identity/accesscontextmanager/v1/access_level_pb2.py
@@ -28,16 +28,16 @@
 _sym_db = _symbol_database.Default()
 
 
+from google.api import resource_pb2 as google_dot_api_dot_resource__pb2
 from google.identity.accesscontextmanager.type import (
     device_resources_pb2 as google_dot_identity_dot_accesscontextmanager_dot_type_dot_device__resources__pb2,
 )
 from google.protobuf import timestamp_pb2 as google_dot_protobuf_dot_timestamp__pb2
 from google.type import expr_pb2 as google_dot_type_dot_expr__pb2
-from google.api import annotations_pb2 as google_dot_api_dot_annotations__pb2
 
 
 DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(
-    b'\n:google/identity/accesscontextmanager/v1/access_level.proto\x12\'google.identity.accesscontextmanager.v1\x1a@google/identity/accesscontextmanager/type/device_resources.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x16google/type/expr.proto\x1a\x1cgoogle/api/annotations.proto"\xb8\x02\n\x0b\x41\x63\x63\x65ssLevel\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\r\n\x05title\x18\x02 \x01(\t\x12\x13\n\x0b\x64\x65scription\x18\x03 \x01(\t\x12\x44\n\x05\x62\x61sic\x18\x04 \x01(\x0b\x32\x33.google.identity.accesscontextmanager.v1.BasicLevelH\x00\x12\x46\n\x06\x63ustom\x18\x05 \x01(\x0b\x32\x34.google.identity.accesscontextmanager.v1.CustomLevelH\x00\x12/\n\x0b\x63reate_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0bupdate_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x07\n\x05level"\xef\x01\n\nBasicLevel\x12\x46\n\nconditions\x18\x01 \x03(\x0b\x32\x32.google.identity.accesscontextmanager.v1.Condition\x12j\n\x12\x63ombining_function\x18\x02 \x01(\x0e\x32N.google.identity.accesscontextmanager.v1.BasicLevel.ConditionCombiningFunction"-\n\x1a\x43onditionCombiningFunction\x12\x07\n\x03\x41ND\x10\x00\x12\x06\n\x02OR\x10\x01"\xc3\x01\n\tCondition\x12\x16\n\x0eip_subnetworks\x18\x01 \x03(\t\x12L\n\rdevice_policy\x18\x02 \x01(\x0b\x32\x35.google.identity.accesscontextmanager.v1.DevicePolicy\x12\x1e\n\x16required_access_levels\x18\x03 \x03(\t\x12\x0e\n\x06negate\x18\x05 \x01(\x08\x12\x0f\n\x07members\x18\x06 \x03(\t\x12\x0f\n\x07regions\x18\x07 \x03(\t".\n\x0b\x43ustomLevel\x12\x1f\n\x04\x65xpr\x18\x01 \x01(\x0b\x32\x11.google.type.Expr"\x89\x03\n\x0c\x44\x65vicePolicy\x12\x1a\n\x12require_screenlock\x18\x01 \x01(\x08\x12\x66\n\x1b\x61llowed_encryption_statuses\x18\x02 \x03(\x0e\x32\x41.google.identity.accesscontextmanager.type.DeviceEncryptionStatus\x12M\n\x0eos_constraints\x18\x03 \x03(\x0b\x32\x35.google.identity.accesscontextmanager.v1.OsConstraint\x12j\n allowed_device_management_levels\x18\x06 \x03(\x0e\x32@.google.identity.accesscontextmanager.type.DeviceManagementLevel\x12\x1e\n\x16require_admin_approval\x18\x07 \x01(\x08\x12\x1a\n\x12require_corp_owned\x18\x08 \x01(\x08"\x8f\x01\n\x0cOsConstraint\x12\x42\n\x07os_type\x18\x01 \x01(\x0e\x32\x31.google.identity.accesscontextmanager.type.OsType\x12\x17\n\x0fminimum_version\x18\x02 \x01(\t\x12"\n\x1arequire_verified_chrome_os\x18\x03 \x01(\x08\x42\xa6\x02\n+com.google.identity.accesscontextmanager.v1B\x10\x41\x63\x63\x65ssLevelProtoP\x01Z[google.golang.org/genproto/googleapis/identity/accesscontextmanager/v1;accesscontextmanager\xa2\x02\x04GACM\xaa\x02\'Google.Identity.AccessContextManager.V1\xca\x02\'Google\\Identity\\AccessContextManager\\V1\xea\x02*Google::Identity::AccessContextManager::V1b\x06proto3'
+    b'\n:google/identity/accesscontextmanager/v1/access_level.proto\x12\'google.identity.accesscontextmanager.v1\x1a\x19google/api/resource.proto\x1a@google/identity/accesscontextmanager/type/device_resources.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x16google/type/expr.proto"\xaa\x03\n\x0b\x41\x63\x63\x65ssLevel\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\r\n\x05title\x18\x02 \x01(\t\x12\x13\n\x0b\x64\x65scription\x18\x03 \x01(\t\x12\x44\n\x05\x62\x61sic\x18\x04 \x01(\x0b\x32\x33.google.identity.accesscontextmanager.v1.BasicLevelH\x00\x12\x46\n\x06\x63ustom\x18\x05 \x01(\x0b\x32\x34.google.identity.accesscontextmanager.v1.CustomLevelH\x00\x12/\n\x0b\x63reate_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0bupdate_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp:p\xea\x41m\n/accesscontextmanager.googleapis.com/AccessLevel\x12:accessPolicies/{access_policy}/accessLevels/{access_level}B\x07\n\x05level"\xef\x01\n\nBasicLevel\x12\x46\n\nconditions\x18\x01 \x03(\x0b\x32\x32.google.identity.accesscontextmanager.v1.Condition\x12j\n\x12\x63ombining_function\x18\x02 \x01(\x0e\x32N.google.identity.accesscontextmanager.v1.BasicLevel.ConditionCombiningFunction"-\n\x1a\x43onditionCombiningFunction\x12\x07\n\x03\x41ND\x10\x00\x12\x06\n\x02OR\x10\x01"\xc3\x01\n\tCondition\x12\x16\n\x0eip_subnetworks\x18\x01 \x03(\t\x12L\n\rdevice_policy\x18\x02 \x01(\x0b\x32\x35.google.identity.accesscontextmanager.v1.DevicePolicy\x12\x1e\n\x16required_access_levels\x18\x03 \x03(\t\x12\x0e\n\x06negate\x18\x05 \x01(\x08\x12\x0f\n\x07members\x18\x06 \x03(\t\x12\x0f\n\x07regions\x18\x07 \x03(\t".\n\x0b\x43ustomLevel\x12\x1f\n\x04\x65xpr\x18\x01 \x01(\x0b\x32\x11.google.type.Expr"\x89\x03\n\x0c\x44\x65vicePolicy\x12\x1a\n\x12require_screenlock\x18\x01 \x01(\x08\x12\x66\n\x1b\x61llowed_encryption_statuses\x18\x02 \x03(\x0e\x32\x41.google.identity.accesscontextmanager.type.DeviceEncryptionStatus\x12M\n\x0eos_constraints\x18\x03 \x03(\x0b\x32\x35.google.identity.accesscontextmanager.v1.OsConstraint\x12j\n allowed_device_management_levels\x18\x06 \x03(\x0e\x32@.google.identity.accesscontextmanager.type.DeviceManagementLevel\x12\x1e\n\x16require_admin_approval\x18\x07 \x01(\x08\x12\x1a\n\x12require_corp_owned\x18\x08 \x01(\x08"\x8f\x01\n\x0cOsConstraint\x12\x42\n\x07os_type\x18\x01 \x01(\x0e\x32\x31.google.identity.accesscontextmanager.type.OsType\x12\x17\n\x0fminimum_version\x18\x02 \x01(\t\x12"\n\x1arequire_verified_chrome_os\x18\x03 \x01(\x08\x42\xa7\x02\n+com.google.identity.accesscontextmanager.v1B\x10\x41\x63\x63\x65ssLevelProtoP\x01Z\\cloud.google.com/go/accesscontextmanager/apiv1/accesscontextmanagerpb;accesscontextmanagerpb\xa2\x02\x04GACM\xaa\x02\'Google.Identity.AccessContextManager.V1\xca\x02\'Google\\Identity\\AccessContextManager\\V1\xea\x02*Google::Identity::AccessContextManager::V1b\x06proto3'
 )
 
 
@@ -119,19 +119,21 @@
 if _descriptor._USE_C_DESCRIPTORS == False:
 
     DESCRIPTOR._options = None
-    DESCRIPTOR._serialized_options = b"\n+com.google.identity.accesscontextmanager.v1B\020AccessLevelProtoP\001Z[google.golang.org/genproto/googleapis/identity/accesscontextmanager/v1;accesscontextmanager\242\002\004GACM\252\002'Google.Identity.AccessContextManager.V1\312\002'Google\\Identity\\AccessContextManager\\V1\352\002*Google::Identity::AccessContextManager::V1"
-    _ACCESSLEVEL._serialized_start = 257
-    _ACCESSLEVEL._serialized_end = 569
-    _BASICLEVEL._serialized_start = 572
-    _BASICLEVEL._serialized_end = 811
-    _BASICLEVEL_CONDITIONCOMBININGFUNCTION._serialized_start = 766
-    _BASICLEVEL_CONDITIONCOMBININGFUNCTION._serialized_end = 811
-    _CONDITION._serialized_start = 814
-    _CONDITION._serialized_end = 1009
-    _CUSTOMLEVEL._serialized_start = 1011
-    _CUSTOMLEVEL._serialized_end = 1057
-    _DEVICEPOLICY._serialized_start = 1060
-    _DEVICEPOLICY._serialized_end = 1453
-    _OSCONSTRAINT._serialized_start = 1456
-    _OSCONSTRAINT._serialized_end = 1599
+    DESCRIPTOR._serialized_options = b"\n+com.google.identity.accesscontextmanager.v1B\020AccessLevelProtoP\001Z\\cloud.google.com/go/accesscontextmanager/apiv1/accesscontextmanagerpb;accesscontextmanagerpb\242\002\004GACM\252\002'Google.Identity.AccessContextManager.V1\312\002'Google\\Identity\\AccessContextManager\\V1\352\002*Google::Identity::AccessContextManager::V1"
+    _ACCESSLEVEL._options = None
+    _ACCESSLEVEL._serialized_options = b"\352Am\n/accesscontextmanager.googleapis.com/AccessLevel\022:accessPolicies/{access_policy}/accessLevels/{access_level}"
+    _ACCESSLEVEL._serialized_start = 254
+    _ACCESSLEVEL._serialized_end = 680
+    _BASICLEVEL._serialized_start = 683
+    _BASICLEVEL._serialized_end = 922
+    _BASICLEVEL_CONDITIONCOMBININGFUNCTION._serialized_start = 877
+    _BASICLEVEL_CONDITIONCOMBININGFUNCTION._serialized_end = 922
+    _CONDITION._serialized_start = 925
+    _CONDITION._serialized_end = 1120
+    _CUSTOMLEVEL._serialized_start = 1122
+    _CUSTOMLEVEL._serialized_end = 1168
+    _DEVICEPOLICY._serialized_start = 1171
+    _DEVICEPOLICY._serialized_end = 1564
+    _OSCONSTRAINT._serialized_start = 1567
+    _OSCONSTRAINT._serialized_end = 1710
 # @@protoc_insertion_point(module_scope)
diff --git a/google/identity/accesscontextmanager/v1/access_policy.proto b/google/identity/accesscontextmanager/v1/access_policy.proto
index 9ec59d1..86d6541 100644
--- a/google/identity/accesscontextmanager/v1/access_policy.proto
+++ b/google/identity/accesscontextmanager/v1/access_policy.proto
@@ -1,4 +1,4 @@
-// Copyright 2020 Google LLC
+// Copyright 2022 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -16,17 +16,17 @@ syntax = "proto3";
 
 package google.identity.accesscontextmanager.v1;
 
+import "google/api/resource.proto";
 import "google/protobuf/timestamp.proto";
-import "google/api/annotations.proto";
 
 option csharp_namespace = "Google.Identity.AccessContextManager.V1";
-option go_package = "google.golang.org/genproto/googleapis/identity/accesscontextmanager/v1;accesscontextmanager";
+option go_package = "cloud.google.com/go/accesscontextmanager/apiv1/accesscontextmanagerpb;accesscontextmanagerpb";
 option java_multiple_files = true;
 option java_outer_classname = "PolicyProto";
 option java_package = "com.google.identity.accesscontextmanager.v1";
+option objc_class_prefix = "GACM";
 option php_namespace = "Google\\Identity\\AccessContextManager\\V1";
 option ruby_package = "Google::Identity::AccessContextManager::V1";
-option objc_class_prefix = "GACM";
 
 // `AccessPolicy` is a container for `AccessLevels` (which define the necessary
 // attributes to use Google Cloud services) and `ServicePerimeters` (which
@@ -34,8 +34,13 @@ option objc_class_prefix = "GACM";
 // access policy is globally visible within an organization, and the
 // restrictions it specifies apply to all projects within an organization.
 message AccessPolicy {
+  option (google.api.resource) = {
+    type: "accesscontextmanager.googleapis.com/AccessPolicy"
+    pattern: "accessPolicies/{access_policy}"
+  };
+
   // Output only. Resource name of the `AccessPolicy`. Format:
-  // `accessPolicies/{policy_id}`
+  // `accessPolicies/{access_policy}`
   string name = 1;
 
   // Required. The parent of this `AccessPolicy` in the Cloud Resource
@@ -46,6 +51,22 @@ message AccessPolicy {
   // Required. Human readable title. Does not affect behavior.
   string title = 3;
 
+  // The scopes of a policy define which resources an ACM policy can restrict,
+  // and where ACM resources can be referenced.
+  // For example, a policy with scopes=["folders/123"] has the following
+  // behavior:
+  // - vpcsc perimeters can only restrict projects within folders/123
+  // - access levels can only be referenced by resources within folders/123.
+  // If empty, there are no limitations on which resources can be restricted by
+  // an ACM policy, and there are no limitations on where ACM resources can be
+  // referenced.
+  // Only one policy can include a given scope (attempting to create a second
+  // policy which includes "folders/123" will result in an error).
+  // Currently, scopes cannot be modified after a policy is created.
+  // Currently, policies can only have a single scope.
+  // Format: list of `folders/{folder_number}` or `projects/{project_number}`
+  repeated string scopes = 7;
+
   // Output only. Time the `AccessPolicy` was created in UTC.
   google.protobuf.Timestamp create_time = 4;
 
diff --git a/google/identity/accesscontextmanager/v1/access_policy_pb2.py b/google/identity/accesscontextmanager/v1/access_policy_pb2.py
index 90e0776..965776c 100644
--- a/google/identity/accesscontextmanager/v1/access_policy_pb2.py
+++ b/google/identity/accesscontextmanager/v1/access_policy_pb2.py
@@ -28,12 +28,12 @@
 _sym_db = _symbol_database.Default()
 
 
+from google.api import resource_pb2 as google_dot_api_dot_resource__pb2
 from google.protobuf import timestamp_pb2 as google_dot_protobuf_dot_timestamp__pb2
-from google.api import annotations_pb2 as google_dot_api_dot_annotations__pb2
 
 
 DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(
-    b"\n;google/identity/accesscontextmanager/v1/access_policy.proto\x12'google.identity.accesscontextmanager.v1\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1cgoogle/api/annotations.proto\"\xab\x01\n\x0c\x41\x63\x63\x65ssPolicy\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x0e\n\x06parent\x18\x02 \x01(\t\x12\r\n\x05title\x18\x03 \x01(\t\x12/\n\x0b\x63reate_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0bupdate_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x0c\n\x04\x65tag\x18\x06 \x01(\tB\xa1\x02\n+com.google.identity.accesscontextmanager.v1B\x0bPolicyProtoP\x01Z[google.golang.org/genproto/googleapis/identity/accesscontextmanager/v1;accesscontextmanager\xa2\x02\x04GACM\xaa\x02'Google.Identity.AccessContextManager.V1\xca\x02'Google\\Identity\\AccessContextManager\\V1\xea\x02*Google::Identity::AccessContextManager::V1b\x06proto3"
+    b"\n;google/identity/accesscontextmanager/v1/access_policy.proto\x12'google.identity.accesscontextmanager.v1\x1a\x19google/api/resource.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"\x92\x02\n\x0c\x41\x63\x63\x65ssPolicy\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x0e\n\x06parent\x18\x02 \x01(\t\x12\r\n\x05title\x18\x03 \x01(\t\x12\x0e\n\x06scopes\x18\x07 \x03(\t\x12/\n\x0b\x63reate_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0bupdate_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x0c\n\x04\x65tag\x18\x06 \x01(\t:U\xea\x41R\n0accesscontextmanager.googleapis.com/AccessPolicy\x12\x1e\x61\x63\x63\x65ssPolicies/{access_policy}B\xa2\x02\n+com.google.identity.accesscontextmanager.v1B\x0bPolicyProtoP\x01Z\\cloud.google.com/go/accesscontextmanager/apiv1/accesscontextmanagerpb;accesscontextmanagerpb\xa2\x02\x04GACM\xaa\x02'Google.Identity.AccessContextManager.V1\xca\x02'Google\\Identity\\AccessContextManager\\V1\xea\x02*Google::Identity::AccessContextManager::V1b\x06proto3"
 )
 
 
@@ -52,7 +52,9 @@
 if _descriptor._USE_C_DESCRIPTORS == False:
 
     DESCRIPTOR._options = None
-    DESCRIPTOR._serialized_options = b"\n+com.google.identity.accesscontextmanager.v1B\013PolicyProtoP\001Z[google.golang.org/genproto/googleapis/identity/accesscontextmanager/v1;accesscontextmanager\242\002\004GACM\252\002'Google.Identity.AccessContextManager.V1\312\002'Google\\Identity\\AccessContextManager\\V1\352\002*Google::Identity::AccessContextManager::V1"
-    _ACCESSPOLICY._serialized_start = 168
-    _ACCESSPOLICY._serialized_end = 339
+    DESCRIPTOR._serialized_options = b"\n+com.google.identity.accesscontextmanager.v1B\013PolicyProtoP\001Z\\cloud.google.com/go/accesscontextmanager/apiv1/accesscontextmanagerpb;accesscontextmanagerpb\242\002\004GACM\252\002'Google.Identity.AccessContextManager.V1\312\002'Google\\Identity\\AccessContextManager\\V1\352\002*Google::Identity::AccessContextManager::V1"
+    _ACCESSPOLICY._options = None
+    _ACCESSPOLICY._serialized_options = b"\352AR\n0accesscontextmanager.googleapis.com/AccessPolicy\022\036accessPolicies/{access_policy}"
+    _ACCESSPOLICY._serialized_start = 165
+    _ACCESSPOLICY._serialized_end = 439
 # @@protoc_insertion_point(module_scope)
diff --git a/google/identity/accesscontextmanager/v1/gcp_user_access_binding.proto b/google/identity/accesscontextmanager/v1/gcp_user_access_binding.proto
new file mode 100644
index 0000000..4a296d5
--- /dev/null
+++ b/google/identity/accesscontextmanager/v1/gcp_user_access_binding.proto
@@ -0,0 +1,68 @@
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.identity.accesscontextmanager.v1;
+
+import "google/api/field_behavior.proto";
+import "google/api/resource.proto";
+
+option csharp_namespace = "Google.Identity.AccessContextManager.V1";
+option go_package = "cloud.google.com/go/accesscontextmanager/apiv1/accesscontextmanagerpb;accesscontextmanagerpb";
+option java_multiple_files = true;
+option java_outer_classname = "GcpUserAccessBindingProto";
+option java_package = "com.google.identity.accesscontextmanager.v1";
+option objc_class_prefix = "GACM";
+option php_namespace = "Google\\Identity\\AccessContextManager\\V1";
+option ruby_package = "Google::Identity::AccessContextManager::V1";
+
+// Restricts access to Cloud Console and Google Cloud APIs for a set of users
+// using Context-Aware Access.
+message GcpUserAccessBinding {
+  option (google.api.resource) = {
+    type: "accesscontextmanager.googleapis.com/GcpUserAccessBinding"
+    pattern: "organizations/{organization}/gcpUserAccessBindings/{gcp_user_access_binding}"
+  };
+
+  // Immutable. Assigned by the server during creation. The last segment has an arbitrary
+  // length and has only URI unreserved characters (as defined by
+  // [RFC 3986 Section 2.3](https://tools.ietf.org/html/rfc3986#section-2.3)).
+  // Should not be specified by the client during creation.
+  // Example: "organizations/256/gcpUserAccessBindings/b3-BhcX_Ud5N"
+  string name = 1 [(google.api.field_behavior) = IMMUTABLE];
+
+  // Required. Immutable. Google Group id whose members are subject to this binding's restrictions.
+  // See "id" in the [G Suite Directory API's Groups resource]
+  // (https://developers.google.com/admin-sdk/directory/v1/reference/groups#resource).
+  // If a group's email address/alias is changed, this resource will continue
+  // to point at the changed group. This field does not accept group email
+  // addresses or aliases.
+  // Example: "01d520gv4vjcrht"
+  string group_key = 2 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.field_behavior) = IMMUTABLE
+  ];
+
+  // Required. Access level that a user must have to be granted access. Only one access
+  // level is supported, not multiple. This repeated field must have exactly
+  // one element.
+  // Example: "accessPolicies/9522/accessLevels/device_trusted"
+  repeated string access_levels = 3 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "accesscontextmanager.googleapis.com/AccessLevel"
+    }
+  ];
+}
diff --git a/google/identity/accesscontextmanager/v1/gcp_user_access_binding_pb2.py b/google/identity/accesscontextmanager/v1/gcp_user_access_binding_pb2.py
new file mode 100644
index 0000000..67e850a
--- /dev/null
+++ b/google/identity/accesscontextmanager/v1/gcp_user_access_binding_pb2.py
@@ -0,0 +1,72 @@
+# -*- coding: utf-8 -*-
+
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# source: google/identity/accesscontextmanager/v1/gcp_user_access_binding.proto
+"""Generated protocol buffer code."""
+from google.protobuf import descriptor as _descriptor
+from google.protobuf import descriptor_pool as _descriptor_pool
+from google.protobuf import message as _message
+from google.protobuf import reflection as _reflection
+from google.protobuf import symbol_database as _symbol_database
+
+# @@protoc_insertion_point(imports)
+
+_sym_db = _symbol_database.Default()
+
+
+from google.api import field_behavior_pb2 as google_dot_api_dot_field__behavior__pb2
+from google.api import resource_pb2 as google_dot_api_dot_resource__pb2
+
+
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(
+    b"\nEgoogle/identity/accesscontextmanager/v1/gcp_user_access_binding.proto\x12'google.identity.accesscontextmanager.v1\x1a\x1fgoogle/api/field_behavior.proto\x1a\x19google/api/resource.proto\"\xa3\x02\n\x14GcpUserAccessBinding\x12\x11\n\x04name\x18\x01 \x01(\tB\x03\xe0\x41\x05\x12\x19\n\tgroup_key\x18\x02 \x01(\tB\x06\xe0\x41\x02\xe0\x41\x05\x12N\n\raccess_levels\x18\x03 \x03(\tB7\xe0\x41\x02\xfa\x41\x31\n/accesscontextmanager.googleapis.com/AccessLevel:\x8c\x01\xea\x41\x88\x01\n8accesscontextmanager.googleapis.com/GcpUserAccessBinding\x12Lorganizations/{organization}/gcpUserAccessBindings/{gcp_user_access_binding}B\xb0\x02\n+com.google.identity.accesscontextmanager.v1B\x19GcpUserAccessBindingProtoP\x01Z\\cloud.google.com/go/accesscontextmanager/apiv1/accesscontextmanagerpb;accesscontextmanagerpb\xa2\x02\x04GACM\xaa\x02'Google.Identity.AccessContextManager.V1\xca\x02'Google\\Identity\\AccessContextManager\\V1\xea\x02*Google::Identity::AccessContextManager::V1b\x06proto3"
+)
+
+
+_GCPUSERACCESSBINDING = DESCRIPTOR.message_types_by_name["GcpUserAccessBinding"]
+GcpUserAccessBinding = _reflection.GeneratedProtocolMessageType(
+    "GcpUserAccessBinding",
+    (_message.Message,),
+    {
+        "DESCRIPTOR": _GCPUSERACCESSBINDING,
+        "__module__": "google.identity.accesscontextmanager.v1.gcp_user_access_binding_pb2"
+        # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.GcpUserAccessBinding)
+    },
+)
+_sym_db.RegisterMessage(GcpUserAccessBinding)
+
+if _descriptor._USE_C_DESCRIPTORS == False:
+
+    DESCRIPTOR._options = None
+    DESCRIPTOR._serialized_options = b"\n+com.google.identity.accesscontextmanager.v1B\031GcpUserAccessBindingProtoP\001Z\\cloud.google.com/go/accesscontextmanager/apiv1/accesscontextmanagerpb;accesscontextmanagerpb\242\002\004GACM\252\002'Google.Identity.AccessContextManager.V1\312\002'Google\\Identity\\AccessContextManager\\V1\352\002*Google::Identity::AccessContextManager::V1"
+    _GCPUSERACCESSBINDING.fields_by_name["name"]._options = None
+    _GCPUSERACCESSBINDING.fields_by_name["name"]._serialized_options = b"\340A\005"
+    _GCPUSERACCESSBINDING.fields_by_name["group_key"]._options = None
+    _GCPUSERACCESSBINDING.fields_by_name[
+        "group_key"
+    ]._serialized_options = b"\340A\002\340A\005"
+    _GCPUSERACCESSBINDING.fields_by_name["access_levels"]._options = None
+    _GCPUSERACCESSBINDING.fields_by_name[
+        "access_levels"
+    ]._serialized_options = (
+        b"\340A\002\372A1\n/accesscontextmanager.googleapis.com/AccessLevel"
+    )
+    _GCPUSERACCESSBINDING._options = None
+    _GCPUSERACCESSBINDING._serialized_options = b"\352A\210\001\n8accesscontextmanager.googleapis.com/GcpUserAccessBinding\022Lorganizations/{organization}/gcpUserAccessBindings/{gcp_user_access_binding}"
+    _GCPUSERACCESSBINDING._serialized_start = 175
+    _GCPUSERACCESSBINDING._serialized_end = 466
+# @@protoc_insertion_point(module_scope)
diff --git a/google/identity/accesscontextmanager/v1/service_perimeter.proto b/google/identity/accesscontextmanager/v1/service_perimeter.proto
index 89d7681..03c324d 100644
--- a/google/identity/accesscontextmanager/v1/service_perimeter.proto
+++ b/google/identity/accesscontextmanager/v1/service_perimeter.proto
@@ -1,4 +1,4 @@
-// Copyright 2020 Google LLC
+// Copyright 2022 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -16,17 +16,17 @@ syntax = "proto3";
 
 package google.identity.accesscontextmanager.v1;
 
+import "google/api/resource.proto";
 import "google/protobuf/timestamp.proto";
-import "google/api/annotations.proto";
 
 option csharp_namespace = "Google.Identity.AccessContextManager.V1";
-option go_package = "google.golang.org/genproto/googleapis/identity/accesscontextmanager/v1;accesscontextmanager";
+option go_package = "cloud.google.com/go/accesscontextmanager/apiv1/accesscontextmanagerpb;accesscontextmanagerpb";
 option java_multiple_files = true;
 option java_outer_classname = "ServicePerimeterProto";
 option java_package = "com.google.identity.accesscontextmanager.v1";
+option objc_class_prefix = "GACM";
 option php_namespace = "Google\\Identity\\AccessContextManager\\V1";
 option ruby_package = "Google::Identity::AccessContextManager::V1";
-option objc_class_prefix = "GACM";
 
 // `ServicePerimeter` describes a set of Google Cloud resources which can freely
 // import and export data amongst themselves, but not export outside of the
@@ -39,6 +39,11 @@ option objc_class_prefix = "GACM";
 // a single Google Cloud project may belong to multiple Service Perimeter
 // Bridges.
 message ServicePerimeter {
+  option (google.api.resource) = {
+    type: "accesscontextmanager.googleapis.com/ServicePerimeter"
+    pattern: "accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}"
+  };
+
   // Specifies the type of the Perimeter. There are two types: regular and
   // bridge. Regular Service Perimeter contains resources, access levels, and
   // restricted services. Every resource can be in at most ONE
@@ -64,7 +69,8 @@ message ServicePerimeter {
 
   // Required. Resource name for the ServicePerimeter.  The `short_name`
   // component must begin with a letter and only include alphanumeric and '_'.
-  // Format: `accessPolicies/{policy_id}/servicePerimeters/{short_name}`
+  // Format:
+  // `accessPolicies/{access_policy}/servicePerimeters/{service_perimeter}`
   string name = 1;
 
   // Human readable title. Must be unique within the Policy.
@@ -123,10 +129,304 @@ message ServicePerimeterConfig {
     bool enable_restriction = 1;
 
     // The list of APIs usable within the Service Perimeter. Must be empty
-    // unless 'enable_restriction' is True.
+    // unless 'enable_restriction' is True. You can specify a list of individual
+    // services, as well as include the 'RESTRICTED-SERVICES' value, which
+    // automatically includes all of the services protected by the perimeter.
     repeated string allowed_services = 2;
   }
 
+  // Specifies the types of identities that are allowed access in either
+  // [IngressFrom]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IngressFrom]
+  // or [EgressFrom]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressFrom]
+  // rules.
+  enum IdentityType {
+    // No blanket identity group specified.
+    IDENTITY_TYPE_UNSPECIFIED = 0;
+
+    // Authorize access from all identities outside the perimeter.
+    ANY_IDENTITY = 1;
+
+    // Authorize access from all human users outside the perimeter.
+    ANY_USER_ACCOUNT = 2;
+
+    // Authorize access from all service accounts outside the perimeter.
+    ANY_SERVICE_ACCOUNT = 3;
+  }
+
+  // An allowed method or permission of a service specified in [ApiOperation]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.ApiOperation].
+  message MethodSelector {
+    // The API method name or Cloud IAM permission name to allow.
+    oneof kind {
+      // Value for `method` should be a valid method name for the corresponding
+      // `service_name` in [ApiOperation]
+      // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.ApiOperation].
+      // If `*` used as value for `method`, then ALL methods and permissions are
+      // allowed.
+      string method = 1;
+
+      // Value for `permission` should be a valid Cloud IAM permission for the
+      // corresponding `service_name` in [ApiOperation]
+      // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.ApiOperation].
+      string permission = 2;
+    }
+  }
+
+  // Identification for an API Operation.
+  message ApiOperation {
+    // The name of the API whose methods or permissions the [IngressPolicy]
+    // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IngressPolicy]
+    // or [EgressPolicy]
+    // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressPolicy]
+    // want to allow. A single [ApiOperation]
+    // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.ApiOperation]
+    // with `service_name` field set to `*` will allow all methods AND
+    // permissions for all services.
+    string service_name = 1;
+
+    // API methods or permissions to allow. Method or permission must belong to
+    // the service specified by `service_name` field. A single [MethodSelector]
+    // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.MethodSelector]
+    // entry with `*` specified for the `method` field will allow all methods
+    // AND permissions for the service specified in `service_name`.
+    repeated MethodSelector method_selectors = 2;
+  }
+
+  // The source that [IngressPolicy]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IngressPolicy]
+  // authorizes access from.
+  message IngressSource {
+    // Allowed ingress source. It can be one of [AccessLevel]
+    // [google.identity.accesscontextmanager.v1.AccessLevel] or Google
+    // Cloud resource.
+    oneof source {
+      // An [AccessLevel]
+      // [google.identity.accesscontextmanager.v1.AccessLevel] resource
+      // name that allow resources within the [ServicePerimeters]
+      // [google.identity.accesscontextmanager.v1.ServicePerimeter] to be
+      // accessed from the internet. [AccessLevels]
+      // [google.identity.accesscontextmanager.v1.AccessLevel] listed must
+      // be in the same policy as this [ServicePerimeter]
+      // [google.identity.accesscontextmanager.v1.ServicePerimeter].
+      // Referencing a nonexistent [AccessLevel]
+      // [google.identity.accesscontextmanager.v1.AccessLevel] will cause
+      // an error. If no [AccessLevel]
+      // [google.identity.accesscontextmanager.v1.AccessLevel] names are
+      // listed, resources within the perimeter can only be accessed via Google
+      // Cloud calls with request origins within the perimeter. Example:
+      // `accessPolicies/MY_POLICY/accessLevels/MY_LEVEL`. If a single `*` is
+      // specified for `access_level`, then all [IngressSources]
+      // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IngressSource]
+      // will be allowed.
+      string access_level = 1;
+
+      // A Google Cloud resource that is allowed to ingress the perimeter.
+      // Requests from these resources will be allowed to access perimeter data.
+      // Currently only projects are allowed.
+      // Format: `projects/{project_number}`
+      // The project may be in any Google Cloud organization, not just the
+      // organization that the perimeter is defined in. `*` is not allowed, the
+      // case of allowing all Google Cloud resources only is not supported.
+      string resource = 2;
+    }
+  }
+
+  // Defines the conditions under which an [IngressPolicy]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IngressPolicy]
+  // matches a request. Conditions are based on information about the source of
+  // the request. The request must satisfy what is defined in `sources` AND
+  // identity related fields in order to match.
+  message IngressFrom {
+    // Sources that this [IngressPolicy]
+    // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IngressPolicy]
+    // authorizes access from.
+    repeated IngressSource sources = 1;
+
+    // A list of identities that are allowed access through this ingress
+    // policy. Should be in the format of email address. The email address
+    // should represent individual user or service account only.
+    repeated string identities = 2;
+
+    // Specifies the type of identities that are allowed access from outside the
+    // perimeter. If left unspecified, then members of `identities` field will
+    // be allowed access.
+    IdentityType identity_type = 3;
+  }
+
+  // Defines the conditions under which an [IngressPolicy]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IngressPolicy]
+  // matches a request. Conditions are based on information about the
+  // [ApiOperation]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.ApiOperation]
+  // intended to be performed on the target resource of the request. The request
+  // must satisfy what is defined in `operations` AND `resources` in order to
+  // match.
+  message IngressTo {
+    // A list of [ApiOperations]
+    // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.ApiOperation]
+    // allowed to be performed by the sources specified in corresponding
+    // [IngressFrom]
+    // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IngressFrom]
+    // in this [ServicePerimeter]
+    // [google.identity.accesscontextmanager.v1.ServicePerimeter].
+    repeated ApiOperation operations = 1;
+
+    // A list of resources, currently only projects in the form
+    // `projects/<projectnumber>`, protected by this [ServicePerimeter]
+    // [google.identity.accesscontextmanager.v1.ServicePerimeter] that are
+    // allowed to be accessed by sources defined in the corresponding
+    // [IngressFrom]
+    // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IngressFrom].
+    // If a single `*` is specified, then access to all resources inside the
+    // perimeter are allowed.
+    repeated string resources = 2;
+  }
+
+  // Policy for ingress into [ServicePerimeter]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter].
+  //
+  // [IngressPolicies]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IngressPolicy]
+  // match requests based on `ingress_from` and `ingress_to` stanzas.  For an
+  // ingress policy to match, both the `ingress_from` and `ingress_to` stanzas
+  // must be matched. If an [IngressPolicy]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IngressPolicy]
+  // matches a request, the request is allowed through the perimeter boundary
+  // from outside the perimeter.
+  //
+  // For example, access from the internet can be allowed either
+  // based on an [AccessLevel]
+  // [google.identity.accesscontextmanager.v1.AccessLevel] or, for traffic
+  // hosted on Google Cloud, the project of the source network. For access from
+  // private networks, using the project of the hosting network is required.
+  //
+  // Individual ingress policies can be limited by restricting which
+  // services and/or actions they match using the `ingress_to` field.
+  message IngressPolicy {
+    // Defines the conditions on the source of a request causing this
+    // [IngressPolicy]
+    // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IngressPolicy]
+    // to apply.
+    IngressFrom ingress_from = 1;
+
+    // Defines the conditions on the [ApiOperation]
+    // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.ApiOperation]
+    // and request destination that cause this [IngressPolicy]
+    // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IngressPolicy]
+    // to apply.
+    IngressTo ingress_to = 2;
+  }
+
+  // Defines the conditions under which an [EgressPolicy]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressPolicy]
+  // matches a request. Conditions based on information about the source of the
+  // request. Note that if the destination of the request is also protected by a
+  // [ServicePerimeter]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter], then that
+  // [ServicePerimeter]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] must have
+  // an [IngressPolicy]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IngressPolicy]
+  // which allows access in order for this request to succeed.
+  message EgressFrom {
+    // A list of identities that are allowed access through this [EgressPolicy].
+    // Should be in the format of email address. The email address should
+    // represent individual user or service account only.
+    repeated string identities = 1;
+
+    // Specifies the type of identities that are allowed access to outside the
+    // perimeter. If left unspecified, then members of `identities` field will
+    // be allowed access.
+    IdentityType identity_type = 2;
+  }
+
+  // Defines the conditions under which an [EgressPolicy]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressPolicy]
+  // matches a request. Conditions are based on information about the
+  // [ApiOperation]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.ApiOperation]
+  // intended to be performed on the `resources` specified. Note that if the
+  // destination of the request is also protected by a [ServicePerimeter]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter], then that
+  // [ServicePerimeter]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] must have
+  // an [IngressPolicy]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IngressPolicy]
+  // which allows access in order for this request to succeed. The request must
+  // match `operations` AND `resources` fields in order to be allowed egress out
+  // of the perimeter.
+  message EgressTo {
+    // A list of resources, currently only projects in the form
+    // `projects/<projectnumber>`, that are allowed to be accessed by sources
+    // defined in the corresponding [EgressFrom]
+    // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressFrom].
+    // A request matches if it contains a resource in this list.  If `*` is
+    // specified for `resources`, then this [EgressTo]
+    // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressTo]
+    // rule will authorize access to all resources outside the perimeter.
+    repeated string resources = 1;
+
+    // A list of [ApiOperations]
+    // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.ApiOperation]
+    // allowed to be performed by the sources specified in the corresponding
+    // [EgressFrom]
+    // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressFrom].
+    // A request matches if it uses an operation/service in this list.
+    repeated ApiOperation operations = 2;
+
+    // A list of external resources that are allowed to be accessed. Only AWS
+    // and Azure resources are supported. For Amazon S3, the supported format is
+    // s3://BUCKET_NAME. For Azure Storage, the supported format is
+    // azure://myaccount.blob.core.windows.net/CONTAINER_NAME. A request matches
+    // if it contains an external resource in this list (Example:
+    // s3://bucket/path). Currently '*' is not allowed.
+    repeated string external_resources = 3;
+  }
+
+  // Policy for egress from perimeter.
+  //
+  // [EgressPolicies]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressPolicy]
+  // match requests based on `egress_from` and `egress_to` stanzas.  For an
+  // [EgressPolicy]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressPolicy]
+  // to match, both `egress_from` and `egress_to` stanzas must be matched. If an
+  // [EgressPolicy]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressPolicy]
+  // matches a request, the request is allowed to span the [ServicePerimeter]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] boundary.
+  // For example, an [EgressPolicy]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressPolicy]
+  // can be used to allow VMs on networks within the [ServicePerimeter]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeter] to access a
+  // defined set of projects outside the perimeter in certain contexts (e.g. to
+  // read data from a Cloud Storage bucket or query against a BigQuery dataset).
+  //
+  // [EgressPolicies]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressPolicy]
+  // are concerned with the *resources* that a request relates as well as the
+  // API services and API actions being used.  They do not related to the
+  // direction of data movement.  More detailed documentation for this concept
+  // can be found in the descriptions of [EgressFrom]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressFrom]
+  // and [EgressTo]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressTo].
+  message EgressPolicy {
+    // Defines conditions on the source of a request causing this [EgressPolicy]
+    // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressPolicy]
+    // to apply.
+    EgressFrom egress_from = 1;
+
+    // Defines the conditions on the [ApiOperation]
+    // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.ApiOperation]
+    // and destination resources that cause this [EgressPolicy]
+    // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressPolicy]
+    // to apply.
+    EgressTo egress_to = 2;
+  }
+
   // A list of Google Cloud resources that are inside of the service perimeter.
   // Currently only projects are allowed. Format: `projects/{project_number}`
   repeated string resources = 1;
@@ -149,4 +449,24 @@ message ServicePerimeterConfig {
 
   // Configuration for APIs allowed within Perimeter.
   VpcAccessibleServices vpc_accessible_services = 10;
+
+  // List of [IngressPolicies]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IngressPolicy]
+  // to apply to the perimeter. A perimeter may have multiple [IngressPolicies]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IngressPolicy],
+  // each of which is evaluated separately. Access is granted if any [Ingress
+  // Policy]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IngressPolicy]
+  // grants it. Must be empty for a perimeter bridge.
+  repeated IngressPolicy ingress_policies = 8;
+
+  // List of [EgressPolicies]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressPolicy]
+  // to apply to the perimeter. A perimeter may have multiple [EgressPolicies]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressPolicy],
+  // each of which is evaluated separately. Access is granted if any
+  // [EgressPolicy]
+  // [google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressPolicy]
+  // grants it. Must be empty for a perimeter bridge.
+  repeated EgressPolicy egress_policies = 9;
 }
diff --git a/google/identity/accesscontextmanager/v1/service_perimeter_pb2.py b/google/identity/accesscontextmanager/v1/service_perimeter_pb2.py
index 7635d8f..1478a3f 100644
--- a/google/identity/accesscontextmanager/v1/service_perimeter_pb2.py
+++ b/google/identity/accesscontextmanager/v1/service_perimeter_pb2.py
@@ -28,12 +28,12 @@
 _sym_db = _symbol_database.Default()
 
 
+from google.api import resource_pb2 as google_dot_api_dot_resource__pb2
 from google.protobuf import timestamp_pb2 as google_dot_protobuf_dot_timestamp__pb2
-from google.api import annotations_pb2 as google_dot_api_dot_annotations__pb2
 
 
 DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(
-    b"\n?google/identity/accesscontextmanager/v1/service_perimeter.proto\x12'google.identity.accesscontextmanager.v1\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1cgoogle/api/annotations.proto\"\x92\x04\n\x10ServicePerimeter\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\r\n\x05title\x18\x02 \x01(\t\x12\x13\n\x0b\x64\x65scription\x18\x03 \x01(\t\x12/\n\x0b\x63reate_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0bupdate_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12_\n\x0eperimeter_type\x18\x06 \x01(\x0e\x32G.google.identity.accesscontextmanager.v1.ServicePerimeter.PerimeterType\x12O\n\x06status\x18\x07 \x01(\x0b\x32?.google.identity.accesscontextmanager.v1.ServicePerimeterConfig\x12M\n\x04spec\x18\x08 \x01(\x0b\x32?.google.identity.accesscontextmanager.v1.ServicePerimeterConfig\x12!\n\x19use_explicit_dry_run_spec\x18\t \x01(\x08\"F\n\rPerimeterType\x12\x1a\n\x16PERIMETER_TYPE_REGULAR\x10\x00\x12\x19\n\x15PERIMETER_TYPE_BRIDGE\x10\x01\"\xa6\x02\n\x16ServicePerimeterConfig\x12\x11\n\tresources\x18\x01 \x03(\t\x12\x15\n\raccess_levels\x18\x02 \x03(\t\x12\x1b\n\x13restricted_services\x18\x04 \x03(\t\x12v\n\x17vpc_accessible_services\x18\n \x01(\x0b\x32U.google.identity.accesscontextmanager.v1.ServicePerimeterConfig.VpcAccessibleServices\x1aM\n\x15VpcAccessibleServices\x12\x1a\n\x12\x65nable_restriction\x18\x01 \x01(\x08\x12\x18\n\x10\x61llowed_services\x18\x02 \x03(\tB\xab\x02\n+com.google.identity.accesscontextmanager.v1B\x15ServicePerimeterProtoP\x01Z[google.golang.org/genproto/googleapis/identity/accesscontextmanager/v1;accesscontextmanager\xa2\x02\x04GACM\xaa\x02'Google.Identity.AccessContextManager.V1\xca\x02'Google\\Identity\\AccessContextManager\\V1\xea\x02*Google::Identity::AccessContextManager::V1b\x06proto3"
+    b'\n?google/identity/accesscontextmanager/v1/service_perimeter.proto\x12\'google.identity.accesscontextmanager.v1\x1a\x19google/api/resource.proto\x1a\x1fgoogle/protobuf/timestamp.proto"\x93\x05\n\x10ServicePerimeter\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\r\n\x05title\x18\x02 \x01(\t\x12\x13\n\x0b\x64\x65scription\x18\x03 \x01(\t\x12/\n\x0b\x63reate_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0bupdate_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12_\n\x0eperimeter_type\x18\x06 \x01(\x0e\x32G.google.identity.accesscontextmanager.v1.ServicePerimeter.PerimeterType\x12O\n\x06status\x18\x07 \x01(\x0b\x32?.google.identity.accesscontextmanager.v1.ServicePerimeterConfig\x12M\n\x04spec\x18\x08 \x01(\x0b\x32?.google.identity.accesscontextmanager.v1.ServicePerimeterConfig\x12!\n\x19use_explicit_dry_run_spec\x18\t \x01(\x08"F\n\rPerimeterType\x12\x1a\n\x16PERIMETER_TYPE_REGULAR\x10\x00\x12\x19\n\x15PERIMETER_TYPE_BRIDGE\x10\x01:\x7f\xea\x41|\n4accesscontextmanager.googleapis.com/ServicePerimeter\x12\x44\x61\x63\x63\x65ssPolicies/{access_policy}/servicePerimeters/{service_perimeter}"\xb5\x0f\n\x16ServicePerimeterConfig\x12\x11\n\tresources\x18\x01 \x03(\t\x12\x15\n\raccess_levels\x18\x02 \x03(\t\x12\x1b\n\x13restricted_services\x18\x04 \x03(\t\x12v\n\x17vpc_accessible_services\x18\n \x01(\x0b\x32U.google.identity.accesscontextmanager.v1.ServicePerimeterConfig.VpcAccessibleServices\x12g\n\x10ingress_policies\x18\x08 \x03(\x0b\x32M.google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IngressPolicy\x12\x65\n\x0f\x65gress_policies\x18\t \x03(\x0b\x32L.google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressPolicy\x1aM\n\x15VpcAccessibleServices\x12\x1a\n\x12\x65nable_restriction\x18\x01 \x01(\x08\x12\x18\n\x10\x61llowed_services\x18\x02 \x03(\t\x1a@\n\x0eMethodSelector\x12\x10\n\x06method\x18\x01 \x01(\tH\x00\x12\x14\n\npermission\x18\x02 \x01(\tH\x00\x42\x06\n\x04kind\x1a\x8e\x01\n\x0c\x41piOperation\x12\x14\n\x0cservice_name\x18\x01 \x01(\t\x12h\n\x10method_selectors\x18\x02 \x03(\x0b\x32N.google.identity.accesscontextmanager.v1.ServicePerimeterConfig.MethodSelector\x1a\x45\n\rIngressSource\x12\x16\n\x0c\x61\x63\x63\x65ss_level\x18\x01 \x01(\tH\x00\x12\x12\n\x08resource\x18\x02 \x01(\tH\x00\x42\x08\n\x06source\x1a\xe6\x01\n\x0bIngressFrom\x12^\n\x07sources\x18\x01 \x03(\x0b\x32M.google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IngressSource\x12\x12\n\nidentities\x18\x02 \x03(\t\x12\x63\n\ridentity_type\x18\x03 \x01(\x0e\x32L.google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IdentityType\x1a\x80\x01\n\tIngressTo\x12`\n\noperations\x18\x01 \x03(\x0b\x32L.google.identity.accesscontextmanager.v1.ServicePerimeterConfig.ApiOperation\x12\x11\n\tresources\x18\x02 \x03(\t\x1a\xd1\x01\n\rIngressPolicy\x12\x61\n\x0cingress_from\x18\x01 \x01(\x0b\x32K.google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IngressFrom\x12]\n\ningress_to\x18\x02 \x01(\x0b\x32I.google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IngressTo\x1a\x85\x01\n\nEgressFrom\x12\x12\n\nidentities\x18\x01 \x03(\t\x12\x63\n\ridentity_type\x18\x02 \x01(\x0e\x32L.google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IdentityType\x1a\x9b\x01\n\x08\x45gressTo\x12\x11\n\tresources\x18\x01 \x03(\t\x12`\n\noperations\x18\x02 \x03(\x0b\x32L.google.identity.accesscontextmanager.v1.ServicePerimeterConfig.ApiOperation\x12\x1a\n\x12\x65xternal_resources\x18\x03 \x03(\t\x1a\xcc\x01\n\x0c\x45gressPolicy\x12_\n\x0b\x65gress_from\x18\x01 \x01(\x0b\x32J.google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressFrom\x12[\n\tegress_to\x18\x02 \x01(\x0b\x32H.google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressTo"n\n\x0cIdentityType\x12\x1d\n\x19IDENTITY_TYPE_UNSPECIFIED\x10\x00\x12\x10\n\x0c\x41NY_IDENTITY\x10\x01\x12\x14\n\x10\x41NY_USER_ACCOUNT\x10\x02\x12\x17\n\x13\x41NY_SERVICE_ACCOUNT\x10\x03\x42\xac\x02\n+com.google.identity.accesscontextmanager.v1B\x15ServicePerimeterProtoP\x01Z\\cloud.google.com/go/accesscontextmanager/apiv1/accesscontextmanagerpb;accesscontextmanagerpb\xa2\x02\x04GACM\xaa\x02\'Google.Identity.AccessContextManager.V1\xca\x02\'Google\\Identity\\AccessContextManager\\V1\xea\x02*Google::Identity::AccessContextManager::V1b\x06proto3'
 )
 
 
@@ -42,7 +42,37 @@
 _SERVICEPERIMETERCONFIG_VPCACCESSIBLESERVICES = (
     _SERVICEPERIMETERCONFIG.nested_types_by_name["VpcAccessibleServices"]
 )
+_SERVICEPERIMETERCONFIG_METHODSELECTOR = _SERVICEPERIMETERCONFIG.nested_types_by_name[
+    "MethodSelector"
+]
+_SERVICEPERIMETERCONFIG_APIOPERATION = _SERVICEPERIMETERCONFIG.nested_types_by_name[
+    "ApiOperation"
+]
+_SERVICEPERIMETERCONFIG_INGRESSSOURCE = _SERVICEPERIMETERCONFIG.nested_types_by_name[
+    "IngressSource"
+]
+_SERVICEPERIMETERCONFIG_INGRESSFROM = _SERVICEPERIMETERCONFIG.nested_types_by_name[
+    "IngressFrom"
+]
+_SERVICEPERIMETERCONFIG_INGRESSTO = _SERVICEPERIMETERCONFIG.nested_types_by_name[
+    "IngressTo"
+]
+_SERVICEPERIMETERCONFIG_INGRESSPOLICY = _SERVICEPERIMETERCONFIG.nested_types_by_name[
+    "IngressPolicy"
+]
+_SERVICEPERIMETERCONFIG_EGRESSFROM = _SERVICEPERIMETERCONFIG.nested_types_by_name[
+    "EgressFrom"
+]
+_SERVICEPERIMETERCONFIG_EGRESSTO = _SERVICEPERIMETERCONFIG.nested_types_by_name[
+    "EgressTo"
+]
+_SERVICEPERIMETERCONFIG_EGRESSPOLICY = _SERVICEPERIMETERCONFIG.nested_types_by_name[
+    "EgressPolicy"
+]
 _SERVICEPERIMETER_PERIMETERTYPE = _SERVICEPERIMETER.enum_types_by_name["PerimeterType"]
+_SERVICEPERIMETERCONFIG_IDENTITYTYPE = _SERVICEPERIMETERCONFIG.enum_types_by_name[
+    "IdentityType"
+]
 ServicePerimeter = _reflection.GeneratedProtocolMessageType(
     "ServicePerimeter",
     (_message.Message,),
@@ -67,6 +97,87 @@
                 # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.ServicePerimeterConfig.VpcAccessibleServices)
             },
         ),
+        "MethodSelector": _reflection.GeneratedProtocolMessageType(
+            "MethodSelector",
+            (_message.Message,),
+            {
+                "DESCRIPTOR": _SERVICEPERIMETERCONFIG_METHODSELECTOR,
+                "__module__": "google.identity.accesscontextmanager.v1.service_perimeter_pb2"
+                # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.ServicePerimeterConfig.MethodSelector)
+            },
+        ),
+        "ApiOperation": _reflection.GeneratedProtocolMessageType(
+            "ApiOperation",
+            (_message.Message,),
+            {
+                "DESCRIPTOR": _SERVICEPERIMETERCONFIG_APIOPERATION,
+                "__module__": "google.identity.accesscontextmanager.v1.service_perimeter_pb2"
+                # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.ServicePerimeterConfig.ApiOperation)
+            },
+        ),
+        "IngressSource": _reflection.GeneratedProtocolMessageType(
+            "IngressSource",
+            (_message.Message,),
+            {
+                "DESCRIPTOR": _SERVICEPERIMETERCONFIG_INGRESSSOURCE,
+                "__module__": "google.identity.accesscontextmanager.v1.service_perimeter_pb2"
+                # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IngressSource)
+            },
+        ),
+        "IngressFrom": _reflection.GeneratedProtocolMessageType(
+            "IngressFrom",
+            (_message.Message,),
+            {
+                "DESCRIPTOR": _SERVICEPERIMETERCONFIG_INGRESSFROM,
+                "__module__": "google.identity.accesscontextmanager.v1.service_perimeter_pb2"
+                # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IngressFrom)
+            },
+        ),
+        "IngressTo": _reflection.GeneratedProtocolMessageType(
+            "IngressTo",
+            (_message.Message,),
+            {
+                "DESCRIPTOR": _SERVICEPERIMETERCONFIG_INGRESSTO,
+                "__module__": "google.identity.accesscontextmanager.v1.service_perimeter_pb2"
+                # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IngressTo)
+            },
+        ),
+        "IngressPolicy": _reflection.GeneratedProtocolMessageType(
+            "IngressPolicy",
+            (_message.Message,),
+            {
+                "DESCRIPTOR": _SERVICEPERIMETERCONFIG_INGRESSPOLICY,
+                "__module__": "google.identity.accesscontextmanager.v1.service_perimeter_pb2"
+                # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.ServicePerimeterConfig.IngressPolicy)
+            },
+        ),
+        "EgressFrom": _reflection.GeneratedProtocolMessageType(
+            "EgressFrom",
+            (_message.Message,),
+            {
+                "DESCRIPTOR": _SERVICEPERIMETERCONFIG_EGRESSFROM,
+                "__module__": "google.identity.accesscontextmanager.v1.service_perimeter_pb2"
+                # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressFrom)
+            },
+        ),
+        "EgressTo": _reflection.GeneratedProtocolMessageType(
+            "EgressTo",
+            (_message.Message,),
+            {
+                "DESCRIPTOR": _SERVICEPERIMETERCONFIG_EGRESSTO,
+                "__module__": "google.identity.accesscontextmanager.v1.service_perimeter_pb2"
+                # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressTo)
+            },
+        ),
+        "EgressPolicy": _reflection.GeneratedProtocolMessageType(
+            "EgressPolicy",
+            (_message.Message,),
+            {
+                "DESCRIPTOR": _SERVICEPERIMETERCONFIG_EGRESSPOLICY,
+                "__module__": "google.identity.accesscontextmanager.v1.service_perimeter_pb2"
+                # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.ServicePerimeterConfig.EgressPolicy)
+            },
+        ),
         "DESCRIPTOR": _SERVICEPERIMETERCONFIG,
         "__module__": "google.identity.accesscontextmanager.v1.service_perimeter_pb2"
         # @@protoc_insertion_point(class_scope:google.identity.accesscontextmanager.v1.ServicePerimeterConfig)
@@ -74,17 +185,48 @@
 )
 _sym_db.RegisterMessage(ServicePerimeterConfig)
 _sym_db.RegisterMessage(ServicePerimeterConfig.VpcAccessibleServices)
+_sym_db.RegisterMessage(ServicePerimeterConfig.MethodSelector)
+_sym_db.RegisterMessage(ServicePerimeterConfig.ApiOperation)
+_sym_db.RegisterMessage(ServicePerimeterConfig.IngressSource)
+_sym_db.RegisterMessage(ServicePerimeterConfig.IngressFrom)
+_sym_db.RegisterMessage(ServicePerimeterConfig.IngressTo)
+_sym_db.RegisterMessage(ServicePerimeterConfig.IngressPolicy)
+_sym_db.RegisterMessage(ServicePerimeterConfig.EgressFrom)
+_sym_db.RegisterMessage(ServicePerimeterConfig.EgressTo)
+_sym_db.RegisterMessage(ServicePerimeterConfig.EgressPolicy)
 
 if _descriptor._USE_C_DESCRIPTORS == False:
 
     DESCRIPTOR._options = None
-    DESCRIPTOR._serialized_options = b"\n+com.google.identity.accesscontextmanager.v1B\025ServicePerimeterProtoP\001Z[google.golang.org/genproto/googleapis/identity/accesscontextmanager/v1;accesscontextmanager\242\002\004GACM\252\002'Google.Identity.AccessContextManager.V1\312\002'Google\\Identity\\AccessContextManager\\V1\352\002*Google::Identity::AccessContextManager::V1"
-    _SERVICEPERIMETER._serialized_start = 172
-    _SERVICEPERIMETER._serialized_end = 702
-    _SERVICEPERIMETER_PERIMETERTYPE._serialized_start = 632
-    _SERVICEPERIMETER_PERIMETERTYPE._serialized_end = 702
-    _SERVICEPERIMETERCONFIG._serialized_start = 705
-    _SERVICEPERIMETERCONFIG._serialized_end = 999
-    _SERVICEPERIMETERCONFIG_VPCACCESSIBLESERVICES._serialized_start = 922
-    _SERVICEPERIMETERCONFIG_VPCACCESSIBLESERVICES._serialized_end = 999
+    DESCRIPTOR._serialized_options = b"\n+com.google.identity.accesscontextmanager.v1B\025ServicePerimeterProtoP\001Z\\cloud.google.com/go/accesscontextmanager/apiv1/accesscontextmanagerpb;accesscontextmanagerpb\242\002\004GACM\252\002'Google.Identity.AccessContextManager.V1\312\002'Google\\Identity\\AccessContextManager\\V1\352\002*Google::Identity::AccessContextManager::V1"
+    _SERVICEPERIMETER._options = None
+    _SERVICEPERIMETER._serialized_options = b"\352A|\n4accesscontextmanager.googleapis.com/ServicePerimeter\022DaccessPolicies/{access_policy}/servicePerimeters/{service_perimeter}"
+    _SERVICEPERIMETER._serialized_start = 169
+    _SERVICEPERIMETER._serialized_end = 828
+    _SERVICEPERIMETER_PERIMETERTYPE._serialized_start = 629
+    _SERVICEPERIMETER_PERIMETERTYPE._serialized_end = 699
+    _SERVICEPERIMETERCONFIG._serialized_start = 831
+    _SERVICEPERIMETERCONFIG._serialized_end = 2804
+    _SERVICEPERIMETERCONFIG_VPCACCESSIBLESERVICES._serialized_start = 1256
+    _SERVICEPERIMETERCONFIG_VPCACCESSIBLESERVICES._serialized_end = 1333
+    _SERVICEPERIMETERCONFIG_METHODSELECTOR._serialized_start = 1335
+    _SERVICEPERIMETERCONFIG_METHODSELECTOR._serialized_end = 1399
+    _SERVICEPERIMETERCONFIG_APIOPERATION._serialized_start = 1402
+    _SERVICEPERIMETERCONFIG_APIOPERATION._serialized_end = 1544
+    _SERVICEPERIMETERCONFIG_INGRESSSOURCE._serialized_start = 1546
+    _SERVICEPERIMETERCONFIG_INGRESSSOURCE._serialized_end = 1615
+    _SERVICEPERIMETERCONFIG_INGRESSFROM._serialized_start = 1618
+    _SERVICEPERIMETERCONFIG_INGRESSFROM._serialized_end = 1848
+    _SERVICEPERIMETERCONFIG_INGRESSTO._serialized_start = 1851
+    _SERVICEPERIMETERCONFIG_INGRESSTO._serialized_end = 1979
+    _SERVICEPERIMETERCONFIG_INGRESSPOLICY._serialized_start = 1982
+    _SERVICEPERIMETERCONFIG_INGRESSPOLICY._serialized_end = 2191
+    _SERVICEPERIMETERCONFIG_EGRESSFROM._serialized_start = 2194
+    _SERVICEPERIMETERCONFIG_EGRESSFROM._serialized_end = 2327
+    _SERVICEPERIMETERCONFIG_EGRESSTO._serialized_start = 2330
+    _SERVICEPERIMETERCONFIG_EGRESSTO._serialized_end = 2485
+    _SERVICEPERIMETERCONFIG_EGRESSPOLICY._serialized_start = 2488
+    _SERVICEPERIMETERCONFIG_EGRESSPOLICY._serialized_end = 2692
+    _SERVICEPERIMETERCONFIG_IDENTITYTYPE._serialized_start = 2694
+    _SERVICEPERIMETERCONFIG_IDENTITYTYPE._serialized_end = 2804
 # @@protoc_insertion_point(module_scope)
diff --git a/owlbot.py b/owlbot.py
index f5bb734..9562802 100644
--- a/owlbot.py
+++ b/owlbot.py
@@ -34,12 +34,29 @@
 # This is required in order for s.copy() to work
 s._tracked_paths.add("googleapis")
 
-os.makedirs("google/api", exist_ok=True)
-os.makedirs("google/type", exist_ok=True)
-
-s.copy("googleapis/google/api/annotations.proto", "google/api")
-s.copy("googleapis/google/api/http.proto", "google/api")
-s.copy("googleapis/google/type/expr.proto", "google/type")
+common_apis = [
+    "google/api",
+    "google/iam/v1",
+    "google/longrunning",
+    "google/rpc",
+    "google/type",
+]
+
+# Create folders for dependencies of the protos that we want to compile
+_ = [os.makedirs(dir, exist_ok=True) for dir in common_apis]
+
+# Copy dependencies of the protos that we want to compile from googleapis
+_ = [s.copy(f"googleapis/{dir}/*.proto", dir) for dir in common_apis]
+
+# Copy the protos that we want to compile from googleapis
+s.copy(
+    "googleapis/google/identity/accesscontextmanager/v1/*.proto",
+    "google/identity/accesscontextmanager/v1",
+)
+s.copy(
+    "googleapis/google/identity/accesscontextmanager/type/*.proto",
+    "google/identity/accesscontextmanager/type",
+)
 
 # Clean up googleapis
 shutil.rmtree("googleapis")
@@ -66,35 +83,14 @@
 # Generate _pb2.py files and format them
 s.shell.run(["nox", "-s", "generate_protos"])
 
-# Clean up
-shutil.rmtree("google/api")
-shutil.rmtree("google/type")
+# Clean up the folders for dependencies which are shipped via `googleapis-common-protos`
+# We should not ship them via this repository
+_ = [shutil.rmtree(dir) for dir in common_apis]
+
+# Also clean up "google/iam" directory
+shutil.rmtree("google/iam")
 
 s.shell.run(["nox", "-s", "blacken"], hide_output=False)
 
 # Add license headers
 python.fix_pb2_headers()
-
-LICENSE = """
-# Copyright 2022 Google LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License."""
-
-PB2_GRPC_HEADER = r"""(\# Generated by the gRPC Python protocol compiler plugin\. DO NOT EDIT!$)
-(.*?$)"""
-
-s.replace(
-    "**/*_pb2_grpc.py",
-    PB2_GRPC_HEADER,
-    rf"{LICENSE}\n\n\g<1>\n\n\g<2>",  # add line breaks to avoid stacking replacements
-)
diff --git a/setup.py b/setup.py
index 31c4c4a..0b3f706 100644
--- a/setup.py
+++ b/setup.py
@@ -29,7 +29,7 @@
 # 'Development Status :: 5 - Production/Stable'
 release_status = "Development Status :: 4 - Beta"
 dependencies = [
-    "google-api-core[grpc] >= 1.34.0, <3.0.0dev,!=2.0.*,!=2.1.*,!=2.2.*,!=2.3.*,!=2.4.*,!=2.5.*,!=2.6.*,!=2.7.*,!=2.8.*,!=2.9.*,!=2.10.*",
+    "google-api-core[grpc] >= 1.34.1, <3.0.0dev,!=2.0.*,!=2.1.*,!=2.2.*,!=2.3.*,!=2.4.*,!=2.5.*,!=2.6.*,!=2.7.*,!=2.8.*,!=2.9.*,!=2.10.*",
     "protobuf>=3.19.5,<5.0.0dev,!=3.20.0,!=3.20.1,!=4.21.1,!=4.21.2,!=4.21.3,!=4.21.4,!=4.21.5",
 ]
 


Test patch:
diff --git a/testing/constraints-3.7.txt b/testing/constraints-3.7.txt
index 3c2947a..7a1c665 100644
--- a/testing/constraints-3.7.txt
+++ b/testing/constraints-3.7.txt
@@ -6,4 +6,4 @@
 # e.g., if setup.py has "foo >= 1.14.0, < 2.0.0dev",
 # Then this file should have foo==1.14.0
 protobuf==3.19.5
-google-api-core==1.34.0
+google-api-core==1.34.1