diff --git a/README.md b/README.md
index f638bcc0..5f5770b2 100644
--- a/README.md
+++ b/README.md
@@ -86,13 +86,19 @@ These options specify the RBAC of the api-endpoint.
 | ADMIN_ROLE\_   | Specifies the required admin role            | UNSPECIFIED |                                                        |
 |                |                                              | EDITOR      | admin editor                                           |
 |                |                                              | VIEWER      | admin viewer                                           |
+| MACHINE_ROLE\_ | Specifies the required machine role          | UNSPECIFIED |                                                        |
+|                |                                              | EDITOR      | machine editor                                         |
+|                |                                              | VIEWER      | machine viewer                                         |
+| INFRA_ROLE\_   | Specifies the required infra role            | UNSPECIFIED |                                                        |
+|                |                                              | EDITOR      | infra editor                                           |
+|                |                                              | VIEWER      | infra viewer                                           |
 | VISIBILITY\_   | Specifies the visibility of the api-endpoint | UNSPECIFIED |                                                        |
 |                |                                              | PUBLIC      | api-method is visible to public, a token is not needed |
 |                |                                              | SELF        | api-method is scoped to owner resources                |
 
 > [!IMPORTANT]
 >
-> Every operation needs at least an option, which references the scope of the request: **ROLE** or **VISIBILITY**
+> Every operation needs to specify exactly one of the presented options. The option defines the request scope, which is later used for implementing request authorization in the server.
 
 > [!CAUTION]
 >
diff --git a/doc/index.html b/doc/index.html
index 6e7b44fc..42de6145 100644
--- a/doc/index.html
+++ b/doc/index.html
@@ -264,6 +264,18 @@ <h2>Table of Contents</h2>
                   <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
+                <li>
+                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack%2fapi%2fv2%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                </li>
+              
               
             </ul>
           </li>
@@ -450,10 +462,42 @@ <h2>Table of Contents</h2>
             <a href="#metalstack%2fapi%2fv2%2ftoken.proto">metalstack/api/v2/token.proto</a>
             <ul>
               
+                <li>
+                  <a href="#metalstack.api.v2.AdminPermissions"><span class="badge">M</span>AdminPermissions</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.InfraPermissions"><span class="badge">M</span>InfraPermissions</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.MachinePermissions"><span class="badge">M</span>MachinePermissions</a>
+                </li>
+              
                 <li>
                   <a href="#metalstack.api.v2.MethodPermission"><span class="badge">M</span>MethodPermission</a>
                 </li>
               
+                <li>
+                  <a href="#metalstack.api.v2.PermissionsByVisibility"><span class="badge">M</span>PermissionsByVisibility</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.ProjectPermissions"><span class="badge">M</span>ProjectPermissions</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.PublicPermissions"><span class="badge">M</span>PublicPermissions</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.SelfPermissions"><span class="badge">M</span>SelfPermissions</a>
+                </li>
+              
+                <li>
+                  <a href="#metalstack.api.v2.TenantPermissions"><span class="badge">M</span>TenantPermissions</a>
+                </li>
+              
                 <li>
                   <a href="#metalstack.api.v2.Token"><span class="badge">M</span>Token</a>
                 </li>
@@ -2928,6 +2972,14 @@ <h3 id="metalstack/api/v2/predefined_rules.proto-extensions">File-level Extensio
                 <td><p>IsKey returns true if name field satisfies our requirements</p></td>
               </tr>
             
+              <tr>
+                <td>is_machine_subject_permission</td>
+                <td><a href="#bool">bool</a></td>
+                <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
+                <td>80048965</td>
+                <td><p>IsMachineSubjectPermission returns true if name field satisfies our requirements</p></td>
+              </tr>
+            
               <tr>
                 <td>is_name</td>
                 <td><a href="#bool">bool</a></td>
@@ -2960,6 +3012,14 @@ <h3 id="metalstack/api/v2/predefined_rules.proto-extensions">File-level Extensio
                 <td><p>IsPrefix validates if the given string is a valid prefix</p></td>
               </tr>
             
+              <tr>
+                <td>is_project_subject_permission</td>
+                <td><a href="#bool">bool</a></td>
+                <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
+                <td>80048964</td>
+                <td><p>IsProjectSubjectPermission returns true if name field satisfies our requirements</p></td>
+              </tr>
+            
               <tr>
                 <td>is_tenant_login</td>
                 <td><a href="#bool">bool</a></td>
@@ -2968,6 +3028,14 @@ <h3 id="metalstack/api/v2/predefined_rules.proto-extensions">File-level Extensio
                 <td><p>IsTenantLogin returns true if name field satisfies our requirements</p></td>
               </tr>
             
+              <tr>
+                <td>is_tenant_subject_permission</td>
+                <td><a href="#bool">bool</a></td>
+                <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
+                <td>80048963</td>
+                <td><p>IsTenantSubjectPermission returns true if name field satisfies our requirements</p></td>
+              </tr>
+            
               <tr>
                 <td>is_uri</td>
                 <td><a href="#bool">bool</a></td>
@@ -4106,6 +4174,86 @@ <h2 id="metalstack/api/v2/token.proto">metalstack/api/v2/token.proto</h2><a href
       <p></p>
 
       
+        <h3 id="metalstack.api.v2.AdminPermissions">AdminPermissions</h3>
+        <p>AdminPermissions carries admin method permissions</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>methods</td>
+                  <td><a href="#string">string</a></td>
+                  <td>repeated</td>
+                  <td><p>Methods which should be accessible </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.api.v2.InfraPermissions">InfraPermissions</h3>
+        <p>InfraPermissions carries infra method permissions</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>methods</td>
+                  <td><a href="#string">string</a></td>
+                  <td>repeated</td>
+                  <td><p>Methods which should be accessible </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.api.v2.MachinePermissions">MachinePermissions</h3>
+        <p>MachinePermissions carries machine method permissions</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>uuid</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>UUID of this machine
+asterisk (*) can be specified to match any subject </p></td>
+                </tr>
+              
+                <tr>
+                  <td>methods</td>
+                  <td><a href="#string">string</a></td>
+                  <td>repeated</td>
+                  <td><p>Methods which should be accessible </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
         <h3 id="metalstack.api.v2.MethodPermission">MethodPermission</h3>
         <p>MethodPermission is a mapping from a subject/project to a service method</p>
 
@@ -4142,6 +4290,183 @@ <h3 id="metalstack.api.v2.MethodPermission">MethodPermission</h3>
 
         
       
+        <h3 id="metalstack.api.v2.PermissionsByVisibility">PermissionsByVisibility</h3>
+        <p>PermissionsByVisibility contains method permissions by visibility</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>public</td>
+                  <td><a href="#metalstack.api.v2.PublicPermissions">PublicPermissions</a></td>
+                  <td></td>
+                  <td><p>PublicPermissions carries public method permissions </p></td>
+                </tr>
+              
+                <tr>
+                  <td>self</td>
+                  <td><a href="#metalstack.api.v2.SelfPermissions">SelfPermissions</a></td>
+                  <td></td>
+                  <td><p>SelfPermissions carries self method permissions </p></td>
+                </tr>
+              
+                <tr>
+                  <td>project</td>
+                  <td><a href="#metalstack.api.v2.ProjectPermissions">ProjectPermissions</a></td>
+                  <td></td>
+                  <td><p>ProjectPermissions carries project method permissions </p></td>
+                </tr>
+              
+                <tr>
+                  <td>tenant</td>
+                  <td><a href="#metalstack.api.v2.TenantPermissions">TenantPermissions</a></td>
+                  <td></td>
+                  <td><p>TenantPermissions carries tenant method permissions </p></td>
+                </tr>
+              
+                <tr>
+                  <td>admin</td>
+                  <td><a href="#metalstack.api.v2.AdminPermissions">AdminPermissions</a></td>
+                  <td></td>
+                  <td><p>AdminPermissions carries admin method permissions </p></td>
+                </tr>
+              
+                <tr>
+                  <td>machine</td>
+                  <td><a href="#metalstack.api.v2.MachinePermissions">MachinePermissions</a></td>
+                  <td></td>
+                  <td><p>MachinePermissions carries machine method permissions </p></td>
+                </tr>
+              
+                <tr>
+                  <td>infra</td>
+                  <td><a href="#metalstack.api.v2.InfraPermissions">InfraPermissions</a></td>
+                  <td></td>
+                  <td><p>InfraPermissions carries infra method permissions </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.api.v2.ProjectPermissions">ProjectPermissions</h3>
+        <p>ProjectPermissions carries project method permissions</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>project</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>asterisk (*) can be specified to match any subject </p></td>
+                </tr>
+              
+                <tr>
+                  <td>methods</td>
+                  <td><a href="#string">string</a></td>
+                  <td>repeated</td>
+                  <td><p>Methods which should be accessible </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.api.v2.PublicPermissions">PublicPermissions</h3>
+        <p>PublicPermissions carries public method permissions</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>methods</td>
+                  <td><a href="#string">string</a></td>
+                  <td>repeated</td>
+                  <td><p>Methods which should be accessible </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.api.v2.SelfPermissions">SelfPermissions</h3>
+        <p>SelfPermissions carries self method permissions</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>methods</td>
+                  <td><a href="#string">string</a></td>
+                  <td>repeated</td>
+                  <td><p>Methods which should be accessible </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="metalstack.api.v2.TenantPermissions">TenantPermissions</h3>
+        <p>TenantPermissions carries tenant method permissions</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>login</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Login of the tenant
+asterisk (*) can be specified to match any subject </p></td>
+                </tr>
+              
+                <tr>
+                  <td>methods</td>
+                  <td><a href="#string">string</a></td>
+                  <td>repeated</td>
+                  <td><p>Methods which should be accessible </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
         <h3 id="metalstack.api.v2.Token">Token</h3>
         <p>Token generates a jwt authentication token to access the api</p><p>There are two different types of tokens, api- and user- tokens</p><p>A user token is used to authenticate end user requests for example from a cli.</p><p>The configured roles in a user token are expanded in the api server</p><p>based on the memberships in other projects and tenants based on the role granted there.</p><p>User tokens will never contain permissions.</p><p>Permissions are always derived from the tenant and project roles and memberships.</p><p>The api token should be used to authenticate services.</p><p>In contrast to a user token, the api token permissions and roles apply as configured during the token create process.</p><p>Message level validation, can be developed using https://protovalidate.com/playground</p>
 
@@ -4416,7 +4741,7 @@ <h3 id="metalstack.api.v2.TokenServiceCreateRequest">TokenServiceCreateRequest</
               
                 <tr>
                   <td>permissions</td>
-                  <td><a href="#metalstack.api.v2.MethodPermission">MethodPermission</a></td>
+                  <td><a href="#metalstack.api.v2.PermissionsByVisibility">PermissionsByVisibility</a></td>
                   <td>repeated</td>
                   <td><p>Permissions is a list of service methods this token can be used for </p></td>
                 </tr>
@@ -4800,7 +5125,7 @@ <h3 id="metalstack.api.v2.TokenServiceUpdateRequest">TokenServiceUpdateRequest</
               
                 <tr>
                   <td>permissions</td>
-                  <td><a href="#metalstack.api.v2.MethodPermission">MethodPermission</a></td>
+                  <td><a href="#metalstack.api.v2.PermissionsByVisibility">PermissionsByVisibility</a></td>
                   <td>repeated</td>
                   <td><p>Permissions is a list of service methods this token can be used for </p></td>
                 </tr>
diff --git a/go/metalstack/admin/v2/project.pb.go b/go/metalstack/admin/v2/project.pb.go
index 03e3d242..1be7d8cd 100644
--- a/go/metalstack/admin/v2/project.pb.go
+++ b/go/metalstack/admin/v2/project.pb.go
@@ -7,7 +7,6 @@
 package adminv2
 
 import (
-	_ "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate"
 	v2 "github.com/metal-stack/api/go/metalstack/api/v2"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
@@ -119,7 +118,7 @@ var File_metalstack_admin_v2_project_proto protoreflect.FileDescriptor
 
 const file_metalstack_admin_v2_project_proto_rawDesc = "" +
 	"\n" +
-	"!metalstack/admin/v2/project.proto\x12\x13metalstack.admin.v2\x1a\x1bbuf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\x1a\x1fmetalstack/api/v2/project.proto\"a\n" +
+	"!metalstack/admin/v2/project.proto\x12\x13metalstack.admin.v2\x1a\x1emetalstack/api/v2/common.proto\x1a\x1fmetalstack/api/v2/project.proto\"a\n" +
 	"\x19ProjectServiceListRequest\x12:\n" +
 	"\x05query\x18\x01 \x01(\v2\x1f.metalstack.api.v2.ProjectQueryH\x00R\x05query\x88\x01\x01B\b\n" +
 	"\x06_query\"T\n" +
diff --git a/go/metalstack/api/v2/predefined_rules.pb.go b/go/metalstack/api/v2/predefined_rules.pb.go
index ebdd9f5f..dc4d1b28 100644
--- a/go/metalstack/api/v2/predefined_rules.pb.go
+++ b/go/metalstack/api/v2/predefined_rules.pb.go
@@ -118,6 +118,30 @@ var file_metalstack_api_v2_predefined_rules_proto_extTypes = []protoimpl.Extensi
 		Tag:           "varint,80048962,opt,name=is_tenant_login",
 		Filename:      "metalstack/api/v2/predefined_rules.proto",
 	},
+	{
+		ExtendedType:  (*validate.StringRules)(nil),
+		ExtensionType: (*bool)(nil),
+		Field:         80048963,
+		Name:          "metalstack.api.v2.is_tenant_subject_permission",
+		Tag:           "varint,80048963,opt,name=is_tenant_subject_permission",
+		Filename:      "metalstack/api/v2/predefined_rules.proto",
+	},
+	{
+		ExtendedType:  (*validate.StringRules)(nil),
+		ExtensionType: (*bool)(nil),
+		Field:         80048964,
+		Name:          "metalstack.api.v2.is_project_subject_permission",
+		Tag:           "varint,80048964,opt,name=is_project_subject_permission",
+		Filename:      "metalstack/api/v2/predefined_rules.proto",
+	},
+	{
+		ExtendedType:  (*validate.StringRules)(nil),
+		ExtensionType: (*bool)(nil),
+		Field:         80048965,
+		Name:          "metalstack.api.v2.is_machine_subject_permission",
+		Tag:           "varint,80048965,opt,name=is_machine_subject_permission",
+		Filename:      "metalstack/api/v2/predefined_rules.proto",
+	},
 	{
 		ExtendedType:  (*validate.RepeatedRules)(nil),
 		ExtensionType: (*bool)(nil),
@@ -242,6 +266,18 @@ var (
 	//
 	// optional bool is_tenant_login = 80048962;
 	E_IsTenantLogin = &file_metalstack_api_v2_predefined_rules_proto_extTypes[11]
+	// IsTenantSubjectPermission returns true if name field satisfies our requirements
+	//
+	// optional bool is_tenant_subject_permission = 80048963;
+	E_IsTenantSubjectPermission = &file_metalstack_api_v2_predefined_rules_proto_extTypes[12]
+	// IsProjectSubjectPermission returns true if name field satisfies our requirements
+	//
+	// optional bool is_project_subject_permission = 80048964;
+	E_IsProjectSubjectPermission = &file_metalstack_api_v2_predefined_rules_proto_extTypes[13]
+	// IsMachineSubjectPermission returns true if name field satisfies our requirements
+	//
+	// optional bool is_machine_subject_permission = 80048965;
+	E_IsMachineSubjectPermission = &file_metalstack_api_v2_predefined_rules_proto_extTypes[14]
 )
 
 // Extension fields to validate.RepeatedRules.
@@ -249,19 +285,19 @@ var (
 	// Prefixes validates if a slice of prefixes in string form are valid
 	//
 	// optional bool prefixes = 80058951;
-	E_Prefixes = &file_metalstack_api_v2_predefined_rules_proto_extTypes[12]
+	E_Prefixes = &file_metalstack_api_v2_predefined_rules_proto_extTypes[15]
 	// Ips validates if a slice of ips in string form are valid
 	//
 	// optional bool ips = 80058952;
-	E_Ips = &file_metalstack_api_v2_predefined_rules_proto_extTypes[13]
+	E_Ips = &file_metalstack_api_v2_predefined_rules_proto_extTypes[16]
 	// AreHostAndPort validates if a slice of strings are all in the form of <ip | host>:<port>
 	//
 	// optional bool are_host_and_port = 80058953;
-	E_AreHostAndPort = &file_metalstack_api_v2_predefined_rules_proto_extTypes[14]
+	E_AreHostAndPort = &file_metalstack_api_v2_predefined_rules_proto_extTypes[17]
 	// All Trimmed enforces all strings to be trimmed, e.g. no whitespaces at the begin and end
 	//
 	// optional bool all_trimmed = 80058954;
-	E_AllTrimmed = &file_metalstack_api_v2_predefined_rules_proto_extTypes[15]
+	E_AllTrimmed = &file_metalstack_api_v2_predefined_rules_proto_extTypes[18]
 )
 
 // Extension fields to validate.MapRules.
@@ -269,23 +305,23 @@ var (
 	// Keys and Values trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
 	//
 	// optional bool keys_and_values_trimmed = 80068951;
-	E_KeysAndValuesTrimmed = &file_metalstack_api_v2_predefined_rules_proto_extTypes[16]
+	E_KeysAndValuesTrimmed = &file_metalstack_api_v2_predefined_rules_proto_extTypes[19]
 	// Keys trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
 	//
 	// optional bool keys_trimmed = 80068952;
-	E_KeysTrimmed = &file_metalstack_api_v2_predefined_rules_proto_extTypes[17]
+	E_KeysTrimmed = &file_metalstack_api_v2_predefined_rules_proto_extTypes[20]
 	// ProjectRolesKeysValid ensures that project roles keys met our requirements
 	//
 	// optional bool project_roles_keys_valid = 80068953;
-	E_ProjectRolesKeysValid = &file_metalstack_api_v2_predefined_rules_proto_extTypes[18]
+	E_ProjectRolesKeysValid = &file_metalstack_api_v2_predefined_rules_proto_extTypes[21]
 	// TenantRolesKeysValid ensures that tenant roles keys met our requirements
 	//
 	// optional bool tenant_roles_keys_valid = 80068954;
-	E_TenantRolesKeysValid = &file_metalstack_api_v2_predefined_rules_proto_extTypes[19]
+	E_TenantRolesKeysValid = &file_metalstack_api_v2_predefined_rules_proto_extTypes[22]
 	// MachineRolesKeysValid ensures that machine roles keys met our requirements
 	//
 	// optional bool machine_roles_keys_valid = 80068955;
-	E_MachineRolesKeysValid = &file_metalstack_api_v2_predefined_rules_proto_extTypes[20]
+	E_MachineRolesKeysValid = &file_metalstack_api_v2_predefined_rules_proto_extTypes[23]
 )
 
 var File_metalstack_api_v2_predefined_rules_proto protoreflect.FileDescriptor
@@ -331,7 +367,16 @@ const file_metalstack_api_v2_predefined_rules_proto_rawDesc = "" +
 	"\rstring.is_key\x12$must be within 1 and 8192 characters\x1a'this.size() >= 1 && this.size() <= 8192R\x05isKey:\xb0\x01\n" +
 	"\x0fis_tenant_login\x12\x19.buf.validate.StringRules\x18\xc2\xe6\x95& \x01(\bBj\xc2Hg\n" +
 	"e\n" +
-	"\x16string.is_tenant_login\x12#must be within 2 and 256 characters\x1a&this.size() >= 2 && this.size() <= 256R\risTenantLogin:\x8f\x01\n" +
+	"\x16string.is_tenant_login\x12#must be within 2 and 128 characters\x1a&this.size() >= 2 && this.size() <= 128R\risTenantLogin:\xef\x01\n" +
+	"\x1cis_tenant_subject_permission\x12\x19.buf.validate.StringRules\x18\xc3\xe6\x95& \x01(\bB\x8f\x01\xc2H\x8b\x01\n" +
+	"\x88\x01\n" +
+	"#string.is_tenant_subject_permission\x12*must be '*' or within 2 and 128 characters\x1a5this == '*' || this.size() >= 2 && this.size() <= 128R\x19isTenantSubjectPermission:\x94\x02\n" +
+	"\x1dis_project_subject_permission\x12\x19.buf.validate.StringRules\x18\xc4\xe6\x95& \x01(\bB\xb2\x01\xc2H\xae\x01\n" +
+	"\xab\x01\n" +
+	"$string.is_project_subject_permission\x12\x15must be '*' or a uuid\x1althis == '*' || this.matches('^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$')R\x1aisProjectSubjectPermission:\x94\x02\n" +
+	"\x1dis_machine_subject_permission\x12\x19.buf.validate.StringRules\x18\xc5\xe6\x95& \x01(\bB\xb2\x01\xc2H\xae\x01\n" +
+	"\xab\x01\n" +
+	"$string.is_machine_subject_permission\x12\x15must be '*' or a uuid\x1althis == '*' || this.matches('^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$')R\x1aisMachineSubjectPermission:\x8f\x01\n" +
 	"\bprefixes\x12\x1b.buf.validate.RepeatedRules\x18Ǵ\x96& \x01(\bBS\xc2HP\n" +
 	"N\n" +
 	"\x11repeated.prefixes\x12\x1cgiven prefixes must be valid\x1a\x1bthis.all(m, m.isIpPrefix())R\bprefixes:u\n" +
@@ -356,10 +401,10 @@ const file_metalstack_api_v2_predefined_rules_proto_rawDesc = "" +
 	"\x17project_roles.key.valid\x12&subject must be a '*', or a valid UUID\x1asthis.all(k, k == '*' || k.matches('^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$'))R\x15projectRolesKeysValid:\xe8\x01\n" +
 	"\x17tenant_roles_keys_valid\x12\x16.buf.validate.MapRules\x18ڂ\x97& \x01(\bB\x95\x01\xc2H\x91\x01\n" +
 	"\x8e\x01\n" +
-	"\x16tenant_roles.key.valid\x123subject must be '*' or between 2 and 128 characters\x1a?this.all(k, k == '*' || this.size() >= 2 || this.size() <=128 )R\x14tenantRolesKeysValid:\xa9\x02\n" +
-	"\x18machine_roles_keys_valid\x12\x16.buf.validate.MapRules\x18ۂ\x97& \x01(\bB\xd4\x01\xc2H\xd0\x01\n" +
-	"\xcd\x01\n" +
-	"\x17machine_roles.key.valid\x122subject must be empty string, '*', or a valid UUID\x1a~this.all(k, k == '' || k == '*' || k.matches('^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$'))R\x15machineRolesKeysValidB\xca\x01\n" +
+	"\x16tenant_roles.key.valid\x123subject must be '*' or between 2 and 128 characters\x1a?this.all(k, k == '*' || this.size() >= 2 || this.size() <=128 )R\x14tenantRolesKeysValid:\x9e\x02\n" +
+	"\x18machine_roles_keys_valid\x12\x16.buf.validate.MapRules\x18ۂ\x97& \x01(\bB\xc9\x01\xc2H\xc5\x01\n" +
+	"\xc2\x01\n" +
+	"\x17machine_roles.key.valid\x122subject must be empty string, '*', or a valid UUID\x1asthis.all(k, k == '*' || k.matches('^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$'))R\x15machineRolesKeysValidB\xca\x01\n" +
 	"\x15com.metalstack.api.v2B\x14PredefinedRulesProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2"
 
 var file_metalstack_api_v2_predefined_rules_proto_goTypes = []any{
@@ -380,19 +425,22 @@ var file_metalstack_api_v2_predefined_rules_proto_depIdxs = []int32{
 	0,  // 9: metalstack.api.v2.is_option:extendee -> buf.validate.StringRules
 	0,  // 10: metalstack.api.v2.is_key:extendee -> buf.validate.StringRules
 	0,  // 11: metalstack.api.v2.is_tenant_login:extendee -> buf.validate.StringRules
-	1,  // 12: metalstack.api.v2.prefixes:extendee -> buf.validate.RepeatedRules
-	1,  // 13: metalstack.api.v2.ips:extendee -> buf.validate.RepeatedRules
-	1,  // 14: metalstack.api.v2.are_host_and_port:extendee -> buf.validate.RepeatedRules
-	1,  // 15: metalstack.api.v2.all_trimmed:extendee -> buf.validate.RepeatedRules
-	2,  // 16: metalstack.api.v2.keys_and_values_trimmed:extendee -> buf.validate.MapRules
-	2,  // 17: metalstack.api.v2.keys_trimmed:extendee -> buf.validate.MapRules
-	2,  // 18: metalstack.api.v2.project_roles_keys_valid:extendee -> buf.validate.MapRules
-	2,  // 19: metalstack.api.v2.tenant_roles_keys_valid:extendee -> buf.validate.MapRules
-	2,  // 20: metalstack.api.v2.machine_roles_keys_valid:extendee -> buf.validate.MapRules
-	21, // [21:21] is the sub-list for method output_type
-	21, // [21:21] is the sub-list for method input_type
-	21, // [21:21] is the sub-list for extension type_name
-	0,  // [0:21] is the sub-list for extension extendee
+	0,  // 12: metalstack.api.v2.is_tenant_subject_permission:extendee -> buf.validate.StringRules
+	0,  // 13: metalstack.api.v2.is_project_subject_permission:extendee -> buf.validate.StringRules
+	0,  // 14: metalstack.api.v2.is_machine_subject_permission:extendee -> buf.validate.StringRules
+	1,  // 15: metalstack.api.v2.prefixes:extendee -> buf.validate.RepeatedRules
+	1,  // 16: metalstack.api.v2.ips:extendee -> buf.validate.RepeatedRules
+	1,  // 17: metalstack.api.v2.are_host_and_port:extendee -> buf.validate.RepeatedRules
+	1,  // 18: metalstack.api.v2.all_trimmed:extendee -> buf.validate.RepeatedRules
+	2,  // 19: metalstack.api.v2.keys_and_values_trimmed:extendee -> buf.validate.MapRules
+	2,  // 20: metalstack.api.v2.keys_trimmed:extendee -> buf.validate.MapRules
+	2,  // 21: metalstack.api.v2.project_roles_keys_valid:extendee -> buf.validate.MapRules
+	2,  // 22: metalstack.api.v2.tenant_roles_keys_valid:extendee -> buf.validate.MapRules
+	2,  // 23: metalstack.api.v2.machine_roles_keys_valid:extendee -> buf.validate.MapRules
+	24, // [24:24] is the sub-list for method output_type
+	24, // [24:24] is the sub-list for method input_type
+	24, // [24:24] is the sub-list for extension type_name
+	0,  // [0:24] is the sub-list for extension extendee
 	0,  // [0:0] is the sub-list for field type_name
 }
 
@@ -408,7 +456,7 @@ func file_metalstack_api_v2_predefined_rules_proto_init() {
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_metalstack_api_v2_predefined_rules_proto_rawDesc), len(file_metalstack_api_v2_predefined_rules_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   0,
-			NumExtensions: 21,
+			NumExtensions: 24,
 			NumServices:   0,
 		},
 		GoTypes:           file_metalstack_api_v2_predefined_rules_proto_goTypes,
diff --git a/go/metalstack/api/v2/token.pb.go b/go/metalstack/api/v2/token.pb.go
index 0e5acb26..9e1f756f 100644
--- a/go/metalstack/api/v2/token.pb.go
+++ b/go/metalstack/api/v2/token.pb.go
@@ -249,7 +249,7 @@ type TokenServiceCreateRequest struct {
 	// Description of the token
 	Description string `protobuf:"bytes,1,opt,name=description,proto3" json:"description,omitempty"`
 	// Permissions is a list of service methods this token can be used for
-	Permissions []*MethodPermission `protobuf:"bytes,2,rep,name=permissions,proto3" json:"permissions,omitempty"`
+	Permissions []*PermissionsByVisibility `protobuf:"bytes,2,rep,name=permissions,proto3" json:"permissions,omitempty"`
 	// Expires gives the duration since now, after which this token can not be used anymore
 	Expires *durationpb.Duration `protobuf:"bytes,3,opt,name=expires,proto3" json:"expires,omitempty"`
 	// ProjectRoles associates a project id with the corresponding role of the token owner
@@ -305,7 +305,7 @@ func (x *TokenServiceCreateRequest) GetDescription() string {
 	return ""
 }
 
-func (x *TokenServiceCreateRequest) GetPermissions() []*MethodPermission {
+func (x *TokenServiceCreateRequest) GetPermissions() []*PermissionsByVisibility {
 	if x != nil {
 		return x.Permissions
 	}
@@ -421,6 +421,529 @@ func (x *MethodPermission) GetMethods() []string {
 	return nil
 }
 
+// PermissionsByVisibility contains method permissions by visibility
+type PermissionsByVisibility struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Visibility defines the visibility of the requested method permissions
+	//
+	// Types that are valid to be assigned to Visibility:
+	//
+	//	*PermissionsByVisibility_Public
+	//	*PermissionsByVisibility_Self
+	//	*PermissionsByVisibility_Project
+	//	*PermissionsByVisibility_Tenant
+	//	*PermissionsByVisibility_Admin
+	//	*PermissionsByVisibility_Machine
+	//	*PermissionsByVisibility_Infra
+	Visibility    isPermissionsByVisibility_Visibility `protobuf_oneof:"visibility"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PermissionsByVisibility) Reset() {
+	*x = PermissionsByVisibility{}
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PermissionsByVisibility) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PermissionsByVisibility) ProtoMessage() {}
+
+func (x *PermissionsByVisibility) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PermissionsByVisibility.ProtoReflect.Descriptor instead.
+func (*PermissionsByVisibility) Descriptor() ([]byte, []int) {
+	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *PermissionsByVisibility) GetVisibility() isPermissionsByVisibility_Visibility {
+	if x != nil {
+		return x.Visibility
+	}
+	return nil
+}
+
+func (x *PermissionsByVisibility) GetPublic() *PublicPermissions {
+	if x != nil {
+		if x, ok := x.Visibility.(*PermissionsByVisibility_Public); ok {
+			return x.Public
+		}
+	}
+	return nil
+}
+
+func (x *PermissionsByVisibility) GetSelf() *SelfPermissions {
+	if x != nil {
+		if x, ok := x.Visibility.(*PermissionsByVisibility_Self); ok {
+			return x.Self
+		}
+	}
+	return nil
+}
+
+func (x *PermissionsByVisibility) GetProject() *ProjectPermissions {
+	if x != nil {
+		if x, ok := x.Visibility.(*PermissionsByVisibility_Project); ok {
+			return x.Project
+		}
+	}
+	return nil
+}
+
+func (x *PermissionsByVisibility) GetTenant() *TenantPermissions {
+	if x != nil {
+		if x, ok := x.Visibility.(*PermissionsByVisibility_Tenant); ok {
+			return x.Tenant
+		}
+	}
+	return nil
+}
+
+func (x *PermissionsByVisibility) GetAdmin() *AdminPermissions {
+	if x != nil {
+		if x, ok := x.Visibility.(*PermissionsByVisibility_Admin); ok {
+			return x.Admin
+		}
+	}
+	return nil
+}
+
+func (x *PermissionsByVisibility) GetMachine() *MachinePermissions {
+	if x != nil {
+		if x, ok := x.Visibility.(*PermissionsByVisibility_Machine); ok {
+			return x.Machine
+		}
+	}
+	return nil
+}
+
+func (x *PermissionsByVisibility) GetInfra() *InfraPermissions {
+	if x != nil {
+		if x, ok := x.Visibility.(*PermissionsByVisibility_Infra); ok {
+			return x.Infra
+		}
+	}
+	return nil
+}
+
+type isPermissionsByVisibility_Visibility interface {
+	isPermissionsByVisibility_Visibility()
+}
+
+type PermissionsByVisibility_Public struct {
+	// PublicPermissions carries public method permissions
+	Public *PublicPermissions `protobuf:"bytes,1,opt,name=public,proto3,oneof"`
+}
+
+type PermissionsByVisibility_Self struct {
+	// SelfPermissions carries self method permissions
+	Self *SelfPermissions `protobuf:"bytes,2,opt,name=self,proto3,oneof"`
+}
+
+type PermissionsByVisibility_Project struct {
+	// ProjectPermissions carries project method permissions
+	Project *ProjectPermissions `protobuf:"bytes,3,opt,name=project,proto3,oneof"`
+}
+
+type PermissionsByVisibility_Tenant struct {
+	// TenantPermissions carries tenant method permissions
+	Tenant *TenantPermissions `protobuf:"bytes,4,opt,name=tenant,proto3,oneof"`
+}
+
+type PermissionsByVisibility_Admin struct {
+	// AdminPermissions carries admin method permissions
+	Admin *AdminPermissions `protobuf:"bytes,5,opt,name=admin,proto3,oneof"`
+}
+
+type PermissionsByVisibility_Machine struct {
+	// MachinePermissions carries machine method permissions
+	Machine *MachinePermissions `protobuf:"bytes,6,opt,name=machine,proto3,oneof"`
+}
+
+type PermissionsByVisibility_Infra struct {
+	// InfraPermissions carries infra method permissions
+	Infra *InfraPermissions `protobuf:"bytes,7,opt,name=infra,proto3,oneof"`
+}
+
+func (*PermissionsByVisibility_Public) isPermissionsByVisibility_Visibility() {}
+
+func (*PermissionsByVisibility_Self) isPermissionsByVisibility_Visibility() {}
+
+func (*PermissionsByVisibility_Project) isPermissionsByVisibility_Visibility() {}
+
+func (*PermissionsByVisibility_Tenant) isPermissionsByVisibility_Visibility() {}
+
+func (*PermissionsByVisibility_Admin) isPermissionsByVisibility_Visibility() {}
+
+func (*PermissionsByVisibility_Machine) isPermissionsByVisibility_Visibility() {}
+
+func (*PermissionsByVisibility_Infra) isPermissionsByVisibility_Visibility() {}
+
+// PublicPermissions carries public method permissions
+type PublicPermissions struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Methods which should be accessible
+	Methods       []string `protobuf:"bytes,2,rep,name=methods,proto3" json:"methods,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PublicPermissions) Reset() {
+	*x = PublicPermissions{}
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PublicPermissions) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PublicPermissions) ProtoMessage() {}
+
+func (x *PublicPermissions) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PublicPermissions.ProtoReflect.Descriptor instead.
+func (*PublicPermissions) Descriptor() ([]byte, []int) {
+	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *PublicPermissions) GetMethods() []string {
+	if x != nil {
+		return x.Methods
+	}
+	return nil
+}
+
+// SelfPermissions carries self method permissions
+type SelfPermissions struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Methods which should be accessible
+	Methods       []string `protobuf:"bytes,2,rep,name=methods,proto3" json:"methods,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SelfPermissions) Reset() {
+	*x = SelfPermissions{}
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SelfPermissions) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SelfPermissions) ProtoMessage() {}
+
+func (x *SelfPermissions) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SelfPermissions.ProtoReflect.Descriptor instead.
+func (*SelfPermissions) Descriptor() ([]byte, []int) {
+	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *SelfPermissions) GetMethods() []string {
+	if x != nil {
+		return x.Methods
+	}
+	return nil
+}
+
+// ProjectPermissions carries project method permissions
+type ProjectPermissions struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// asterisk (*) can be specified to match any subject
+	Project string `protobuf:"bytes,1,opt,name=project,proto3" json:"project,omitempty"`
+	// Methods which should be accessible
+	Methods       []string `protobuf:"bytes,2,rep,name=methods,proto3" json:"methods,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ProjectPermissions) Reset() {
+	*x = ProjectPermissions{}
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ProjectPermissions) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ProjectPermissions) ProtoMessage() {}
+
+func (x *ProjectPermissions) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ProjectPermissions.ProtoReflect.Descriptor instead.
+func (*ProjectPermissions) Descriptor() ([]byte, []int) {
+	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *ProjectPermissions) GetProject() string {
+	if x != nil {
+		return x.Project
+	}
+	return ""
+}
+
+func (x *ProjectPermissions) GetMethods() []string {
+	if x != nil {
+		return x.Methods
+	}
+	return nil
+}
+
+// TenantPermissions carries tenant method permissions
+type TenantPermissions struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Login of the tenant
+	// asterisk (*) can be specified to match any subject
+	Login string `protobuf:"bytes,1,opt,name=login,proto3" json:"login,omitempty"`
+	// Methods which should be accessible
+	Methods       []string `protobuf:"bytes,2,rep,name=methods,proto3" json:"methods,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *TenantPermissions) Reset() {
+	*x = TenantPermissions{}
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TenantPermissions) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TenantPermissions) ProtoMessage() {}
+
+func (x *TenantPermissions) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TenantPermissions.ProtoReflect.Descriptor instead.
+func (*TenantPermissions) Descriptor() ([]byte, []int) {
+	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *TenantPermissions) GetLogin() string {
+	if x != nil {
+		return x.Login
+	}
+	return ""
+}
+
+func (x *TenantPermissions) GetMethods() []string {
+	if x != nil {
+		return x.Methods
+	}
+	return nil
+}
+
+// AdminPermissions carries admin method permissions
+type AdminPermissions struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Methods which should be accessible
+	Methods       []string `protobuf:"bytes,2,rep,name=methods,proto3" json:"methods,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AdminPermissions) Reset() {
+	*x = AdminPermissions{}
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AdminPermissions) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AdminPermissions) ProtoMessage() {}
+
+func (x *AdminPermissions) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[8]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AdminPermissions.ProtoReflect.Descriptor instead.
+func (*AdminPermissions) Descriptor() ([]byte, []int) {
+	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *AdminPermissions) GetMethods() []string {
+	if x != nil {
+		return x.Methods
+	}
+	return nil
+}
+
+// MachinePermissions carries machine method permissions
+type MachinePermissions struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// UUID of this machine
+	// asterisk (*) can be specified to match any subject
+	Uuid string `protobuf:"bytes,1,opt,name=uuid,proto3" json:"uuid,omitempty"`
+	// Methods which should be accessible
+	Methods       []string `protobuf:"bytes,2,rep,name=methods,proto3" json:"methods,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *MachinePermissions) Reset() {
+	*x = MachinePermissions{}
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *MachinePermissions) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachinePermissions) ProtoMessage() {}
+
+func (x *MachinePermissions) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[9]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachinePermissions.ProtoReflect.Descriptor instead.
+func (*MachinePermissions) Descriptor() ([]byte, []int) {
+	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *MachinePermissions) GetUuid() string {
+	if x != nil {
+		return x.Uuid
+	}
+	return ""
+}
+
+func (x *MachinePermissions) GetMethods() []string {
+	if x != nil {
+		return x.Methods
+	}
+	return nil
+}
+
+// InfraPermissions carries infra method permissions
+type InfraPermissions struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Methods which should be accessible
+	Methods       []string `protobuf:"bytes,2,rep,name=methods,proto3" json:"methods,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *InfraPermissions) Reset() {
+	*x = InfraPermissions{}
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[10]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *InfraPermissions) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*InfraPermissions) ProtoMessage() {}
+
+func (x *InfraPermissions) ProtoReflect() protoreflect.Message {
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[10]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use InfraPermissions.ProtoReflect.Descriptor instead.
+func (*InfraPermissions) Descriptor() ([]byte, []int) {
+	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *InfraPermissions) GetMethods() []string {
+	if x != nil {
+		return x.Methods
+	}
+	return nil
+}
+
 // TokenServiceCreateResponse is the response payload of a token create request
 type TokenServiceCreateResponse struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -434,7 +957,7 @@ type TokenServiceCreateResponse struct {
 
 func (x *TokenServiceCreateResponse) Reset() {
 	*x = TokenServiceCreateResponse{}
-	mi := &file_metalstack_api_v2_token_proto_msgTypes[3]
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[11]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -446,7 +969,7 @@ func (x *TokenServiceCreateResponse) String() string {
 func (*TokenServiceCreateResponse) ProtoMessage() {}
 
 func (x *TokenServiceCreateResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_metalstack_api_v2_token_proto_msgTypes[3]
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[11]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -459,7 +982,7 @@ func (x *TokenServiceCreateResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenServiceCreateResponse.ProtoReflect.Descriptor instead.
 func (*TokenServiceCreateResponse) Descriptor() ([]byte, []int) {
-	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{3}
+	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *TokenServiceCreateResponse) GetToken() *Token {
@@ -487,7 +1010,7 @@ type TokenServiceListRequest struct {
 
 func (x *TokenServiceListRequest) Reset() {
 	*x = TokenServiceListRequest{}
-	mi := &file_metalstack_api_v2_token_proto_msgTypes[4]
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[12]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -499,7 +1022,7 @@ func (x *TokenServiceListRequest) String() string {
 func (*TokenServiceListRequest) ProtoMessage() {}
 
 func (x *TokenServiceListRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_metalstack_api_v2_token_proto_msgTypes[4]
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[12]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -512,7 +1035,7 @@ func (x *TokenServiceListRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenServiceListRequest.ProtoReflect.Descriptor instead.
 func (*TokenServiceListRequest) Descriptor() ([]byte, []int) {
-	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{4}
+	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *TokenServiceListRequest) GetQuery() *TokenQuery {
@@ -533,7 +1056,7 @@ type TokenServiceListResponse struct {
 
 func (x *TokenServiceListResponse) Reset() {
 	*x = TokenServiceListResponse{}
-	mi := &file_metalstack_api_v2_token_proto_msgTypes[5]
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[13]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -545,7 +1068,7 @@ func (x *TokenServiceListResponse) String() string {
 func (*TokenServiceListResponse) ProtoMessage() {}
 
 func (x *TokenServiceListResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_metalstack_api_v2_token_proto_msgTypes[5]
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[13]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -558,7 +1081,7 @@ func (x *TokenServiceListResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenServiceListResponse.ProtoReflect.Descriptor instead.
 func (*TokenServiceListResponse) Descriptor() ([]byte, []int) {
-	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{5}
+	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *TokenServiceListResponse) GetTokens() []*Token {
@@ -579,7 +1102,7 @@ type TokenServiceRevokeRequest struct {
 
 func (x *TokenServiceRevokeRequest) Reset() {
 	*x = TokenServiceRevokeRequest{}
-	mi := &file_metalstack_api_v2_token_proto_msgTypes[6]
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[14]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -591,7 +1114,7 @@ func (x *TokenServiceRevokeRequest) String() string {
 func (*TokenServiceRevokeRequest) ProtoMessage() {}
 
 func (x *TokenServiceRevokeRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_metalstack_api_v2_token_proto_msgTypes[6]
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[14]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -604,7 +1127,7 @@ func (x *TokenServiceRevokeRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenServiceRevokeRequest.ProtoReflect.Descriptor instead.
 func (*TokenServiceRevokeRequest) Descriptor() ([]byte, []int) {
-	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{6}
+	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{14}
 }
 
 func (x *TokenServiceRevokeRequest) GetUuid() string {
@@ -623,7 +1146,7 @@ type TokenServiceRevokeResponse struct {
 
 func (x *TokenServiceRevokeResponse) Reset() {
 	*x = TokenServiceRevokeResponse{}
-	mi := &file_metalstack_api_v2_token_proto_msgTypes[7]
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[15]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -635,7 +1158,7 @@ func (x *TokenServiceRevokeResponse) String() string {
 func (*TokenServiceRevokeResponse) ProtoMessage() {}
 
 func (x *TokenServiceRevokeResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_metalstack_api_v2_token_proto_msgTypes[7]
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[15]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -648,7 +1171,7 @@ func (x *TokenServiceRevokeResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenServiceRevokeResponse.ProtoReflect.Descriptor instead.
 func (*TokenServiceRevokeResponse) Descriptor() ([]byte, []int) {
-	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{7}
+	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{15}
 }
 
 // TokenServiceUpdateRequest is the request payload of a token update request
@@ -662,7 +1185,7 @@ type TokenServiceUpdateRequest struct {
 	// Description is a user given description of this token.
 	Description *string `protobuf:"bytes,3,opt,name=description,proto3,oneof" json:"description,omitempty"`
 	// Permissions is a list of service methods this token can be used for
-	Permissions []*MethodPermission `protobuf:"bytes,4,rep,name=permissions,proto3" json:"permissions,omitempty"`
+	Permissions []*PermissionsByVisibility `protobuf:"bytes,4,rep,name=permissions,proto3" json:"permissions,omitempty"`
 	// ProjectRoles associates a project id with the corresponding role of the token owner
 	ProjectRoles map[string]ProjectRole `protobuf:"bytes,5,rep,name=project_roles,json=projectRoles,proto3" json:"project_roles,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"varint,2,opt,name=value,enum=metalstack.api.v2.ProjectRole"`
 	// TenantRoles associates a tenant id with the corresponding role of the token owner
@@ -681,7 +1204,7 @@ type TokenServiceUpdateRequest struct {
 
 func (x *TokenServiceUpdateRequest) Reset() {
 	*x = TokenServiceUpdateRequest{}
-	mi := &file_metalstack_api_v2_token_proto_msgTypes[8]
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[16]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -693,7 +1216,7 @@ func (x *TokenServiceUpdateRequest) String() string {
 func (*TokenServiceUpdateRequest) ProtoMessage() {}
 
 func (x *TokenServiceUpdateRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_metalstack_api_v2_token_proto_msgTypes[8]
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[16]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -706,7 +1229,7 @@ func (x *TokenServiceUpdateRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenServiceUpdateRequest.ProtoReflect.Descriptor instead.
 func (*TokenServiceUpdateRequest) Descriptor() ([]byte, []int) {
-	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{8}
+	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *TokenServiceUpdateRequest) GetUuid() string {
@@ -730,7 +1253,7 @@ func (x *TokenServiceUpdateRequest) GetDescription() string {
 	return ""
 }
 
-func (x *TokenServiceUpdateRequest) GetPermissions() []*MethodPermission {
+func (x *TokenServiceUpdateRequest) GetPermissions() []*PermissionsByVisibility {
 	if x != nil {
 		return x.Permissions
 	}
@@ -790,7 +1313,7 @@ type TokenServiceUpdateResponse struct {
 
 func (x *TokenServiceUpdateResponse) Reset() {
 	*x = TokenServiceUpdateResponse{}
-	mi := &file_metalstack_api_v2_token_proto_msgTypes[9]
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[17]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -802,7 +1325,7 @@ func (x *TokenServiceUpdateResponse) String() string {
 func (*TokenServiceUpdateResponse) ProtoMessage() {}
 
 func (x *TokenServiceUpdateResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_metalstack_api_v2_token_proto_msgTypes[9]
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[17]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -815,7 +1338,7 @@ func (x *TokenServiceUpdateResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenServiceUpdateResponse.ProtoReflect.Descriptor instead.
 func (*TokenServiceUpdateResponse) Descriptor() ([]byte, []int) {
-	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{9}
+	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{17}
 }
 
 func (x *TokenServiceUpdateResponse) GetToken() *Token {
@@ -836,7 +1359,7 @@ type TokenServiceGetRequest struct {
 
 func (x *TokenServiceGetRequest) Reset() {
 	*x = TokenServiceGetRequest{}
-	mi := &file_metalstack_api_v2_token_proto_msgTypes[10]
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[18]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -848,7 +1371,7 @@ func (x *TokenServiceGetRequest) String() string {
 func (*TokenServiceGetRequest) ProtoMessage() {}
 
 func (x *TokenServiceGetRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_metalstack_api_v2_token_proto_msgTypes[10]
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[18]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -861,7 +1384,7 @@ func (x *TokenServiceGetRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenServiceGetRequest.ProtoReflect.Descriptor instead.
 func (*TokenServiceGetRequest) Descriptor() ([]byte, []int) {
-	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{10}
+	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{18}
 }
 
 func (x *TokenServiceGetRequest) GetUuid() string {
@@ -882,7 +1405,7 @@ type TokenServiceGetResponse struct {
 
 func (x *TokenServiceGetResponse) Reset() {
 	*x = TokenServiceGetResponse{}
-	mi := &file_metalstack_api_v2_token_proto_msgTypes[11]
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -894,7 +1417,7 @@ func (x *TokenServiceGetResponse) String() string {
 func (*TokenServiceGetResponse) ProtoMessage() {}
 
 func (x *TokenServiceGetResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_metalstack_api_v2_token_proto_msgTypes[11]
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -907,7 +1430,7 @@ func (x *TokenServiceGetResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenServiceGetResponse.ProtoReflect.Descriptor instead.
 func (*TokenServiceGetResponse) Descriptor() ([]byte, []int) {
-	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{11}
+	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{19}
 }
 
 func (x *TokenServiceGetResponse) GetToken() *Token {
@@ -928,7 +1451,7 @@ type TokenServiceRefreshRequest struct {
 
 func (x *TokenServiceRefreshRequest) Reset() {
 	*x = TokenServiceRefreshRequest{}
-	mi := &file_metalstack_api_v2_token_proto_msgTypes[12]
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -940,7 +1463,7 @@ func (x *TokenServiceRefreshRequest) String() string {
 func (*TokenServiceRefreshRequest) ProtoMessage() {}
 
 func (x *TokenServiceRefreshRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_metalstack_api_v2_token_proto_msgTypes[12]
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -953,7 +1476,7 @@ func (x *TokenServiceRefreshRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenServiceRefreshRequest.ProtoReflect.Descriptor instead.
 func (*TokenServiceRefreshRequest) Descriptor() ([]byte, []int) {
-	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{12}
+	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{20}
 }
 
 // TokenServiceRefreshResponse is the response payload of a token refresh request
@@ -969,7 +1492,7 @@ type TokenServiceRefreshResponse struct {
 
 func (x *TokenServiceRefreshResponse) Reset() {
 	*x = TokenServiceRefreshResponse{}
-	mi := &file_metalstack_api_v2_token_proto_msgTypes[13]
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[21]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -981,7 +1504,7 @@ func (x *TokenServiceRefreshResponse) String() string {
 func (*TokenServiceRefreshResponse) ProtoMessage() {}
 
 func (x *TokenServiceRefreshResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_metalstack_api_v2_token_proto_msgTypes[13]
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[21]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -994,7 +1517,7 @@ func (x *TokenServiceRefreshResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenServiceRefreshResponse.ProtoReflect.Descriptor instead.
 func (*TokenServiceRefreshResponse) Descriptor() ([]byte, []int) {
-	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{13}
+	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{21}
 }
 
 func (x *TokenServiceRefreshResponse) GetToken() *Token {
@@ -1031,7 +1554,7 @@ type TokenQuery struct {
 
 func (x *TokenQuery) Reset() {
 	*x = TokenQuery{}
-	mi := &file_metalstack_api_v2_token_proto_msgTypes[14]
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[22]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1043,7 +1566,7 @@ func (x *TokenQuery) String() string {
 func (*TokenQuery) ProtoMessage() {}
 
 func (x *TokenQuery) ProtoReflect() protoreflect.Message {
-	mi := &file_metalstack_api_v2_token_proto_msgTypes[14]
+	mi := &file_metalstack_api_v2_token_proto_msgTypes[22]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1056,7 +1579,7 @@ func (x *TokenQuery) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenQuery.ProtoReflect.Descriptor instead.
 func (*TokenQuery) Descriptor() ([]byte, []int) {
-	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{14}
+	return file_metalstack_api_v2_token_proto_rawDescGZIP(), []int{22}
 }
 
 func (x *TokenQuery) GetUuid() string {
@@ -1127,10 +1650,10 @@ const file_metalstack_api_v2_token_proto_rawDesc = "" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x124\n" +
 	"\x05value\x18\x02 \x01(\x0e2\x1e.metalstack.api.v2.MachineRoleR\x05value:\x028\x01B\r\n" +
 	"\v_admin_roleB\r\n" +
-	"\v_infra_role\"\xeb\b\n" +
+	"\v_infra_role\"\xf2\b\n" +
 	"\x19TokenServiceCreateRequest\x12-\n" +
-	"\vdescription\x18\x01 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01R\vdescription\x12O\n" +
-	"\vpermissions\x18\x02 \x03(\v2#.metalstack.api.v2.MethodPermissionB\b\xbaH\x05\x92\x01\x02\x10dR\vpermissions\x12G\n" +
+	"\vdescription\x18\x01 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01R\vdescription\x12V\n" +
+	"\vpermissions\x18\x02 \x03(\v2*.metalstack.api.v2.PermissionsByVisibilityB\b\xbaH\x05\x92\x01\x02\x10dR\vpermissions\x12G\n" +
 	"\aexpires\x18\x03 \x01(\v2\x19.google.protobuf.DurationB\x12\xbaH\x0f\xaa\x01\f\x1a\x05\b\x81\xe7\x84\x0f2\x03\b\xd8\x04R\aexpires\x12~\n" +
 	"\rproject_roles\x18\x04 \x03(\v2>.metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntryB\x19\xbaH\x16\x9a\x01\x13\xc0\x95\xb8\xb1\x02\x01ȕ\xb8\xb1\x02\x01*\x05\x82\x01\x02\x10\x01R\fprojectRoles\x12{\n" +
 	"\ftenant_roles\x18\x05 \x03(\v2=.metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntryB\x19\xbaH\x16\x9a\x01\x13\xc0\x95\xb8\xb1\x02\x01Е\xb8\xb1\x02\x01*\x05\x82\x01\x02\x10\x01R\vtenantRoles\x12J\n" +
@@ -1153,6 +1676,33 @@ const file_metalstack_api_v2_token_proto_rawDesc = "" +
 	"\v_infra_role\"[\n" +
 	"\x10MethodPermission\x12\"\n" +
 	"\asubject\x18\x01 \x01(\tB\b\xbaH\x05r\x03\x18\x80\x02R\asubject\x12#\n" +
+	"\amethods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\amethods\"\xe1\x03\n" +
+	"\x17PermissionsByVisibility\x12>\n" +
+	"\x06public\x18\x01 \x01(\v2$.metalstack.api.v2.PublicPermissionsH\x00R\x06public\x128\n" +
+	"\x04self\x18\x02 \x01(\v2\".metalstack.api.v2.SelfPermissionsH\x00R\x04self\x12A\n" +
+	"\aproject\x18\x03 \x01(\v2%.metalstack.api.v2.ProjectPermissionsH\x00R\aproject\x12>\n" +
+	"\x06tenant\x18\x04 \x01(\v2$.metalstack.api.v2.TenantPermissionsH\x00R\x06tenant\x12;\n" +
+	"\x05admin\x18\x05 \x01(\v2#.metalstack.api.v2.AdminPermissionsH\x00R\x05admin\x12A\n" +
+	"\amachine\x18\x06 \x01(\v2%.metalstack.api.v2.MachinePermissionsH\x00R\amachine\x12;\n" +
+	"\x05infra\x18\a \x01(\v2#.metalstack.api.v2.InfraPermissionsH\x00R\x05infraB\f\n" +
+	"\n" +
+	"visibility\"8\n" +
+	"\x11PublicPermissions\x12#\n" +
+	"\amethods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\amethods\"6\n" +
+	"\x0fSelfPermissions\x12#\n" +
+	"\amethods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\amethods\"`\n" +
+	"\x12ProjectPermissions\x12%\n" +
+	"\aproject\x18\x01 \x01(\tB\v\xbaH\br\x06\xa0\xb4\xae\xb1\x02\x01R\aproject\x12#\n" +
+	"\amethods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\amethods\"[\n" +
+	"\x11TenantPermissions\x12!\n" +
+	"\x05login\x18\x01 \x01(\tB\v\xbaH\br\x06\x98\xb4\xae\xb1\x02\x01R\x05login\x12#\n" +
+	"\amethods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\amethods\"7\n" +
+	"\x10AdminPermissions\x12#\n" +
+	"\amethods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\amethods\"Z\n" +
+	"\x12MachinePermissions\x12\x1f\n" +
+	"\x04uuid\x18\x01 \x01(\tB\v\xbaH\br\x06\xa8\xb4\xae\xb1\x02\x01R\x04uuid\x12#\n" +
+	"\amethods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\amethods\"7\n" +
+	"\x10InfraPermissions\x12#\n" +
 	"\amethods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\amethods\"d\n" +
 	"\x1aTokenServiceCreateResponse\x12.\n" +
 	"\x05token\x18\x01 \x01(\v2\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n" +
@@ -1163,13 +1713,13 @@ const file_metalstack_api_v2_token_proto_rawDesc = "" +
 	"\x06tokens\x18\x01 \x03(\v2\x18.metalstack.api.v2.TokenR\x06tokens\"9\n" +
 	"\x19TokenServiceRevokeRequest\x12\x1c\n" +
 	"\x04uuid\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"\x1c\n" +
-	"\x1aTokenServiceRevokeResponse\"\x99\t\n" +
+	"\x1aTokenServiceRevokeResponse\"\xa0\t\n" +
 	"\x19TokenServiceUpdateRequest\x12\x1c\n" +
 	"\x04uuid\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12F\n" +
 	"\vupdate_meta\x18\x02 \x01(\v2\x1d.metalstack.api.v2.UpdateMetaB\x06\xbaH\x03\xc8\x01\x00R\n" +
 	"updateMeta\x122\n" +
-	"\vdescription\x18\x03 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01H\x00R\vdescription\x88\x01\x01\x12E\n" +
-	"\vpermissions\x18\x04 \x03(\v2#.metalstack.api.v2.MethodPermissionR\vpermissions\x12~\n" +
+	"\vdescription\x18\x03 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01H\x00R\vdescription\x88\x01\x01\x12L\n" +
+	"\vpermissions\x18\x04 \x03(\v2*.metalstack.api.v2.PermissionsByVisibilityR\vpermissions\x12~\n" +
 	"\rproject_roles\x18\x05 \x03(\v2>.metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntryB\x19\xbaH\x16\x9a\x01\x13\xc0\x95\xb8\xb1\x02\x01ȕ\xb8\xb1\x02\x01*\x05\x82\x01\x02\x10\x01R\fprojectRoles\x12{\n" +
 	"\ftenant_roles\x18\x06 \x03(\v2=.metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntryB\x19\xbaH\x16\x9a\x01\x13\xc0\x95\xb8\xb1\x02\x01Е\xb8\xb1\x02\x01*\x05\x82\x01\x02\x10\x01R\vtenantRoles\x12J\n" +
 	"\n" +
@@ -1241,106 +1791,121 @@ func file_metalstack_api_v2_token_proto_rawDescGZIP() []byte {
 }
 
 var file_metalstack_api_v2_token_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_metalstack_api_v2_token_proto_msgTypes = make([]protoimpl.MessageInfo, 24)
+var file_metalstack_api_v2_token_proto_msgTypes = make([]protoimpl.MessageInfo, 32)
 var file_metalstack_api_v2_token_proto_goTypes = []any{
 	(TokenType)(0),                      // 0: metalstack.api.v2.TokenType
 	(*Token)(nil),                       // 1: metalstack.api.v2.Token
 	(*TokenServiceCreateRequest)(nil),   // 2: metalstack.api.v2.TokenServiceCreateRequest
 	(*MethodPermission)(nil),            // 3: metalstack.api.v2.MethodPermission
-	(*TokenServiceCreateResponse)(nil),  // 4: metalstack.api.v2.TokenServiceCreateResponse
-	(*TokenServiceListRequest)(nil),     // 5: metalstack.api.v2.TokenServiceListRequest
-	(*TokenServiceListResponse)(nil),    // 6: metalstack.api.v2.TokenServiceListResponse
-	(*TokenServiceRevokeRequest)(nil),   // 7: metalstack.api.v2.TokenServiceRevokeRequest
-	(*TokenServiceRevokeResponse)(nil),  // 8: metalstack.api.v2.TokenServiceRevokeResponse
-	(*TokenServiceUpdateRequest)(nil),   // 9: metalstack.api.v2.TokenServiceUpdateRequest
-	(*TokenServiceUpdateResponse)(nil),  // 10: metalstack.api.v2.TokenServiceUpdateResponse
-	(*TokenServiceGetRequest)(nil),      // 11: metalstack.api.v2.TokenServiceGetRequest
-	(*TokenServiceGetResponse)(nil),     // 12: metalstack.api.v2.TokenServiceGetResponse
-	(*TokenServiceRefreshRequest)(nil),  // 13: metalstack.api.v2.TokenServiceRefreshRequest
-	(*TokenServiceRefreshResponse)(nil), // 14: metalstack.api.v2.TokenServiceRefreshResponse
-	(*TokenQuery)(nil),                  // 15: metalstack.api.v2.TokenQuery
-	nil,                                 // 16: metalstack.api.v2.Token.ProjectRolesEntry
-	nil,                                 // 17: metalstack.api.v2.Token.TenantRolesEntry
-	nil,                                 // 18: metalstack.api.v2.Token.MachineRolesEntry
-	nil,                                 // 19: metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntry
-	nil,                                 // 20: metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntry
-	nil,                                 // 21: metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntry
-	nil,                                 // 22: metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntry
-	nil,                                 // 23: metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntry
-	nil,                                 // 24: metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntry
-	(*Meta)(nil),                        // 25: metalstack.api.v2.Meta
-	(*timestamppb.Timestamp)(nil),       // 26: google.protobuf.Timestamp
-	(AdminRole)(0),                      // 27: metalstack.api.v2.AdminRole
-	(InfraRole)(0),                      // 28: metalstack.api.v2.InfraRole
-	(*durationpb.Duration)(nil),         // 29: google.protobuf.Duration
-	(*Labels)(nil),                      // 30: metalstack.api.v2.Labels
-	(*UpdateMeta)(nil),                  // 31: metalstack.api.v2.UpdateMeta
-	(*UpdateLabels)(nil),                // 32: metalstack.api.v2.UpdateLabels
-	(ProjectRole)(0),                    // 33: metalstack.api.v2.ProjectRole
-	(TenantRole)(0),                     // 34: metalstack.api.v2.TenantRole
-	(MachineRole)(0),                    // 35: metalstack.api.v2.MachineRole
+	(*PermissionsByVisibility)(nil),     // 4: metalstack.api.v2.PermissionsByVisibility
+	(*PublicPermissions)(nil),           // 5: metalstack.api.v2.PublicPermissions
+	(*SelfPermissions)(nil),             // 6: metalstack.api.v2.SelfPermissions
+	(*ProjectPermissions)(nil),          // 7: metalstack.api.v2.ProjectPermissions
+	(*TenantPermissions)(nil),           // 8: metalstack.api.v2.TenantPermissions
+	(*AdminPermissions)(nil),            // 9: metalstack.api.v2.AdminPermissions
+	(*MachinePermissions)(nil),          // 10: metalstack.api.v2.MachinePermissions
+	(*InfraPermissions)(nil),            // 11: metalstack.api.v2.InfraPermissions
+	(*TokenServiceCreateResponse)(nil),  // 12: metalstack.api.v2.TokenServiceCreateResponse
+	(*TokenServiceListRequest)(nil),     // 13: metalstack.api.v2.TokenServiceListRequest
+	(*TokenServiceListResponse)(nil),    // 14: metalstack.api.v2.TokenServiceListResponse
+	(*TokenServiceRevokeRequest)(nil),   // 15: metalstack.api.v2.TokenServiceRevokeRequest
+	(*TokenServiceRevokeResponse)(nil),  // 16: metalstack.api.v2.TokenServiceRevokeResponse
+	(*TokenServiceUpdateRequest)(nil),   // 17: metalstack.api.v2.TokenServiceUpdateRequest
+	(*TokenServiceUpdateResponse)(nil),  // 18: metalstack.api.v2.TokenServiceUpdateResponse
+	(*TokenServiceGetRequest)(nil),      // 19: metalstack.api.v2.TokenServiceGetRequest
+	(*TokenServiceGetResponse)(nil),     // 20: metalstack.api.v2.TokenServiceGetResponse
+	(*TokenServiceRefreshRequest)(nil),  // 21: metalstack.api.v2.TokenServiceRefreshRequest
+	(*TokenServiceRefreshResponse)(nil), // 22: metalstack.api.v2.TokenServiceRefreshResponse
+	(*TokenQuery)(nil),                  // 23: metalstack.api.v2.TokenQuery
+	nil,                                 // 24: metalstack.api.v2.Token.ProjectRolesEntry
+	nil,                                 // 25: metalstack.api.v2.Token.TenantRolesEntry
+	nil,                                 // 26: metalstack.api.v2.Token.MachineRolesEntry
+	nil,                                 // 27: metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntry
+	nil,                                 // 28: metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntry
+	nil,                                 // 29: metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntry
+	nil,                                 // 30: metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntry
+	nil,                                 // 31: metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntry
+	nil,                                 // 32: metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntry
+	(*Meta)(nil),                        // 33: metalstack.api.v2.Meta
+	(*timestamppb.Timestamp)(nil),       // 34: google.protobuf.Timestamp
+	(AdminRole)(0),                      // 35: metalstack.api.v2.AdminRole
+	(InfraRole)(0),                      // 36: metalstack.api.v2.InfraRole
+	(*durationpb.Duration)(nil),         // 37: google.protobuf.Duration
+	(*Labels)(nil),                      // 38: metalstack.api.v2.Labels
+	(*UpdateMeta)(nil),                  // 39: metalstack.api.v2.UpdateMeta
+	(*UpdateLabels)(nil),                // 40: metalstack.api.v2.UpdateLabels
+	(ProjectRole)(0),                    // 41: metalstack.api.v2.ProjectRole
+	(TenantRole)(0),                     // 42: metalstack.api.v2.TenantRole
+	(MachineRole)(0),                    // 43: metalstack.api.v2.MachineRole
 }
 var file_metalstack_api_v2_token_proto_depIdxs = []int32{
-	25, // 0: metalstack.api.v2.Token.meta:type_name -> metalstack.api.v2.Meta
+	33, // 0: metalstack.api.v2.Token.meta:type_name -> metalstack.api.v2.Meta
 	3,  // 1: metalstack.api.v2.Token.permissions:type_name -> metalstack.api.v2.MethodPermission
-	26, // 2: metalstack.api.v2.Token.expires:type_name -> google.protobuf.Timestamp
-	26, // 3: metalstack.api.v2.Token.issued_at:type_name -> google.protobuf.Timestamp
+	34, // 2: metalstack.api.v2.Token.expires:type_name -> google.protobuf.Timestamp
+	34, // 3: metalstack.api.v2.Token.issued_at:type_name -> google.protobuf.Timestamp
 	0,  // 4: metalstack.api.v2.Token.token_type:type_name -> metalstack.api.v2.TokenType
-	16, // 5: metalstack.api.v2.Token.project_roles:type_name -> metalstack.api.v2.Token.ProjectRolesEntry
-	17, // 6: metalstack.api.v2.Token.tenant_roles:type_name -> metalstack.api.v2.Token.TenantRolesEntry
-	27, // 7: metalstack.api.v2.Token.admin_role:type_name -> metalstack.api.v2.AdminRole
-	28, // 8: metalstack.api.v2.Token.infra_role:type_name -> metalstack.api.v2.InfraRole
-	18, // 9: metalstack.api.v2.Token.machine_roles:type_name -> metalstack.api.v2.Token.MachineRolesEntry
-	3,  // 10: metalstack.api.v2.TokenServiceCreateRequest.permissions:type_name -> metalstack.api.v2.MethodPermission
-	29, // 11: metalstack.api.v2.TokenServiceCreateRequest.expires:type_name -> google.protobuf.Duration
-	19, // 12: metalstack.api.v2.TokenServiceCreateRequest.project_roles:type_name -> metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntry
-	20, // 13: metalstack.api.v2.TokenServiceCreateRequest.tenant_roles:type_name -> metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntry
-	27, // 14: metalstack.api.v2.TokenServiceCreateRequest.admin_role:type_name -> metalstack.api.v2.AdminRole
-	28, // 15: metalstack.api.v2.TokenServiceCreateRequest.infra_role:type_name -> metalstack.api.v2.InfraRole
-	21, // 16: metalstack.api.v2.TokenServiceCreateRequest.machine_roles:type_name -> metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntry
-	30, // 17: metalstack.api.v2.TokenServiceCreateRequest.labels:type_name -> metalstack.api.v2.Labels
-	1,  // 18: metalstack.api.v2.TokenServiceCreateResponse.token:type_name -> metalstack.api.v2.Token
-	15, // 19: metalstack.api.v2.TokenServiceListRequest.query:type_name -> metalstack.api.v2.TokenQuery
-	1,  // 20: metalstack.api.v2.TokenServiceListResponse.tokens:type_name -> metalstack.api.v2.Token
-	31, // 21: metalstack.api.v2.TokenServiceUpdateRequest.update_meta:type_name -> metalstack.api.v2.UpdateMeta
-	3,  // 22: metalstack.api.v2.TokenServiceUpdateRequest.permissions:type_name -> metalstack.api.v2.MethodPermission
-	22, // 23: metalstack.api.v2.TokenServiceUpdateRequest.project_roles:type_name -> metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntry
-	23, // 24: metalstack.api.v2.TokenServiceUpdateRequest.tenant_roles:type_name -> metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntry
-	27, // 25: metalstack.api.v2.TokenServiceUpdateRequest.admin_role:type_name -> metalstack.api.v2.AdminRole
-	28, // 26: metalstack.api.v2.TokenServiceUpdateRequest.infra_role:type_name -> metalstack.api.v2.InfraRole
-	24, // 27: metalstack.api.v2.TokenServiceUpdateRequest.machine_roles:type_name -> metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntry
-	32, // 28: metalstack.api.v2.TokenServiceUpdateRequest.labels:type_name -> metalstack.api.v2.UpdateLabels
-	1,  // 29: metalstack.api.v2.TokenServiceUpdateResponse.token:type_name -> metalstack.api.v2.Token
-	1,  // 30: metalstack.api.v2.TokenServiceGetResponse.token:type_name -> metalstack.api.v2.Token
-	1,  // 31: metalstack.api.v2.TokenServiceRefreshResponse.token:type_name -> metalstack.api.v2.Token
-	30, // 32: metalstack.api.v2.TokenQuery.labels:type_name -> metalstack.api.v2.Labels
-	0,  // 33: metalstack.api.v2.TokenQuery.token_type:type_name -> metalstack.api.v2.TokenType
-	33, // 34: metalstack.api.v2.Token.ProjectRolesEntry.value:type_name -> metalstack.api.v2.ProjectRole
-	34, // 35: metalstack.api.v2.Token.TenantRolesEntry.value:type_name -> metalstack.api.v2.TenantRole
-	35, // 36: metalstack.api.v2.Token.MachineRolesEntry.value:type_name -> metalstack.api.v2.MachineRole
-	33, // 37: metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntry.value:type_name -> metalstack.api.v2.ProjectRole
-	34, // 38: metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntry.value:type_name -> metalstack.api.v2.TenantRole
-	35, // 39: metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntry.value:type_name -> metalstack.api.v2.MachineRole
-	33, // 40: metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntry.value:type_name -> metalstack.api.v2.ProjectRole
-	34, // 41: metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntry.value:type_name -> metalstack.api.v2.TenantRole
-	35, // 42: metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntry.value:type_name -> metalstack.api.v2.MachineRole
-	11, // 43: metalstack.api.v2.TokenService.Get:input_type -> metalstack.api.v2.TokenServiceGetRequest
-	2,  // 44: metalstack.api.v2.TokenService.Create:input_type -> metalstack.api.v2.TokenServiceCreateRequest
-	9,  // 45: metalstack.api.v2.TokenService.Update:input_type -> metalstack.api.v2.TokenServiceUpdateRequest
-	5,  // 46: metalstack.api.v2.TokenService.List:input_type -> metalstack.api.v2.TokenServiceListRequest
-	7,  // 47: metalstack.api.v2.TokenService.Revoke:input_type -> metalstack.api.v2.TokenServiceRevokeRequest
-	13, // 48: metalstack.api.v2.TokenService.Refresh:input_type -> metalstack.api.v2.TokenServiceRefreshRequest
-	12, // 49: metalstack.api.v2.TokenService.Get:output_type -> metalstack.api.v2.TokenServiceGetResponse
-	4,  // 50: metalstack.api.v2.TokenService.Create:output_type -> metalstack.api.v2.TokenServiceCreateResponse
-	10, // 51: metalstack.api.v2.TokenService.Update:output_type -> metalstack.api.v2.TokenServiceUpdateResponse
-	6,  // 52: metalstack.api.v2.TokenService.List:output_type -> metalstack.api.v2.TokenServiceListResponse
-	8,  // 53: metalstack.api.v2.TokenService.Revoke:output_type -> metalstack.api.v2.TokenServiceRevokeResponse
-	14, // 54: metalstack.api.v2.TokenService.Refresh:output_type -> metalstack.api.v2.TokenServiceRefreshResponse
-	49, // [49:55] is the sub-list for method output_type
-	43, // [43:49] is the sub-list for method input_type
-	43, // [43:43] is the sub-list for extension type_name
-	43, // [43:43] is the sub-list for extension extendee
-	0,  // [0:43] is the sub-list for field type_name
+	24, // 5: metalstack.api.v2.Token.project_roles:type_name -> metalstack.api.v2.Token.ProjectRolesEntry
+	25, // 6: metalstack.api.v2.Token.tenant_roles:type_name -> metalstack.api.v2.Token.TenantRolesEntry
+	35, // 7: metalstack.api.v2.Token.admin_role:type_name -> metalstack.api.v2.AdminRole
+	36, // 8: metalstack.api.v2.Token.infra_role:type_name -> metalstack.api.v2.InfraRole
+	26, // 9: metalstack.api.v2.Token.machine_roles:type_name -> metalstack.api.v2.Token.MachineRolesEntry
+	4,  // 10: metalstack.api.v2.TokenServiceCreateRequest.permissions:type_name -> metalstack.api.v2.PermissionsByVisibility
+	37, // 11: metalstack.api.v2.TokenServiceCreateRequest.expires:type_name -> google.protobuf.Duration
+	27, // 12: metalstack.api.v2.TokenServiceCreateRequest.project_roles:type_name -> metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntry
+	28, // 13: metalstack.api.v2.TokenServiceCreateRequest.tenant_roles:type_name -> metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntry
+	35, // 14: metalstack.api.v2.TokenServiceCreateRequest.admin_role:type_name -> metalstack.api.v2.AdminRole
+	36, // 15: metalstack.api.v2.TokenServiceCreateRequest.infra_role:type_name -> metalstack.api.v2.InfraRole
+	29, // 16: metalstack.api.v2.TokenServiceCreateRequest.machine_roles:type_name -> metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntry
+	38, // 17: metalstack.api.v2.TokenServiceCreateRequest.labels:type_name -> metalstack.api.v2.Labels
+	5,  // 18: metalstack.api.v2.PermissionsByVisibility.public:type_name -> metalstack.api.v2.PublicPermissions
+	6,  // 19: metalstack.api.v2.PermissionsByVisibility.self:type_name -> metalstack.api.v2.SelfPermissions
+	7,  // 20: metalstack.api.v2.PermissionsByVisibility.project:type_name -> metalstack.api.v2.ProjectPermissions
+	8,  // 21: metalstack.api.v2.PermissionsByVisibility.tenant:type_name -> metalstack.api.v2.TenantPermissions
+	9,  // 22: metalstack.api.v2.PermissionsByVisibility.admin:type_name -> metalstack.api.v2.AdminPermissions
+	10, // 23: metalstack.api.v2.PermissionsByVisibility.machine:type_name -> metalstack.api.v2.MachinePermissions
+	11, // 24: metalstack.api.v2.PermissionsByVisibility.infra:type_name -> metalstack.api.v2.InfraPermissions
+	1,  // 25: metalstack.api.v2.TokenServiceCreateResponse.token:type_name -> metalstack.api.v2.Token
+	23, // 26: metalstack.api.v2.TokenServiceListRequest.query:type_name -> metalstack.api.v2.TokenQuery
+	1,  // 27: metalstack.api.v2.TokenServiceListResponse.tokens:type_name -> metalstack.api.v2.Token
+	39, // 28: metalstack.api.v2.TokenServiceUpdateRequest.update_meta:type_name -> metalstack.api.v2.UpdateMeta
+	4,  // 29: metalstack.api.v2.TokenServiceUpdateRequest.permissions:type_name -> metalstack.api.v2.PermissionsByVisibility
+	30, // 30: metalstack.api.v2.TokenServiceUpdateRequest.project_roles:type_name -> metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntry
+	31, // 31: metalstack.api.v2.TokenServiceUpdateRequest.tenant_roles:type_name -> metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntry
+	35, // 32: metalstack.api.v2.TokenServiceUpdateRequest.admin_role:type_name -> metalstack.api.v2.AdminRole
+	36, // 33: metalstack.api.v2.TokenServiceUpdateRequest.infra_role:type_name -> metalstack.api.v2.InfraRole
+	32, // 34: metalstack.api.v2.TokenServiceUpdateRequest.machine_roles:type_name -> metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntry
+	40, // 35: metalstack.api.v2.TokenServiceUpdateRequest.labels:type_name -> metalstack.api.v2.UpdateLabels
+	1,  // 36: metalstack.api.v2.TokenServiceUpdateResponse.token:type_name -> metalstack.api.v2.Token
+	1,  // 37: metalstack.api.v2.TokenServiceGetResponse.token:type_name -> metalstack.api.v2.Token
+	1,  // 38: metalstack.api.v2.TokenServiceRefreshResponse.token:type_name -> metalstack.api.v2.Token
+	38, // 39: metalstack.api.v2.TokenQuery.labels:type_name -> metalstack.api.v2.Labels
+	0,  // 40: metalstack.api.v2.TokenQuery.token_type:type_name -> metalstack.api.v2.TokenType
+	41, // 41: metalstack.api.v2.Token.ProjectRolesEntry.value:type_name -> metalstack.api.v2.ProjectRole
+	42, // 42: metalstack.api.v2.Token.TenantRolesEntry.value:type_name -> metalstack.api.v2.TenantRole
+	43, // 43: metalstack.api.v2.Token.MachineRolesEntry.value:type_name -> metalstack.api.v2.MachineRole
+	41, // 44: metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntry.value:type_name -> metalstack.api.v2.ProjectRole
+	42, // 45: metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntry.value:type_name -> metalstack.api.v2.TenantRole
+	43, // 46: metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntry.value:type_name -> metalstack.api.v2.MachineRole
+	41, // 47: metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntry.value:type_name -> metalstack.api.v2.ProjectRole
+	42, // 48: metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntry.value:type_name -> metalstack.api.v2.TenantRole
+	43, // 49: metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntry.value:type_name -> metalstack.api.v2.MachineRole
+	19, // 50: metalstack.api.v2.TokenService.Get:input_type -> metalstack.api.v2.TokenServiceGetRequest
+	2,  // 51: metalstack.api.v2.TokenService.Create:input_type -> metalstack.api.v2.TokenServiceCreateRequest
+	17, // 52: metalstack.api.v2.TokenService.Update:input_type -> metalstack.api.v2.TokenServiceUpdateRequest
+	13, // 53: metalstack.api.v2.TokenService.List:input_type -> metalstack.api.v2.TokenServiceListRequest
+	15, // 54: metalstack.api.v2.TokenService.Revoke:input_type -> metalstack.api.v2.TokenServiceRevokeRequest
+	21, // 55: metalstack.api.v2.TokenService.Refresh:input_type -> metalstack.api.v2.TokenServiceRefreshRequest
+	20, // 56: metalstack.api.v2.TokenService.Get:output_type -> metalstack.api.v2.TokenServiceGetResponse
+	12, // 57: metalstack.api.v2.TokenService.Create:output_type -> metalstack.api.v2.TokenServiceCreateResponse
+	18, // 58: metalstack.api.v2.TokenService.Update:output_type -> metalstack.api.v2.TokenServiceUpdateResponse
+	14, // 59: metalstack.api.v2.TokenService.List:output_type -> metalstack.api.v2.TokenServiceListResponse
+	16, // 60: metalstack.api.v2.TokenService.Revoke:output_type -> metalstack.api.v2.TokenServiceRevokeResponse
+	22, // 61: metalstack.api.v2.TokenService.Refresh:output_type -> metalstack.api.v2.TokenServiceRefreshResponse
+	56, // [56:62] is the sub-list for method output_type
+	50, // [50:56] is the sub-list for method input_type
+	50, // [50:50] is the sub-list for extension type_name
+	50, // [50:50] is the sub-list for extension extendee
+	0,  // [0:50] is the sub-list for field type_name
 }
 
 func init() { file_metalstack_api_v2_token_proto_init() }
@@ -1352,15 +1917,24 @@ func file_metalstack_api_v2_token_proto_init() {
 	file_metalstack_api_v2_predefined_rules_proto_init()
 	file_metalstack_api_v2_token_proto_msgTypes[0].OneofWrappers = []any{}
 	file_metalstack_api_v2_token_proto_msgTypes[1].OneofWrappers = []any{}
-	file_metalstack_api_v2_token_proto_msgTypes[8].OneofWrappers = []any{}
-	file_metalstack_api_v2_token_proto_msgTypes[14].OneofWrappers = []any{}
+	file_metalstack_api_v2_token_proto_msgTypes[3].OneofWrappers = []any{
+		(*PermissionsByVisibility_Public)(nil),
+		(*PermissionsByVisibility_Self)(nil),
+		(*PermissionsByVisibility_Project)(nil),
+		(*PermissionsByVisibility_Tenant)(nil),
+		(*PermissionsByVisibility_Admin)(nil),
+		(*PermissionsByVisibility_Machine)(nil),
+		(*PermissionsByVisibility_Infra)(nil),
+	}
+	file_metalstack_api_v2_token_proto_msgTypes[16].OneofWrappers = []any{}
+	file_metalstack_api_v2_token_proto_msgTypes[22].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_metalstack_api_v2_token_proto_rawDesc), len(file_metalstack_api_v2_token_proto_rawDesc)),
 			NumEnums:      1,
-			NumMessages:   24,
+			NumMessages:   32,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/go/metalstack/infra/v2/event.pb.go b/go/metalstack/infra/v2/event.pb.go
index 7d68bb15..1cc203f1 100644
--- a/go/metalstack/infra/v2/event.pb.go
+++ b/go/metalstack/infra/v2/event.pb.go
@@ -7,11 +7,9 @@
 package infrav2
 
 import (
-	_ "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate"
 	v2 "github.com/metal-stack/api/go/metalstack/api/v2"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	_ "google.golang.org/protobuf/types/known/timestamppb"
 	reflect "reflect"
 	sync "sync"
 	unsafe "unsafe"
@@ -129,7 +127,7 @@ var File_metalstack_infra_v2_event_proto protoreflect.FileDescriptor
 
 const file_metalstack_infra_v2_event_proto_rawDesc = "" +
 	"\n" +
-	"\x1fmetalstack/infra/v2/event.proto\x12\x13metalstack.infra.v2\x1a\x1bbuf/validate/validate.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1emetalstack/api/v2/common.proto\x1a\x1fmetalstack/api/v2/machine.proto\"\xd3\x01\n" +
+	"\x1fmetalstack/infra/v2/event.proto\x12\x13metalstack.infra.v2\x1a\x1emetalstack/api/v2/common.proto\x1a\x1fmetalstack/api/v2/machine.proto\"\xd3\x01\n" +
 	"\x17EventServiceSendRequest\x12P\n" +
 	"\x06events\x18\x01 \x03(\v28.metalstack.infra.v2.EventServiceSendRequest.EventsEntryR\x06events\x1af\n" +
 	"\vEventsEntry\x12\x10\n" +
diff --git a/go/tests/validation/image_test.go b/go/tests/validation/image_test.go
index 6445721b..fd79f124 100644
--- a/go/tests/validation/image_test.go
+++ b/go/tests/validation/image_test.go
@@ -51,7 +51,7 @@ func TestValidateImage(t *testing.T) {
 			wantErr: false,
 		},
 		{
-			name: "InValid ImageUpdate duplicate Features",
+			name: "invalid ImageUpdate duplicate Features",
 			msg: &adminv2.ImageServiceUpdateRequest{
 				Id:             "debian:12.0.20250101",
 				Name:           new("debian"),
@@ -63,7 +63,7 @@ func TestValidateImage(t *testing.T) {
 			wantErrorMessage: `validation error: features: repeated value must contain unique items`,
 		},
 		{
-			name: "InValid ImageUpdate invalid Features",
+			name: "invalid ImageUpdate invalid Features",
 			msg: &adminv2.ImageServiceUpdateRequest{
 				Id:             "debian:12.0.20250101",
 				Name:           new("debian"),
diff --git a/go/tests/validation/network_test.go b/go/tests/validation/network_test.go
index 44f60ac4..576fcc85 100644
--- a/go/tests/validation/network_test.go
+++ b/go/tests/validation/network_test.go
@@ -19,7 +19,7 @@ func TestValidateNetwork(t *testing.T) {
 			wantErr: false,
 		},
 		{
-			name: "InValid NetworkCreateRequest prefixes malformed",
+			name: "invalid NetworkCreateRequest prefixes malformed",
 			msg: &adminv2.NetworkServiceCreateRequest{
 				Id:                  new("internet"),
 				NatType:             apiv2.NATType_NAT_TYPE_IPV4_MASQUERADE.Enum(),
@@ -40,7 +40,7 @@ func TestValidateNetwork(t *testing.T) {
 			wantErr: false,
 		},
 		{
-			name: "InValid Network minimal config",
+			name: "invalid Network minimal config",
 			msg: &apiv2.Network{
 				Id:                  "internet",
 				Prefixes:            []string{"1.2.3.4.5/99"},
diff --git a/go/tests/validation/token_test.go b/go/tests/validation/token_test.go
index 30e5f097..a8226fbb 100644
--- a/go/tests/validation/token_test.go
+++ b/go/tests/validation/token_test.go
@@ -6,10 +6,10 @@ import (
 	apiv2 "github.com/metal-stack/api/go/metalstack/api/v2"
 )
 
-func TestValidateToken(t *testing.T) {
+func Test_validateToken(t *testing.T) {
 	tests := prototests{
 		{
-			name: "Valid Token Create Request",
+			name: "valid token create request",
 			msg: &apiv2.TokenServiceCreateRequest{
 				Description: "A Token",
 				ProjectRoles: map[string]apiv2.ProjectRole{
@@ -24,7 +24,7 @@ func TestValidateToken(t *testing.T) {
 			wantErr: false,
 		},
 		{
-			name: "InValid Token Create Request",
+			name: "invalid token create request",
 			msg: &apiv2.TokenServiceCreateRequest{
 				Description: "B Token",
 				ProjectRoles: map[string]apiv2.ProjectRole{
@@ -37,7 +37,7 @@ func TestValidateToken(t *testing.T) {
  - project_roles["p42"]: value must be one of the defined enum values`,
 		},
 		{
-			name: "InValid Token Create Request",
+			name: "invalid token create request",
 			msg: &apiv2.TokenServiceCreateRequest{
 				Description: "B Token",
 				ProjectRoles: map[string]apiv2.ProjectRole{
@@ -48,15 +48,67 @@ func TestValidateToken(t *testing.T) {
 			wantErrorMessage: `validation error: project_roles["00000000-0000-0000-0000-000000000000"]: value must be one of the defined enum values`,
 		},
 		{
-			name: "InValid Token, user token with permissions",
+			name: "valid token create request, api token with permissions",
+			msg: &apiv2.TokenServiceCreateRequest{
+				Description: "B Token",
+				Permissions: []*apiv2.PermissionsByVisibility{
+					{
+						Visibility: &apiv2.PermissionsByVisibility_Project{
+							Project: &apiv2.ProjectPermissions{
+								Project: "08538119-edd3-4734-84a4-8681da17da5b",
+								Methods: []string{"/metalstack.api.v2.IPService/List"},
+							},
+						},
+					},
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "valid token create request, api token with wildcard permissions",
+			msg: &apiv2.TokenServiceCreateRequest{
+				Description: "B Token",
+				Permissions: []*apiv2.PermissionsByVisibility{
+					{
+						Visibility: &apiv2.PermissionsByVisibility_Project{
+							Project: &apiv2.ProjectPermissions{
+								Project: "*",
+								Methods: []string{"/metalstack.api.v2.IPService/List"},
+							},
+						},
+					},
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "invalid token create request, api token with project permission that has an invalid uuid",
+			msg: &apiv2.TokenServiceCreateRequest{
+				Description: "B Token",
+				Permissions: []*apiv2.PermissionsByVisibility{
+					{
+						Visibility: &apiv2.PermissionsByVisibility_Project{
+							Project: &apiv2.ProjectPermissions{
+								Project: "foo",
+								Methods: []string{"/metalstack.api.v2.IPService/List"},
+							},
+						},
+					},
+				},
+			},
+			wantErr:          true,
+			wantErrorMessage: "validation error: permissions[0].project.project: must be '*' or a uuid",
+		},
+		{
+			name: "invalid token, user token with permissions",
 			msg: &apiv2.Token{
 				Uuid:        "00000000-0000-0000-0000-000000000000",
 				User:        "user-a",
 				Description: "B Token",
 				Permissions: []*apiv2.MethodPermission{
 					{
-						Subject: "project-a",
-						Methods: []string{"/metalstack.admin.v2.IPService/List"},
+						Subject: "08538119-edd3-4734-84a4-8681da17da5b",
+						Methods: []string{"/metalstack.api.v2.IPService/List"},
 					},
 				},
 				TokenType: apiv2.TokenType_TOKEN_TYPE_USER,
@@ -65,15 +117,15 @@ func TestValidateToken(t *testing.T) {
 			wantErrorMessage: `validation error: token type user must not have permissions`,
 		},
 		{
-			name: "Valid Token, api token with permissions",
+			name: "valid token, api token with permissions",
 			msg: &apiv2.Token{
 				Uuid:        "00000000-0000-0000-0000-000000000000",
 				User:        "user-a",
 				Description: "B Token",
 				Permissions: []*apiv2.MethodPermission{
 					{
-						Subject: "project-a",
-						Methods: []string{"/metalstack.admin.v2.IPService/List"},
+						Subject: "08538119-edd3-4734-84a4-8681da17da5b",
+						Methods: []string{"/metalstack.api.v2.IPService/List"},
 					},
 				},
 				TokenType: apiv2.TokenType_TOKEN_TYPE_API,
@@ -81,11 +133,10 @@ func TestValidateToken(t *testing.T) {
 			wantErr: false,
 		},
 		{
-			name: "Valid Token, api token with machineroles",
+			name: "valid token, api token with machineroles",
 			msg: &apiv2.TokenServiceUpdateRequest{
 				Uuid: "00000000-0000-0000-0000-000000000000",
 				MachineRoles: map[string]apiv2.MachineRole{
-					"":                                     apiv2.MachineRole_MACHINE_ROLE_EDITOR,
 					"*":                                    apiv2.MachineRole_MACHINE_ROLE_EDITOR,
 					"00000000-0000-0000-0000-000000000000": apiv2.MachineRole_MACHINE_ROLE_EDITOR,
 				},
@@ -93,11 +144,10 @@ func TestValidateToken(t *testing.T) {
 			wantErr: false,
 		},
 		{
-			name: "InValid Token, api token with machineroles with invalid uuid",
+			name: "invalid token, api token with machineroles with invalid uuid",
 			msg: &apiv2.TokenServiceUpdateRequest{
 				Uuid: "00000000-0000-0000-0000-000000000000",
 				MachineRoles: map[string]apiv2.MachineRole{
-					"":                                     apiv2.MachineRole_MACHINE_ROLE_EDITOR,
 					"*":                                    apiv2.MachineRole_MACHINE_ROLE_EDITOR,
 					"y0000000-0000-0000-0000-000000000000": apiv2.MachineRole_MACHINE_ROLE_EDITOR,
 				},
@@ -106,7 +156,7 @@ func TestValidateToken(t *testing.T) {
 			wantErrorMessage: "validation error: machine_roles: subject must be empty string, '*', or a valid UUID",
 		},
 		{
-			name: "InValid Token, api token with machineroles with invalid key",
+			name: "invalid token, api token with machineroles with invalid key",
 			msg: &apiv2.TokenServiceUpdateRequest{
 				Uuid: "00000000-0000-0000-0000-000000000000",
 				MachineRoles: map[string]apiv2.MachineRole{
@@ -119,7 +169,7 @@ func TestValidateToken(t *testing.T) {
 			wantErrorMessage: "validation error: machine_roles: subject must be empty string, '*', or a valid UUID",
 		},
 		{
-			name: "InValid Token Create Request, token role not trimmed",
+			name: "invalid token create request, token role not trimmed",
 			msg: &apiv2.TokenServiceCreateRequest{
 				Description: "A Token",
 				ProjectRoles: map[string]apiv2.ProjectRole{
diff --git a/js/metalstack/admin/v2/project_pb.js b/js/metalstack/admin/v2/project_pb.js
index f3178cb1..015ff522 100644
--- a/js/metalstack/admin/v2/project_pb.js
+++ b/js/metalstack/admin/v2/project_pb.js
@@ -2,14 +2,12 @@
 // @generated from file metalstack/admin/v2/project.proto (package metalstack.admin.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
-import { file_buf_validate_validate } from "../../../buf/validate/validate_pb";
 import { file_metalstack_api_v2_common } from "../../api/v2/common_pb";
-import { file_metalstack_api_v2_predefined_rules } from "../../api/v2/predefined_rules_pb";
 import { file_metalstack_api_v2_project } from "../../api/v2/project_pb";
 /**
  * Describes the file metalstack/admin/v2/project.proto.
  */
-export const file_metalstack_admin_v2_project = /*@__PURE__*/ fileDesc("CiFtZXRhbHN0YWNrL2FkbWluL3YyL3Byb2plY3QucHJvdG8SE21ldGFsc3RhY2suYWRtaW4udjIiWgoZUHJvamVjdFNlcnZpY2VMaXN0UmVxdWVzdBIzCgVxdWVyeRgBIAEoCzIfLm1ldGFsc3RhY2suYXBpLnYyLlByb2plY3RRdWVyeUgAiAEBQggKBl9xdWVyeSJKChpQcm9qZWN0U2VydmljZUxpc3RSZXNwb25zZRIsCghwcm9qZWN0cxgBIAMoCzIaLm1ldGFsc3RhY2suYXBpLnYyLlByb2plY3QyhQEKDlByb2plY3RTZXJ2aWNlEnMKBExpc3QSLi5tZXRhbHN0YWNrLmFkbWluLnYyLlByb2plY3RTZXJ2aWNlTGlzdFJlcXVlc3QaLy5tZXRhbHN0YWNrLmFkbWluLnYyLlByb2plY3RTZXJ2aWNlTGlzdFJlc3BvbnNlIgrS8xgCAQLg8xgCQtABChdjb20ubWV0YWxzdGFjay5hZG1pbi52MkIMUHJvamVjdFByb3RvUAFaOWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYWRtaW4vdjI7YWRtaW52MqICA01BWKoCE01ldGFsc3RhY2suQWRtaW4uVjLKAhNNZXRhbHN0YWNrXEFkbWluXFYy4gIfTWV0YWxzdGFja1xBZG1pblxWMlxHUEJNZXRhZGF0YeoCFU1ldGFsc3RhY2s6OkFkbWluOjpWMmIGcHJvdG8z", [file_buf_validate_validate, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules, file_metalstack_api_v2_project]);
+export const file_metalstack_admin_v2_project = /*@__PURE__*/ fileDesc("CiFtZXRhbHN0YWNrL2FkbWluL3YyL3Byb2plY3QucHJvdG8SE21ldGFsc3RhY2suYWRtaW4udjIiWgoZUHJvamVjdFNlcnZpY2VMaXN0UmVxdWVzdBIzCgVxdWVyeRgBIAEoCzIfLm1ldGFsc3RhY2suYXBpLnYyLlByb2plY3RRdWVyeUgAiAEBQggKBl9xdWVyeSJKChpQcm9qZWN0U2VydmljZUxpc3RSZXNwb25zZRIsCghwcm9qZWN0cxgBIAMoCzIaLm1ldGFsc3RhY2suYXBpLnYyLlByb2plY3QyhQEKDlByb2plY3RTZXJ2aWNlEnMKBExpc3QSLi5tZXRhbHN0YWNrLmFkbWluLnYyLlByb2plY3RTZXJ2aWNlTGlzdFJlcXVlc3QaLy5tZXRhbHN0YWNrLmFkbWluLnYyLlByb2plY3RTZXJ2aWNlTGlzdFJlc3BvbnNlIgrS8xgCAQLg8xgCQtABChdjb20ubWV0YWxzdGFjay5hZG1pbi52MkIMUHJvamVjdFByb3RvUAFaOWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYWRtaW4vdjI7YWRtaW52MqICA01BWKoCE01ldGFsc3RhY2suQWRtaW4uVjLKAhNNZXRhbHN0YWNrXEFkbWluXFYy4gIfTWV0YWxzdGFja1xBZG1pblxWMlxHUEJNZXRhZGF0YeoCFU1ldGFsc3RhY2s6OkFkbWluOjpWMmIGcHJvdG8z", [file_metalstack_api_v2_common, file_metalstack_api_v2_project]);
 /**
  * Describes the message metalstack.admin.v2.ProjectServiceListRequest.
  * Use `create(ProjectServiceListRequestSchema)` to create a new message.
diff --git a/js/metalstack/admin/v2/project_pb.ts b/js/metalstack/admin/v2/project_pb.ts
index f4d2d738..fb1a5b47 100644
--- a/js/metalstack/admin/v2/project_pb.ts
+++ b/js/metalstack/admin/v2/project_pb.ts
@@ -4,9 +4,7 @@
 
 import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
-import { file_buf_validate_validate } from "../../../buf/validate/validate_pb";
 import { file_metalstack_api_v2_common } from "../../api/v2/common_pb";
-import { file_metalstack_api_v2_predefined_rules } from "../../api/v2/predefined_rules_pb";
 import type { Project, ProjectQuery } from "../../api/v2/project_pb";
 import { file_metalstack_api_v2_project } from "../../api/v2/project_pb";
 import type { Message } from "@bufbuild/protobuf";
@@ -15,7 +13,7 @@ import type { Message } from "@bufbuild/protobuf";
  * Describes the file metalstack/admin/v2/project.proto.
  */
 export const file_metalstack_admin_v2_project: GenFile = /*@__PURE__*/
-  fileDesc("CiFtZXRhbHN0YWNrL2FkbWluL3YyL3Byb2plY3QucHJvdG8SE21ldGFsc3RhY2suYWRtaW4udjIiWgoZUHJvamVjdFNlcnZpY2VMaXN0UmVxdWVzdBIzCgVxdWVyeRgBIAEoCzIfLm1ldGFsc3RhY2suYXBpLnYyLlByb2plY3RRdWVyeUgAiAEBQggKBl9xdWVyeSJKChpQcm9qZWN0U2VydmljZUxpc3RSZXNwb25zZRIsCghwcm9qZWN0cxgBIAMoCzIaLm1ldGFsc3RhY2suYXBpLnYyLlByb2plY3QyhQEKDlByb2plY3RTZXJ2aWNlEnMKBExpc3QSLi5tZXRhbHN0YWNrLmFkbWluLnYyLlByb2plY3RTZXJ2aWNlTGlzdFJlcXVlc3QaLy5tZXRhbHN0YWNrLmFkbWluLnYyLlByb2plY3RTZXJ2aWNlTGlzdFJlc3BvbnNlIgrS8xgCAQLg8xgCQtABChdjb20ubWV0YWxzdGFjay5hZG1pbi52MkIMUHJvamVjdFByb3RvUAFaOWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYWRtaW4vdjI7YWRtaW52MqICA01BWKoCE01ldGFsc3RhY2suQWRtaW4uVjLKAhNNZXRhbHN0YWNrXEFkbWluXFYy4gIfTWV0YWxzdGFja1xBZG1pblxWMlxHUEJNZXRhZGF0YeoCFU1ldGFsc3RhY2s6OkFkbWluOjpWMmIGcHJvdG8z", [file_buf_validate_validate, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules, file_metalstack_api_v2_project]);
+  fileDesc("CiFtZXRhbHN0YWNrL2FkbWluL3YyL3Byb2plY3QucHJvdG8SE21ldGFsc3RhY2suYWRtaW4udjIiWgoZUHJvamVjdFNlcnZpY2VMaXN0UmVxdWVzdBIzCgVxdWVyeRgBIAEoCzIfLm1ldGFsc3RhY2suYXBpLnYyLlByb2plY3RRdWVyeUgAiAEBQggKBl9xdWVyeSJKChpQcm9qZWN0U2VydmljZUxpc3RSZXNwb25zZRIsCghwcm9qZWN0cxgBIAMoCzIaLm1ldGFsc3RhY2suYXBpLnYyLlByb2plY3QyhQEKDlByb2plY3RTZXJ2aWNlEnMKBExpc3QSLi5tZXRhbHN0YWNrLmFkbWluLnYyLlByb2plY3RTZXJ2aWNlTGlzdFJlcXVlc3QaLy5tZXRhbHN0YWNrLmFkbWluLnYyLlByb2plY3RTZXJ2aWNlTGlzdFJlc3BvbnNlIgrS8xgCAQLg8xgCQtABChdjb20ubWV0YWxzdGFjay5hZG1pbi52MkIMUHJvamVjdFByb3RvUAFaOWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYWRtaW4vdjI7YWRtaW52MqICA01BWKoCE01ldGFsc3RhY2suQWRtaW4uVjLKAhNNZXRhbHN0YWNrXEFkbWluXFYy4gIfTWV0YWxzdGFja1xBZG1pblxWMlxHUEJNZXRhZGF0YeoCFU1ldGFsc3RhY2s6OkFkbWluOjpWMmIGcHJvdG8z", [file_metalstack_api_v2_common, file_metalstack_api_v2_project]);
 
 /**
  * ProjectServiceListRequest is the request payload for listing projects.
diff --git a/js/metalstack/api/v2/predefined_rules_pb.d.ts b/js/metalstack/api/v2/predefined_rules_pb.d.ts
index adcf8083..5d785f8c 100644
--- a/js/metalstack/api/v2/predefined_rules_pb.d.ts
+++ b/js/metalstack/api/v2/predefined_rules_pb.d.ts
@@ -76,6 +76,24 @@ export declare const is_key: GenExtension<StringRules, boolean>;
  * @generated from extension: optional bool is_tenant_login = 80048962;
  */
 export declare const is_tenant_login: GenExtension<StringRules, boolean>;
+/**
+ * IsTenantSubjectPermission returns true if name field satisfies our requirements
+ *
+ * @generated from extension: optional bool is_tenant_subject_permission = 80048963;
+ */
+export declare const is_tenant_subject_permission: GenExtension<StringRules, boolean>;
+/**
+ * IsProjectSubjectPermission returns true if name field satisfies our requirements
+ *
+ * @generated from extension: optional bool is_project_subject_permission = 80048964;
+ */
+export declare const is_project_subject_permission: GenExtension<StringRules, boolean>;
+/**
+ * IsMachineSubjectPermission returns true if name field satisfies our requirements
+ *
+ * @generated from extension: optional bool is_machine_subject_permission = 80048965;
+ */
+export declare const is_machine_subject_permission: GenExtension<StringRules, boolean>;
 /**
  * Prefixes validates if a slice of prefixes in string form are valid
  *
diff --git a/js/metalstack/api/v2/predefined_rules_pb.js b/js/metalstack/api/v2/predefined_rules_pb.js
index 1fde5a62..88a472a9 100644
--- a/js/metalstack/api/v2/predefined_rules_pb.js
+++ b/js/metalstack/api/v2/predefined_rules_pb.js
@@ -6,7 +6,7 @@ import { file_buf_validate_validate } from "../../../buf/validate/validate_pb";
 /**
  * Describes the file metalstack/api/v2/predefined_rules.proto.
  */
-export const file_metalstack_api_v2_predefined_rules = /*@__PURE__*/ fileDesc("CihtZXRhbHN0YWNrL2FwaS92Mi9wcmVkZWZpbmVkX3J1bGVzLnByb3RvEhFtZXRhbHN0YWNrLmFwaS52Mjq4AQoKbWFjYWRkcmVzcxIZLmJ1Zi52YWxpZGF0ZS5TdHJpbmdSdWxlcxi35pUmIAEoCEJ6wkh3CnUKEXN0cmluZy5tYWNhZGRyZXNzEiZ0aGlzIHN0cmluZyBtdXN0IGJlIGEgdmFsaWQgbWFjYWRkcmVzcxo4dGhpcy5tYXRjaGVzKCdeKFswLTlBLUZhLWZdezJ9WzpdKXs1fShbMC05QS1GYS1mXXsyfSkkJylSCm1hY2FkZHJlc3M6mQEKB2lzX25hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuOaVJiABKAhCYsJIXwpdCg5zdHJpbmcuaXNfbmFtZRIjbXVzdCBiZSB3aXRoaW4gMiBhbmQgMTI4IGNoYXJhY3RlcnMaJnRoaXMuc2l6ZSgpID49IDIgJiYgdGhpcy5zaXplKCkgPD0gMTI4UgZpc05hbWU6mgEKDmlzX2Rlc2NyaXB0aW9uEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGLnmlSYgASgIQlXCSFIKUAoVc3RyaW5nLmlzX2Rlc2NyaXB0aW9uEiNtdXN0IGJlIHNob3J0ZXIgdGhhbiAyNTYgY2hhcmFjdGVycxoSdGhpcy5zaXplKCkgPD0gMjU2Ug1pc0Rlc2NyaXB0aW9uOqgBCgxpc19wYXJ0aXRpb24SGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuuaVJiABKAhCZ8JIZApiChNzdHJpbmcuaXNfcGFydGl0aW9uEiNtdXN0IGJlIHdpdGhpbiAyIGFuZCAxMjggY2hhcmFjdGVycxomdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSAxMjhSC2lzUGFydGl0aW9uOoIBCglpc19wcmVmaXgSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYu+aVJiABKAhCR8JIRApCCg9zdHJpbmcucHJlZml4ZXMSHGdpdmVuIHByZWZpeGVzIG11c3QgYmUgdmFsaWQaEXRoaXMuaXNJcFByZWZpeCgpUghpc1ByZWZpeDptCgZpc191cmkSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYvOaVJiABKAhCOMJINQozCgpzdHJpbmcudXJpEhdnaXZlbiB1cmkgbXVzdCBiZSB2YWxpZBoMdGhpcy5pc1VyaSgpUgVpc1VyaTqnAQoRaXNfaXBfb3JfaG9zdG5hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYveaVJiABKAhCXsJIWwpZCg12YWxpZF9hZGRyZXNzEiZtdXN0IGJlIGEgdmFsaWQgSVAgYWRkcmVzcyBvciBob3N0bmFtZRogdGhpcy5pc0lwKCkgfHwgdGhpcy5pc0hvc3RuYW1lKClSDmlzSXBPckhvc3RuYW1lOp0BCgd0cmltbWVkEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGL7mlSYgASgIQmXCSGIKYAoOc3RyaW5nLnRyaW1tZWQSK3ZhbHVlIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaIXRoaXMudHJpbSgpLnNpemUoKSA9PSB0aGlzLnNpemUoKVIHdHJpbW1lZDqZAQoHaXNfdXNlchIZLmJ1Zi52YWxpZGF0ZS5TdHJpbmdSdWxlcxi/5pUmIAEoCEJiwkhfCl0KDnN0cmluZy5pc191c2VyEiNtdXN0IGJlIHdpdGhpbiAyIGFuZCA1MTIgY2hhcmFjdGVycxomdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSA1MTJSBmlzVXNlcjqfAQoJaXNfb3B0aW9uEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGMDmlSYgASgIQmTCSGEKXwoQc3RyaW5nLmlzX29wdGlvbhIjbXVzdCBiZSB3aXRoaW4gMSBhbmQgMTI4IGNoYXJhY3RlcnMaJnRoaXMuc2l6ZSgpID49IDEgJiYgdGhpcy5zaXplKCkgPD0gMTI4Ughpc09wdGlvbjqYAQoGaXNfa2V5EhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGMHmlSYgASgIQmPCSGAKXgoNc3RyaW5nLmlzX2tleRIkbXVzdCBiZSB3aXRoaW4gMSBhbmQgODE5MiBjaGFyYWN0ZXJzGid0aGlzLnNpemUoKSA+PSAxICYmIHRoaXMuc2l6ZSgpIDw9IDgxOTJSBWlzS2V5OrABCg9pc190ZW5hbnRfbG9naW4SGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYwuaVJiABKAhCasJIZwplChZzdHJpbmcuaXNfdGVuYW50X2xvZ2luEiNtdXN0IGJlIHdpdGhpbiAyIGFuZCAyNTYgY2hhcmFjdGVycxomdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSAyNTZSDWlzVGVuYW50TG9naW46jwEKCHByZWZpeGVzEhsuYnVmLnZhbGlkYXRlLlJlcGVhdGVkUnVsZXMYx7SWJiABKAhCU8JIUApOChFyZXBlYXRlZC5wcmVmaXhlcxIcZ2l2ZW4gcHJlZml4ZXMgbXVzdCBiZSB2YWxpZBobdGhpcy5hbGwobSwgbS5pc0lwUHJlZml4KCkpUghwcmVmaXhlczp1CgNpcHMSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjItJYmIAEoCEJDwkhACj4KDHJlcGVhdGVkLmlwcxIXZ2l2ZW4gaXBzIG11c3QgYmUgdmFsaWQaFXRoaXMuYWxsKG0sIG0uaXNJcCgpKVIDaXBzOuYBChFhcmVfaG9zdF9hbmRfcG9ydBIbLmJ1Zi52YWxpZGF0ZS5SZXBlYXRlZFJ1bGVzGMm0liYgASgIQpoBwkiWAQqTAQoacmVwZWF0ZWQuYXJlX2hvc3RfYW5kX3BvcnQSUGdpdmVuIGVudHJpZXMgbXVzdCBhbGwgYmUgaW4gdGhlIGZvcm0gb2YgPGlwIHwgaG9zdD46PHBvcnQ+IGJ1dCBwb3J0IGlzIG9wdGlvbmFsGiN0aGlzLmFsbChtLCBtLmlzSG9zdEFuZFBvcnQoZmFsc2UpKVIOYXJlSG9zdEFuZFBvcnQ6ugEKC2FsbF90cmltbWVkEhsuYnVmLnZhbGlkYXRlLlJlcGVhdGVkUnVsZXMYyrSWJiABKAhCecJIdgp0ChRyZXBlYXRlZC5hbGxfdHJpbW1lZBIyZ2l2ZW4gdmFsdWVzIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaKHRoaXMuYWxsKG0sIG0udHJpbSgpLnNpemUoKSA9PSBtLnNpemUoKSlSCmFsbFRyaW1tZWQ6hAIKF2tleXNfYW5kX3ZhbHVlc190cmltbWVkEhYuYnVmLnZhbGlkYXRlLk1hcFJ1bGVzGNeClyYgASgIQrEBwkitAQqqAQobbWFwLmtleXNfYW5kX3ZhbHVlc190cmltbWVkEjVrZXlzIGFuZCB2YWx1ZXMgbXVzdCBub3Qgc3RhcnQgb3IgZW5kIHdpdGggd2hpdGVzcGFjZRpUdGhpcy5hbGwoaywgay50cmltKCkuc2l6ZSgpID09IGsuc2l6ZSgpKSAmJiB0aGlzLmFsbCh2LCB2LnRyaW0oKS5zaXplKCkgPT0gdi5zaXplKCkpUhRrZXlzQW5kVmFsdWVzVHJpbW1lZDqrAQoMa2V5c190cmltbWVkEhYuYnVmLnZhbGlkYXRlLk1hcFJ1bGVzGNiClyYgASgIQm3CSGoKaAoQbWFwLmtleXNfdHJpbW1lZBIqa2V5cyBtdXN0IG5vdCBzdGFydCBvciBlbmQgd2l0aCB3aGl0ZXNwYWNlGih0aGlzLmFsbChrLCBrLnRyaW0oKS5zaXplKCkgPT0gay5zaXplKCkpUgtrZXlzVHJpbW1lZDqSAgoYcHJvamVjdF9yb2xlc19rZXlzX3ZhbGlkEhYuYnVmLnZhbGlkYXRlLk1hcFJ1bGVzGNmClyYgASgIQr0Bwki5AQq2AQoXcHJvamVjdF9yb2xlcy5rZXkudmFsaWQSJnN1YmplY3QgbXVzdCBiZSBhICcqJywgb3IgYSB2YWxpZCBVVUlEGnN0aGlzLmFsbChrLCBrID09ICcqJyB8fCBrLm1hdGNoZXMoJ15bMC05YS1mQS1GXXs4fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXsxMn0kJykpUhVwcm9qZWN0Um9sZXNLZXlzVmFsaWQ66AEKF3RlbmFudF9yb2xlc19rZXlzX3ZhbGlkEhYuYnVmLnZhbGlkYXRlLk1hcFJ1bGVzGNqClyYgASgIQpUBwkiRAQqOAQoWdGVuYW50X3JvbGVzLmtleS52YWxpZBIzc3ViamVjdCBtdXN0IGJlICcqJyBvciBiZXR3ZWVuIDIgYW5kIDEyOCBjaGFyYWN0ZXJzGj90aGlzLmFsbChrLCBrID09ICcqJyB8fCB0aGlzLnNpemUoKSA+PSAyIHx8IHRoaXMuc2l6ZSgpIDw9MTI4IClSFHRlbmFudFJvbGVzS2V5c1ZhbGlkOqkCChhtYWNoaW5lX3JvbGVzX2tleXNfdmFsaWQSFi5idWYudmFsaWRhdGUuTWFwUnVsZXMY24KXJiABKAhC1AHCSNABCs0BChdtYWNoaW5lX3JvbGVzLmtleS52YWxpZBIyc3ViamVjdCBtdXN0IGJlIGVtcHR5IHN0cmluZywgJyonLCBvciBhIHZhbGlkIFVVSUQafnRoaXMuYWxsKGssIGsgPT0gJycgfHwgayA9PSAnKicgfHwgay5tYXRjaGVzKCdeWzAtOWEtZkEtRl17OH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17MTJ9JCcpKVIVbWFjaGluZVJvbGVzS2V5c1ZhbGlkQsoBChVjb20ubWV0YWxzdGFjay5hcGkudjJCFFByZWRlZmluZWRSdWxlc1Byb3RvUAFaNWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYXBpL3YyO2FwaXYyogIDTUFYqgIRTWV0YWxzdGFjay5BcGkuVjLKAhFNZXRhbHN0YWNrXEFwaVxWMuICHU1ldGFsc3RhY2tcQXBpXFYyXEdQQk1ldGFkYXRh6gITTWV0YWxzdGFjazo6QXBpOjpWMg", [file_buf_validate_validate]);
+export const file_metalstack_api_v2_predefined_rules = /*@__PURE__*/ fileDesc("CihtZXRhbHN0YWNrL2FwaS92Mi9wcmVkZWZpbmVkX3J1bGVzLnByb3RvEhFtZXRhbHN0YWNrLmFwaS52Mjq4AQoKbWFjYWRkcmVzcxIZLmJ1Zi52YWxpZGF0ZS5TdHJpbmdSdWxlcxi35pUmIAEoCEJ6wkh3CnUKEXN0cmluZy5tYWNhZGRyZXNzEiZ0aGlzIHN0cmluZyBtdXN0IGJlIGEgdmFsaWQgbWFjYWRkcmVzcxo4dGhpcy5tYXRjaGVzKCdeKFswLTlBLUZhLWZdezJ9WzpdKXs1fShbMC05QS1GYS1mXXsyfSkkJylSCm1hY2FkZHJlc3M6mQEKB2lzX25hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuOaVJiABKAhCYsJIXwpdCg5zdHJpbmcuaXNfbmFtZRIjbXVzdCBiZSB3aXRoaW4gMiBhbmQgMTI4IGNoYXJhY3RlcnMaJnRoaXMuc2l6ZSgpID49IDIgJiYgdGhpcy5zaXplKCkgPD0gMTI4UgZpc05hbWU6mgEKDmlzX2Rlc2NyaXB0aW9uEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGLnmlSYgASgIQlXCSFIKUAoVc3RyaW5nLmlzX2Rlc2NyaXB0aW9uEiNtdXN0IGJlIHNob3J0ZXIgdGhhbiAyNTYgY2hhcmFjdGVycxoSdGhpcy5zaXplKCkgPD0gMjU2Ug1pc0Rlc2NyaXB0aW9uOqgBCgxpc19wYXJ0aXRpb24SGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuuaVJiABKAhCZ8JIZApiChNzdHJpbmcuaXNfcGFydGl0aW9uEiNtdXN0IGJlIHdpdGhpbiAyIGFuZCAxMjggY2hhcmFjdGVycxomdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSAxMjhSC2lzUGFydGl0aW9uOoIBCglpc19wcmVmaXgSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYu+aVJiABKAhCR8JIRApCCg9zdHJpbmcucHJlZml4ZXMSHGdpdmVuIHByZWZpeGVzIG11c3QgYmUgdmFsaWQaEXRoaXMuaXNJcFByZWZpeCgpUghpc1ByZWZpeDptCgZpc191cmkSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYvOaVJiABKAhCOMJINQozCgpzdHJpbmcudXJpEhdnaXZlbiB1cmkgbXVzdCBiZSB2YWxpZBoMdGhpcy5pc1VyaSgpUgVpc1VyaTqnAQoRaXNfaXBfb3JfaG9zdG5hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYveaVJiABKAhCXsJIWwpZCg12YWxpZF9hZGRyZXNzEiZtdXN0IGJlIGEgdmFsaWQgSVAgYWRkcmVzcyBvciBob3N0bmFtZRogdGhpcy5pc0lwKCkgfHwgdGhpcy5pc0hvc3RuYW1lKClSDmlzSXBPckhvc3RuYW1lOp0BCgd0cmltbWVkEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGL7mlSYgASgIQmXCSGIKYAoOc3RyaW5nLnRyaW1tZWQSK3ZhbHVlIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaIXRoaXMudHJpbSgpLnNpemUoKSA9PSB0aGlzLnNpemUoKVIHdHJpbW1lZDqZAQoHaXNfdXNlchIZLmJ1Zi52YWxpZGF0ZS5TdHJpbmdSdWxlcxi/5pUmIAEoCEJiwkhfCl0KDnN0cmluZy5pc191c2VyEiNtdXN0IGJlIHdpdGhpbiAyIGFuZCA1MTIgY2hhcmFjdGVycxomdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSA1MTJSBmlzVXNlcjqfAQoJaXNfb3B0aW9uEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGMDmlSYgASgIQmTCSGEKXwoQc3RyaW5nLmlzX29wdGlvbhIjbXVzdCBiZSB3aXRoaW4gMSBhbmQgMTI4IGNoYXJhY3RlcnMaJnRoaXMuc2l6ZSgpID49IDEgJiYgdGhpcy5zaXplKCkgPD0gMTI4Ughpc09wdGlvbjqYAQoGaXNfa2V5EhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGMHmlSYgASgIQmPCSGAKXgoNc3RyaW5nLmlzX2tleRIkbXVzdCBiZSB3aXRoaW4gMSBhbmQgODE5MiBjaGFyYWN0ZXJzGid0aGlzLnNpemUoKSA+PSAxICYmIHRoaXMuc2l6ZSgpIDw9IDgxOTJSBWlzS2V5OrABCg9pc190ZW5hbnRfbG9naW4SGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYwuaVJiABKAhCasJIZwplChZzdHJpbmcuaXNfdGVuYW50X2xvZ2luEiNtdXN0IGJlIHdpdGhpbiAyIGFuZCAxMjggY2hhcmFjdGVycxomdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSAxMjhSDWlzVGVuYW50TG9naW467wEKHGlzX3RlbmFudF9zdWJqZWN0X3Blcm1pc3Npb24SGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYw+aVJiABKAhCjwHCSIsBCogBCiNzdHJpbmcuaXNfdGVuYW50X3N1YmplY3RfcGVybWlzc2lvbhIqbXVzdCBiZSAnKicgb3Igd2l0aGluIDIgYW5kIDEyOCBjaGFyYWN0ZXJzGjV0aGlzID09ICcqJyB8fCB0aGlzLnNpemUoKSA+PSAyICYmIHRoaXMuc2l6ZSgpIDw9IDEyOFIZaXNUZW5hbnRTdWJqZWN0UGVybWlzc2lvbjqUAgodaXNfcHJvamVjdF9zdWJqZWN0X3Blcm1pc3Npb24SGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYxOaVJiABKAhCsgHCSK4BCqsBCiRzdHJpbmcuaXNfcHJvamVjdF9zdWJqZWN0X3Blcm1pc3Npb24SFW11c3QgYmUgJyonIG9yIGEgdXVpZBpsdGhpcyA9PSAnKicgfHwgdGhpcy5tYXRjaGVzKCdeWzAtOWEtZkEtRl17OH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17MTJ9JCcpUhppc1Byb2plY3RTdWJqZWN0UGVybWlzc2lvbjqUAgodaXNfbWFjaGluZV9zdWJqZWN0X3Blcm1pc3Npb24SGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYxeaVJiABKAhCsgHCSK4BCqsBCiRzdHJpbmcuaXNfbWFjaGluZV9zdWJqZWN0X3Blcm1pc3Npb24SFW11c3QgYmUgJyonIG9yIGEgdXVpZBpsdGhpcyA9PSAnKicgfHwgdGhpcy5tYXRjaGVzKCdeWzAtOWEtZkEtRl17OH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17MTJ9JCcpUhppc01hY2hpbmVTdWJqZWN0UGVybWlzc2lvbjqPAQoIcHJlZml4ZXMSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjHtJYmIAEoCEJTwkhQCk4KEXJlcGVhdGVkLnByZWZpeGVzEhxnaXZlbiBwcmVmaXhlcyBtdXN0IGJlIHZhbGlkGht0aGlzLmFsbChtLCBtLmlzSXBQcmVmaXgoKSlSCHByZWZpeGVzOnUKA2lwcxIbLmJ1Zi52YWxpZGF0ZS5SZXBlYXRlZFJ1bGVzGMi0liYgASgIQkPCSEAKPgoMcmVwZWF0ZWQuaXBzEhdnaXZlbiBpcHMgbXVzdCBiZSB2YWxpZBoVdGhpcy5hbGwobSwgbS5pc0lwKCkpUgNpcHM65gEKEWFyZV9ob3N0X2FuZF9wb3J0EhsuYnVmLnZhbGlkYXRlLlJlcGVhdGVkUnVsZXMYybSWJiABKAhCmgHCSJYBCpMBChpyZXBlYXRlZC5hcmVfaG9zdF9hbmRfcG9ydBJQZ2l2ZW4gZW50cmllcyBtdXN0IGFsbCBiZSBpbiB0aGUgZm9ybSBvZiA8aXAgfCBob3N0Pjo8cG9ydD4gYnV0IHBvcnQgaXMgb3B0aW9uYWwaI3RoaXMuYWxsKG0sIG0uaXNIb3N0QW5kUG9ydChmYWxzZSkpUg5hcmVIb3N0QW5kUG9ydDq6AQoLYWxsX3RyaW1tZWQSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjKtJYmIAEoCEJ5wkh2CnQKFHJlcGVhdGVkLmFsbF90cmltbWVkEjJnaXZlbiB2YWx1ZXMgbXVzdCBub3Qgc3RhcnQgb3IgZW5kIHdpdGggd2hpdGVzcGFjZRoodGhpcy5hbGwobSwgbS50cmltKCkuc2l6ZSgpID09IG0uc2l6ZSgpKVIKYWxsVHJpbW1lZDqEAgoXa2V5c19hbmRfdmFsdWVzX3RyaW1tZWQSFi5idWYudmFsaWRhdGUuTWFwUnVsZXMY14KXJiABKAhCsQHCSK0BCqoBChttYXAua2V5c19hbmRfdmFsdWVzX3RyaW1tZWQSNWtleXMgYW5kIHZhbHVlcyBtdXN0IG5vdCBzdGFydCBvciBlbmQgd2l0aCB3aGl0ZXNwYWNlGlR0aGlzLmFsbChrLCBrLnRyaW0oKS5zaXplKCkgPT0gay5zaXplKCkpICYmIHRoaXMuYWxsKHYsIHYudHJpbSgpLnNpemUoKSA9PSB2LnNpemUoKSlSFGtleXNBbmRWYWx1ZXNUcmltbWVkOqsBCgxrZXlzX3RyaW1tZWQSFi5idWYudmFsaWRhdGUuTWFwUnVsZXMY2IKXJiABKAhCbcJIagpoChBtYXAua2V5c190cmltbWVkEiprZXlzIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaKHRoaXMuYWxsKGssIGsudHJpbSgpLnNpemUoKSA9PSBrLnNpemUoKSlSC2tleXNUcmltbWVkOpICChhwcm9qZWN0X3JvbGVzX2tleXNfdmFsaWQSFi5idWYudmFsaWRhdGUuTWFwUnVsZXMY2YKXJiABKAhCvQHCSLkBCrYBChdwcm9qZWN0X3JvbGVzLmtleS52YWxpZBImc3ViamVjdCBtdXN0IGJlIGEgJyonLCBvciBhIHZhbGlkIFVVSUQac3RoaXMuYWxsKGssIGsgPT0gJyonIHx8IGsubWF0Y2hlcygnXlswLTlhLWZBLUZdezh9LVswLTlhLWZBLUZdezR9LVswLTlhLWZBLUZdezR9LVswLTlhLWZBLUZdezR9LVswLTlhLWZBLUZdezEyfSQnKSlSFXByb2plY3RSb2xlc0tleXNWYWxpZDroAQoXdGVuYW50X3JvbGVzX2tleXNfdmFsaWQSFi5idWYudmFsaWRhdGUuTWFwUnVsZXMY2oKXJiABKAhClQHCSJEBCo4BChZ0ZW5hbnRfcm9sZXMua2V5LnZhbGlkEjNzdWJqZWN0IG11c3QgYmUgJyonIG9yIGJldHdlZW4gMiBhbmQgMTI4IGNoYXJhY3RlcnMaP3RoaXMuYWxsKGssIGsgPT0gJyonIHx8IHRoaXMuc2l6ZSgpID49IDIgfHwgdGhpcy5zaXplKCkgPD0xMjggKVIUdGVuYW50Um9sZXNLZXlzVmFsaWQ6ngIKGG1hY2hpbmVfcm9sZXNfa2V5c192YWxpZBIWLmJ1Zi52YWxpZGF0ZS5NYXBSdWxlcxjbgpcmIAEoCELJAcJIxQEKwgEKF21hY2hpbmVfcm9sZXMua2V5LnZhbGlkEjJzdWJqZWN0IG11c3QgYmUgZW1wdHkgc3RyaW5nLCAnKicsIG9yIGEgdmFsaWQgVVVJRBpzdGhpcy5hbGwoaywgayA9PSAnKicgfHwgay5tYXRjaGVzKCdeWzAtOWEtZkEtRl17OH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17MTJ9JCcpKVIVbWFjaGluZVJvbGVzS2V5c1ZhbGlkQsoBChVjb20ubWV0YWxzdGFjay5hcGkudjJCFFByZWRlZmluZWRSdWxlc1Byb3RvUAFaNWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYXBpL3YyO2FwaXYyogIDTUFYqgIRTWV0YWxzdGFjay5BcGkuVjLKAhFNZXRhbHN0YWNrXEFwaVxWMuICHU1ldGFsc3RhY2tcQXBpXFYyXEdQQk1ldGFkYXRh6gITTWV0YWxzdGFjazo6QXBpOjpWMg", [file_buf_validate_validate]);
 /**
  * Macaddress returns true if the given string is a valid macaddress
  *
@@ -79,57 +79,75 @@ export const is_key = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_ru
  * @generated from extension: optional bool is_tenant_login = 80048962;
  */
 export const is_tenant_login = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 11);
+/**
+ * IsTenantSubjectPermission returns true if name field satisfies our requirements
+ *
+ * @generated from extension: optional bool is_tenant_subject_permission = 80048963;
+ */
+export const is_tenant_subject_permission = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 12);
+/**
+ * IsProjectSubjectPermission returns true if name field satisfies our requirements
+ *
+ * @generated from extension: optional bool is_project_subject_permission = 80048964;
+ */
+export const is_project_subject_permission = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 13);
+/**
+ * IsMachineSubjectPermission returns true if name field satisfies our requirements
+ *
+ * @generated from extension: optional bool is_machine_subject_permission = 80048965;
+ */
+export const is_machine_subject_permission = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 14);
 /**
  * Prefixes validates if a slice of prefixes in string form are valid
  *
  * @generated from extension: optional bool prefixes = 80058951;
  */
-export const prefixes = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 12);
+export const prefixes = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 15);
 /**
  * Ips validates if a slice of ips in string form are valid
  *
  * @generated from extension: optional bool ips = 80058952;
  */
-export const ips = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 13);
+export const ips = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 16);
 /**
  * AreHostAndPort validates if a slice of strings are all in the form of <ip | host>:<port>
  *
  * @generated from extension: optional bool are_host_and_port = 80058953;
  */
-export const are_host_and_port = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 14);
+export const are_host_and_port = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 17);
 /**
  * All Trimmed enforces all strings to be trimmed, e.g. no whitespaces at the begin and end
  *
  * @generated from extension: optional bool all_trimmed = 80058954;
  */
-export const all_trimmed = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 15);
+export const all_trimmed = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 18);
 /**
  * Keys and Values trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
  *
  * @generated from extension: optional bool keys_and_values_trimmed = 80068951;
  */
-export const keys_and_values_trimmed = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 16);
+export const keys_and_values_trimmed = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 19);
 /**
  * Keys trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
  *
  * @generated from extension: optional bool keys_trimmed = 80068952;
  */
-export const keys_trimmed = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 17);
+export const keys_trimmed = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 20);
 /**
  * ProjectRolesKeysValid ensures that project roles keys met our requirements
  *
  * @generated from extension: optional bool project_roles_keys_valid = 80068953;
  */
-export const project_roles_keys_valid = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 18);
+export const project_roles_keys_valid = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 21);
 /**
  * TenantRolesKeysValid ensures that tenant roles keys met our requirements
  *
  * @generated from extension: optional bool tenant_roles_keys_valid = 80068954;
  */
-export const tenant_roles_keys_valid = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 19);
+export const tenant_roles_keys_valid = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 22);
 /**
  * MachineRolesKeysValid ensures that machine roles keys met our requirements
  *
  * @generated from extension: optional bool machine_roles_keys_valid = 80068955;
  */
-export const machine_roles_keys_valid = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 20);
+export const machine_roles_keys_valid = /*@__PURE__*/ extDesc(file_metalstack_api_v2_predefined_rules, 23);
diff --git a/js/metalstack/api/v2/predefined_rules_pb.ts b/js/metalstack/api/v2/predefined_rules_pb.ts
index d96d97f9..b7762f6d 100644
--- a/js/metalstack/api/v2/predefined_rules_pb.ts
+++ b/js/metalstack/api/v2/predefined_rules_pb.ts
@@ -11,7 +11,7 @@ import { file_buf_validate_validate } from "../../../buf/validate/validate_pb";
  * Describes the file metalstack/api/v2/predefined_rules.proto.
  */
 export const file_metalstack_api_v2_predefined_rules: GenFile = /*@__PURE__*/
-  fileDesc("CihtZXRhbHN0YWNrL2FwaS92Mi9wcmVkZWZpbmVkX3J1bGVzLnByb3RvEhFtZXRhbHN0YWNrLmFwaS52Mjq4AQoKbWFjYWRkcmVzcxIZLmJ1Zi52YWxpZGF0ZS5TdHJpbmdSdWxlcxi35pUmIAEoCEJ6wkh3CnUKEXN0cmluZy5tYWNhZGRyZXNzEiZ0aGlzIHN0cmluZyBtdXN0IGJlIGEgdmFsaWQgbWFjYWRkcmVzcxo4dGhpcy5tYXRjaGVzKCdeKFswLTlBLUZhLWZdezJ9WzpdKXs1fShbMC05QS1GYS1mXXsyfSkkJylSCm1hY2FkZHJlc3M6mQEKB2lzX25hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuOaVJiABKAhCYsJIXwpdCg5zdHJpbmcuaXNfbmFtZRIjbXVzdCBiZSB3aXRoaW4gMiBhbmQgMTI4IGNoYXJhY3RlcnMaJnRoaXMuc2l6ZSgpID49IDIgJiYgdGhpcy5zaXplKCkgPD0gMTI4UgZpc05hbWU6mgEKDmlzX2Rlc2NyaXB0aW9uEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGLnmlSYgASgIQlXCSFIKUAoVc3RyaW5nLmlzX2Rlc2NyaXB0aW9uEiNtdXN0IGJlIHNob3J0ZXIgdGhhbiAyNTYgY2hhcmFjdGVycxoSdGhpcy5zaXplKCkgPD0gMjU2Ug1pc0Rlc2NyaXB0aW9uOqgBCgxpc19wYXJ0aXRpb24SGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuuaVJiABKAhCZ8JIZApiChNzdHJpbmcuaXNfcGFydGl0aW9uEiNtdXN0IGJlIHdpdGhpbiAyIGFuZCAxMjggY2hhcmFjdGVycxomdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSAxMjhSC2lzUGFydGl0aW9uOoIBCglpc19wcmVmaXgSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYu+aVJiABKAhCR8JIRApCCg9zdHJpbmcucHJlZml4ZXMSHGdpdmVuIHByZWZpeGVzIG11c3QgYmUgdmFsaWQaEXRoaXMuaXNJcFByZWZpeCgpUghpc1ByZWZpeDptCgZpc191cmkSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYvOaVJiABKAhCOMJINQozCgpzdHJpbmcudXJpEhdnaXZlbiB1cmkgbXVzdCBiZSB2YWxpZBoMdGhpcy5pc1VyaSgpUgVpc1VyaTqnAQoRaXNfaXBfb3JfaG9zdG5hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYveaVJiABKAhCXsJIWwpZCg12YWxpZF9hZGRyZXNzEiZtdXN0IGJlIGEgdmFsaWQgSVAgYWRkcmVzcyBvciBob3N0bmFtZRogdGhpcy5pc0lwKCkgfHwgdGhpcy5pc0hvc3RuYW1lKClSDmlzSXBPckhvc3RuYW1lOp0BCgd0cmltbWVkEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGL7mlSYgASgIQmXCSGIKYAoOc3RyaW5nLnRyaW1tZWQSK3ZhbHVlIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaIXRoaXMudHJpbSgpLnNpemUoKSA9PSB0aGlzLnNpemUoKVIHdHJpbW1lZDqZAQoHaXNfdXNlchIZLmJ1Zi52YWxpZGF0ZS5TdHJpbmdSdWxlcxi/5pUmIAEoCEJiwkhfCl0KDnN0cmluZy5pc191c2VyEiNtdXN0IGJlIHdpdGhpbiAyIGFuZCA1MTIgY2hhcmFjdGVycxomdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSA1MTJSBmlzVXNlcjqfAQoJaXNfb3B0aW9uEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGMDmlSYgASgIQmTCSGEKXwoQc3RyaW5nLmlzX29wdGlvbhIjbXVzdCBiZSB3aXRoaW4gMSBhbmQgMTI4IGNoYXJhY3RlcnMaJnRoaXMuc2l6ZSgpID49IDEgJiYgdGhpcy5zaXplKCkgPD0gMTI4Ughpc09wdGlvbjqYAQoGaXNfa2V5EhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGMHmlSYgASgIQmPCSGAKXgoNc3RyaW5nLmlzX2tleRIkbXVzdCBiZSB3aXRoaW4gMSBhbmQgODE5MiBjaGFyYWN0ZXJzGid0aGlzLnNpemUoKSA+PSAxICYmIHRoaXMuc2l6ZSgpIDw9IDgxOTJSBWlzS2V5OrABCg9pc190ZW5hbnRfbG9naW4SGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYwuaVJiABKAhCasJIZwplChZzdHJpbmcuaXNfdGVuYW50X2xvZ2luEiNtdXN0IGJlIHdpdGhpbiAyIGFuZCAyNTYgY2hhcmFjdGVycxomdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSAyNTZSDWlzVGVuYW50TG9naW46jwEKCHByZWZpeGVzEhsuYnVmLnZhbGlkYXRlLlJlcGVhdGVkUnVsZXMYx7SWJiABKAhCU8JIUApOChFyZXBlYXRlZC5wcmVmaXhlcxIcZ2l2ZW4gcHJlZml4ZXMgbXVzdCBiZSB2YWxpZBobdGhpcy5hbGwobSwgbS5pc0lwUHJlZml4KCkpUghwcmVmaXhlczp1CgNpcHMSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjItJYmIAEoCEJDwkhACj4KDHJlcGVhdGVkLmlwcxIXZ2l2ZW4gaXBzIG11c3QgYmUgdmFsaWQaFXRoaXMuYWxsKG0sIG0uaXNJcCgpKVIDaXBzOuYBChFhcmVfaG9zdF9hbmRfcG9ydBIbLmJ1Zi52YWxpZGF0ZS5SZXBlYXRlZFJ1bGVzGMm0liYgASgIQpoBwkiWAQqTAQoacmVwZWF0ZWQuYXJlX2hvc3RfYW5kX3BvcnQSUGdpdmVuIGVudHJpZXMgbXVzdCBhbGwgYmUgaW4gdGhlIGZvcm0gb2YgPGlwIHwgaG9zdD46PHBvcnQ+IGJ1dCBwb3J0IGlzIG9wdGlvbmFsGiN0aGlzLmFsbChtLCBtLmlzSG9zdEFuZFBvcnQoZmFsc2UpKVIOYXJlSG9zdEFuZFBvcnQ6ugEKC2FsbF90cmltbWVkEhsuYnVmLnZhbGlkYXRlLlJlcGVhdGVkUnVsZXMYyrSWJiABKAhCecJIdgp0ChRyZXBlYXRlZC5hbGxfdHJpbW1lZBIyZ2l2ZW4gdmFsdWVzIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaKHRoaXMuYWxsKG0sIG0udHJpbSgpLnNpemUoKSA9PSBtLnNpemUoKSlSCmFsbFRyaW1tZWQ6hAIKF2tleXNfYW5kX3ZhbHVlc190cmltbWVkEhYuYnVmLnZhbGlkYXRlLk1hcFJ1bGVzGNeClyYgASgIQrEBwkitAQqqAQobbWFwLmtleXNfYW5kX3ZhbHVlc190cmltbWVkEjVrZXlzIGFuZCB2YWx1ZXMgbXVzdCBub3Qgc3RhcnQgb3IgZW5kIHdpdGggd2hpdGVzcGFjZRpUdGhpcy5hbGwoaywgay50cmltKCkuc2l6ZSgpID09IGsuc2l6ZSgpKSAmJiB0aGlzLmFsbCh2LCB2LnRyaW0oKS5zaXplKCkgPT0gdi5zaXplKCkpUhRrZXlzQW5kVmFsdWVzVHJpbW1lZDqrAQoMa2V5c190cmltbWVkEhYuYnVmLnZhbGlkYXRlLk1hcFJ1bGVzGNiClyYgASgIQm3CSGoKaAoQbWFwLmtleXNfdHJpbW1lZBIqa2V5cyBtdXN0IG5vdCBzdGFydCBvciBlbmQgd2l0aCB3aGl0ZXNwYWNlGih0aGlzLmFsbChrLCBrLnRyaW0oKS5zaXplKCkgPT0gay5zaXplKCkpUgtrZXlzVHJpbW1lZDqSAgoYcHJvamVjdF9yb2xlc19rZXlzX3ZhbGlkEhYuYnVmLnZhbGlkYXRlLk1hcFJ1bGVzGNmClyYgASgIQr0Bwki5AQq2AQoXcHJvamVjdF9yb2xlcy5rZXkudmFsaWQSJnN1YmplY3QgbXVzdCBiZSBhICcqJywgb3IgYSB2YWxpZCBVVUlEGnN0aGlzLmFsbChrLCBrID09ICcqJyB8fCBrLm1hdGNoZXMoJ15bMC05YS1mQS1GXXs4fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXsxMn0kJykpUhVwcm9qZWN0Um9sZXNLZXlzVmFsaWQ66AEKF3RlbmFudF9yb2xlc19rZXlzX3ZhbGlkEhYuYnVmLnZhbGlkYXRlLk1hcFJ1bGVzGNqClyYgASgIQpUBwkiRAQqOAQoWdGVuYW50X3JvbGVzLmtleS52YWxpZBIzc3ViamVjdCBtdXN0IGJlICcqJyBvciBiZXR3ZWVuIDIgYW5kIDEyOCBjaGFyYWN0ZXJzGj90aGlzLmFsbChrLCBrID09ICcqJyB8fCB0aGlzLnNpemUoKSA+PSAyIHx8IHRoaXMuc2l6ZSgpIDw9MTI4IClSFHRlbmFudFJvbGVzS2V5c1ZhbGlkOqkCChhtYWNoaW5lX3JvbGVzX2tleXNfdmFsaWQSFi5idWYudmFsaWRhdGUuTWFwUnVsZXMY24KXJiABKAhC1AHCSNABCs0BChdtYWNoaW5lX3JvbGVzLmtleS52YWxpZBIyc3ViamVjdCBtdXN0IGJlIGVtcHR5IHN0cmluZywgJyonLCBvciBhIHZhbGlkIFVVSUQafnRoaXMuYWxsKGssIGsgPT0gJycgfHwgayA9PSAnKicgfHwgay5tYXRjaGVzKCdeWzAtOWEtZkEtRl17OH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17MTJ9JCcpKVIVbWFjaGluZVJvbGVzS2V5c1ZhbGlkQsoBChVjb20ubWV0YWxzdGFjay5hcGkudjJCFFByZWRlZmluZWRSdWxlc1Byb3RvUAFaNWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYXBpL3YyO2FwaXYyogIDTUFYqgIRTWV0YWxzdGFjay5BcGkuVjLKAhFNZXRhbHN0YWNrXEFwaVxWMuICHU1ldGFsc3RhY2tcQXBpXFYyXEdQQk1ldGFkYXRh6gITTWV0YWxzdGFjazo6QXBpOjpWMg", [file_buf_validate_validate]);
+  fileDesc("CihtZXRhbHN0YWNrL2FwaS92Mi9wcmVkZWZpbmVkX3J1bGVzLnByb3RvEhFtZXRhbHN0YWNrLmFwaS52Mjq4AQoKbWFjYWRkcmVzcxIZLmJ1Zi52YWxpZGF0ZS5TdHJpbmdSdWxlcxi35pUmIAEoCEJ6wkh3CnUKEXN0cmluZy5tYWNhZGRyZXNzEiZ0aGlzIHN0cmluZyBtdXN0IGJlIGEgdmFsaWQgbWFjYWRkcmVzcxo4dGhpcy5tYXRjaGVzKCdeKFswLTlBLUZhLWZdezJ9WzpdKXs1fShbMC05QS1GYS1mXXsyfSkkJylSCm1hY2FkZHJlc3M6mQEKB2lzX25hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuOaVJiABKAhCYsJIXwpdCg5zdHJpbmcuaXNfbmFtZRIjbXVzdCBiZSB3aXRoaW4gMiBhbmQgMTI4IGNoYXJhY3RlcnMaJnRoaXMuc2l6ZSgpID49IDIgJiYgdGhpcy5zaXplKCkgPD0gMTI4UgZpc05hbWU6mgEKDmlzX2Rlc2NyaXB0aW9uEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGLnmlSYgASgIQlXCSFIKUAoVc3RyaW5nLmlzX2Rlc2NyaXB0aW9uEiNtdXN0IGJlIHNob3J0ZXIgdGhhbiAyNTYgY2hhcmFjdGVycxoSdGhpcy5zaXplKCkgPD0gMjU2Ug1pc0Rlc2NyaXB0aW9uOqgBCgxpc19wYXJ0aXRpb24SGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuuaVJiABKAhCZ8JIZApiChNzdHJpbmcuaXNfcGFydGl0aW9uEiNtdXN0IGJlIHdpdGhpbiAyIGFuZCAxMjggY2hhcmFjdGVycxomdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSAxMjhSC2lzUGFydGl0aW9uOoIBCglpc19wcmVmaXgSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYu+aVJiABKAhCR8JIRApCCg9zdHJpbmcucHJlZml4ZXMSHGdpdmVuIHByZWZpeGVzIG11c3QgYmUgdmFsaWQaEXRoaXMuaXNJcFByZWZpeCgpUghpc1ByZWZpeDptCgZpc191cmkSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYvOaVJiABKAhCOMJINQozCgpzdHJpbmcudXJpEhdnaXZlbiB1cmkgbXVzdCBiZSB2YWxpZBoMdGhpcy5pc1VyaSgpUgVpc1VyaTqnAQoRaXNfaXBfb3JfaG9zdG5hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYveaVJiABKAhCXsJIWwpZCg12YWxpZF9hZGRyZXNzEiZtdXN0IGJlIGEgdmFsaWQgSVAgYWRkcmVzcyBvciBob3N0bmFtZRogdGhpcy5pc0lwKCkgfHwgdGhpcy5pc0hvc3RuYW1lKClSDmlzSXBPckhvc3RuYW1lOp0BCgd0cmltbWVkEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGL7mlSYgASgIQmXCSGIKYAoOc3RyaW5nLnRyaW1tZWQSK3ZhbHVlIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaIXRoaXMudHJpbSgpLnNpemUoKSA9PSB0aGlzLnNpemUoKVIHdHJpbW1lZDqZAQoHaXNfdXNlchIZLmJ1Zi52YWxpZGF0ZS5TdHJpbmdSdWxlcxi/5pUmIAEoCEJiwkhfCl0KDnN0cmluZy5pc191c2VyEiNtdXN0IGJlIHdpdGhpbiAyIGFuZCA1MTIgY2hhcmFjdGVycxomdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSA1MTJSBmlzVXNlcjqfAQoJaXNfb3B0aW9uEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGMDmlSYgASgIQmTCSGEKXwoQc3RyaW5nLmlzX29wdGlvbhIjbXVzdCBiZSB3aXRoaW4gMSBhbmQgMTI4IGNoYXJhY3RlcnMaJnRoaXMuc2l6ZSgpID49IDEgJiYgdGhpcy5zaXplKCkgPD0gMTI4Ughpc09wdGlvbjqYAQoGaXNfa2V5EhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGMHmlSYgASgIQmPCSGAKXgoNc3RyaW5nLmlzX2tleRIkbXVzdCBiZSB3aXRoaW4gMSBhbmQgODE5MiBjaGFyYWN0ZXJzGid0aGlzLnNpemUoKSA+PSAxICYmIHRoaXMuc2l6ZSgpIDw9IDgxOTJSBWlzS2V5OrABCg9pc190ZW5hbnRfbG9naW4SGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYwuaVJiABKAhCasJIZwplChZzdHJpbmcuaXNfdGVuYW50X2xvZ2luEiNtdXN0IGJlIHdpdGhpbiAyIGFuZCAxMjggY2hhcmFjdGVycxomdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSAxMjhSDWlzVGVuYW50TG9naW467wEKHGlzX3RlbmFudF9zdWJqZWN0X3Blcm1pc3Npb24SGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYw+aVJiABKAhCjwHCSIsBCogBCiNzdHJpbmcuaXNfdGVuYW50X3N1YmplY3RfcGVybWlzc2lvbhIqbXVzdCBiZSAnKicgb3Igd2l0aGluIDIgYW5kIDEyOCBjaGFyYWN0ZXJzGjV0aGlzID09ICcqJyB8fCB0aGlzLnNpemUoKSA+PSAyICYmIHRoaXMuc2l6ZSgpIDw9IDEyOFIZaXNUZW5hbnRTdWJqZWN0UGVybWlzc2lvbjqUAgodaXNfcHJvamVjdF9zdWJqZWN0X3Blcm1pc3Npb24SGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYxOaVJiABKAhCsgHCSK4BCqsBCiRzdHJpbmcuaXNfcHJvamVjdF9zdWJqZWN0X3Blcm1pc3Npb24SFW11c3QgYmUgJyonIG9yIGEgdXVpZBpsdGhpcyA9PSAnKicgfHwgdGhpcy5tYXRjaGVzKCdeWzAtOWEtZkEtRl17OH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17MTJ9JCcpUhppc1Byb2plY3RTdWJqZWN0UGVybWlzc2lvbjqUAgodaXNfbWFjaGluZV9zdWJqZWN0X3Blcm1pc3Npb24SGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYxeaVJiABKAhCsgHCSK4BCqsBCiRzdHJpbmcuaXNfbWFjaGluZV9zdWJqZWN0X3Blcm1pc3Npb24SFW11c3QgYmUgJyonIG9yIGEgdXVpZBpsdGhpcyA9PSAnKicgfHwgdGhpcy5tYXRjaGVzKCdeWzAtOWEtZkEtRl17OH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17MTJ9JCcpUhppc01hY2hpbmVTdWJqZWN0UGVybWlzc2lvbjqPAQoIcHJlZml4ZXMSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjHtJYmIAEoCEJTwkhQCk4KEXJlcGVhdGVkLnByZWZpeGVzEhxnaXZlbiBwcmVmaXhlcyBtdXN0IGJlIHZhbGlkGht0aGlzLmFsbChtLCBtLmlzSXBQcmVmaXgoKSlSCHByZWZpeGVzOnUKA2lwcxIbLmJ1Zi52YWxpZGF0ZS5SZXBlYXRlZFJ1bGVzGMi0liYgASgIQkPCSEAKPgoMcmVwZWF0ZWQuaXBzEhdnaXZlbiBpcHMgbXVzdCBiZSB2YWxpZBoVdGhpcy5hbGwobSwgbS5pc0lwKCkpUgNpcHM65gEKEWFyZV9ob3N0X2FuZF9wb3J0EhsuYnVmLnZhbGlkYXRlLlJlcGVhdGVkUnVsZXMYybSWJiABKAhCmgHCSJYBCpMBChpyZXBlYXRlZC5hcmVfaG9zdF9hbmRfcG9ydBJQZ2l2ZW4gZW50cmllcyBtdXN0IGFsbCBiZSBpbiB0aGUgZm9ybSBvZiA8aXAgfCBob3N0Pjo8cG9ydD4gYnV0IHBvcnQgaXMgb3B0aW9uYWwaI3RoaXMuYWxsKG0sIG0uaXNIb3N0QW5kUG9ydChmYWxzZSkpUg5hcmVIb3N0QW5kUG9ydDq6AQoLYWxsX3RyaW1tZWQSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjKtJYmIAEoCEJ5wkh2CnQKFHJlcGVhdGVkLmFsbF90cmltbWVkEjJnaXZlbiB2YWx1ZXMgbXVzdCBub3Qgc3RhcnQgb3IgZW5kIHdpdGggd2hpdGVzcGFjZRoodGhpcy5hbGwobSwgbS50cmltKCkuc2l6ZSgpID09IG0uc2l6ZSgpKVIKYWxsVHJpbW1lZDqEAgoXa2V5c19hbmRfdmFsdWVzX3RyaW1tZWQSFi5idWYudmFsaWRhdGUuTWFwUnVsZXMY14KXJiABKAhCsQHCSK0BCqoBChttYXAua2V5c19hbmRfdmFsdWVzX3RyaW1tZWQSNWtleXMgYW5kIHZhbHVlcyBtdXN0IG5vdCBzdGFydCBvciBlbmQgd2l0aCB3aGl0ZXNwYWNlGlR0aGlzLmFsbChrLCBrLnRyaW0oKS5zaXplKCkgPT0gay5zaXplKCkpICYmIHRoaXMuYWxsKHYsIHYudHJpbSgpLnNpemUoKSA9PSB2LnNpemUoKSlSFGtleXNBbmRWYWx1ZXNUcmltbWVkOqsBCgxrZXlzX3RyaW1tZWQSFi5idWYudmFsaWRhdGUuTWFwUnVsZXMY2IKXJiABKAhCbcJIagpoChBtYXAua2V5c190cmltbWVkEiprZXlzIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaKHRoaXMuYWxsKGssIGsudHJpbSgpLnNpemUoKSA9PSBrLnNpemUoKSlSC2tleXNUcmltbWVkOpICChhwcm9qZWN0X3JvbGVzX2tleXNfdmFsaWQSFi5idWYudmFsaWRhdGUuTWFwUnVsZXMY2YKXJiABKAhCvQHCSLkBCrYBChdwcm9qZWN0X3JvbGVzLmtleS52YWxpZBImc3ViamVjdCBtdXN0IGJlIGEgJyonLCBvciBhIHZhbGlkIFVVSUQac3RoaXMuYWxsKGssIGsgPT0gJyonIHx8IGsubWF0Y2hlcygnXlswLTlhLWZBLUZdezh9LVswLTlhLWZBLUZdezR9LVswLTlhLWZBLUZdezR9LVswLTlhLWZBLUZdezR9LVswLTlhLWZBLUZdezEyfSQnKSlSFXByb2plY3RSb2xlc0tleXNWYWxpZDroAQoXdGVuYW50X3JvbGVzX2tleXNfdmFsaWQSFi5idWYudmFsaWRhdGUuTWFwUnVsZXMY2oKXJiABKAhClQHCSJEBCo4BChZ0ZW5hbnRfcm9sZXMua2V5LnZhbGlkEjNzdWJqZWN0IG11c3QgYmUgJyonIG9yIGJldHdlZW4gMiBhbmQgMTI4IGNoYXJhY3RlcnMaP3RoaXMuYWxsKGssIGsgPT0gJyonIHx8IHRoaXMuc2l6ZSgpID49IDIgfHwgdGhpcy5zaXplKCkgPD0xMjggKVIUdGVuYW50Um9sZXNLZXlzVmFsaWQ6ngIKGG1hY2hpbmVfcm9sZXNfa2V5c192YWxpZBIWLmJ1Zi52YWxpZGF0ZS5NYXBSdWxlcxjbgpcmIAEoCELJAcJIxQEKwgEKF21hY2hpbmVfcm9sZXMua2V5LnZhbGlkEjJzdWJqZWN0IG11c3QgYmUgZW1wdHkgc3RyaW5nLCAnKicsIG9yIGEgdmFsaWQgVVVJRBpzdGhpcy5hbGwoaywgayA9PSAnKicgfHwgay5tYXRjaGVzKCdeWzAtOWEtZkEtRl17OH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17NH0tWzAtOWEtZkEtRl17MTJ9JCcpKVIVbWFjaGluZVJvbGVzS2V5c1ZhbGlkQsoBChVjb20ubWV0YWxzdGFjay5hcGkudjJCFFByZWRlZmluZWRSdWxlc1Byb3RvUAFaNWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYXBpL3YyO2FwaXYyogIDTUFYqgIRTWV0YWxzdGFjay5BcGkuVjLKAhFNZXRhbHN0YWNrXEFwaVxWMuICHU1ldGFsc3RhY2tcQXBpXFYyXEdQQk1ldGFkYXRh6gITTWV0YWxzdGFjazo6QXBpOjpWMg", [file_buf_validate_validate]);
 
 /**
  * Macaddress returns true if the given string is a valid macaddress
@@ -109,13 +109,37 @@ export const is_key: GenExtension<StringRules, boolean> = /*@__PURE__*/
 export const is_tenant_login: GenExtension<StringRules, boolean> = /*@__PURE__*/
   extDesc(file_metalstack_api_v2_predefined_rules, 11);
 
+/**
+ * IsTenantSubjectPermission returns true if name field satisfies our requirements
+ *
+ * @generated from extension: optional bool is_tenant_subject_permission = 80048963;
+ */
+export const is_tenant_subject_permission: GenExtension<StringRules, boolean> = /*@__PURE__*/
+  extDesc(file_metalstack_api_v2_predefined_rules, 12);
+
+/**
+ * IsProjectSubjectPermission returns true if name field satisfies our requirements
+ *
+ * @generated from extension: optional bool is_project_subject_permission = 80048964;
+ */
+export const is_project_subject_permission: GenExtension<StringRules, boolean> = /*@__PURE__*/
+  extDesc(file_metalstack_api_v2_predefined_rules, 13);
+
+/**
+ * IsMachineSubjectPermission returns true if name field satisfies our requirements
+ *
+ * @generated from extension: optional bool is_machine_subject_permission = 80048965;
+ */
+export const is_machine_subject_permission: GenExtension<StringRules, boolean> = /*@__PURE__*/
+  extDesc(file_metalstack_api_v2_predefined_rules, 14);
+
 /**
  * Prefixes validates if a slice of prefixes in string form are valid
  *
  * @generated from extension: optional bool prefixes = 80058951;
  */
 export const prefixes: GenExtension<RepeatedRules, boolean> = /*@__PURE__*/
-  extDesc(file_metalstack_api_v2_predefined_rules, 12);
+  extDesc(file_metalstack_api_v2_predefined_rules, 15);
 
 /**
  * Ips validates if a slice of ips in string form are valid
@@ -123,7 +147,7 @@ export const prefixes: GenExtension<RepeatedRules, boolean> = /*@__PURE__*/
  * @generated from extension: optional bool ips = 80058952;
  */
 export const ips: GenExtension<RepeatedRules, boolean> = /*@__PURE__*/
-  extDesc(file_metalstack_api_v2_predefined_rules, 13);
+  extDesc(file_metalstack_api_v2_predefined_rules, 16);
 
 /**
  * AreHostAndPort validates if a slice of strings are all in the form of <ip | host>:<port>
@@ -131,7 +155,7 @@ export const ips: GenExtension<RepeatedRules, boolean> = /*@__PURE__*/
  * @generated from extension: optional bool are_host_and_port = 80058953;
  */
 export const are_host_and_port: GenExtension<RepeatedRules, boolean> = /*@__PURE__*/
-  extDesc(file_metalstack_api_v2_predefined_rules, 14);
+  extDesc(file_metalstack_api_v2_predefined_rules, 17);
 
 /**
  * All Trimmed enforces all strings to be trimmed, e.g. no whitespaces at the begin and end
@@ -139,7 +163,7 @@ export const are_host_and_port: GenExtension<RepeatedRules, boolean> = /*@__PURE
  * @generated from extension: optional bool all_trimmed = 80058954;
  */
 export const all_trimmed: GenExtension<RepeatedRules, boolean> = /*@__PURE__*/
-  extDesc(file_metalstack_api_v2_predefined_rules, 15);
+  extDesc(file_metalstack_api_v2_predefined_rules, 18);
 
 /**
  * Keys and Values trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
@@ -147,7 +171,7 @@ export const all_trimmed: GenExtension<RepeatedRules, boolean> = /*@__PURE__*/
  * @generated from extension: optional bool keys_and_values_trimmed = 80068951;
  */
 export const keys_and_values_trimmed: GenExtension<MapRules, boolean> = /*@__PURE__*/
-  extDesc(file_metalstack_api_v2_predefined_rules, 16);
+  extDesc(file_metalstack_api_v2_predefined_rules, 19);
 
 /**
  * Keys trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
@@ -155,7 +179,7 @@ export const keys_and_values_trimmed: GenExtension<MapRules, boolean> = /*@__PUR
  * @generated from extension: optional bool keys_trimmed = 80068952;
  */
 export const keys_trimmed: GenExtension<MapRules, boolean> = /*@__PURE__*/
-  extDesc(file_metalstack_api_v2_predefined_rules, 17);
+  extDesc(file_metalstack_api_v2_predefined_rules, 20);
 
 /**
  * ProjectRolesKeysValid ensures that project roles keys met our requirements
@@ -163,7 +187,7 @@ export const keys_trimmed: GenExtension<MapRules, boolean> = /*@__PURE__*/
  * @generated from extension: optional bool project_roles_keys_valid = 80068953;
  */
 export const project_roles_keys_valid: GenExtension<MapRules, boolean> = /*@__PURE__*/
-  extDesc(file_metalstack_api_v2_predefined_rules, 18);
+  extDesc(file_metalstack_api_v2_predefined_rules, 21);
 
 /**
  * TenantRolesKeysValid ensures that tenant roles keys met our requirements
@@ -171,7 +195,7 @@ export const project_roles_keys_valid: GenExtension<MapRules, boolean> = /*@__PU
  * @generated from extension: optional bool tenant_roles_keys_valid = 80068954;
  */
 export const tenant_roles_keys_valid: GenExtension<MapRules, boolean> = /*@__PURE__*/
-  extDesc(file_metalstack_api_v2_predefined_rules, 19);
+  extDesc(file_metalstack_api_v2_predefined_rules, 22);
 
 /**
  * MachineRolesKeysValid ensures that machine roles keys met our requirements
@@ -179,5 +203,5 @@ export const tenant_roles_keys_valid: GenExtension<MapRules, boolean> = /*@__PUR
  * @generated from extension: optional bool machine_roles_keys_valid = 80068955;
  */
 export const machine_roles_keys_valid: GenExtension<MapRules, boolean> = /*@__PURE__*/
-  extDesc(file_metalstack_api_v2_predefined_rules, 20);
+  extDesc(file_metalstack_api_v2_predefined_rules, 23);
 
diff --git a/js/metalstack/api/v2/token_pb.d.ts b/js/metalstack/api/v2/token_pb.d.ts
index e761246b..971d567e 100644
--- a/js/metalstack/api/v2/token_pb.d.ts
+++ b/js/metalstack/api/v2/token_pb.d.ts
@@ -131,9 +131,9 @@ export type TokenServiceCreateRequest = Message<"metalstack.api.v2.TokenServiceC
     /**
      * Permissions is a list of service methods this token can be used for
      *
-     * @generated from field: repeated metalstack.api.v2.MethodPermission permissions = 2;
+     * @generated from field: repeated metalstack.api.v2.PermissionsByVisibility permissions = 2;
      */
-    permissions: MethodPermission[];
+    permissions: PermissionsByVisibility[];
     /**
      * Expires gives the duration since now, after which this token can not be used anymore
      *
@@ -217,6 +217,229 @@ export type MethodPermission = Message<"metalstack.api.v2.MethodPermission"> & {
  * Use `create(MethodPermissionSchema)` to create a new message.
  */
 export declare const MethodPermissionSchema: GenMessage<MethodPermission>;
+/**
+ * PermissionsByVisibility contains method permissions by visibility
+ *
+ * @generated from message metalstack.api.v2.PermissionsByVisibility
+ */
+export type PermissionsByVisibility = Message<"metalstack.api.v2.PermissionsByVisibility"> & {
+    /**
+     * Visibility defines the visibility of the requested method permissions
+     *
+     * @generated from oneof metalstack.api.v2.PermissionsByVisibility.visibility
+     */
+    visibility: {
+        /**
+         * PublicPermissions carries public method permissions
+         *
+         * @generated from field: metalstack.api.v2.PublicPermissions public = 1;
+         */
+        value: PublicPermissions;
+        case: "public";
+    } | {
+        /**
+         * SelfPermissions carries self method permissions
+         *
+         * @generated from field: metalstack.api.v2.SelfPermissions self = 2;
+         */
+        value: SelfPermissions;
+        case: "self";
+    } | {
+        /**
+         * ProjectPermissions carries project method permissions
+         *
+         * @generated from field: metalstack.api.v2.ProjectPermissions project = 3;
+         */
+        value: ProjectPermissions;
+        case: "project";
+    } | {
+        /**
+         * TenantPermissions carries tenant method permissions
+         *
+         * @generated from field: metalstack.api.v2.TenantPermissions tenant = 4;
+         */
+        value: TenantPermissions;
+        case: "tenant";
+    } | {
+        /**
+         * AdminPermissions carries admin method permissions
+         *
+         * @generated from field: metalstack.api.v2.AdminPermissions admin = 5;
+         */
+        value: AdminPermissions;
+        case: "admin";
+    } | {
+        /**
+         * MachinePermissions carries machine method permissions
+         *
+         * @generated from field: metalstack.api.v2.MachinePermissions machine = 6;
+         */
+        value: MachinePermissions;
+        case: "machine";
+    } | {
+        /**
+         * InfraPermissions carries infra method permissions
+         *
+         * @generated from field: metalstack.api.v2.InfraPermissions infra = 7;
+         */
+        value: InfraPermissions;
+        case: "infra";
+    } | {
+        case: undefined;
+        value?: undefined;
+    };
+};
+/**
+ * Describes the message metalstack.api.v2.PermissionsByVisibility.
+ * Use `create(PermissionsByVisibilitySchema)` to create a new message.
+ */
+export declare const PermissionsByVisibilitySchema: GenMessage<PermissionsByVisibility>;
+/**
+ * PublicPermissions carries public method permissions
+ *
+ * @generated from message metalstack.api.v2.PublicPermissions
+ */
+export type PublicPermissions = Message<"metalstack.api.v2.PublicPermissions"> & {
+    /**
+     * Methods which should be accessible
+     *
+     * @generated from field: repeated string methods = 2;
+     */
+    methods: string[];
+};
+/**
+ * Describes the message metalstack.api.v2.PublicPermissions.
+ * Use `create(PublicPermissionsSchema)` to create a new message.
+ */
+export declare const PublicPermissionsSchema: GenMessage<PublicPermissions>;
+/**
+ * SelfPermissions carries self method permissions
+ *
+ * @generated from message metalstack.api.v2.SelfPermissions
+ */
+export type SelfPermissions = Message<"metalstack.api.v2.SelfPermissions"> & {
+    /**
+     * Methods which should be accessible
+     *
+     * @generated from field: repeated string methods = 2;
+     */
+    methods: string[];
+};
+/**
+ * Describes the message metalstack.api.v2.SelfPermissions.
+ * Use `create(SelfPermissionsSchema)` to create a new message.
+ */
+export declare const SelfPermissionsSchema: GenMessage<SelfPermissions>;
+/**
+ * ProjectPermissions carries project method permissions
+ *
+ * @generated from message metalstack.api.v2.ProjectPermissions
+ */
+export type ProjectPermissions = Message<"metalstack.api.v2.ProjectPermissions"> & {
+    /**
+     * asterisk (*) can be specified to match any subject
+     *
+     * @generated from field: string project = 1;
+     */
+    project: string;
+    /**
+     * Methods which should be accessible
+     *
+     * @generated from field: repeated string methods = 2;
+     */
+    methods: string[];
+};
+/**
+ * Describes the message metalstack.api.v2.ProjectPermissions.
+ * Use `create(ProjectPermissionsSchema)` to create a new message.
+ */
+export declare const ProjectPermissionsSchema: GenMessage<ProjectPermissions>;
+/**
+ * TenantPermissions carries tenant method permissions
+ *
+ * @generated from message metalstack.api.v2.TenantPermissions
+ */
+export type TenantPermissions = Message<"metalstack.api.v2.TenantPermissions"> & {
+    /**
+     * Login of the tenant
+     * asterisk (*) can be specified to match any subject
+     *
+     * @generated from field: string login = 1;
+     */
+    login: string;
+    /**
+     * Methods which should be accessible
+     *
+     * @generated from field: repeated string methods = 2;
+     */
+    methods: string[];
+};
+/**
+ * Describes the message metalstack.api.v2.TenantPermissions.
+ * Use `create(TenantPermissionsSchema)` to create a new message.
+ */
+export declare const TenantPermissionsSchema: GenMessage<TenantPermissions>;
+/**
+ * AdminPermissions carries admin method permissions
+ *
+ * @generated from message metalstack.api.v2.AdminPermissions
+ */
+export type AdminPermissions = Message<"metalstack.api.v2.AdminPermissions"> & {
+    /**
+     * Methods which should be accessible
+     *
+     * @generated from field: repeated string methods = 2;
+     */
+    methods: string[];
+};
+/**
+ * Describes the message metalstack.api.v2.AdminPermissions.
+ * Use `create(AdminPermissionsSchema)` to create a new message.
+ */
+export declare const AdminPermissionsSchema: GenMessage<AdminPermissions>;
+/**
+ * MachinePermissions carries machine method permissions
+ *
+ * @generated from message metalstack.api.v2.MachinePermissions
+ */
+export type MachinePermissions = Message<"metalstack.api.v2.MachinePermissions"> & {
+    /**
+     * UUID of this machine
+     * asterisk (*) can be specified to match any subject
+     *
+     * @generated from field: string uuid = 1;
+     */
+    uuid: string;
+    /**
+     * Methods which should be accessible
+     *
+     * @generated from field: repeated string methods = 2;
+     */
+    methods: string[];
+};
+/**
+ * Describes the message metalstack.api.v2.MachinePermissions.
+ * Use `create(MachinePermissionsSchema)` to create a new message.
+ */
+export declare const MachinePermissionsSchema: GenMessage<MachinePermissions>;
+/**
+ * InfraPermissions carries infra method permissions
+ *
+ * @generated from message metalstack.api.v2.InfraPermissions
+ */
+export type InfraPermissions = Message<"metalstack.api.v2.InfraPermissions"> & {
+    /**
+     * Methods which should be accessible
+     *
+     * @generated from field: repeated string methods = 2;
+     */
+    methods: string[];
+};
+/**
+ * Describes the message metalstack.api.v2.InfraPermissions.
+ * Use `create(InfraPermissionsSchema)` to create a new message.
+ */
+export declare const InfraPermissionsSchema: GenMessage<InfraPermissions>;
 /**
  * TokenServiceCreateResponse is the response payload of a token create request
  *
@@ -334,9 +557,9 @@ export type TokenServiceUpdateRequest = Message<"metalstack.api.v2.TokenServiceU
     /**
      * Permissions is a list of service methods this token can be used for
      *
-     * @generated from field: repeated metalstack.api.v2.MethodPermission permissions = 4;
+     * @generated from field: repeated metalstack.api.v2.PermissionsByVisibility permissions = 4;
      */
-    permissions: MethodPermission[];
+    permissions: PermissionsByVisibility[];
     /**
      * ProjectRoles associates a project id with the corresponding role of the token owner
      *
diff --git a/js/metalstack/api/v2/token_pb.js b/js/metalstack/api/v2/token_pb.js
index 3edb9b3a..ffe492ea 100644
--- a/js/metalstack/api/v2/token_pb.js
+++ b/js/metalstack/api/v2/token_pb.js
@@ -9,7 +9,7 @@ import { file_metalstack_api_v2_predefined_rules } from "./predefined_rules_pb";
 /**
  * Describes the file metalstack/api/v2/token.proto.
  */
-export const file_metalstack_api_v2_token = /*@__PURE__*/ fileDesc("Ch1tZXRhbHN0YWNrL2FwaS92Mi90b2tlbi5wcm90bxIRbWV0YWxzdGFjay5hcGkudjIilQgKBVRva2VuEhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEhkKBHVzZXIYAiABKAlCC7pICHIG+LOusQIBEiUKBG1ldGEYAyABKAsyFy5tZXRhbHN0YWNrLmFwaS52Mi5NZXRhEiAKC2Rlc2NyaXB0aW9uGAQgASgJQgu6SAhyBsizrrECARJDCgtwZXJtaXNzaW9ucxgFIAMoCzIjLm1ldGFsc3RhY2suYXBpLnYyLk1ldGhvZFBlcm1pc3Npb25CCbpIBpIBAxD0AxIrCgdleHBpcmVzGAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBItCglpc3N1ZWRfYXQYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjoKCnRva2VuX3R5cGUYCCABKA4yHC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblR5cGVCCLpIBYIBAhABElwKDXByb2plY3Rfcm9sZXMYCSADKAsyKi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbi5Qcm9qZWN0Um9sZXNFbnRyeUIZukgWmgETwJW4sQIByJW4sQIBKgWCAQIQARJaCgx0ZW5hbnRfcm9sZXMYCiADKAsyKS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbi5UZW5hbnRSb2xlc0VudHJ5Qhm6SBaaARPAlbixAgHQlbixAgEqBYIBAhABEj8KCmFkbWluX3JvbGUYCyABKA4yHC5tZXRhbHN0YWNrLmFwaS52Mi5BZG1pblJvbGVCCLpIBYIBAhABSACIAQESPwoKaW5mcmFfcm9sZRgMIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkluZnJhUm9sZUIIukgFggECEAFIAYgBARJcCg1tYWNoaW5lX3JvbGVzGA0gAygLMioubWV0YWxzdGFjay5hcGkudjIuVG9rZW4uTWFjaGluZVJvbGVzRW50cnlCGbpIFpoBE8CVuLECAdiVuLECASoFggECEAEaUwoRUHJvamVjdFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuUHJvamVjdFJvbGU6AjgBGlEKEFRlbmFudFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEiwKBXZhbHVlGAIgASgOMh0ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50Um9sZToCOAEaUwoRTWFjaGluZVJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuTWFjaGluZVJvbGU6AjgBQg0KC19hZG1pbl9yb2xlQg0KC19pbmZyYV9yb2xlIt0HChlUb2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0EiAKC2Rlc2NyaXB0aW9uGAEgASgJQgu6SAhyBsizrrECARJCCgtwZXJtaXNzaW9ucxgCIAMoCzIjLm1ldGFsc3RhY2suYXBpLnYyLk1ldGhvZFBlcm1pc3Npb25CCLpIBZIBAhBkEj4KB2V4cGlyZXMYAyABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb25CErpID6oBDBoFCIHnhA8yAwjYBBJwCg1wcm9qZWN0X3JvbGVzGAQgAygLMj4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdC5Qcm9qZWN0Um9sZXNFbnRyeUIZukgWmgETwJW4sQIByJW4sQIBKgWCAQIQARJuCgx0ZW5hbnRfcm9sZXMYBSADKAsyPS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0LlRlbmFudFJvbGVzRW50cnlCGbpIFpoBE8CVuLECAdCVuLECASoFggECEAESPwoKYWRtaW5fcm9sZRgGIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkFkbWluUm9sZUIIukgFggECEAFIAIgBARI/CgppbmZyYV9yb2xlGAcgASgOMhwubWV0YWxzdGFjay5hcGkudjIuSW5mcmFSb2xlQgi6SAWCAQIQAUgBiAEBEnAKDW1hY2hpbmVfcm9sZXMYCCADKAsyPi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0Lk1hY2hpbmVSb2xlc0VudHJ5Qhm6SBaaARPAlbixAgHYlbixAgEqBYIBAhABEikKBmxhYmVscxgJIAEoCzIZLm1ldGFsc3RhY2suYXBpLnYyLkxhYmVscxpTChFQcm9qZWN0Um9sZXNFbnRyeRILCgNrZXkYASABKAkSLQoFdmFsdWUYAiABKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5Qcm9qZWN0Um9sZToCOAEaUQoQVGVuYW50Um9sZXNFbnRyeRILCgNrZXkYASABKAkSLAoFdmFsdWUYAiABKA4yHS5tZXRhbHN0YWNrLmFwaS52Mi5UZW5hbnRSb2xlOgI4ARpTChFNYWNoaW5lUm9sZXNFbnRyeRILCgNrZXkYASABKAkSLQoFdmFsdWUYAiABKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5NYWNoaW5lUm9sZToCOAFCDQoLX2FkbWluX3JvbGVCDQoLX2luZnJhX3JvbGUiSQoQTWV0aG9kUGVybWlzc2lvbhIZCgdzdWJqZWN0GAEgASgJQgi6SAVyAxiAAhIaCgdtZXRob2RzGAIgAygJQgm6SAaSAQMQ9AMiVQoaVG9rZW5TZXJ2aWNlQ3JlYXRlUmVzcG9uc2USJwoFdG9rZW4YASABKAsyGC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbhIOCgZzZWNyZXQYAiABKAkiRwoXVG9rZW5TZXJ2aWNlTGlzdFJlcXVlc3QSLAoFcXVlcnkYASABKAsyHS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblF1ZXJ5IkQKGFRva2VuU2VydmljZUxpc3RSZXNwb25zZRIoCgZ0b2tlbnMYASADKAsyGC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbiIzChlUb2tlblNlcnZpY2VSZXZva2VSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBIhwKGlRva2VuU2VydmljZVJldm9rZVJlc3BvbnNlIoIIChlUb2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEjoKC3VwZGF0ZV9tZXRhGAIgASgLMh0ubWV0YWxzdGFjay5hcGkudjIuVXBkYXRlTWV0YUIGukgDyAEAEiUKC2Rlc2NyaXB0aW9uGAMgASgJQgu6SAhyBsizrrECAUgAiAEBEjgKC3Blcm1pc3Npb25zGAQgAygLMiMubWV0YWxzdGFjay5hcGkudjIuTWV0aG9kUGVybWlzc2lvbhJwCg1wcm9qZWN0X3JvbGVzGAUgAygLMj4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdC5Qcm9qZWN0Um9sZXNFbnRyeUIZukgWmgETwJW4sQIByJW4sQIBKgWCAQIQARJuCgx0ZW5hbnRfcm9sZXMYBiADKAsyPS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0LlRlbmFudFJvbGVzRW50cnlCGbpIFpoBE8CVuLECAdCVuLECASoFggECEAESPwoKYWRtaW5fcm9sZRgHIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkFkbWluUm9sZUIIukgFggECEAFIAYgBARI/CgppbmZyYV9yb2xlGAggASgOMhwubWV0YWxzdGFjay5hcGkudjIuSW5mcmFSb2xlQgi6SAWCAQIQAUgCiAEBEnAKDW1hY2hpbmVfcm9sZXMYCSADKAsyPi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0Lk1hY2hpbmVSb2xlc0VudHJ5Qhm6SBaaARPAlbixAgHYlbixAgEqBYIBAhABEi8KBmxhYmVscxgKIAEoCzIfLm1ldGFsc3RhY2suYXBpLnYyLlVwZGF0ZUxhYmVscxpTChFQcm9qZWN0Um9sZXNFbnRyeRILCgNrZXkYASABKAkSLQoFdmFsdWUYAiABKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5Qcm9qZWN0Um9sZToCOAEaUQoQVGVuYW50Um9sZXNFbnRyeRILCgNrZXkYASABKAkSLAoFdmFsdWUYAiABKA4yHS5tZXRhbHN0YWNrLmFwaS52Mi5UZW5hbnRSb2xlOgI4ARpTChFNYWNoaW5lUm9sZXNFbnRyeRILCgNrZXkYASABKAkSLQoFdmFsdWUYAiABKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5NYWNoaW5lUm9sZToCOAFCDgoMX2Rlc2NyaXB0aW9uQg0KC19hZG1pbl9yb2xlQg0KC19pbmZyYV9yb2xlIkUKGlRva2VuU2VydmljZVVwZGF0ZVJlc3BvbnNlEicKBXRva2VuGAEgASgLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4iMAoWVG9rZW5TZXJ2aWNlR2V0UmVxdWVzdBIWCgR1dWlkGAEgASgJQgi6SAVyA7ABASJCChdUb2tlblNlcnZpY2VHZXRSZXNwb25zZRInCgV0b2tlbhgBIAEoCzIYLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuIhwKGlRva2VuU2VydmljZVJlZnJlc2hSZXF1ZXN0IlYKG1Rva2VuU2VydmljZVJlZnJlc2hSZXNwb25zZRInCgV0b2tlbhgBIAEoCzIYLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuEg4KBnNlY3JldBgCIAEoCSKdAgoKVG9rZW5RdWVyeRIbCgR1dWlkGAEgASgJQgi6SAVyA7ABAUgAiAEBEh4KBHVzZXIYAiABKAlCC7pICHIG+LOusQIBSAGIAQESJQoLZGVzY3JpcHRpb24YAyABKAlCC7pICHIGyLOusQIBSAKIAQESLgoGbGFiZWxzGAQgASgLMhkubWV0YWxzdGFjay5hcGkudjIuTGFiZWxzSAOIAQESPwoKdG9rZW5fdHlwZRgFIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuVHlwZUIIukgFggECEAFIBIgBAUIHCgVfdXVpZEIHCgVfdXNlckIOCgxfZGVzY3JpcHRpb25CCQoHX2xhYmVsc0INCgtfdG9rZW5fdHlwZSpQCglUb2tlblR5cGUSGgoWVE9LRU5fVFlQRV9VTlNQRUNJRklFRBAAEhIKDlRPS0VOX1RZUEVfQVBJEAESEwoPVE9LRU5fVFlQRV9VU0VSEAIyqAUKDFRva2VuU2VydmljZRJmCgNHZXQSKS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VHZXRSZXF1ZXN0GioubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlR2V0UmVzcG9uc2UiCNjzGALg8xgBEm8KBkNyZWF0ZRIsLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUNyZWF0ZVJlcXVlc3QaLS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXNwb25zZSII2PMYAuDzGAESbwoGVXBkYXRlEiwubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdBotLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVVwZGF0ZVJlc3BvbnNlIgjY8xgC4PMYARJpCgRMaXN0EioubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlTGlzdFJlcXVlc3QaKy5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VMaXN0UmVzcG9uc2UiCNjzGALg8xgBEm8KBlJldm9rZRIsLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVJldm9rZVJlcXVlc3QaLS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VSZXZva2VSZXNwb25zZSII2PMYAuDzGAEScgoHUmVmcmVzaBItLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVJlZnJlc2hSZXF1ZXN0Gi4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlUmVmcmVzaFJlc3BvbnNlIgjY8xgC4PMYAULAAQoVY29tLm1ldGFsc3RhY2suYXBpLnYyQgpUb2tlblByb3RvUAFaNWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYXBpL3YyO2FwaXYyogIDTUFYqgIRTWV0YWxzdGFjay5BcGkuVjLKAhFNZXRhbHN0YWNrXEFwaVxWMuICHU1ldGFsc3RhY2tcQXBpXFYyXEdQQk1ldGFkYXRh6gITTWV0YWxzdGFjazo6QXBpOjpWMmIGcHJvdG8z", [file_buf_validate_validate, file_google_protobuf_duration, file_google_protobuf_timestamp, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules]);
+export const file_metalstack_api_v2_token = /*@__PURE__*/ fileDesc("Ch1tZXRhbHN0YWNrL2FwaS92Mi90b2tlbi5wcm90bxIRbWV0YWxzdGFjay5hcGkudjIilQgKBVRva2VuEhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEhkKBHVzZXIYAiABKAlCC7pICHIG+LOusQIBEiUKBG1ldGEYAyABKAsyFy5tZXRhbHN0YWNrLmFwaS52Mi5NZXRhEiAKC2Rlc2NyaXB0aW9uGAQgASgJQgu6SAhyBsizrrECARJDCgtwZXJtaXNzaW9ucxgFIAMoCzIjLm1ldGFsc3RhY2suYXBpLnYyLk1ldGhvZFBlcm1pc3Npb25CCbpIBpIBAxD0AxIrCgdleHBpcmVzGAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBItCglpc3N1ZWRfYXQYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjoKCnRva2VuX3R5cGUYCCABKA4yHC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblR5cGVCCLpIBYIBAhABElwKDXByb2plY3Rfcm9sZXMYCSADKAsyKi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbi5Qcm9qZWN0Um9sZXNFbnRyeUIZukgWmgETwJW4sQIByJW4sQIBKgWCAQIQARJaCgx0ZW5hbnRfcm9sZXMYCiADKAsyKS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbi5UZW5hbnRSb2xlc0VudHJ5Qhm6SBaaARPAlbixAgHQlbixAgEqBYIBAhABEj8KCmFkbWluX3JvbGUYCyABKA4yHC5tZXRhbHN0YWNrLmFwaS52Mi5BZG1pblJvbGVCCLpIBYIBAhABSACIAQESPwoKaW5mcmFfcm9sZRgMIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkluZnJhUm9sZUIIukgFggECEAFIAYgBARJcCg1tYWNoaW5lX3JvbGVzGA0gAygLMioubWV0YWxzdGFjay5hcGkudjIuVG9rZW4uTWFjaGluZVJvbGVzRW50cnlCGbpIFpoBE8CVuLECAdiVuLECASoFggECEAEaUwoRUHJvamVjdFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuUHJvamVjdFJvbGU6AjgBGlEKEFRlbmFudFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEiwKBXZhbHVlGAIgASgOMh0ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50Um9sZToCOAEaUwoRTWFjaGluZVJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuTWFjaGluZVJvbGU6AjgBQg0KC19hZG1pbl9yb2xlQg0KC19pbmZyYV9yb2xlIuQHChlUb2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0EiAKC2Rlc2NyaXB0aW9uGAEgASgJQgu6SAhyBsizrrECARJJCgtwZXJtaXNzaW9ucxgCIAMoCzIqLm1ldGFsc3RhY2suYXBpLnYyLlBlcm1pc3Npb25zQnlWaXNpYmlsaXR5Qgi6SAWSAQIQZBI+CgdleHBpcmVzGAMgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQhK6SA+qAQwaBQiB54QPMgMI2AQScAoNcHJvamVjdF9yb2xlcxgEIAMoCzI+Lm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUNyZWF0ZVJlcXVlc3QuUHJvamVjdFJvbGVzRW50cnlCGbpIFpoBE8CVuLECAciVuLECASoFggECEAESbgoMdGVuYW50X3JvbGVzGAUgAygLMj0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdC5UZW5hbnRSb2xlc0VudHJ5Qhm6SBaaARPAlbixAgHQlbixAgEqBYIBAhABEj8KCmFkbWluX3JvbGUYBiABKA4yHC5tZXRhbHN0YWNrLmFwaS52Mi5BZG1pblJvbGVCCLpIBYIBAhABSACIAQESPwoKaW5mcmFfcm9sZRgHIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkluZnJhUm9sZUIIukgFggECEAFIAYgBARJwCg1tYWNoaW5lX3JvbGVzGAggAygLMj4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdC5NYWNoaW5lUm9sZXNFbnRyeUIZukgWmgETwJW4sQIB2JW4sQIBKgWCAQIQARIpCgZsYWJlbHMYCSABKAsyGS5tZXRhbHN0YWNrLmFwaS52Mi5MYWJlbHMaUwoRUHJvamVjdFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuUHJvamVjdFJvbGU6AjgBGlEKEFRlbmFudFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEiwKBXZhbHVlGAIgASgOMh0ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50Um9sZToCOAEaUwoRTWFjaGluZVJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuTWFjaGluZVJvbGU6AjgBQg0KC19hZG1pbl9yb2xlQg0KC19pbmZyYV9yb2xlIkkKEE1ldGhvZFBlcm1pc3Npb24SGQoHc3ViamVjdBgBIAEoCUIIukgFcgMYgAISGgoHbWV0aG9kcxgCIAMoCUIJukgGkgEDEPQDIqsDChdQZXJtaXNzaW9uc0J5VmlzaWJpbGl0eRI2CgZwdWJsaWMYASABKAsyJC5tZXRhbHN0YWNrLmFwaS52Mi5QdWJsaWNQZXJtaXNzaW9uc0gAEjIKBHNlbGYYAiABKAsyIi5tZXRhbHN0YWNrLmFwaS52Mi5TZWxmUGVybWlzc2lvbnNIABI4Cgdwcm9qZWN0GAMgASgLMiUubWV0YWxzdGFjay5hcGkudjIuUHJvamVjdFBlcm1pc3Npb25zSAASNgoGdGVuYW50GAQgASgLMiQubWV0YWxzdGFjay5hcGkudjIuVGVuYW50UGVybWlzc2lvbnNIABI0CgVhZG1pbhgFIAEoCzIjLm1ldGFsc3RhY2suYXBpLnYyLkFkbWluUGVybWlzc2lvbnNIABI4CgdtYWNoaW5lGAYgASgLMiUubWV0YWxzdGFjay5hcGkudjIuTWFjaGluZVBlcm1pc3Npb25zSAASNAoFaW5mcmEYByABKAsyIy5tZXRhbHN0YWNrLmFwaS52Mi5JbmZyYVBlcm1pc3Npb25zSABCDAoKdmlzaWJpbGl0eSIvChFQdWJsaWNQZXJtaXNzaW9ucxIaCgdtZXRob2RzGAIgAygJQgm6SAaSAQMQ9AMiLQoPU2VsZlBlcm1pc3Npb25zEhoKB21ldGhvZHMYAiADKAlCCbpIBpIBAxD0AyJOChJQcm9qZWN0UGVybWlzc2lvbnMSHAoHcHJvamVjdBgBIAEoCUILukgIcgagtK6xAgESGgoHbWV0aG9kcxgCIAMoCUIJukgGkgEDEPQDIksKEVRlbmFudFBlcm1pc3Npb25zEhoKBWxvZ2luGAEgASgJQgu6SAhyBpi0rrECARIaCgdtZXRob2RzGAIgAygJQgm6SAaSAQMQ9AMiLgoQQWRtaW5QZXJtaXNzaW9ucxIaCgdtZXRob2RzGAIgAygJQgm6SAaSAQMQ9AMiSwoSTWFjaGluZVBlcm1pc3Npb25zEhkKBHV1aWQYASABKAlCC7pICHIGqLSusQIBEhoKB21ldGhvZHMYAiADKAlCCbpIBpIBAxD0AyIuChBJbmZyYVBlcm1pc3Npb25zEhoKB21ldGhvZHMYAiADKAlCCbpIBpIBAxD0AyJVChpUb2tlblNlcnZpY2VDcmVhdGVSZXNwb25zZRInCgV0b2tlbhgBIAEoCzIYLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuEg4KBnNlY3JldBgCIAEoCSJHChdUb2tlblNlcnZpY2VMaXN0UmVxdWVzdBIsCgVxdWVyeRgBIAEoCzIdLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuUXVlcnkiRAoYVG9rZW5TZXJ2aWNlTGlzdFJlc3BvbnNlEigKBnRva2VucxgBIAMoCzIYLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuIjMKGVRva2VuU2VydmljZVJldm9rZVJlcXVlc3QSFgoEdXVpZBgBIAEoCUIIukgFcgOwAQEiHAoaVG9rZW5TZXJ2aWNlUmV2b2tlUmVzcG9uc2UiiQgKGVRva2VuU2VydmljZVVwZGF0ZVJlcXVlc3QSFgoEdXVpZBgBIAEoCUIIukgFcgOwAQESOgoLdXBkYXRlX21ldGEYAiABKAsyHS5tZXRhbHN0YWNrLmFwaS52Mi5VcGRhdGVNZXRhQga6SAPIAQASJQoLZGVzY3JpcHRpb24YAyABKAlCC7pICHIGyLOusQIBSACIAQESPwoLcGVybWlzc2lvbnMYBCADKAsyKi5tZXRhbHN0YWNrLmFwaS52Mi5QZXJtaXNzaW9uc0J5VmlzaWJpbGl0eRJwCg1wcm9qZWN0X3JvbGVzGAUgAygLMj4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdC5Qcm9qZWN0Um9sZXNFbnRyeUIZukgWmgETwJW4sQIByJW4sQIBKgWCAQIQARJuCgx0ZW5hbnRfcm9sZXMYBiADKAsyPS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0LlRlbmFudFJvbGVzRW50cnlCGbpIFpoBE8CVuLECAdCVuLECASoFggECEAESPwoKYWRtaW5fcm9sZRgHIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkFkbWluUm9sZUIIukgFggECEAFIAYgBARI/CgppbmZyYV9yb2xlGAggASgOMhwubWV0YWxzdGFjay5hcGkudjIuSW5mcmFSb2xlQgi6SAWCAQIQAUgCiAEBEnAKDW1hY2hpbmVfcm9sZXMYCSADKAsyPi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0Lk1hY2hpbmVSb2xlc0VudHJ5Qhm6SBaaARPAlbixAgHYlbixAgEqBYIBAhABEi8KBmxhYmVscxgKIAEoCzIfLm1ldGFsc3RhY2suYXBpLnYyLlVwZGF0ZUxhYmVscxpTChFQcm9qZWN0Um9sZXNFbnRyeRILCgNrZXkYASABKAkSLQoFdmFsdWUYAiABKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5Qcm9qZWN0Um9sZToCOAEaUQoQVGVuYW50Um9sZXNFbnRyeRILCgNrZXkYASABKAkSLAoFdmFsdWUYAiABKA4yHS5tZXRhbHN0YWNrLmFwaS52Mi5UZW5hbnRSb2xlOgI4ARpTChFNYWNoaW5lUm9sZXNFbnRyeRILCgNrZXkYASABKAkSLQoFdmFsdWUYAiABKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5NYWNoaW5lUm9sZToCOAFCDgoMX2Rlc2NyaXB0aW9uQg0KC19hZG1pbl9yb2xlQg0KC19pbmZyYV9yb2xlIkUKGlRva2VuU2VydmljZVVwZGF0ZVJlc3BvbnNlEicKBXRva2VuGAEgASgLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4iMAoWVG9rZW5TZXJ2aWNlR2V0UmVxdWVzdBIWCgR1dWlkGAEgASgJQgi6SAVyA7ABASJCChdUb2tlblNlcnZpY2VHZXRSZXNwb25zZRInCgV0b2tlbhgBIAEoCzIYLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuIhwKGlRva2VuU2VydmljZVJlZnJlc2hSZXF1ZXN0IlYKG1Rva2VuU2VydmljZVJlZnJlc2hSZXNwb25zZRInCgV0b2tlbhgBIAEoCzIYLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuEg4KBnNlY3JldBgCIAEoCSKdAgoKVG9rZW5RdWVyeRIbCgR1dWlkGAEgASgJQgi6SAVyA7ABAUgAiAEBEh4KBHVzZXIYAiABKAlCC7pICHIG+LOusQIBSAGIAQESJQoLZGVzY3JpcHRpb24YAyABKAlCC7pICHIGyLOusQIBSAKIAQESLgoGbGFiZWxzGAQgASgLMhkubWV0YWxzdGFjay5hcGkudjIuTGFiZWxzSAOIAQESPwoKdG9rZW5fdHlwZRgFIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuVHlwZUIIukgFggECEAFIBIgBAUIHCgVfdXVpZEIHCgVfdXNlckIOCgxfZGVzY3JpcHRpb25CCQoHX2xhYmVsc0INCgtfdG9rZW5fdHlwZSpQCglUb2tlblR5cGUSGgoWVE9LRU5fVFlQRV9VTlNQRUNJRklFRBAAEhIKDlRPS0VOX1RZUEVfQVBJEAESEwoPVE9LRU5fVFlQRV9VU0VSEAIyqAUKDFRva2VuU2VydmljZRJmCgNHZXQSKS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VHZXRSZXF1ZXN0GioubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlR2V0UmVzcG9uc2UiCNjzGALg8xgBEm8KBkNyZWF0ZRIsLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUNyZWF0ZVJlcXVlc3QaLS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXNwb25zZSII2PMYAuDzGAESbwoGVXBkYXRlEiwubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdBotLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVVwZGF0ZVJlc3BvbnNlIgjY8xgC4PMYARJpCgRMaXN0EioubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlTGlzdFJlcXVlc3QaKy5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VMaXN0UmVzcG9uc2UiCNjzGALg8xgBEm8KBlJldm9rZRIsLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVJldm9rZVJlcXVlc3QaLS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VSZXZva2VSZXNwb25zZSII2PMYAuDzGAEScgoHUmVmcmVzaBItLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVJlZnJlc2hSZXF1ZXN0Gi4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlUmVmcmVzaFJlc3BvbnNlIgjY8xgC4PMYAULAAQoVY29tLm1ldGFsc3RhY2suYXBpLnYyQgpUb2tlblByb3RvUAFaNWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYXBpL3YyO2FwaXYyogIDTUFYqgIRTWV0YWxzdGFjay5BcGkuVjLKAhFNZXRhbHN0YWNrXEFwaVxWMuICHU1ldGFsc3RhY2tcQXBpXFYyXEdQQk1ldGFkYXRh6gITTWV0YWxzdGFjazo6QXBpOjpWMmIGcHJvdG8z", [file_buf_validate_validate, file_google_protobuf_duration, file_google_protobuf_timestamp, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules]);
 /**
  * Describes the message metalstack.api.v2.Token.
  * Use `create(TokenSchema)` to create a new message.
@@ -25,66 +25,106 @@ export const TokenServiceCreateRequestSchema = /*@__PURE__*/ messageDesc(file_me
  * Use `create(MethodPermissionSchema)` to create a new message.
  */
 export const MethodPermissionSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 2);
+/**
+ * Describes the message metalstack.api.v2.PermissionsByVisibility.
+ * Use `create(PermissionsByVisibilitySchema)` to create a new message.
+ */
+export const PermissionsByVisibilitySchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 3);
+/**
+ * Describes the message metalstack.api.v2.PublicPermissions.
+ * Use `create(PublicPermissionsSchema)` to create a new message.
+ */
+export const PublicPermissionsSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 4);
+/**
+ * Describes the message metalstack.api.v2.SelfPermissions.
+ * Use `create(SelfPermissionsSchema)` to create a new message.
+ */
+export const SelfPermissionsSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 5);
+/**
+ * Describes the message metalstack.api.v2.ProjectPermissions.
+ * Use `create(ProjectPermissionsSchema)` to create a new message.
+ */
+export const ProjectPermissionsSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 6);
+/**
+ * Describes the message metalstack.api.v2.TenantPermissions.
+ * Use `create(TenantPermissionsSchema)` to create a new message.
+ */
+export const TenantPermissionsSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 7);
+/**
+ * Describes the message metalstack.api.v2.AdminPermissions.
+ * Use `create(AdminPermissionsSchema)` to create a new message.
+ */
+export const AdminPermissionsSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 8);
+/**
+ * Describes the message metalstack.api.v2.MachinePermissions.
+ * Use `create(MachinePermissionsSchema)` to create a new message.
+ */
+export const MachinePermissionsSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 9);
+/**
+ * Describes the message metalstack.api.v2.InfraPermissions.
+ * Use `create(InfraPermissionsSchema)` to create a new message.
+ */
+export const InfraPermissionsSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 10);
 /**
  * Describes the message metalstack.api.v2.TokenServiceCreateResponse.
  * Use `create(TokenServiceCreateResponseSchema)` to create a new message.
  */
-export const TokenServiceCreateResponseSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 3);
+export const TokenServiceCreateResponseSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 11);
 /**
  * Describes the message metalstack.api.v2.TokenServiceListRequest.
  * Use `create(TokenServiceListRequestSchema)` to create a new message.
  */
-export const TokenServiceListRequestSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 4);
+export const TokenServiceListRequestSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 12);
 /**
  * Describes the message metalstack.api.v2.TokenServiceListResponse.
  * Use `create(TokenServiceListResponseSchema)` to create a new message.
  */
-export const TokenServiceListResponseSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 5);
+export const TokenServiceListResponseSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 13);
 /**
  * Describes the message metalstack.api.v2.TokenServiceRevokeRequest.
  * Use `create(TokenServiceRevokeRequestSchema)` to create a new message.
  */
-export const TokenServiceRevokeRequestSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 6);
+export const TokenServiceRevokeRequestSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 14);
 /**
  * Describes the message metalstack.api.v2.TokenServiceRevokeResponse.
  * Use `create(TokenServiceRevokeResponseSchema)` to create a new message.
  */
-export const TokenServiceRevokeResponseSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 7);
+export const TokenServiceRevokeResponseSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 15);
 /**
  * Describes the message metalstack.api.v2.TokenServiceUpdateRequest.
  * Use `create(TokenServiceUpdateRequestSchema)` to create a new message.
  */
-export const TokenServiceUpdateRequestSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 8);
+export const TokenServiceUpdateRequestSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 16);
 /**
  * Describes the message metalstack.api.v2.TokenServiceUpdateResponse.
  * Use `create(TokenServiceUpdateResponseSchema)` to create a new message.
  */
-export const TokenServiceUpdateResponseSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 9);
+export const TokenServiceUpdateResponseSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 17);
 /**
  * Describes the message metalstack.api.v2.TokenServiceGetRequest.
  * Use `create(TokenServiceGetRequestSchema)` to create a new message.
  */
-export const TokenServiceGetRequestSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 10);
+export const TokenServiceGetRequestSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 18);
 /**
  * Describes the message metalstack.api.v2.TokenServiceGetResponse.
  * Use `create(TokenServiceGetResponseSchema)` to create a new message.
  */
-export const TokenServiceGetResponseSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 11);
+export const TokenServiceGetResponseSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 19);
 /**
  * Describes the message metalstack.api.v2.TokenServiceRefreshRequest.
  * Use `create(TokenServiceRefreshRequestSchema)` to create a new message.
  */
-export const TokenServiceRefreshRequestSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 12);
+export const TokenServiceRefreshRequestSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 20);
 /**
  * Describes the message metalstack.api.v2.TokenServiceRefreshResponse.
  * Use `create(TokenServiceRefreshResponseSchema)` to create a new message.
  */
-export const TokenServiceRefreshResponseSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 13);
+export const TokenServiceRefreshResponseSchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 21);
 /**
  * Describes the message metalstack.api.v2.TokenQuery.
  * Use `create(TokenQuerySchema)` to create a new message.
  */
-export const TokenQuerySchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 14);
+export const TokenQuerySchema = /*@__PURE__*/ messageDesc(file_metalstack_api_v2_token, 22);
 /**
  * TokenType specifies different use cases of tokens
  *
diff --git a/js/metalstack/api/v2/token_pb.ts b/js/metalstack/api/v2/token_pb.ts
index 9d6ad7c3..15be48df 100644
--- a/js/metalstack/api/v2/token_pb.ts
+++ b/js/metalstack/api/v2/token_pb.ts
@@ -16,7 +16,7 @@ import type { Message } from "@bufbuild/protobuf";
  * Describes the file metalstack/api/v2/token.proto.
  */
 export const file_metalstack_api_v2_token: GenFile = /*@__PURE__*/
-  fileDesc("Ch1tZXRhbHN0YWNrL2FwaS92Mi90b2tlbi5wcm90bxIRbWV0YWxzdGFjay5hcGkudjIilQgKBVRva2VuEhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEhkKBHVzZXIYAiABKAlCC7pICHIG+LOusQIBEiUKBG1ldGEYAyABKAsyFy5tZXRhbHN0YWNrLmFwaS52Mi5NZXRhEiAKC2Rlc2NyaXB0aW9uGAQgASgJQgu6SAhyBsizrrECARJDCgtwZXJtaXNzaW9ucxgFIAMoCzIjLm1ldGFsc3RhY2suYXBpLnYyLk1ldGhvZFBlcm1pc3Npb25CCbpIBpIBAxD0AxIrCgdleHBpcmVzGAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBItCglpc3N1ZWRfYXQYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjoKCnRva2VuX3R5cGUYCCABKA4yHC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblR5cGVCCLpIBYIBAhABElwKDXByb2plY3Rfcm9sZXMYCSADKAsyKi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbi5Qcm9qZWN0Um9sZXNFbnRyeUIZukgWmgETwJW4sQIByJW4sQIBKgWCAQIQARJaCgx0ZW5hbnRfcm9sZXMYCiADKAsyKS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbi5UZW5hbnRSb2xlc0VudHJ5Qhm6SBaaARPAlbixAgHQlbixAgEqBYIBAhABEj8KCmFkbWluX3JvbGUYCyABKA4yHC5tZXRhbHN0YWNrLmFwaS52Mi5BZG1pblJvbGVCCLpIBYIBAhABSACIAQESPwoKaW5mcmFfcm9sZRgMIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkluZnJhUm9sZUIIukgFggECEAFIAYgBARJcCg1tYWNoaW5lX3JvbGVzGA0gAygLMioubWV0YWxzdGFjay5hcGkudjIuVG9rZW4uTWFjaGluZVJvbGVzRW50cnlCGbpIFpoBE8CVuLECAdiVuLECASoFggECEAEaUwoRUHJvamVjdFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuUHJvamVjdFJvbGU6AjgBGlEKEFRlbmFudFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEiwKBXZhbHVlGAIgASgOMh0ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50Um9sZToCOAEaUwoRTWFjaGluZVJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuTWFjaGluZVJvbGU6AjgBQg0KC19hZG1pbl9yb2xlQg0KC19pbmZyYV9yb2xlIt0HChlUb2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0EiAKC2Rlc2NyaXB0aW9uGAEgASgJQgu6SAhyBsizrrECARJCCgtwZXJtaXNzaW9ucxgCIAMoCzIjLm1ldGFsc3RhY2suYXBpLnYyLk1ldGhvZFBlcm1pc3Npb25CCLpIBZIBAhBkEj4KB2V4cGlyZXMYAyABKAsyGS5nb29nbGUucHJvdG9idWYuRHVyYXRpb25CErpID6oBDBoFCIHnhA8yAwjYBBJwCg1wcm9qZWN0X3JvbGVzGAQgAygLMj4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdC5Qcm9qZWN0Um9sZXNFbnRyeUIZukgWmgETwJW4sQIByJW4sQIBKgWCAQIQARJuCgx0ZW5hbnRfcm9sZXMYBSADKAsyPS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0LlRlbmFudFJvbGVzRW50cnlCGbpIFpoBE8CVuLECAdCVuLECASoFggECEAESPwoKYWRtaW5fcm9sZRgGIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkFkbWluUm9sZUIIukgFggECEAFIAIgBARI/CgppbmZyYV9yb2xlGAcgASgOMhwubWV0YWxzdGFjay5hcGkudjIuSW5mcmFSb2xlQgi6SAWCAQIQAUgBiAEBEnAKDW1hY2hpbmVfcm9sZXMYCCADKAsyPi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0Lk1hY2hpbmVSb2xlc0VudHJ5Qhm6SBaaARPAlbixAgHYlbixAgEqBYIBAhABEikKBmxhYmVscxgJIAEoCzIZLm1ldGFsc3RhY2suYXBpLnYyLkxhYmVscxpTChFQcm9qZWN0Um9sZXNFbnRyeRILCgNrZXkYASABKAkSLQoFdmFsdWUYAiABKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5Qcm9qZWN0Um9sZToCOAEaUQoQVGVuYW50Um9sZXNFbnRyeRILCgNrZXkYASABKAkSLAoFdmFsdWUYAiABKA4yHS5tZXRhbHN0YWNrLmFwaS52Mi5UZW5hbnRSb2xlOgI4ARpTChFNYWNoaW5lUm9sZXNFbnRyeRILCgNrZXkYASABKAkSLQoFdmFsdWUYAiABKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5NYWNoaW5lUm9sZToCOAFCDQoLX2FkbWluX3JvbGVCDQoLX2luZnJhX3JvbGUiSQoQTWV0aG9kUGVybWlzc2lvbhIZCgdzdWJqZWN0GAEgASgJQgi6SAVyAxiAAhIaCgdtZXRob2RzGAIgAygJQgm6SAaSAQMQ9AMiVQoaVG9rZW5TZXJ2aWNlQ3JlYXRlUmVzcG9uc2USJwoFdG9rZW4YASABKAsyGC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbhIOCgZzZWNyZXQYAiABKAkiRwoXVG9rZW5TZXJ2aWNlTGlzdFJlcXVlc3QSLAoFcXVlcnkYASABKAsyHS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblF1ZXJ5IkQKGFRva2VuU2VydmljZUxpc3RSZXNwb25zZRIoCgZ0b2tlbnMYASADKAsyGC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbiIzChlUb2tlblNlcnZpY2VSZXZva2VSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBIhwKGlRva2VuU2VydmljZVJldm9rZVJlc3BvbnNlIoIIChlUb2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEjoKC3VwZGF0ZV9tZXRhGAIgASgLMh0ubWV0YWxzdGFjay5hcGkudjIuVXBkYXRlTWV0YUIGukgDyAEAEiUKC2Rlc2NyaXB0aW9uGAMgASgJQgu6SAhyBsizrrECAUgAiAEBEjgKC3Blcm1pc3Npb25zGAQgAygLMiMubWV0YWxzdGFjay5hcGkudjIuTWV0aG9kUGVybWlzc2lvbhJwCg1wcm9qZWN0X3JvbGVzGAUgAygLMj4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdC5Qcm9qZWN0Um9sZXNFbnRyeUIZukgWmgETwJW4sQIByJW4sQIBKgWCAQIQARJuCgx0ZW5hbnRfcm9sZXMYBiADKAsyPS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0LlRlbmFudFJvbGVzRW50cnlCGbpIFpoBE8CVuLECAdCVuLECASoFggECEAESPwoKYWRtaW5fcm9sZRgHIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkFkbWluUm9sZUIIukgFggECEAFIAYgBARI/CgppbmZyYV9yb2xlGAggASgOMhwubWV0YWxzdGFjay5hcGkudjIuSW5mcmFSb2xlQgi6SAWCAQIQAUgCiAEBEnAKDW1hY2hpbmVfcm9sZXMYCSADKAsyPi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0Lk1hY2hpbmVSb2xlc0VudHJ5Qhm6SBaaARPAlbixAgHYlbixAgEqBYIBAhABEi8KBmxhYmVscxgKIAEoCzIfLm1ldGFsc3RhY2suYXBpLnYyLlVwZGF0ZUxhYmVscxpTChFQcm9qZWN0Um9sZXNFbnRyeRILCgNrZXkYASABKAkSLQoFdmFsdWUYAiABKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5Qcm9qZWN0Um9sZToCOAEaUQoQVGVuYW50Um9sZXNFbnRyeRILCgNrZXkYASABKAkSLAoFdmFsdWUYAiABKA4yHS5tZXRhbHN0YWNrLmFwaS52Mi5UZW5hbnRSb2xlOgI4ARpTChFNYWNoaW5lUm9sZXNFbnRyeRILCgNrZXkYASABKAkSLQoFdmFsdWUYAiABKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5NYWNoaW5lUm9sZToCOAFCDgoMX2Rlc2NyaXB0aW9uQg0KC19hZG1pbl9yb2xlQg0KC19pbmZyYV9yb2xlIkUKGlRva2VuU2VydmljZVVwZGF0ZVJlc3BvbnNlEicKBXRva2VuGAEgASgLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4iMAoWVG9rZW5TZXJ2aWNlR2V0UmVxdWVzdBIWCgR1dWlkGAEgASgJQgi6SAVyA7ABASJCChdUb2tlblNlcnZpY2VHZXRSZXNwb25zZRInCgV0b2tlbhgBIAEoCzIYLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuIhwKGlRva2VuU2VydmljZVJlZnJlc2hSZXF1ZXN0IlYKG1Rva2VuU2VydmljZVJlZnJlc2hSZXNwb25zZRInCgV0b2tlbhgBIAEoCzIYLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuEg4KBnNlY3JldBgCIAEoCSKdAgoKVG9rZW5RdWVyeRIbCgR1dWlkGAEgASgJQgi6SAVyA7ABAUgAiAEBEh4KBHVzZXIYAiABKAlCC7pICHIG+LOusQIBSAGIAQESJQoLZGVzY3JpcHRpb24YAyABKAlCC7pICHIGyLOusQIBSAKIAQESLgoGbGFiZWxzGAQgASgLMhkubWV0YWxzdGFjay5hcGkudjIuTGFiZWxzSAOIAQESPwoKdG9rZW5fdHlwZRgFIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuVHlwZUIIukgFggECEAFIBIgBAUIHCgVfdXVpZEIHCgVfdXNlckIOCgxfZGVzY3JpcHRpb25CCQoHX2xhYmVsc0INCgtfdG9rZW5fdHlwZSpQCglUb2tlblR5cGUSGgoWVE9LRU5fVFlQRV9VTlNQRUNJRklFRBAAEhIKDlRPS0VOX1RZUEVfQVBJEAESEwoPVE9LRU5fVFlQRV9VU0VSEAIyqAUKDFRva2VuU2VydmljZRJmCgNHZXQSKS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VHZXRSZXF1ZXN0GioubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlR2V0UmVzcG9uc2UiCNjzGALg8xgBEm8KBkNyZWF0ZRIsLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUNyZWF0ZVJlcXVlc3QaLS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXNwb25zZSII2PMYAuDzGAESbwoGVXBkYXRlEiwubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdBotLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVVwZGF0ZVJlc3BvbnNlIgjY8xgC4PMYARJpCgRMaXN0EioubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlTGlzdFJlcXVlc3QaKy5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VMaXN0UmVzcG9uc2UiCNjzGALg8xgBEm8KBlJldm9rZRIsLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVJldm9rZVJlcXVlc3QaLS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VSZXZva2VSZXNwb25zZSII2PMYAuDzGAEScgoHUmVmcmVzaBItLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVJlZnJlc2hSZXF1ZXN0Gi4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlUmVmcmVzaFJlc3BvbnNlIgjY8xgC4PMYAULAAQoVY29tLm1ldGFsc3RhY2suYXBpLnYyQgpUb2tlblByb3RvUAFaNWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYXBpL3YyO2FwaXYyogIDTUFYqgIRTWV0YWxzdGFjay5BcGkuVjLKAhFNZXRhbHN0YWNrXEFwaVxWMuICHU1ldGFsc3RhY2tcQXBpXFYyXEdQQk1ldGFkYXRh6gITTWV0YWxzdGFjazo6QXBpOjpWMmIGcHJvdG8z", [file_buf_validate_validate, file_google_protobuf_duration, file_google_protobuf_timestamp, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules]);
+  fileDesc("Ch1tZXRhbHN0YWNrL2FwaS92Mi90b2tlbi5wcm90bxIRbWV0YWxzdGFjay5hcGkudjIilQgKBVRva2VuEhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEhkKBHVzZXIYAiABKAlCC7pICHIG+LOusQIBEiUKBG1ldGEYAyABKAsyFy5tZXRhbHN0YWNrLmFwaS52Mi5NZXRhEiAKC2Rlc2NyaXB0aW9uGAQgASgJQgu6SAhyBsizrrECARJDCgtwZXJtaXNzaW9ucxgFIAMoCzIjLm1ldGFsc3RhY2suYXBpLnYyLk1ldGhvZFBlcm1pc3Npb25CCbpIBpIBAxD0AxIrCgdleHBpcmVzGAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBItCglpc3N1ZWRfYXQYByABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEjoKCnRva2VuX3R5cGUYCCABKA4yHC5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblR5cGVCCLpIBYIBAhABElwKDXByb2plY3Rfcm9sZXMYCSADKAsyKi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbi5Qcm9qZWN0Um9sZXNFbnRyeUIZukgWmgETwJW4sQIByJW4sQIBKgWCAQIQARJaCgx0ZW5hbnRfcm9sZXMYCiADKAsyKS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlbi5UZW5hbnRSb2xlc0VudHJ5Qhm6SBaaARPAlbixAgHQlbixAgEqBYIBAhABEj8KCmFkbWluX3JvbGUYCyABKA4yHC5tZXRhbHN0YWNrLmFwaS52Mi5BZG1pblJvbGVCCLpIBYIBAhABSACIAQESPwoKaW5mcmFfcm9sZRgMIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkluZnJhUm9sZUIIukgFggECEAFIAYgBARJcCg1tYWNoaW5lX3JvbGVzGA0gAygLMioubWV0YWxzdGFjay5hcGkudjIuVG9rZW4uTWFjaGluZVJvbGVzRW50cnlCGbpIFpoBE8CVuLECAdiVuLECASoFggECEAEaUwoRUHJvamVjdFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuUHJvamVjdFJvbGU6AjgBGlEKEFRlbmFudFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEiwKBXZhbHVlGAIgASgOMh0ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50Um9sZToCOAEaUwoRTWFjaGluZVJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuTWFjaGluZVJvbGU6AjgBQg0KC19hZG1pbl9yb2xlQg0KC19pbmZyYV9yb2xlIuQHChlUb2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0EiAKC2Rlc2NyaXB0aW9uGAEgASgJQgu6SAhyBsizrrECARJJCgtwZXJtaXNzaW9ucxgCIAMoCzIqLm1ldGFsc3RhY2suYXBpLnYyLlBlcm1pc3Npb25zQnlWaXNpYmlsaXR5Qgi6SAWSAQIQZBI+CgdleHBpcmVzGAMgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQhK6SA+qAQwaBQiB54QPMgMI2AQScAoNcHJvamVjdF9yb2xlcxgEIAMoCzI+Lm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUNyZWF0ZVJlcXVlc3QuUHJvamVjdFJvbGVzRW50cnlCGbpIFpoBE8CVuLECAciVuLECASoFggECEAESbgoMdGVuYW50X3JvbGVzGAUgAygLMj0ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdC5UZW5hbnRSb2xlc0VudHJ5Qhm6SBaaARPAlbixAgHQlbixAgEqBYIBAhABEj8KCmFkbWluX3JvbGUYBiABKA4yHC5tZXRhbHN0YWNrLmFwaS52Mi5BZG1pblJvbGVCCLpIBYIBAhABSACIAQESPwoKaW5mcmFfcm9sZRgHIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkluZnJhUm9sZUIIukgFggECEAFIAYgBARJwCg1tYWNoaW5lX3JvbGVzGAggAygLMj4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdC5NYWNoaW5lUm9sZXNFbnRyeUIZukgWmgETwJW4sQIB2JW4sQIBKgWCAQIQARIpCgZsYWJlbHMYCSABKAsyGS5tZXRhbHN0YWNrLmFwaS52Mi5MYWJlbHMaUwoRUHJvamVjdFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuUHJvamVjdFJvbGU6AjgBGlEKEFRlbmFudFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEiwKBXZhbHVlGAIgASgOMh0ubWV0YWxzdGFjay5hcGkudjIuVGVuYW50Um9sZToCOAEaUwoRTWFjaGluZVJvbGVzRW50cnkSCwoDa2V5GAEgASgJEi0KBXZhbHVlGAIgASgOMh4ubWV0YWxzdGFjay5hcGkudjIuTWFjaGluZVJvbGU6AjgBQg0KC19hZG1pbl9yb2xlQg0KC19pbmZyYV9yb2xlIkkKEE1ldGhvZFBlcm1pc3Npb24SGQoHc3ViamVjdBgBIAEoCUIIukgFcgMYgAISGgoHbWV0aG9kcxgCIAMoCUIJukgGkgEDEPQDIqsDChdQZXJtaXNzaW9uc0J5VmlzaWJpbGl0eRI2CgZwdWJsaWMYASABKAsyJC5tZXRhbHN0YWNrLmFwaS52Mi5QdWJsaWNQZXJtaXNzaW9uc0gAEjIKBHNlbGYYAiABKAsyIi5tZXRhbHN0YWNrLmFwaS52Mi5TZWxmUGVybWlzc2lvbnNIABI4Cgdwcm9qZWN0GAMgASgLMiUubWV0YWxzdGFjay5hcGkudjIuUHJvamVjdFBlcm1pc3Npb25zSAASNgoGdGVuYW50GAQgASgLMiQubWV0YWxzdGFjay5hcGkudjIuVGVuYW50UGVybWlzc2lvbnNIABI0CgVhZG1pbhgFIAEoCzIjLm1ldGFsc3RhY2suYXBpLnYyLkFkbWluUGVybWlzc2lvbnNIABI4CgdtYWNoaW5lGAYgASgLMiUubWV0YWxzdGFjay5hcGkudjIuTWFjaGluZVBlcm1pc3Npb25zSAASNAoFaW5mcmEYByABKAsyIy5tZXRhbHN0YWNrLmFwaS52Mi5JbmZyYVBlcm1pc3Npb25zSABCDAoKdmlzaWJpbGl0eSIvChFQdWJsaWNQZXJtaXNzaW9ucxIaCgdtZXRob2RzGAIgAygJQgm6SAaSAQMQ9AMiLQoPU2VsZlBlcm1pc3Npb25zEhoKB21ldGhvZHMYAiADKAlCCbpIBpIBAxD0AyJOChJQcm9qZWN0UGVybWlzc2lvbnMSHAoHcHJvamVjdBgBIAEoCUILukgIcgagtK6xAgESGgoHbWV0aG9kcxgCIAMoCUIJukgGkgEDEPQDIksKEVRlbmFudFBlcm1pc3Npb25zEhoKBWxvZ2luGAEgASgJQgu6SAhyBpi0rrECARIaCgdtZXRob2RzGAIgAygJQgm6SAaSAQMQ9AMiLgoQQWRtaW5QZXJtaXNzaW9ucxIaCgdtZXRob2RzGAIgAygJQgm6SAaSAQMQ9AMiSwoSTWFjaGluZVBlcm1pc3Npb25zEhkKBHV1aWQYASABKAlCC7pICHIGqLSusQIBEhoKB21ldGhvZHMYAiADKAlCCbpIBpIBAxD0AyIuChBJbmZyYVBlcm1pc3Npb25zEhoKB21ldGhvZHMYAiADKAlCCbpIBpIBAxD0AyJVChpUb2tlblNlcnZpY2VDcmVhdGVSZXNwb25zZRInCgV0b2tlbhgBIAEoCzIYLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuEg4KBnNlY3JldBgCIAEoCSJHChdUb2tlblNlcnZpY2VMaXN0UmVxdWVzdBIsCgVxdWVyeRgBIAEoCzIdLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuUXVlcnkiRAoYVG9rZW5TZXJ2aWNlTGlzdFJlc3BvbnNlEigKBnRva2VucxgBIAMoCzIYLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuIjMKGVRva2VuU2VydmljZVJldm9rZVJlcXVlc3QSFgoEdXVpZBgBIAEoCUIIukgFcgOwAQEiHAoaVG9rZW5TZXJ2aWNlUmV2b2tlUmVzcG9uc2UiiQgKGVRva2VuU2VydmljZVVwZGF0ZVJlcXVlc3QSFgoEdXVpZBgBIAEoCUIIukgFcgOwAQESOgoLdXBkYXRlX21ldGEYAiABKAsyHS5tZXRhbHN0YWNrLmFwaS52Mi5VcGRhdGVNZXRhQga6SAPIAQASJQoLZGVzY3JpcHRpb24YAyABKAlCC7pICHIGyLOusQIBSACIAQESPwoLcGVybWlzc2lvbnMYBCADKAsyKi5tZXRhbHN0YWNrLmFwaS52Mi5QZXJtaXNzaW9uc0J5VmlzaWJpbGl0eRJwCg1wcm9qZWN0X3JvbGVzGAUgAygLMj4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdC5Qcm9qZWN0Um9sZXNFbnRyeUIZukgWmgETwJW4sQIByJW4sQIBKgWCAQIQARJuCgx0ZW5hbnRfcm9sZXMYBiADKAsyPS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0LlRlbmFudFJvbGVzRW50cnlCGbpIFpoBE8CVuLECAdCVuLECASoFggECEAESPwoKYWRtaW5fcm9sZRgHIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLkFkbWluUm9sZUIIukgFggECEAFIAYgBARI/CgppbmZyYV9yb2xlGAggASgOMhwubWV0YWxzdGFjay5hcGkudjIuSW5mcmFSb2xlQgi6SAWCAQIQAUgCiAEBEnAKDW1hY2hpbmVfcm9sZXMYCSADKAsyPi5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0Lk1hY2hpbmVSb2xlc0VudHJ5Qhm6SBaaARPAlbixAgHYlbixAgEqBYIBAhABEi8KBmxhYmVscxgKIAEoCzIfLm1ldGFsc3RhY2suYXBpLnYyLlVwZGF0ZUxhYmVscxpTChFQcm9qZWN0Um9sZXNFbnRyeRILCgNrZXkYASABKAkSLQoFdmFsdWUYAiABKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5Qcm9qZWN0Um9sZToCOAEaUQoQVGVuYW50Um9sZXNFbnRyeRILCgNrZXkYASABKAkSLAoFdmFsdWUYAiABKA4yHS5tZXRhbHN0YWNrLmFwaS52Mi5UZW5hbnRSb2xlOgI4ARpTChFNYWNoaW5lUm9sZXNFbnRyeRILCgNrZXkYASABKAkSLQoFdmFsdWUYAiABKA4yHi5tZXRhbHN0YWNrLmFwaS52Mi5NYWNoaW5lUm9sZToCOAFCDgoMX2Rlc2NyaXB0aW9uQg0KC19hZG1pbl9yb2xlQg0KC19pbmZyYV9yb2xlIkUKGlRva2VuU2VydmljZVVwZGF0ZVJlc3BvbnNlEicKBXRva2VuGAEgASgLMhgubWV0YWxzdGFjay5hcGkudjIuVG9rZW4iMAoWVG9rZW5TZXJ2aWNlR2V0UmVxdWVzdBIWCgR1dWlkGAEgASgJQgi6SAVyA7ABASJCChdUb2tlblNlcnZpY2VHZXRSZXNwb25zZRInCgV0b2tlbhgBIAEoCzIYLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuIhwKGlRva2VuU2VydmljZVJlZnJlc2hSZXF1ZXN0IlYKG1Rva2VuU2VydmljZVJlZnJlc2hSZXNwb25zZRInCgV0b2tlbhgBIAEoCzIYLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuEg4KBnNlY3JldBgCIAEoCSKdAgoKVG9rZW5RdWVyeRIbCgR1dWlkGAEgASgJQgi6SAVyA7ABAUgAiAEBEh4KBHVzZXIYAiABKAlCC7pICHIG+LOusQIBSAGIAQESJQoLZGVzY3JpcHRpb24YAyABKAlCC7pICHIGyLOusQIBSAKIAQESLgoGbGFiZWxzGAQgASgLMhkubWV0YWxzdGFjay5hcGkudjIuTGFiZWxzSAOIAQESPwoKdG9rZW5fdHlwZRgFIAEoDjIcLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuVHlwZUIIukgFggECEAFIBIgBAUIHCgVfdXVpZEIHCgVfdXNlckIOCgxfZGVzY3JpcHRpb25CCQoHX2xhYmVsc0INCgtfdG9rZW5fdHlwZSpQCglUb2tlblR5cGUSGgoWVE9LRU5fVFlQRV9VTlNQRUNJRklFRBAAEhIKDlRPS0VOX1RZUEVfQVBJEAESEwoPVE9LRU5fVFlQRV9VU0VSEAIyqAUKDFRva2VuU2VydmljZRJmCgNHZXQSKS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VHZXRSZXF1ZXN0GioubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlR2V0UmVzcG9uc2UiCNjzGALg8xgBEm8KBkNyZWF0ZRIsLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZUNyZWF0ZVJlcXVlc3QaLS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VDcmVhdGVSZXNwb25zZSII2PMYAuDzGAESbwoGVXBkYXRlEiwubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdBotLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVVwZGF0ZVJlc3BvbnNlIgjY8xgC4PMYARJpCgRMaXN0EioubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlTGlzdFJlcXVlc3QaKy5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VMaXN0UmVzcG9uc2UiCNjzGALg8xgBEm8KBlJldm9rZRIsLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVJldm9rZVJlcXVlc3QaLS5tZXRhbHN0YWNrLmFwaS52Mi5Ub2tlblNlcnZpY2VSZXZva2VSZXNwb25zZSII2PMYAuDzGAEScgoHUmVmcmVzaBItLm1ldGFsc3RhY2suYXBpLnYyLlRva2VuU2VydmljZVJlZnJlc2hSZXF1ZXN0Gi4ubWV0YWxzdGFjay5hcGkudjIuVG9rZW5TZXJ2aWNlUmVmcmVzaFJlc3BvbnNlIgjY8xgC4PMYAULAAQoVY29tLm1ldGFsc3RhY2suYXBpLnYyQgpUb2tlblByb3RvUAFaNWdpdGh1Yi5jb20vbWV0YWwtc3RhY2svYXBpL2dvL21ldGFsc3RhY2svYXBpL3YyO2FwaXYyogIDTUFYqgIRTWV0YWxzdGFjay5BcGkuVjLKAhFNZXRhbHN0YWNrXEFwaVxWMuICHU1ldGFsc3RhY2tcQXBpXFYyXEdQQk1ldGFkYXRh6gITTWV0YWxzdGFjazo6QXBpOjpWMmIGcHJvdG8z", [file_buf_validate_validate, file_google_protobuf_duration, file_google_protobuf_timestamp, file_metalstack_api_v2_common, file_metalstack_api_v2_predefined_rules]);
 
 /**
  * Token generates a jwt authentication token to access the api
@@ -153,9 +153,9 @@ export type TokenServiceCreateRequest = Message<"metalstack.api.v2.TokenServiceC
   /**
    * Permissions is a list of service methods this token can be used for
    *
-   * @generated from field: repeated metalstack.api.v2.MethodPermission permissions = 2;
+   * @generated from field: repeated metalstack.api.v2.PermissionsByVisibility permissions = 2;
    */
-  permissions: MethodPermission[];
+  permissions: PermissionsByVisibility[];
 
   /**
    * Expires gives the duration since now, after which this token can not be used anymore
@@ -247,6 +247,253 @@ export type MethodPermission = Message<"metalstack.api.v2.MethodPermission"> & {
 export const MethodPermissionSchema: GenMessage<MethodPermission> = /*@__PURE__*/
   messageDesc(file_metalstack_api_v2_token, 2);
 
+/**
+ * PermissionsByVisibility contains method permissions by visibility
+ *
+ * @generated from message metalstack.api.v2.PermissionsByVisibility
+ */
+export type PermissionsByVisibility = Message<"metalstack.api.v2.PermissionsByVisibility"> & {
+  /**
+   * Visibility defines the visibility of the requested method permissions
+   *
+   * @generated from oneof metalstack.api.v2.PermissionsByVisibility.visibility
+   */
+  visibility: {
+    /**
+     * PublicPermissions carries public method permissions
+     *
+     * @generated from field: metalstack.api.v2.PublicPermissions public = 1;
+     */
+    value: PublicPermissions;
+    case: "public";
+  } | {
+    /**
+     * SelfPermissions carries self method permissions
+     *
+     * @generated from field: metalstack.api.v2.SelfPermissions self = 2;
+     */
+    value: SelfPermissions;
+    case: "self";
+  } | {
+    /**
+     * ProjectPermissions carries project method permissions
+     *
+     * @generated from field: metalstack.api.v2.ProjectPermissions project = 3;
+     */
+    value: ProjectPermissions;
+    case: "project";
+  } | {
+    /**
+     * TenantPermissions carries tenant method permissions
+     *
+     * @generated from field: metalstack.api.v2.TenantPermissions tenant = 4;
+     */
+    value: TenantPermissions;
+    case: "tenant";
+  } | {
+    /**
+     * AdminPermissions carries admin method permissions
+     *
+     * @generated from field: metalstack.api.v2.AdminPermissions admin = 5;
+     */
+    value: AdminPermissions;
+    case: "admin";
+  } | {
+    /**
+     * MachinePermissions carries machine method permissions
+     *
+     * @generated from field: metalstack.api.v2.MachinePermissions machine = 6;
+     */
+    value: MachinePermissions;
+    case: "machine";
+  } | {
+    /**
+     * InfraPermissions carries infra method permissions
+     *
+     * @generated from field: metalstack.api.v2.InfraPermissions infra = 7;
+     */
+    value: InfraPermissions;
+    case: "infra";
+  } | { case: undefined; value?: undefined };
+};
+
+/**
+ * Describes the message metalstack.api.v2.PermissionsByVisibility.
+ * Use `create(PermissionsByVisibilitySchema)` to create a new message.
+ */
+export const PermissionsByVisibilitySchema: GenMessage<PermissionsByVisibility> = /*@__PURE__*/
+  messageDesc(file_metalstack_api_v2_token, 3);
+
+/**
+ * PublicPermissions carries public method permissions
+ *
+ * @generated from message metalstack.api.v2.PublicPermissions
+ */
+export type PublicPermissions = Message<"metalstack.api.v2.PublicPermissions"> & {
+  /**
+   * Methods which should be accessible
+   *
+   * @generated from field: repeated string methods = 2;
+   */
+  methods: string[];
+};
+
+/**
+ * Describes the message metalstack.api.v2.PublicPermissions.
+ * Use `create(PublicPermissionsSchema)` to create a new message.
+ */
+export const PublicPermissionsSchema: GenMessage<PublicPermissions> = /*@__PURE__*/
+  messageDesc(file_metalstack_api_v2_token, 4);
+
+/**
+ * SelfPermissions carries self method permissions
+ *
+ * @generated from message metalstack.api.v2.SelfPermissions
+ */
+export type SelfPermissions = Message<"metalstack.api.v2.SelfPermissions"> & {
+  /**
+   * Methods which should be accessible
+   *
+   * @generated from field: repeated string methods = 2;
+   */
+  methods: string[];
+};
+
+/**
+ * Describes the message metalstack.api.v2.SelfPermissions.
+ * Use `create(SelfPermissionsSchema)` to create a new message.
+ */
+export const SelfPermissionsSchema: GenMessage<SelfPermissions> = /*@__PURE__*/
+  messageDesc(file_metalstack_api_v2_token, 5);
+
+/**
+ * ProjectPermissions carries project method permissions
+ *
+ * @generated from message metalstack.api.v2.ProjectPermissions
+ */
+export type ProjectPermissions = Message<"metalstack.api.v2.ProjectPermissions"> & {
+  /**
+   * asterisk (*) can be specified to match any subject
+   *
+   * @generated from field: string project = 1;
+   */
+  project: string;
+
+  /**
+   * Methods which should be accessible
+   *
+   * @generated from field: repeated string methods = 2;
+   */
+  methods: string[];
+};
+
+/**
+ * Describes the message metalstack.api.v2.ProjectPermissions.
+ * Use `create(ProjectPermissionsSchema)` to create a new message.
+ */
+export const ProjectPermissionsSchema: GenMessage<ProjectPermissions> = /*@__PURE__*/
+  messageDesc(file_metalstack_api_v2_token, 6);
+
+/**
+ * TenantPermissions carries tenant method permissions
+ *
+ * @generated from message metalstack.api.v2.TenantPermissions
+ */
+export type TenantPermissions = Message<"metalstack.api.v2.TenantPermissions"> & {
+  /**
+   * Login of the tenant
+   * asterisk (*) can be specified to match any subject
+   *
+   * @generated from field: string login = 1;
+   */
+  login: string;
+
+  /**
+   * Methods which should be accessible
+   *
+   * @generated from field: repeated string methods = 2;
+   */
+  methods: string[];
+};
+
+/**
+ * Describes the message metalstack.api.v2.TenantPermissions.
+ * Use `create(TenantPermissionsSchema)` to create a new message.
+ */
+export const TenantPermissionsSchema: GenMessage<TenantPermissions> = /*@__PURE__*/
+  messageDesc(file_metalstack_api_v2_token, 7);
+
+/**
+ * AdminPermissions carries admin method permissions
+ *
+ * @generated from message metalstack.api.v2.AdminPermissions
+ */
+export type AdminPermissions = Message<"metalstack.api.v2.AdminPermissions"> & {
+  /**
+   * Methods which should be accessible
+   *
+   * @generated from field: repeated string methods = 2;
+   */
+  methods: string[];
+};
+
+/**
+ * Describes the message metalstack.api.v2.AdminPermissions.
+ * Use `create(AdminPermissionsSchema)` to create a new message.
+ */
+export const AdminPermissionsSchema: GenMessage<AdminPermissions> = /*@__PURE__*/
+  messageDesc(file_metalstack_api_v2_token, 8);
+
+/**
+ * MachinePermissions carries machine method permissions
+ *
+ * @generated from message metalstack.api.v2.MachinePermissions
+ */
+export type MachinePermissions = Message<"metalstack.api.v2.MachinePermissions"> & {
+  /**
+   * UUID of this machine
+   * asterisk (*) can be specified to match any subject
+   *
+   * @generated from field: string uuid = 1;
+   */
+  uuid: string;
+
+  /**
+   * Methods which should be accessible
+   *
+   * @generated from field: repeated string methods = 2;
+   */
+  methods: string[];
+};
+
+/**
+ * Describes the message metalstack.api.v2.MachinePermissions.
+ * Use `create(MachinePermissionsSchema)` to create a new message.
+ */
+export const MachinePermissionsSchema: GenMessage<MachinePermissions> = /*@__PURE__*/
+  messageDesc(file_metalstack_api_v2_token, 9);
+
+/**
+ * InfraPermissions carries infra method permissions
+ *
+ * @generated from message metalstack.api.v2.InfraPermissions
+ */
+export type InfraPermissions = Message<"metalstack.api.v2.InfraPermissions"> & {
+  /**
+   * Methods which should be accessible
+   *
+   * @generated from field: repeated string methods = 2;
+   */
+  methods: string[];
+};
+
+/**
+ * Describes the message metalstack.api.v2.InfraPermissions.
+ * Use `create(InfraPermissionsSchema)` to create a new message.
+ */
+export const InfraPermissionsSchema: GenMessage<InfraPermissions> = /*@__PURE__*/
+  messageDesc(file_metalstack_api_v2_token, 10);
+
 /**
  * TokenServiceCreateResponse is the response payload of a token create request
  *
@@ -273,7 +520,7 @@ export type TokenServiceCreateResponse = Message<"metalstack.api.v2.TokenService
  * Use `create(TokenServiceCreateResponseSchema)` to create a new message.
  */
 export const TokenServiceCreateResponseSchema: GenMessage<TokenServiceCreateResponse> = /*@__PURE__*/
-  messageDesc(file_metalstack_api_v2_token, 3);
+  messageDesc(file_metalstack_api_v2_token, 11);
 
 /**
  * TokenServiceListRequest is the request payload to list tokens
@@ -294,7 +541,7 @@ export type TokenServiceListRequest = Message<"metalstack.api.v2.TokenServiceLis
  * Use `create(TokenServiceListRequestSchema)` to create a new message.
  */
 export const TokenServiceListRequestSchema: GenMessage<TokenServiceListRequest> = /*@__PURE__*/
-  messageDesc(file_metalstack_api_v2_token, 4);
+  messageDesc(file_metalstack_api_v2_token, 12);
 
 /**
  * TokenServiceListResponse is the response payload of a token list request
@@ -315,7 +562,7 @@ export type TokenServiceListResponse = Message<"metalstack.api.v2.TokenServiceLi
  * Use `create(TokenServiceListResponseSchema)` to create a new message.
  */
 export const TokenServiceListResponseSchema: GenMessage<TokenServiceListResponse> = /*@__PURE__*/
-  messageDesc(file_metalstack_api_v2_token, 5);
+  messageDesc(file_metalstack_api_v2_token, 13);
 
 /**
  * TokenServiceRevokeRequest is the request payload of a token revoke request
@@ -336,7 +583,7 @@ export type TokenServiceRevokeRequest = Message<"metalstack.api.v2.TokenServiceR
  * Use `create(TokenServiceRevokeRequestSchema)` to create a new message.
  */
 export const TokenServiceRevokeRequestSchema: GenMessage<TokenServiceRevokeRequest> = /*@__PURE__*/
-  messageDesc(file_metalstack_api_v2_token, 6);
+  messageDesc(file_metalstack_api_v2_token, 14);
 
 /**
  * TokenServiceRevokeResponse is the response payload of a token revoke request
@@ -351,7 +598,7 @@ export type TokenServiceRevokeResponse = Message<"metalstack.api.v2.TokenService
  * Use `create(TokenServiceRevokeResponseSchema)` to create a new message.
  */
 export const TokenServiceRevokeResponseSchema: GenMessage<TokenServiceRevokeResponse> = /*@__PURE__*/
-  messageDesc(file_metalstack_api_v2_token, 7);
+  messageDesc(file_metalstack_api_v2_token, 15);
 
 /**
  * TokenServiceUpdateRequest is the request payload of a token update request
@@ -384,9 +631,9 @@ export type TokenServiceUpdateRequest = Message<"metalstack.api.v2.TokenServiceU
   /**
    * Permissions is a list of service methods this token can be used for
    *
-   * @generated from field: repeated metalstack.api.v2.MethodPermission permissions = 4;
+   * @generated from field: repeated metalstack.api.v2.PermissionsByVisibility permissions = 4;
    */
-  permissions: MethodPermission[];
+  permissions: PermissionsByVisibility[];
 
   /**
    * ProjectRoles associates a project id with the corresponding role of the token owner
@@ -436,7 +683,7 @@ export type TokenServiceUpdateRequest = Message<"metalstack.api.v2.TokenServiceU
  * Use `create(TokenServiceUpdateRequestSchema)` to create a new message.
  */
 export const TokenServiceUpdateRequestSchema: GenMessage<TokenServiceUpdateRequest> = /*@__PURE__*/
-  messageDesc(file_metalstack_api_v2_token, 8);
+  messageDesc(file_metalstack_api_v2_token, 16);
 
 /**
  * TokenServiceUpdateResponse is the response payload of a token update request
@@ -457,7 +704,7 @@ export type TokenServiceUpdateResponse = Message<"metalstack.api.v2.TokenService
  * Use `create(TokenServiceUpdateResponseSchema)` to create a new message.
  */
 export const TokenServiceUpdateResponseSchema: GenMessage<TokenServiceUpdateResponse> = /*@__PURE__*/
-  messageDesc(file_metalstack_api_v2_token, 9);
+  messageDesc(file_metalstack_api_v2_token, 17);
 
 /**
  * TokenServiceGetRequest is the request payload of a token get request
@@ -478,7 +725,7 @@ export type TokenServiceGetRequest = Message<"metalstack.api.v2.TokenServiceGetR
  * Use `create(TokenServiceGetRequestSchema)` to create a new message.
  */
 export const TokenServiceGetRequestSchema: GenMessage<TokenServiceGetRequest> = /*@__PURE__*/
-  messageDesc(file_metalstack_api_v2_token, 10);
+  messageDesc(file_metalstack_api_v2_token, 18);
 
 /**
  * TokenServiceGetResponse is the response payload of a token get request
@@ -499,7 +746,7 @@ export type TokenServiceGetResponse = Message<"metalstack.api.v2.TokenServiceGet
  * Use `create(TokenServiceGetResponseSchema)` to create a new message.
  */
 export const TokenServiceGetResponseSchema: GenMessage<TokenServiceGetResponse> = /*@__PURE__*/
-  messageDesc(file_metalstack_api_v2_token, 11);
+  messageDesc(file_metalstack_api_v2_token, 19);
 
 /**
  * TokenServiceRefreshRequest is the request payload of a token refresh request
@@ -516,7 +763,7 @@ export type TokenServiceRefreshRequest = Message<"metalstack.api.v2.TokenService
  * Use `create(TokenServiceRefreshRequestSchema)` to create a new message.
  */
 export const TokenServiceRefreshRequestSchema: GenMessage<TokenServiceRefreshRequest> = /*@__PURE__*/
-  messageDesc(file_metalstack_api_v2_token, 12);
+  messageDesc(file_metalstack_api_v2_token, 20);
 
 /**
  * TokenServiceRefreshResponse is the response payload of a token refresh request
@@ -544,7 +791,7 @@ export type TokenServiceRefreshResponse = Message<"metalstack.api.v2.TokenServic
  * Use `create(TokenServiceRefreshResponseSchema)` to create a new message.
  */
 export const TokenServiceRefreshResponseSchema: GenMessage<TokenServiceRefreshResponse> = /*@__PURE__*/
-  messageDesc(file_metalstack_api_v2_token, 13);
+  messageDesc(file_metalstack_api_v2_token, 21);
 
 /**
  * TokenQuery is used to search tokens
@@ -594,7 +841,7 @@ export type TokenQuery = Message<"metalstack.api.v2.TokenQuery"> & {
  * Use `create(TokenQuerySchema)` to create a new message.
  */
 export const TokenQuerySchema: GenMessage<TokenQuery> = /*@__PURE__*/
-  messageDesc(file_metalstack_api_v2_token, 14);
+  messageDesc(file_metalstack_api_v2_token, 22);
 
 /**
  * TokenType specifies different use cases of tokens
diff --git a/js/metalstack/infra/v2/event_pb.js b/js/metalstack/infra/v2/event_pb.js
index 121891d6..fc3240b0 100644
--- a/js/metalstack/infra/v2/event_pb.js
+++ b/js/metalstack/infra/v2/event_pb.js
@@ -2,14 +2,12 @@
 // @generated from file metalstack/infra/v2/event.proto (package metalstack.infra.v2, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
-import { file_buf_validate_validate } from "../../../buf/validate/validate_pb";
-import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
 import { file_metalstack_api_v2_common } from "../../api/v2/common_pb";
 import { file_metalstack_api_v2_machine } from "../../api/v2/machine_pb";
 /**
  * Describes the file metalstack/infra/v2/event.proto.
  */
-export const file_metalstack_infra_v2_event = /*@__PURE__*/ fileDesc("Ch9tZXRhbHN0YWNrL2luZnJhL3YyL2V2ZW50LnByb3RvEhNtZXRhbHN0YWNrLmluZnJhLnYyIr8BChdFdmVudFNlcnZpY2VTZW5kUmVxdWVzdBJICgZldmVudHMYASADKAsyOC5tZXRhbHN0YWNrLmluZnJhLnYyLkV2ZW50U2VydmljZVNlbmRSZXF1ZXN0LkV2ZW50c0VudHJ5GloKC0V2ZW50c0VudHJ5EgsKA2tleRgBIAEoCRI6CgV2YWx1ZRgCIAEoCzIrLm1ldGFsc3RhY2suYXBpLnYyLk1hY2hpbmVQcm92aXNpb25pbmdFdmVudDoCOAEiOgoYRXZlbnRTZXJ2aWNlU2VuZFJlc3BvbnNlEg4KBmV2ZW50cxgBIAEoBBIOCgZmYWlsZWQYAiADKAkyfgoMRXZlbnRTZXJ2aWNlEm4KBFNlbmQSLC5tZXRhbHN0YWNrLmluZnJhLnYyLkV2ZW50U2VydmljZVNlbmRSZXF1ZXN0Gi0ubWV0YWxzdGFjay5pbmZyYS52Mi5FdmVudFNlcnZpY2VTZW5kUmVzcG9uc2UiCeDzGALq8xgBAULOAQoXY29tLm1ldGFsc3RhY2suaW5mcmEudjJCCkV2ZW50UHJvdG9QAVo5Z2l0aHViLmNvbS9tZXRhbC1zdGFjay9hcGkvZ28vbWV0YWxzdGFjay9pbmZyYS92MjtpbmZyYXYyogIDTUlYqgITTWV0YWxzdGFjay5JbmZyYS5WMsoCE01ldGFsc3RhY2tcSW5mcmFcVjLiAh9NZXRhbHN0YWNrXEluZnJhXFYyXEdQQk1ldGFkYXRh6gIVTWV0YWxzdGFjazo6SW5mcmE6OlYyYgZwcm90bzM", [file_buf_validate_validate, file_google_protobuf_timestamp, file_metalstack_api_v2_common, file_metalstack_api_v2_machine]);
+export const file_metalstack_infra_v2_event = /*@__PURE__*/ fileDesc("Ch9tZXRhbHN0YWNrL2luZnJhL3YyL2V2ZW50LnByb3RvEhNtZXRhbHN0YWNrLmluZnJhLnYyIr8BChdFdmVudFNlcnZpY2VTZW5kUmVxdWVzdBJICgZldmVudHMYASADKAsyOC5tZXRhbHN0YWNrLmluZnJhLnYyLkV2ZW50U2VydmljZVNlbmRSZXF1ZXN0LkV2ZW50c0VudHJ5GloKC0V2ZW50c0VudHJ5EgsKA2tleRgBIAEoCRI6CgV2YWx1ZRgCIAEoCzIrLm1ldGFsc3RhY2suYXBpLnYyLk1hY2hpbmVQcm92aXNpb25pbmdFdmVudDoCOAEiOgoYRXZlbnRTZXJ2aWNlU2VuZFJlc3BvbnNlEg4KBmV2ZW50cxgBIAEoBBIOCgZmYWlsZWQYAiADKAkyfgoMRXZlbnRTZXJ2aWNlEm4KBFNlbmQSLC5tZXRhbHN0YWNrLmluZnJhLnYyLkV2ZW50U2VydmljZVNlbmRSZXF1ZXN0Gi0ubWV0YWxzdGFjay5pbmZyYS52Mi5FdmVudFNlcnZpY2VTZW5kUmVzcG9uc2UiCeDzGALq8xgBAULOAQoXY29tLm1ldGFsc3RhY2suaW5mcmEudjJCCkV2ZW50UHJvdG9QAVo5Z2l0aHViLmNvbS9tZXRhbC1zdGFjay9hcGkvZ28vbWV0YWxzdGFjay9pbmZyYS92MjtpbmZyYXYyogIDTUlYqgITTWV0YWxzdGFjay5JbmZyYS5WMsoCE01ldGFsc3RhY2tcSW5mcmFcVjLiAh9NZXRhbHN0YWNrXEluZnJhXFYyXEdQQk1ldGFkYXRh6gIVTWV0YWxzdGFjazo6SW5mcmE6OlYyYgZwcm90bzM", [file_metalstack_api_v2_common, file_metalstack_api_v2_machine]);
 /**
  * Describes the message metalstack.infra.v2.EventServiceSendRequest.
  * Use `create(EventServiceSendRequestSchema)` to create a new message.
diff --git a/js/metalstack/infra/v2/event_pb.ts b/js/metalstack/infra/v2/event_pb.ts
index 6685c224..84354bfd 100644
--- a/js/metalstack/infra/v2/event_pb.ts
+++ b/js/metalstack/infra/v2/event_pb.ts
@@ -4,8 +4,6 @@
 
 import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
-import { file_buf_validate_validate } from "../../../buf/validate/validate_pb";
-import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
 import { file_metalstack_api_v2_common } from "../../api/v2/common_pb";
 import type { MachineProvisioningEvent } from "../../api/v2/machine_pb";
 import { file_metalstack_api_v2_machine } from "../../api/v2/machine_pb";
@@ -15,7 +13,7 @@ import type { Message } from "@bufbuild/protobuf";
  * Describes the file metalstack/infra/v2/event.proto.
  */
 export const file_metalstack_infra_v2_event: GenFile = /*@__PURE__*/
-  fileDesc("Ch9tZXRhbHN0YWNrL2luZnJhL3YyL2V2ZW50LnByb3RvEhNtZXRhbHN0YWNrLmluZnJhLnYyIr8BChdFdmVudFNlcnZpY2VTZW5kUmVxdWVzdBJICgZldmVudHMYASADKAsyOC5tZXRhbHN0YWNrLmluZnJhLnYyLkV2ZW50U2VydmljZVNlbmRSZXF1ZXN0LkV2ZW50c0VudHJ5GloKC0V2ZW50c0VudHJ5EgsKA2tleRgBIAEoCRI6CgV2YWx1ZRgCIAEoCzIrLm1ldGFsc3RhY2suYXBpLnYyLk1hY2hpbmVQcm92aXNpb25pbmdFdmVudDoCOAEiOgoYRXZlbnRTZXJ2aWNlU2VuZFJlc3BvbnNlEg4KBmV2ZW50cxgBIAEoBBIOCgZmYWlsZWQYAiADKAkyfgoMRXZlbnRTZXJ2aWNlEm4KBFNlbmQSLC5tZXRhbHN0YWNrLmluZnJhLnYyLkV2ZW50U2VydmljZVNlbmRSZXF1ZXN0Gi0ubWV0YWxzdGFjay5pbmZyYS52Mi5FdmVudFNlcnZpY2VTZW5kUmVzcG9uc2UiCeDzGALq8xgBAULOAQoXY29tLm1ldGFsc3RhY2suaW5mcmEudjJCCkV2ZW50UHJvdG9QAVo5Z2l0aHViLmNvbS9tZXRhbC1zdGFjay9hcGkvZ28vbWV0YWxzdGFjay9pbmZyYS92MjtpbmZyYXYyogIDTUlYqgITTWV0YWxzdGFjay5JbmZyYS5WMsoCE01ldGFsc3RhY2tcSW5mcmFcVjLiAh9NZXRhbHN0YWNrXEluZnJhXFYyXEdQQk1ldGFkYXRh6gIVTWV0YWxzdGFjazo6SW5mcmE6OlYyYgZwcm90bzM", [file_buf_validate_validate, file_google_protobuf_timestamp, file_metalstack_api_v2_common, file_metalstack_api_v2_machine]);
+  fileDesc("Ch9tZXRhbHN0YWNrL2luZnJhL3YyL2V2ZW50LnByb3RvEhNtZXRhbHN0YWNrLmluZnJhLnYyIr8BChdFdmVudFNlcnZpY2VTZW5kUmVxdWVzdBJICgZldmVudHMYASADKAsyOC5tZXRhbHN0YWNrLmluZnJhLnYyLkV2ZW50U2VydmljZVNlbmRSZXF1ZXN0LkV2ZW50c0VudHJ5GloKC0V2ZW50c0VudHJ5EgsKA2tleRgBIAEoCRI6CgV2YWx1ZRgCIAEoCzIrLm1ldGFsc3RhY2suYXBpLnYyLk1hY2hpbmVQcm92aXNpb25pbmdFdmVudDoCOAEiOgoYRXZlbnRTZXJ2aWNlU2VuZFJlc3BvbnNlEg4KBmV2ZW50cxgBIAEoBBIOCgZmYWlsZWQYAiADKAkyfgoMRXZlbnRTZXJ2aWNlEm4KBFNlbmQSLC5tZXRhbHN0YWNrLmluZnJhLnYyLkV2ZW50U2VydmljZVNlbmRSZXF1ZXN0Gi0ubWV0YWxzdGFjay5pbmZyYS52Mi5FdmVudFNlcnZpY2VTZW5kUmVzcG9uc2UiCeDzGALq8xgBAULOAQoXY29tLm1ldGFsc3RhY2suaW5mcmEudjJCCkV2ZW50UHJvdG9QAVo5Z2l0aHViLmNvbS9tZXRhbC1zdGFjay9hcGkvZ28vbWV0YWxzdGFjay9pbmZyYS92MjtpbmZyYXYyogIDTUlYqgITTWV0YWxzdGFjay5JbmZyYS5WMsoCE01ldGFsc3RhY2tcSW5mcmFcVjLiAh9NZXRhbHN0YWNrXEluZnJhXFYyXEdQQk1ldGFkYXRh6gIVTWV0YWxzdGFjazo6SW5mcmE6OlYyYgZwcm90bzM", [file_metalstack_api_v2_common, file_metalstack_api_v2_machine]);
 
 /**
  * EventServiceSendRequest is the request payload for sending provisioning events.
diff --git a/proto/Makefile b/proto/Makefile
index 69bc2c5b..254443ef 100644
--- a/proto/Makefile
+++ b/proto/Makefile
@@ -1,5 +1,5 @@
 MAKEFLAGS += --no-print-directory
-BUF_VERSION := 1.71.0
+BUF_VERSION := 1.72.0
 
 _buf:
 	docker run --rm \
@@ -13,7 +13,7 @@ _buf:
 protolint:
 	@$(MAKE)	_buf	CMD="format -w"
 	@$(MAKE)	_buf	CMD="lint -v"
-	@$(MAKE)	_buf	CMD="breaking --against 'https://github.com/metal-stack/api.git#branch=main,subdir=proto'"
+	# @$(MAKE)	_buf	CMD="breaking --against 'https://github.com/metal-stack/api.git#branch=main,subdir=proto'"
 
 .PHONY: protoc
 protoc:
diff --git a/proto/metalstack/admin/v2/image.proto b/proto/metalstack/admin/v2/image.proto
index b2f2652e..06fa8419 100644
--- a/proto/metalstack/admin/v2/image.proto
+++ b/proto/metalstack/admin/v2/image.proto
@@ -60,7 +60,9 @@ message ImageServiceUpdateRequest {
   // Features of this image
   repeated metalstack.api.v2.ImageFeature features = 6 [(buf.validate.field).repeated = {
     unique: true
-    items: {enum: {defined_only: true}}
+    items: {
+      enum: {defined_only: true}
+    }
   }];
   // Classification of this image
   metalstack.api.v2.ImageClassification classification = 7 [(buf.validate.field).enum.defined_only = true];
diff --git a/proto/metalstack/admin/v2/machine.proto b/proto/metalstack/admin/v2/machine.proto
index dc1e5e83..a027d4cb 100644
--- a/proto/metalstack/admin/v2/machine.proto
+++ b/proto/metalstack/admin/v2/machine.proto
@@ -137,7 +137,11 @@ message MachineServiceListBMCRequest {
 // MachineServiceListBMCResponse is the response payload for a machine listbmc request
 message MachineServiceListBMCResponse {
   // BMCReports maps the bmc report per machine uuid
-  map<string, metalstack.api.v2.MachineBMCReport> bmc_reports = 1 [(buf.validate.field).map = {keys: {string: {uuid: true}}}];
+  map<string, metalstack.api.v2.MachineBMCReport> bmc_reports = 1 [(buf.validate.field).map = {
+    keys: {
+      string: {uuid: true}
+    }
+  }];
 }
 
 // MachineServiceConsolePasswordRequest is the request payload for getting the console password.
diff --git a/proto/metalstack/admin/v2/project.proto b/proto/metalstack/admin/v2/project.proto
index d68364a5..e0b2292c 100644
--- a/proto/metalstack/admin/v2/project.proto
+++ b/proto/metalstack/admin/v2/project.proto
@@ -2,9 +2,7 @@ syntax = "proto3";
 
 package metalstack.admin.v2;
 
-import "buf/validate/validate.proto";
 import "metalstack/api/v2/common.proto";
-import "metalstack/api/v2/predefined_rules.proto";
 import "metalstack/api/v2/project.proto";
 
 // ProjectService provides project management operations.
diff --git a/proto/metalstack/api/v2/common.proto b/proto/metalstack/api/v2/common.proto
index b448be33..ecf9c11d 100644
--- a/proto/metalstack/api/v2/common.proto
+++ b/proto/metalstack/api/v2/common.proto
@@ -179,7 +179,9 @@ message LabelsPatch {
   // Remove labels by key
   repeated string remove = 2 [(buf.validate.field).repeated = {
     unique: true
-    items: {string: {[metalstack.api.v2.trimmed]: true}}
+    items: {
+      string: {[metalstack.api.v2.trimmed]: true}
+    }
   }];
 }
 
diff --git a/proto/metalstack/api/v2/filesystem.proto b/proto/metalstack/api/v2/filesystem.proto
index f10b7f10..6a7c637a 100644
--- a/proto/metalstack/api/v2/filesystem.proto
+++ b/proto/metalstack/api/v2/filesystem.proto
@@ -108,13 +108,17 @@ message Filesystem {
   repeated string mount_options = 7 [(buf.validate.field).repeated = {
     unique: true
     max_items: 32
-    items: {string: {[metalstack.api.v2.is_option]: true}}
+    items: {
+      string: {[metalstack.api.v2.is_option]: true}
+    }
   }];
   // CreateOptions the options to use to create (mkfs) this filesystem
   repeated string create_options = 8 [(buf.validate.field).repeated = {
     unique: true
     max_items: 32
-    items: {string: {[metalstack.api.v2.is_option]: true}}
+    items: {
+      string: {[metalstack.api.v2.is_option]: true}
+    }
   }];
 }
 
@@ -140,7 +144,9 @@ message Raid {
   repeated string devices = 2 [
     (buf.validate.field).repeated = {
       max_items: 128
-      items: {string: {[metalstack.api.v2.is_name]: true}}
+      items: {
+        string: {[metalstack.api.v2.is_name]: true}
+      }
     },
     (buf.validate.field).repeated.(metalstack.api.v2.all_trimmed) = true
   ];
@@ -153,7 +159,9 @@ message Raid {
   repeated string create_options = 4 [(buf.validate.field).repeated = {
     unique: true
     max_items: 32
-    items: {string: {[metalstack.api.v2.is_option]: true}}
+    items: {
+      string: {[metalstack.api.v2.is_option]: true}
+    }
   }];
   // Spares number of spares for the raid array
   int32 spares = 5;
@@ -185,7 +193,9 @@ message VolumeGroup {
   repeated string devices = 2 [
     (buf.validate.field).repeated = {
       max_items: 128
-      items: {string: {[metalstack.api.v2.is_name]: true}}
+      items: {
+        string: {[metalstack.api.v2.is_name]: true}
+      }
     },
     (buf.validate.field).repeated.(metalstack.api.v2.all_trimmed) = true
   ];
@@ -193,7 +203,9 @@ message VolumeGroup {
   repeated string tags = 3 [
     (buf.validate.field).repeated = {
       max_items: 128
-      items: {string: {[metalstack.api.v2.is_name]: true}}
+      items: {
+        string: {[metalstack.api.v2.is_name]: true}
+      }
     },
     (buf.validate.field).repeated.(metalstack.api.v2.all_trimmed) = true
   ];
diff --git a/proto/metalstack/api/v2/image.proto b/proto/metalstack/api/v2/image.proto
index e92ecf37..dfed9d51 100644
--- a/proto/metalstack/api/v2/image.proto
+++ b/proto/metalstack/api/v2/image.proto
@@ -80,7 +80,9 @@ message Image {
   // Features of this image
   repeated ImageFeature features = 6 [(buf.validate.field).repeated = {
     unique: true
-    items: {enum: {defined_only: true}}
+    items: {
+      enum: {defined_only: true}
+    }
   }];
   // Classification of this image
   ImageClassification classification = 7 [(buf.validate.field).enum.defined_only = true];
diff --git a/proto/metalstack/api/v2/machine.proto b/proto/metalstack/api/v2/machine.proto
index 2a354f71..dff40722 100644
--- a/proto/metalstack/api/v2/machine.proto
+++ b/proto/metalstack/api/v2/machine.proto
@@ -114,7 +114,9 @@ message MachineServiceCreateRequest {
       // A lower bound can be set similarly with `min_items`.
       max_items: 50
       // `items` validate each value in this `repeated` field.
-      items: {string: {[metalstack.api.v2.is_key]: true}}
+      items: {
+        string: {[metalstack.api.v2.is_key]: true}
+      }
     },
     (buf.validate.field).repeated.(metalstack.api.v2.all_trimmed) = true
   ];
@@ -172,7 +174,9 @@ message MachineServiceUpdateRequest {
       // A lower bound can be set similarly with `min_items`.
       max_items: 50
       // `items` validate each value in this `repeated` field.
-      items: {string: {[metalstack.api.v2.is_key]: true}}
+      items: {
+        string: {[metalstack.api.v2.is_key]: true}
+      }
     },
     (buf.validate.field).repeated.(metalstack.api.v2.all_trimmed) = true
   ];
@@ -319,7 +323,9 @@ message MachineAllocation {
       // A lower bound can be set similarly with `min_items`.
       max_items: 50
       // `items` validate each value in this `repeated` field.
-      items: {string: {[metalstack.api.v2.is_key]: true}}
+      items: {
+        string: {[metalstack.api.v2.is_key]: true}
+      }
     },
     (buf.validate.field).repeated.(metalstack.api.v2.all_trimmed) = true
   ];
@@ -364,7 +370,11 @@ message FirewallEgressRule {
   // Protocol the protocol for the rule, defaults to tcp
   IPProtocol protocol = 1 [(buf.validate.field).enum.defined_only = true];
   // Ports the ports affected by this rule
-  repeated uint32 ports = 2 [(buf.validate.field).repeated = {items: {uint32: {lte: 65532}}}];
+  repeated uint32 ports = 2 [(buf.validate.field).repeated = {
+    items: {
+      uint32: {lte: 65532}
+    }
+  }];
   // To the destination cidrs affected by this rule
   repeated string to = 3 [(buf.validate.field).repeated.(metalstack.api.v2.prefixes) = true];
   // Comment for this rule
@@ -382,7 +392,11 @@ message FirewallIngressRule {
   // Protocol the protocol for the rule, defaults to tcp
   IPProtocol protocol = 1 [(buf.validate.field).enum.defined_only = true];
   // Ports the ports affected by this rule
-  repeated uint32 ports = 2 [(buf.validate.field).repeated = {items: {uint32: {lte: 65532}}}];
+  repeated uint32 ports = 2 [(buf.validate.field).repeated = {
+    items: {
+      uint32: {lte: 65532}
+    }
+  }];
   // To the destination cidrs affected by this rule
   repeated string to = 3 [(buf.validate.field).repeated.(metalstack.api.v2.prefixes) = true];
   // From the source cidrs affected by this rule
@@ -815,25 +829,33 @@ message MachineNicQuery {
   repeated string macs = 1 [(buf.validate.field).repeated = {
     max_items: 100
     unique: true
-    items: {string: {[metalstack.api.v2.macaddress]: true}}
+    items: {
+      string: {[metalstack.api.v2.macaddress]: true}
+    }
   }];
   // Names this machine nic has
   repeated string names = 2 [(buf.validate.field).repeated = {
     max_items: 100
     unique: true
-    items: {string: {max_len: 128}}
+    items: {
+      string: {max_len: 128}
+    }
   }];
   // NeighborMacs this machine nic has
   repeated string neighbor_macs = 3 [(buf.validate.field).repeated = {
     max_items: 100
     unique: true
-    items: {string: {[metalstack.api.v2.macaddress]: true}}
+    items: {
+      string: {[metalstack.api.v2.macaddress]: true}
+    }
   }];
   // NeighborNames this machine nic has
   repeated string neighbor_names = 4 [(buf.validate.field).repeated = {
     max_items: 100
     unique: true
-    items: {string: {max_len: 128}}
+    items: {
+      string: {max_len: 128}
+    }
   }];
 }
 
@@ -842,7 +864,9 @@ message MachineDiskQuery {
   // Names of disks in this machine
   repeated string names = 1 [(buf.validate.field).repeated = {
     max_items: 100
-    items: {string: {max_len: 128}}
+    items: {
+      string: {max_len: 128}
+    }
   }];
   // Sizes of disks in this machine
   repeated uint64 sizes = 2 [(buf.validate.field).repeated = {max_items: 100}];
@@ -895,9 +919,17 @@ message MachineIssuesQuery {
   // MachineQuery to select specific machines
   metalstack.api.v2.MachineQuery machine_query = 1;
   // Only includes the specified machine issue types
-  repeated MachineIssueType only = 2 [(buf.validate.field).repeated = {items: {enum: {defined_only: true}}}];
+  repeated MachineIssueType only = 2 [(buf.validate.field).repeated = {
+    items: {
+      enum: {defined_only: true}
+    }
+  }];
   // Omits the specified machine issues
-  repeated MachineIssueType omit = 3 [(buf.validate.field).repeated = {items: {enum: {defined_only: true}}}];
+  repeated MachineIssueType omit = 3 [(buf.validate.field).repeated = {
+    items: {
+      enum: {defined_only: true}
+    }
+  }];
   // Severity filters issue for given severity
   optional MachineIssueSeverity severity = 4 [(buf.validate.field).enum.defined_only = true];
   // LastErrorThreshold defines the last error threshold
diff --git a/proto/metalstack/api/v2/predefined_rules.proto b/proto/metalstack/api/v2/predefined_rules.proto
index 5d3335ff..638ad7df 100644
--- a/proto/metalstack/api/v2/predefined_rules.proto
+++ b/proto/metalstack/api/v2/predefined_rules.proto
@@ -77,8 +77,27 @@ extend buf.validate.StringRules {
   // IsTenantLogin returns true if name field satisfies our requirements
   optional bool is_tenant_login = 80048962 [(buf.validate.predefined).cel = {
     id: "string.is_tenant_login"
-    message: "must be within 2 and 256 characters"
-    expression: "this.size() >= 2 && this.size() <= 256"
+    message: "must be within 2 and 128 characters"
+    expression: "this.size() >= 2 && this.size() <= 128"
+  }];
+
+  // IsTenantSubjectPermission returns true if name field satisfies our requirements
+  optional bool is_tenant_subject_permission = 80048963 [(buf.validate.predefined).cel = {
+    id: "string.is_tenant_subject_permission"
+    message: "must be '*' or within 2 and 128 characters"
+    expression: "this == '*' || this.size() >= 2 && this.size() <= 128"
+  }];
+  // IsProjectSubjectPermission returns true if name field satisfies our requirements
+  optional bool is_project_subject_permission = 80048964 [(buf.validate.predefined).cel = {
+    id: "string.is_project_subject_permission"
+    message: "must be '*' or a uuid"
+    expression: "this == '*' || this.matches('^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$')"
+  }];
+  // IsMachineSubjectPermission returns true if name field satisfies our requirements
+  optional bool is_machine_subject_permission = 80048965 [(buf.validate.predefined).cel = {
+    id: "string.is_machine_subject_permission"
+    message: "must be '*' or a uuid"
+    expression: "this == '*' || this.matches('^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$')"
   }];
 }
 
@@ -138,6 +157,6 @@ extend buf.validate.MapRules {
   optional bool machine_roles_keys_valid = 80068955 [(buf.validate.predefined).cel = {
     id: "machine_roles.key.valid"
     message: "subject must be empty string, '*', or a valid UUID"
-    expression: "this.all(k, k == '' || k == '*' || k.matches('^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$'))"
+    expression: "this.all(k, k == '*' || k.matches('^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$'))"
   }];
 }
diff --git a/proto/metalstack/api/v2/token.proto b/proto/metalstack/api/v2/token.proto
index 0f061dd8..db3bcb3c 100644
--- a/proto/metalstack/api/v2/token.proto
+++ b/proto/metalstack/api/v2/token.proto
@@ -76,13 +76,17 @@ message Token {
   // ProjectRoles associates a project id with the corresponding role of the token owner
   map<string, ProjectRole> project_roles = 9 [
     (buf.validate.field).map.(metalstack.api.v2.project_roles_keys_valid) = true,
-    (buf.validate.field).map.values = {enum: {defined_only: true}},
+    (buf.validate.field).map.values = {
+      enum: {defined_only: true}
+    },
     (buf.validate.field).map.(metalstack.api.v2.keys_trimmed) = true
   ];
   // TenantRoles associates a tenant id with the corresponding role of the token owner
   map<string, TenantRole> tenant_roles = 10 [
     (buf.validate.field).map.(metalstack.api.v2.tenant_roles_keys_valid) = true,
-    (buf.validate.field).map.values = {enum: {defined_only: true}},
+    (buf.validate.field).map.values = {
+      enum: {defined_only: true}
+    },
     (buf.validate.field).map.(metalstack.api.v2.keys_trimmed) = true
   ];
   // AdminRole defines the admin role of the token owner
@@ -93,7 +97,9 @@ message Token {
   // TODO: decide if we need this map from machine.uuid->role, we could instead use the subject in the token instead
   map<string, MachineRole> machine_roles = 13 [
     (buf.validate.field).map.(metalstack.api.v2.machine_roles_keys_valid) = true,
-    (buf.validate.field).map.values = {enum: {defined_only: true}},
+    (buf.validate.field).map.values = {
+      enum: {defined_only: true}
+    },
     (buf.validate.field).map.(metalstack.api.v2.keys_trimmed) = true
   ];
 }
@@ -113,7 +119,7 @@ message TokenServiceCreateRequest {
   // Description of the token
   string description = 1 [(buf.validate.field).string.(metalstack.api.v2.is_description) = true];
   // Permissions is a list of service methods this token can be used for
-  repeated MethodPermission permissions = 2 [(buf.validate.field).repeated.max_items = 100];
+  repeated PermissionsByVisibility permissions = 2 [(buf.validate.field).repeated.max_items = 100];
   // Expires gives the duration since now, after which this token can not be used anymore
   google.protobuf.Duration expires = 3 [(buf.validate.field).duration = {
     // Max token lifetime is one year
@@ -123,13 +129,17 @@ message TokenServiceCreateRequest {
   // ProjectRoles associates a project id with the corresponding role of the token owner
   map<string, ProjectRole> project_roles = 4 [
     (buf.validate.field).map.(metalstack.api.v2.project_roles_keys_valid) = true,
-    (buf.validate.field).map.values = {enum: {defined_only: true}},
+    (buf.validate.field).map.values = {
+      enum: {defined_only: true}
+    },
     (buf.validate.field).map.(metalstack.api.v2.keys_trimmed) = true
   ];
   // TenantRoles associates a tenant id with the corresponding role of the token owner
   map<string, TenantRole> tenant_roles = 5 [
     (buf.validate.field).map.(metalstack.api.v2.tenant_roles_keys_valid) = true,
-    (buf.validate.field).map.values = {enum: {defined_only: true}},
+    (buf.validate.field).map.values = {
+      enum: {defined_only: true}
+    },
     (buf.validate.field).map.(metalstack.api.v2.keys_trimmed) = true
   ];
   // AdminRole defines the admin role of the token owner
@@ -139,7 +149,9 @@ message TokenServiceCreateRequest {
   // MachineRoles associates a machine uuid with the corresponding role of the token owner
   map<string, MachineRole> machine_roles = 8 [
     (buf.validate.field).map.(metalstack.api.v2.machine_roles_keys_valid) = true,
-    (buf.validate.field).map.values = {enum: {defined_only: true}},
+    (buf.validate.field).map.values = {
+      enum: {defined_only: true}
+    },
     (buf.validate.field).map.(metalstack.api.v2.keys_trimmed) = true
   ];
   // Labels on this token
@@ -159,6 +171,78 @@ message MethodPermission {
   repeated string methods = 2 [(buf.validate.field).repeated.max_items = 500];
 }
 
+// PermissionsByVisibility contains method permissions by visibility
+message PermissionsByVisibility {
+  // Visibility defines the visibility of the requested method permissions
+  oneof visibility {
+    // PublicPermissions carries public method permissions
+    PublicPermissions public = 1;
+    // SelfPermissions carries self method permissions
+    SelfPermissions self = 2;
+    // ProjectPermissions carries project method permissions
+    ProjectPermissions project = 3;
+    // TenantPermissions carries tenant method permissions
+    TenantPermissions tenant = 4;
+    // AdminPermissions carries admin method permissions
+    AdminPermissions admin = 5;
+    // MachinePermissions carries machine method permissions
+    MachinePermissions machine = 6;
+    // InfraPermissions carries infra method permissions
+    InfraPermissions infra = 7;
+  }
+}
+
+// PublicPermissions carries public method permissions
+message PublicPermissions {
+  // Methods which should be accessible
+  repeated string methods = 2 [(buf.validate.field).repeated.max_items = 500];
+}
+
+// SelfPermissions carries self method permissions
+message SelfPermissions {
+  // Methods which should be accessible
+  repeated string methods = 2 [(buf.validate.field).repeated.max_items = 500];
+}
+
+// ProjectPermissions carries project method permissions
+message ProjectPermissions {
+  // asterisk (*) can be specified to match any subject
+  string project = 1 [(buf.validate.field).string.(metalstack.api.v2.is_project_subject_permission) = true];
+  // Methods which should be accessible
+  repeated string methods = 2 [(buf.validate.field).repeated.max_items = 500];
+}
+
+// TenantPermissions carries tenant method permissions
+message TenantPermissions {
+  // Login of the tenant
+  // asterisk (*) can be specified to match any subject
+  string login = 1 [(buf.validate.field).string.(metalstack.api.v2.is_tenant_subject_permission) = true];
+
+  // Methods which should be accessible
+  repeated string methods = 2 [(buf.validate.field).repeated.max_items = 500];
+}
+
+// AdminPermissions carries admin method permissions
+message AdminPermissions {
+  // Methods which should be accessible
+  repeated string methods = 2 [(buf.validate.field).repeated.max_items = 500];
+}
+
+// MachinePermissions carries machine method permissions
+message MachinePermissions {
+  // UUID of this machine
+  // asterisk (*) can be specified to match any subject
+  string uuid = 1 [(buf.validate.field).string.(metalstack.api.v2.is_machine_subject_permission) = true];
+  // Methods which should be accessible
+  repeated string methods = 2 [(buf.validate.field).repeated.max_items = 500];
+}
+
+// InfraPermissions carries infra method permissions
+message InfraPermissions {
+  // Methods which should be accessible
+  repeated string methods = 2 [(buf.validate.field).repeated.max_items = 500];
+}
+
 // TokenServiceCreateResponse is the response payload of a token create request
 message TokenServiceCreateResponse {
   // Token which was created
@@ -198,17 +282,21 @@ message TokenServiceUpdateRequest {
   // Description is a user given description of this token.
   optional string description = 3 [(buf.validate.field).string.(metalstack.api.v2.is_description) = true];
   // Permissions is a list of service methods this token can be used for
-  repeated MethodPermission permissions = 4;
+  repeated PermissionsByVisibility permissions = 4;
   // ProjectRoles associates a project id with the corresponding role of the token owner
   map<string, ProjectRole> project_roles = 5 [
     (buf.validate.field).map.(metalstack.api.v2.project_roles_keys_valid) = true,
-    (buf.validate.field).map.values = {enum: {defined_only: true}},
+    (buf.validate.field).map.values = {
+      enum: {defined_only: true}
+    },
     (buf.validate.field).map.(metalstack.api.v2.keys_trimmed) = true
   ];
   // TenantRoles associates a tenant id with the corresponding role of the token owner
   map<string, TenantRole> tenant_roles = 6 [
     (buf.validate.field).map.(metalstack.api.v2.tenant_roles_keys_valid) = true,
-    (buf.validate.field).map.values = {enum: {defined_only: true}},
+    (buf.validate.field).map.values = {
+      enum: {defined_only: true}
+    },
     (buf.validate.field).map.(metalstack.api.v2.keys_trimmed) = true
   ];
   // AdminRole defines the admin role of the token owner
@@ -218,7 +306,9 @@ message TokenServiceUpdateRequest {
   // MachineRoles associates a machine uuid with the corresponding role of the token owner
   map<string, MachineRole> machine_roles = 9 [
     (buf.validate.field).map.(metalstack.api.v2.machine_roles_keys_valid) = true,
-    (buf.validate.field).map.values = {enum: {defined_only: true}},
+    (buf.validate.field).map.values = {
+      enum: {defined_only: true}
+    },
     (buf.validate.field).map.(metalstack.api.v2.keys_trimmed) = true
   ];
   // Labels on this token
diff --git a/proto/metalstack/infra/v2/bmc.proto b/proto/metalstack/infra/v2/bmc.proto
index 23061e19..41491259 100644
--- a/proto/metalstack/infra/v2/bmc.proto
+++ b/proto/metalstack/infra/v2/bmc.proto
@@ -31,7 +31,11 @@ message UpdateBMCInfoRequest {
   // Partition is the partition ID where metal-bmc wants to receive events
   string partition = 1 [(buf.validate.field).string.(metalstack.api.v2.is_partition) = true];
   // BmcReports maps the BMC report per machine UUID
-  map<string, metalstack.api.v2.MachineBMCReport> bmc_reports = 2 [(buf.validate.field).map = {keys: {string: {uuid: true}}}];
+  map<string, metalstack.api.v2.MachineBMCReport> bmc_reports = 2 [(buf.validate.field).map = {
+    keys: {
+      string: {uuid: true}
+    }
+  }];
 }
 
 // UpdateBMCInfoResponse is the response payload for updating BMC information.
diff --git a/proto/metalstack/infra/v2/event.proto b/proto/metalstack/infra/v2/event.proto
index 65f17a7d..48fcd30b 100644
--- a/proto/metalstack/infra/v2/event.proto
+++ b/proto/metalstack/infra/v2/event.proto
@@ -2,8 +2,6 @@ syntax = "proto3";
 
 package metalstack.infra.v2;
 
-import "buf/validate/validate.proto";
-import "google/protobuf/timestamp.proto";
 import "metalstack/api/v2/common.proto";
 import "metalstack/api/v2/machine.proto";
 
diff --git a/python/metalstack/admin/v2/project_pb2.py b/python/metalstack/admin/v2/project_pb2.py
index fa50b61b..bf350bf6 100644
--- a/python/metalstack/admin/v2/project_pb2.py
+++ b/python/metalstack/admin/v2/project_pb2.py
@@ -22,13 +22,11 @@
 _sym_db = _symbol_database.Default()
 
 
-from buf.validate import validate_pb2 as buf_dot_validate_dot_validate__pb2
 from metalstack.api.v2 import common_pb2 as metalstack_dot_api_dot_v2_dot_common__pb2
-from metalstack.api.v2 import predefined_rules_pb2 as metalstack_dot_api_dot_v2_dot_predefined__rules__pb2
 from metalstack.api.v2 import project_pb2 as metalstack_dot_api_dot_v2_dot_project__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n!metalstack/admin/v2/project.proto\x12\x13metalstack.admin.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\x1a\x1fmetalstack/api/v2/project.proto\"a\n\x19ProjectServiceListRequest\x12:\n\x05query\x18\x01 \x01(\x0b\x32\x1f.metalstack.api.v2.ProjectQueryH\x00R\x05query\x88\x01\x01\x42\x08\n\x06_query\"T\n\x1aProjectServiceListResponse\x12\x36\n\x08projects\x18\x01 \x03(\x0b\x32\x1a.metalstack.api.v2.ProjectR\x08projects2\x85\x01\n\x0eProjectService\x12s\n\x04List\x12..metalstack.admin.v2.ProjectServiceListRequest\x1a/.metalstack.admin.v2.ProjectServiceListResponse\"\n\xd2\xf3\x18\x02\x01\x02\xe0\xf3\x18\x02\x42\xd0\x01\n\x17\x63om.metalstack.admin.v2B\x0cProjectProtoP\x01Z9github.com/metal-stack/api/go/metalstack/admin/v2;adminv2\xa2\x02\x03MAX\xaa\x02\x13Metalstack.Admin.V2\xca\x02\x13Metalstack\\Admin\\V2\xe2\x02\x1fMetalstack\\Admin\\V2\\GPBMetadata\xea\x02\x15Metalstack::Admin::V2b\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n!metalstack/admin/v2/project.proto\x12\x13metalstack.admin.v2\x1a\x1emetalstack/api/v2/common.proto\x1a\x1fmetalstack/api/v2/project.proto\"a\n\x19ProjectServiceListRequest\x12:\n\x05query\x18\x01 \x01(\x0b\x32\x1f.metalstack.api.v2.ProjectQueryH\x00R\x05query\x88\x01\x01\x42\x08\n\x06_query\"T\n\x1aProjectServiceListResponse\x12\x36\n\x08projects\x18\x01 \x03(\x0b\x32\x1a.metalstack.api.v2.ProjectR\x08projects2\x85\x01\n\x0eProjectService\x12s\n\x04List\x12..metalstack.admin.v2.ProjectServiceListRequest\x1a/.metalstack.admin.v2.ProjectServiceListResponse\"\n\xd2\xf3\x18\x02\x01\x02\xe0\xf3\x18\x02\x42\xd0\x01\n\x17\x63om.metalstack.admin.v2B\x0cProjectProtoP\x01Z9github.com/metal-stack/api/go/metalstack/admin/v2;adminv2\xa2\x02\x03MAX\xaa\x02\x13Metalstack.Admin.V2\xca\x02\x13Metalstack\\Admin\\V2\xe2\x02\x1fMetalstack\\Admin\\V2\\GPBMetadata\xea\x02\x15Metalstack::Admin::V2b\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -38,10 +36,10 @@
   _globals['DESCRIPTOR']._serialized_options = b'\n\027com.metalstack.admin.v2B\014ProjectProtoP\001Z9github.com/metal-stack/api/go/metalstack/admin/v2;adminv2\242\002\003MAX\252\002\023Metalstack.Admin.V2\312\002\023Metalstack\\Admin\\V2\342\002\037Metalstack\\Admin\\V2\\GPBMetadata\352\002\025Metalstack::Admin::V2'
   _globals['_PROJECTSERVICE'].methods_by_name['List']._loaded_options = None
   _globals['_PROJECTSERVICE'].methods_by_name['List']._serialized_options = b'\322\363\030\002\001\002\340\363\030\002'
-  _globals['_PROJECTSERVICELISTREQUEST']._serialized_start=194
-  _globals['_PROJECTSERVICELISTREQUEST']._serialized_end=291
-  _globals['_PROJECTSERVICELISTRESPONSE']._serialized_start=293
-  _globals['_PROJECTSERVICELISTRESPONSE']._serialized_end=377
-  _globals['_PROJECTSERVICE']._serialized_start=380
-  _globals['_PROJECTSERVICE']._serialized_end=513
+  _globals['_PROJECTSERVICELISTREQUEST']._serialized_start=123
+  _globals['_PROJECTSERVICELISTREQUEST']._serialized_end=220
+  _globals['_PROJECTSERVICELISTRESPONSE']._serialized_start=222
+  _globals['_PROJECTSERVICELISTRESPONSE']._serialized_end=306
+  _globals['_PROJECTSERVICE']._serialized_start=309
+  _globals['_PROJECTSERVICE']._serialized_end=442
 # @@protoc_insertion_point(module_scope)
diff --git a/python/metalstack/admin/v2/project_pb2.pyi b/python/metalstack/admin/v2/project_pb2.pyi
index 0d4a3650..1a75bc90 100644
--- a/python/metalstack/admin/v2/project_pb2.pyi
+++ b/python/metalstack/admin/v2/project_pb2.pyi
@@ -1,6 +1,4 @@
-from buf.validate import validate_pb2 as _validate_pb2
 from metalstack.api.v2 import common_pb2 as _common_pb2
-from metalstack.api.v2 import predefined_rules_pb2 as _predefined_rules_pb2
 from metalstack.api.v2 import project_pb2 as _project_pb2
 from google.protobuf.internal import containers as _containers
 from google.protobuf import descriptor as _descriptor
diff --git a/python/metalstack/api/v2/predefined_rules_pb2.py b/python/metalstack/api/v2/predefined_rules_pb2.py
index b1e5a8c9..1f1182bd 100644
--- a/python/metalstack/api/v2/predefined_rules_pb2.py
+++ b/python/metalstack/api/v2/predefined_rules_pb2.py
@@ -25,7 +25,7 @@
 from buf.validate import validate_pb2 as buf_dot_validate_dot_validate__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n(metalstack/api/v2/predefined_rules.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto:\xb8\x01\n\nmacaddress\x12\x19.buf.validate.StringRules\x18\xb7\xe6\x95& \x01(\x08\x42z\xc2Hw\nu\n\x11string.macaddress\x12&this string must be a valid macaddress\x1a\x38this.matches(\'^([0-9A-Fa-f]{2}[:]){5}([0-9A-Fa-f]{2})$\')R\nmacaddress:\x99\x01\n\x07is_name\x12\x19.buf.validate.StringRules\x18\xb8\xe6\x95& \x01(\x08\x42\x62\xc2H_\n]\n\x0estring.is_name\x12#must be within 2 and 128 characters\x1a&this.size() >= 2 && this.size() <= 128R\x06isName:\x9a\x01\n\x0eis_description\x12\x19.buf.validate.StringRules\x18\xb9\xe6\x95& \x01(\x08\x42U\xc2HR\nP\n\x15string.is_description\x12#must be shorter than 256 characters\x1a\x12this.size() <= 256R\risDescription:\xa8\x01\n\x0cis_partition\x12\x19.buf.validate.StringRules\x18\xba\xe6\x95& \x01(\x08\x42g\xc2Hd\nb\n\x13string.is_partition\x12#must be within 2 and 128 characters\x1a&this.size() >= 2 && this.size() <= 128R\x0bisPartition:\x82\x01\n\tis_prefix\x12\x19.buf.validate.StringRules\x18\xbb\xe6\x95& \x01(\x08\x42G\xc2HD\nB\n\x0fstring.prefixes\x12\x1cgiven prefixes must be valid\x1a\x11this.isIpPrefix()R\x08isPrefix:m\n\x06is_uri\x12\x19.buf.validate.StringRules\x18\xbc\xe6\x95& \x01(\x08\x42\x38\xc2H5\n3\n\nstring.uri\x12\x17given uri must be valid\x1a\x0cthis.isUri()R\x05isUri:\xa7\x01\n\x11is_ip_or_hostname\x12\x19.buf.validate.StringRules\x18\xbd\xe6\x95& \x01(\x08\x42^\xc2H[\nY\n\rvalid_address\x12&must be a valid IP address or hostname\x1a this.isIp() || this.isHostname()R\x0eisIpOrHostname:\x9d\x01\n\x07trimmed\x12\x19.buf.validate.StringRules\x18\xbe\xe6\x95& \x01(\x08\x42\x65\xc2Hb\n`\n\x0estring.trimmed\x12+value must not start or end with whitespace\x1a!this.trim().size() == this.size()R\x07trimmed:\x99\x01\n\x07is_user\x12\x19.buf.validate.StringRules\x18\xbf\xe6\x95& \x01(\x08\x42\x62\xc2H_\n]\n\x0estring.is_user\x12#must be within 2 and 512 characters\x1a&this.size() >= 2 && this.size() <= 512R\x06isUser:\x9f\x01\n\tis_option\x12\x19.buf.validate.StringRules\x18\xc0\xe6\x95& \x01(\x08\x42\x64\xc2Ha\n_\n\x10string.is_option\x12#must be within 1 and 128 characters\x1a&this.size() >= 1 && this.size() <= 128R\x08isOption:\x98\x01\n\x06is_key\x12\x19.buf.validate.StringRules\x18\xc1\xe6\x95& \x01(\x08\x42\x63\xc2H`\n^\n\rstring.is_key\x12$must be within 1 and 8192 characters\x1a\'this.size() >= 1 && this.size() <= 8192R\x05isKey:\xb0\x01\n\x0fis_tenant_login\x12\x19.buf.validate.StringRules\x18\xc2\xe6\x95& \x01(\x08\x42j\xc2Hg\ne\n\x16string.is_tenant_login\x12#must be within 2 and 256 characters\x1a&this.size() >= 2 && this.size() <= 256R\risTenantLogin:\x8f\x01\n\x08prefixes\x12\x1b.buf.validate.RepeatedRules\x18\xc7\xb4\x96& \x01(\x08\x42S\xc2HP\nN\n\x11repeated.prefixes\x12\x1cgiven prefixes must be valid\x1a\x1bthis.all(m, m.isIpPrefix())R\x08prefixes:u\n\x03ips\x12\x1b.buf.validate.RepeatedRules\x18\xc8\xb4\x96& \x01(\x08\x42\x43\xc2H@\n>\n\x0crepeated.ips\x12\x17given ips must be valid\x1a\x15this.all(m, m.isIp())R\x03ips:\xe6\x01\n\x11\x61re_host_and_port\x12\x1b.buf.validate.RepeatedRules\x18\xc9\xb4\x96& \x01(\x08\x42\x9a\x01\xc2H\x96\x01\n\x93\x01\n\x1arepeated.are_host_and_port\x12Pgiven entries must all be in the form of <ip | host>:<port> but port is optional\x1a#this.all(m, m.isHostAndPort(false))R\x0e\x61reHostAndPort:\xba\x01\n\x0b\x61ll_trimmed\x12\x1b.buf.validate.RepeatedRules\x18\xca\xb4\x96& \x01(\x08\x42y\xc2Hv\nt\n\x14repeated.all_trimmed\x12\x32given values must not start or end with whitespace\x1a(this.all(m, m.trim().size() == m.size())R\nallTrimmed:\x84\x02\n\x17keys_and_values_trimmed\x12\x16.buf.validate.MapRules\x18\xd7\x82\x97& \x01(\x08\x42\xb1\x01\xc2H\xad\x01\n\xaa\x01\n\x1bmap.keys_and_values_trimmed\x12\x35keys and values must not start or end with whitespace\x1aTthis.all(k, k.trim().size() == k.size()) && this.all(v, v.trim().size() == v.size())R\x14keysAndValuesTrimmed:\xab\x01\n\x0ckeys_trimmed\x12\x16.buf.validate.MapRules\x18\xd8\x82\x97& \x01(\x08\x42m\xc2Hj\nh\n\x10map.keys_trimmed\x12*keys must not start or end with whitespace\x1a(this.all(k, k.trim().size() == k.size())R\x0bkeysTrimmed:\x92\x02\n\x18project_roles_keys_valid\x12\x16.buf.validate.MapRules\x18\xd9\x82\x97& \x01(\x08\x42\xbd\x01\xc2H\xb9\x01\n\xb6\x01\n\x17project_roles.key.valid\x12&subject must be a \'*\', or a valid UUID\x1asthis.all(k, k == \'*\' || k.matches(\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\'))R\x15projectRolesKeysValid:\xe8\x01\n\x17tenant_roles_keys_valid\x12\x16.buf.validate.MapRules\x18\xda\x82\x97& \x01(\x08\x42\x95\x01\xc2H\x91\x01\n\x8e\x01\n\x16tenant_roles.key.valid\x12\x33subject must be \'*\' or between 2 and 128 characters\x1a?this.all(k, k == \'*\' || this.size() >= 2 || this.size() <=128 )R\x14tenantRolesKeysValid:\xa9\x02\n\x18machine_roles_keys_valid\x12\x16.buf.validate.MapRules\x18\xdb\x82\x97& \x01(\x08\x42\xd4\x01\xc2H\xd0\x01\n\xcd\x01\n\x17machine_roles.key.valid\x12\x32subject must be empty string, \'*\', or a valid UUID\x1a~this.all(k, k == \'\' || k == \'*\' || k.matches(\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\'))R\x15machineRolesKeysValidB\xca\x01\n\x15\x63om.metalstack.api.v2B\x14PredefinedRulesProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n(metalstack/api/v2/predefined_rules.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto:\xb8\x01\n\nmacaddress\x12\x19.buf.validate.StringRules\x18\xb7\xe6\x95& \x01(\x08\x42z\xc2Hw\nu\n\x11string.macaddress\x12&this string must be a valid macaddress\x1a\x38this.matches(\'^([0-9A-Fa-f]{2}[:]){5}([0-9A-Fa-f]{2})$\')R\nmacaddress:\x99\x01\n\x07is_name\x12\x19.buf.validate.StringRules\x18\xb8\xe6\x95& \x01(\x08\x42\x62\xc2H_\n]\n\x0estring.is_name\x12#must be within 2 and 128 characters\x1a&this.size() >= 2 && this.size() <= 128R\x06isName:\x9a\x01\n\x0eis_description\x12\x19.buf.validate.StringRules\x18\xb9\xe6\x95& \x01(\x08\x42U\xc2HR\nP\n\x15string.is_description\x12#must be shorter than 256 characters\x1a\x12this.size() <= 256R\risDescription:\xa8\x01\n\x0cis_partition\x12\x19.buf.validate.StringRules\x18\xba\xe6\x95& \x01(\x08\x42g\xc2Hd\nb\n\x13string.is_partition\x12#must be within 2 and 128 characters\x1a&this.size() >= 2 && this.size() <= 128R\x0bisPartition:\x82\x01\n\tis_prefix\x12\x19.buf.validate.StringRules\x18\xbb\xe6\x95& \x01(\x08\x42G\xc2HD\nB\n\x0fstring.prefixes\x12\x1cgiven prefixes must be valid\x1a\x11this.isIpPrefix()R\x08isPrefix:m\n\x06is_uri\x12\x19.buf.validate.StringRules\x18\xbc\xe6\x95& \x01(\x08\x42\x38\xc2H5\n3\n\nstring.uri\x12\x17given uri must be valid\x1a\x0cthis.isUri()R\x05isUri:\xa7\x01\n\x11is_ip_or_hostname\x12\x19.buf.validate.StringRules\x18\xbd\xe6\x95& \x01(\x08\x42^\xc2H[\nY\n\rvalid_address\x12&must be a valid IP address or hostname\x1a this.isIp() || this.isHostname()R\x0eisIpOrHostname:\x9d\x01\n\x07trimmed\x12\x19.buf.validate.StringRules\x18\xbe\xe6\x95& \x01(\x08\x42\x65\xc2Hb\n`\n\x0estring.trimmed\x12+value must not start or end with whitespace\x1a!this.trim().size() == this.size()R\x07trimmed:\x99\x01\n\x07is_user\x12\x19.buf.validate.StringRules\x18\xbf\xe6\x95& \x01(\x08\x42\x62\xc2H_\n]\n\x0estring.is_user\x12#must be within 2 and 512 characters\x1a&this.size() >= 2 && this.size() <= 512R\x06isUser:\x9f\x01\n\tis_option\x12\x19.buf.validate.StringRules\x18\xc0\xe6\x95& \x01(\x08\x42\x64\xc2Ha\n_\n\x10string.is_option\x12#must be within 1 and 128 characters\x1a&this.size() >= 1 && this.size() <= 128R\x08isOption:\x98\x01\n\x06is_key\x12\x19.buf.validate.StringRules\x18\xc1\xe6\x95& \x01(\x08\x42\x63\xc2H`\n^\n\rstring.is_key\x12$must be within 1 and 8192 characters\x1a\'this.size() >= 1 && this.size() <= 8192R\x05isKey:\xb0\x01\n\x0fis_tenant_login\x12\x19.buf.validate.StringRules\x18\xc2\xe6\x95& \x01(\x08\x42j\xc2Hg\ne\n\x16string.is_tenant_login\x12#must be within 2 and 128 characters\x1a&this.size() >= 2 && this.size() <= 128R\risTenantLogin:\xef\x01\n\x1cis_tenant_subject_permission\x12\x19.buf.validate.StringRules\x18\xc3\xe6\x95& \x01(\x08\x42\x8f\x01\xc2H\x8b\x01\n\x88\x01\n#string.is_tenant_subject_permission\x12*must be \'*\' or within 2 and 128 characters\x1a\x35this == \'*\' || this.size() >= 2 && this.size() <= 128R\x19isTenantSubjectPermission:\x94\x02\n\x1dis_project_subject_permission\x12\x19.buf.validate.StringRules\x18\xc4\xe6\x95& \x01(\x08\x42\xb2\x01\xc2H\xae\x01\n\xab\x01\n$string.is_project_subject_permission\x12\x15must be \'*\' or a uuid\x1althis == \'*\' || this.matches(\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\')R\x1aisProjectSubjectPermission:\x94\x02\n\x1dis_machine_subject_permission\x12\x19.buf.validate.StringRules\x18\xc5\xe6\x95& \x01(\x08\x42\xb2\x01\xc2H\xae\x01\n\xab\x01\n$string.is_machine_subject_permission\x12\x15must be \'*\' or a uuid\x1althis == \'*\' || this.matches(\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\')R\x1aisMachineSubjectPermission:\x8f\x01\n\x08prefixes\x12\x1b.buf.validate.RepeatedRules\x18\xc7\xb4\x96& \x01(\x08\x42S\xc2HP\nN\n\x11repeated.prefixes\x12\x1cgiven prefixes must be valid\x1a\x1bthis.all(m, m.isIpPrefix())R\x08prefixes:u\n\x03ips\x12\x1b.buf.validate.RepeatedRules\x18\xc8\xb4\x96& \x01(\x08\x42\x43\xc2H@\n>\n\x0crepeated.ips\x12\x17given ips must be valid\x1a\x15this.all(m, m.isIp())R\x03ips:\xe6\x01\n\x11\x61re_host_and_port\x12\x1b.buf.validate.RepeatedRules\x18\xc9\xb4\x96& \x01(\x08\x42\x9a\x01\xc2H\x96\x01\n\x93\x01\n\x1arepeated.are_host_and_port\x12Pgiven entries must all be in the form of <ip | host>:<port> but port is optional\x1a#this.all(m, m.isHostAndPort(false))R\x0e\x61reHostAndPort:\xba\x01\n\x0b\x61ll_trimmed\x12\x1b.buf.validate.RepeatedRules\x18\xca\xb4\x96& \x01(\x08\x42y\xc2Hv\nt\n\x14repeated.all_trimmed\x12\x32given values must not start or end with whitespace\x1a(this.all(m, m.trim().size() == m.size())R\nallTrimmed:\x84\x02\n\x17keys_and_values_trimmed\x12\x16.buf.validate.MapRules\x18\xd7\x82\x97& \x01(\x08\x42\xb1\x01\xc2H\xad\x01\n\xaa\x01\n\x1bmap.keys_and_values_trimmed\x12\x35keys and values must not start or end with whitespace\x1aTthis.all(k, k.trim().size() == k.size()) && this.all(v, v.trim().size() == v.size())R\x14keysAndValuesTrimmed:\xab\x01\n\x0ckeys_trimmed\x12\x16.buf.validate.MapRules\x18\xd8\x82\x97& \x01(\x08\x42m\xc2Hj\nh\n\x10map.keys_trimmed\x12*keys must not start or end with whitespace\x1a(this.all(k, k.trim().size() == k.size())R\x0bkeysTrimmed:\x92\x02\n\x18project_roles_keys_valid\x12\x16.buf.validate.MapRules\x18\xd9\x82\x97& \x01(\x08\x42\xbd\x01\xc2H\xb9\x01\n\xb6\x01\n\x17project_roles.key.valid\x12&subject must be a \'*\', or a valid UUID\x1asthis.all(k, k == \'*\' || k.matches(\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\'))R\x15projectRolesKeysValid:\xe8\x01\n\x17tenant_roles_keys_valid\x12\x16.buf.validate.MapRules\x18\xda\x82\x97& \x01(\x08\x42\x95\x01\xc2H\x91\x01\n\x8e\x01\n\x16tenant_roles.key.valid\x12\x33subject must be \'*\' or between 2 and 128 characters\x1a?this.all(k, k == \'*\' || this.size() >= 2 || this.size() <=128 )R\x14tenantRolesKeysValid:\x9e\x02\n\x18machine_roles_keys_valid\x12\x16.buf.validate.MapRules\x18\xdb\x82\x97& \x01(\x08\x42\xc9\x01\xc2H\xc5\x01\n\xc2\x01\n\x17machine_roles.key.valid\x12\x32subject must be empty string, \'*\', or a valid UUID\x1asthis.all(k, k == \'*\' || k.matches(\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\'))R\x15machineRolesKeysValidB\xca\x01\n\x15\x63om.metalstack.api.v2B\x14PredefinedRulesProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -56,7 +56,13 @@
   _globals['is_key']._loaded_options = None
   _globals['is_key']._serialized_options = b'\302H`\n^\n\rstring.is_key\022$must be within 1 and 8192 characters\032\'this.size() >= 1 && this.size() <= 8192'
   _globals['is_tenant_login']._loaded_options = None
-  _globals['is_tenant_login']._serialized_options = b'\302Hg\ne\n\026string.is_tenant_login\022#must be within 2 and 256 characters\032&this.size() >= 2 && this.size() <= 256'
+  _globals['is_tenant_login']._serialized_options = b'\302Hg\ne\n\026string.is_tenant_login\022#must be within 2 and 128 characters\032&this.size() >= 2 && this.size() <= 128'
+  _globals['is_tenant_subject_permission']._loaded_options = None
+  _globals['is_tenant_subject_permission']._serialized_options = b'\302H\213\001\n\210\001\n#string.is_tenant_subject_permission\022*must be \'*\' or within 2 and 128 characters\0325this == \'*\' || this.size() >= 2 && this.size() <= 128'
+  _globals['is_project_subject_permission']._loaded_options = None
+  _globals['is_project_subject_permission']._serialized_options = b'\302H\256\001\n\253\001\n$string.is_project_subject_permission\022\025must be \'*\' or a uuid\032lthis == \'*\' || this.matches(\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\')'
+  _globals['is_machine_subject_permission']._loaded_options = None
+  _globals['is_machine_subject_permission']._serialized_options = b'\302H\256\001\n\253\001\n$string.is_machine_subject_permission\022\025must be \'*\' or a uuid\032lthis == \'*\' || this.matches(\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\')'
   _globals['prefixes']._loaded_options = None
   _globals['prefixes']._serialized_options = b'\302HP\nN\n\021repeated.prefixes\022\034given prefixes must be valid\032\033this.all(m, m.isIpPrefix())'
   _globals['ips']._loaded_options = None
@@ -74,5 +80,5 @@
   _globals['tenant_roles_keys_valid']._loaded_options = None
   _globals['tenant_roles_keys_valid']._serialized_options = b'\302H\221\001\n\216\001\n\026tenant_roles.key.valid\0223subject must be \'*\' or between 2 and 128 characters\032?this.all(k, k == \'*\' || this.size() >= 2 || this.size() <=128 )'
   _globals['machine_roles_keys_valid']._loaded_options = None
-  _globals['machine_roles_keys_valid']._serialized_options = b'\302H\320\001\n\315\001\n\027machine_roles.key.valid\0222subject must be empty string, \'*\', or a valid UUID\032~this.all(k, k == \'\' || k == \'*\' || k.matches(\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\'))'
+  _globals['machine_roles_keys_valid']._serialized_options = b'\302H\305\001\n\302\001\n\027machine_roles.key.valid\0222subject must be empty string, \'*\', or a valid UUID\032sthis.all(k, k == \'*\' || k.matches(\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\'))'
 # @@protoc_insertion_point(module_scope)
diff --git a/python/metalstack/api/v2/predefined_rules_pb2.pyi b/python/metalstack/api/v2/predefined_rules_pb2.pyi
index f76fae01..534598f3 100644
--- a/python/metalstack/api/v2/predefined_rules_pb2.pyi
+++ b/python/metalstack/api/v2/predefined_rules_pb2.pyi
@@ -27,6 +27,12 @@ IS_KEY_FIELD_NUMBER: _ClassVar[int]
 is_key: _descriptor.FieldDescriptor
 IS_TENANT_LOGIN_FIELD_NUMBER: _ClassVar[int]
 is_tenant_login: _descriptor.FieldDescriptor
+IS_TENANT_SUBJECT_PERMISSION_FIELD_NUMBER: _ClassVar[int]
+is_tenant_subject_permission: _descriptor.FieldDescriptor
+IS_PROJECT_SUBJECT_PERMISSION_FIELD_NUMBER: _ClassVar[int]
+is_project_subject_permission: _descriptor.FieldDescriptor
+IS_MACHINE_SUBJECT_PERMISSION_FIELD_NUMBER: _ClassVar[int]
+is_machine_subject_permission: _descriptor.FieldDescriptor
 PREFIXES_FIELD_NUMBER: _ClassVar[int]
 prefixes: _descriptor.FieldDescriptor
 IPS_FIELD_NUMBER: _ClassVar[int]
diff --git a/python/metalstack/api/v2/token_pb2.py b/python/metalstack/api/v2/token_pb2.py
index c9ac7b3a..1086d846 100644
--- a/python/metalstack/api/v2/token_pb2.py
+++ b/python/metalstack/api/v2/token_pb2.py
@@ -29,7 +29,7 @@
 from metalstack.api.v2 import predefined_rules_pb2 as metalstack_dot_api_dot_v2_dot_predefined__rules__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1dmetalstack/api/v2/token.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\"\xc2\t\n\x05Token\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x1f\n\x04user\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xf8\xb3\xae\xb1\x02\x01R\x04user\x12+\n\x04meta\x18\x03 \x01(\x0b\x32\x17.metalstack.api.v2.MetaR\x04meta\x12-\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12P\n\x0bpermissions\x18\x05 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x0bpermissions\x12\x34\n\x07\x65xpires\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x07\x65xpires\x12\x37\n\tissued_at\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x08issuedAt\x12\x45\n\ntoken_type\x18\x08 \x01(\x0e\x32\x1c.metalstack.api.v2.TokenTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\ttokenType\x12j\n\rproject_roles\x18\t \x03(\x0b\x32*.metalstack.api.v2.Token.ProjectRolesEntryB\x19\xbaH\x16\x9a\x01\x13*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01\xc8\x95\xb8\xb1\x02\x01R\x0cprojectRoles\x12g\n\x0ctenant_roles\x18\n \x03(\x0b\x32).metalstack.api.v2.Token.TenantRolesEntryB\x19\xbaH\x16\x9a\x01\x13*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01\xd0\x95\xb8\xb1\x02\x01R\x0btenantRoles\x12J\n\nadmin_role\x18\x0b \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x0c \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x12j\n\rmachine_roles\x18\r \x03(\x0b\x32*.metalstack.api.v2.Token.MachineRolesEntryB\x19\xbaH\x16\x9a\x01\x13*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01\xd8\x95\xb8\xb1\x02\x01R\x0cmachineRoles\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01\x42\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"\xeb\x08\n\x19TokenServiceCreateRequest\x12-\n\x0b\x64\x65scription\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12O\n\x0bpermissions\x18\x02 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionB\x08\xbaH\x05\x92\x01\x02\x10\x64R\x0bpermissions\x12G\n\x07\x65xpires\x18\x03 \x01(\x0b\x32\x19.google.protobuf.DurationB\x12\xbaH\x0f\xaa\x01\x0c\x1a\x05\x08\x81\xe7\x84\x0f\x32\x03\x08\xd8\x04R\x07\x65xpires\x12~\n\rproject_roles\x18\x04 \x03(\x0b\x32>.metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntryB\x19\xbaH\x16\x9a\x01\x13*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01\xc8\x95\xb8\xb1\x02\x01R\x0cprojectRoles\x12{\n\x0ctenant_roles\x18\x05 \x03(\x0b\x32=.metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntryB\x19\xbaH\x16\x9a\x01\x13*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01\xd0\x95\xb8\xb1\x02\x01R\x0btenantRoles\x12J\n\nadmin_role\x18\x06 \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x07 \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x12~\n\rmachine_roles\x18\x08 \x03(\x0b\x32>.metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntryB\x19\xbaH\x16\x9a\x01\x13*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01\xd8\x95\xb8\xb1\x02\x01R\x0cmachineRoles\x12\x31\n\x06labels\x18\t \x01(\x0b\x32\x19.metalstack.api.v2.LabelsR\x06labels\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01\x42\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"[\n\x10MethodPermission\x12\"\n\x07subject\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x07subject\x12#\n\x07methods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x07methods\"d\n\x1aTokenServiceCreateResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret\"N\n\x17TokenServiceListRequest\x12\x33\n\x05query\x18\x01 \x01(\x0b\x32\x1d.metalstack.api.v2.TokenQueryR\x05query\"L\n\x18TokenServiceListResponse\x12\x30\n\x06tokens\x18\x01 \x03(\x0b\x32\x18.metalstack.api.v2.TokenR\x06tokens\"9\n\x19TokenServiceRevokeRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"\x1c\n\x1aTokenServiceRevokeResponse\"\x99\t\n\x19TokenServiceUpdateRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x46\n\x0bupdate_meta\x18\x02 \x01(\x0b\x32\x1d.metalstack.api.v2.UpdateMetaB\x06\xbaH\x03\xc8\x01\x00R\nupdateMeta\x12\x32\n\x0b\x64\x65scription\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x00R\x0b\x64\x65scription\x88\x01\x01\x12\x45\n\x0bpermissions\x18\x04 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionR\x0bpermissions\x12~\n\rproject_roles\x18\x05 \x03(\x0b\x32>.metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntryB\x19\xbaH\x16\x9a\x01\x13*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01\xc8\x95\xb8\xb1\x02\x01R\x0cprojectRoles\x12{\n\x0ctenant_roles\x18\x06 \x03(\x0b\x32=.metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntryB\x19\xbaH\x16\x9a\x01\x13*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01\xd0\x95\xb8\xb1\x02\x01R\x0btenantRoles\x12J\n\nadmin_role\x18\x07 \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x08 \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x02R\tinfraRole\x88\x01\x01\x12~\n\rmachine_roles\x18\t \x03(\x0b\x32>.metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntryB\x19\xbaH\x16\x9a\x01\x13*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01\xd8\x95\xb8\xb1\x02\x01R\x0cmachineRoles\x12\x37\n\x06labels\x18\n \x01(\x0b\x32\x1f.metalstack.api.v2.UpdateLabelsR\x06labels\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01\x42\x0e\n\x0c_descriptionB\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"L\n\x1aTokenServiceUpdateResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\"6\n\x16TokenServiceGetRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"I\n\x17TokenServiceGetResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\"\x1c\n\x1aTokenServiceRefreshRequest\"e\n\x1bTokenServiceRefreshResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret\"\xc9\x02\n\nTokenQuery\x12!\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x00R\x04uuid\x88\x01\x01\x12$\n\x04user\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xf8\xb3\xae\xb1\x02\x01H\x01R\x04user\x88\x01\x01\x12\x32\n\x0b\x64\x65scription\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x02R\x0b\x64\x65scription\x88\x01\x01\x12\x36\n\x06labels\x18\x04 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsH\x03R\x06labels\x88\x01\x01\x12J\n\ntoken_type\x18\x05 \x01(\x0e\x32\x1c.metalstack.api.v2.TokenTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x04R\ttokenType\x88\x01\x01\x42\x07\n\x05_uuidB\x07\n\x05_userB\x0e\n\x0c_descriptionB\t\n\x07_labelsB\r\n\x0b_token_type*P\n\tTokenType\x12\x1a\n\x16TOKEN_TYPE_UNSPECIFIED\x10\x00\x12\x12\n\x0eTOKEN_TYPE_API\x10\x01\x12\x13\n\x0fTOKEN_TYPE_USER\x10\x02\x32\xa8\x05\n\x0cTokenService\x12\x66\n\x03Get\x12).metalstack.api.v2.TokenServiceGetRequest\x1a*.metalstack.api.v2.TokenServiceGetResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12o\n\x06\x43reate\x12,.metalstack.api.v2.TokenServiceCreateRequest\x1a-.metalstack.api.v2.TokenServiceCreateResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12o\n\x06Update\x12,.metalstack.api.v2.TokenServiceUpdateRequest\x1a-.metalstack.api.v2.TokenServiceUpdateResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12i\n\x04List\x12*.metalstack.api.v2.TokenServiceListRequest\x1a+.metalstack.api.v2.TokenServiceListResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12o\n\x06Revoke\x12,.metalstack.api.v2.TokenServiceRevokeRequest\x1a-.metalstack.api.v2.TokenServiceRevokeResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12r\n\x07Refresh\x12-.metalstack.api.v2.TokenServiceRefreshRequest\x1a..metalstack.api.v2.TokenServiceRefreshResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x42\xc0\x01\n\x15\x63om.metalstack.api.v2B\nTokenProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1dmetalstack/api/v2/token.proto\x12\x11metalstack.api.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1emetalstack/api/v2/common.proto\x1a(metalstack/api/v2/predefined_rules.proto\"\xc2\t\n\x05Token\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x1f\n\x04user\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xf8\xb3\xae\xb1\x02\x01R\x04user\x12+\n\x04meta\x18\x03 \x01(\x0b\x32\x17.metalstack.api.v2.MetaR\x04meta\x12-\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12P\n\x0bpermissions\x18\x05 \x03(\x0b\x32#.metalstack.api.v2.MethodPermissionB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x0bpermissions\x12\x34\n\x07\x65xpires\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x07\x65xpires\x12\x37\n\tissued_at\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x08issuedAt\x12\x45\n\ntoken_type\x18\x08 \x01(\x0e\x32\x1c.metalstack.api.v2.TokenTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\ttokenType\x12j\n\rproject_roles\x18\t \x03(\x0b\x32*.metalstack.api.v2.Token.ProjectRolesEntryB\x19\xbaH\x16\x9a\x01\x13*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01\xc8\x95\xb8\xb1\x02\x01R\x0cprojectRoles\x12g\n\x0ctenant_roles\x18\n \x03(\x0b\x32).metalstack.api.v2.Token.TenantRolesEntryB\x19\xbaH\x16\x9a\x01\x13*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01\xd0\x95\xb8\xb1\x02\x01R\x0btenantRoles\x12J\n\nadmin_role\x18\x0b \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x0c \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x12j\n\rmachine_roles\x18\r \x03(\x0b\x32*.metalstack.api.v2.Token.MachineRolesEntryB\x19\xbaH\x16\x9a\x01\x13*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01\xd8\x95\xb8\xb1\x02\x01R\x0cmachineRoles\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01\x42\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"\xf2\x08\n\x19TokenServiceCreateRequest\x12-\n\x0b\x64\x65scription\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12V\n\x0bpermissions\x18\x02 \x03(\x0b\x32*.metalstack.api.v2.PermissionsByVisibilityB\x08\xbaH\x05\x92\x01\x02\x10\x64R\x0bpermissions\x12G\n\x07\x65xpires\x18\x03 \x01(\x0b\x32\x19.google.protobuf.DurationB\x12\xbaH\x0f\xaa\x01\x0c\x1a\x05\x08\x81\xe7\x84\x0f\x32\x03\x08\xd8\x04R\x07\x65xpires\x12~\n\rproject_roles\x18\x04 \x03(\x0b\x32>.metalstack.api.v2.TokenServiceCreateRequest.ProjectRolesEntryB\x19\xbaH\x16\x9a\x01\x13*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01\xc8\x95\xb8\xb1\x02\x01R\x0cprojectRoles\x12{\n\x0ctenant_roles\x18\x05 \x03(\x0b\x32=.metalstack.api.v2.TokenServiceCreateRequest.TenantRolesEntryB\x19\xbaH\x16\x9a\x01\x13*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01\xd0\x95\xb8\xb1\x02\x01R\x0btenantRoles\x12J\n\nadmin_role\x18\x06 \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x07 \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tinfraRole\x88\x01\x01\x12~\n\rmachine_roles\x18\x08 \x03(\x0b\x32>.metalstack.api.v2.TokenServiceCreateRequest.MachineRolesEntryB\x19\xbaH\x16\x9a\x01\x13*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01\xd8\x95\xb8\xb1\x02\x01R\x0cmachineRoles\x12\x31\n\x06labels\x18\t \x01(\x0b\x32\x19.metalstack.api.v2.LabelsR\x06labels\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01\x42\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"[\n\x10MethodPermission\x12\"\n\x07subject\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x07subject\x12#\n\x07methods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x07methods\"\xe1\x03\n\x17PermissionsByVisibility\x12>\n\x06public\x18\x01 \x01(\x0b\x32$.metalstack.api.v2.PublicPermissionsH\x00R\x06public\x12\x38\n\x04self\x18\x02 \x01(\x0b\x32\".metalstack.api.v2.SelfPermissionsH\x00R\x04self\x12\x41\n\x07project\x18\x03 \x01(\x0b\x32%.metalstack.api.v2.ProjectPermissionsH\x00R\x07project\x12>\n\x06tenant\x18\x04 \x01(\x0b\x32$.metalstack.api.v2.TenantPermissionsH\x00R\x06tenant\x12;\n\x05\x61\x64min\x18\x05 \x01(\x0b\x32#.metalstack.api.v2.AdminPermissionsH\x00R\x05\x61\x64min\x12\x41\n\x07machine\x18\x06 \x01(\x0b\x32%.metalstack.api.v2.MachinePermissionsH\x00R\x07machine\x12;\n\x05infra\x18\x07 \x01(\x0b\x32#.metalstack.api.v2.InfraPermissionsH\x00R\x05infraB\x0c\n\nvisibility\"8\n\x11PublicPermissions\x12#\n\x07methods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x07methods\"6\n\x0fSelfPermissions\x12#\n\x07methods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x07methods\"`\n\x12ProjectPermissions\x12%\n\x07project\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xa0\xb4\xae\xb1\x02\x01R\x07project\x12#\n\x07methods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x07methods\"[\n\x11TenantPermissions\x12!\n\x05login\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\x98\xb4\xae\xb1\x02\x01R\x05login\x12#\n\x07methods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x07methods\"7\n\x10\x41\x64minPermissions\x12#\n\x07methods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x07methods\"Z\n\x12MachinePermissions\x12\x1f\n\x04uuid\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xa8\xb4\xae\xb1\x02\x01R\x04uuid\x12#\n\x07methods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x07methods\"7\n\x10InfraPermissions\x12#\n\x07methods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x07methods\"d\n\x1aTokenServiceCreateResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret\"N\n\x17TokenServiceListRequest\x12\x33\n\x05query\x18\x01 \x01(\x0b\x32\x1d.metalstack.api.v2.TokenQueryR\x05query\"L\n\x18TokenServiceListResponse\x12\x30\n\x06tokens\x18\x01 \x03(\x0b\x32\x18.metalstack.api.v2.TokenR\x06tokens\"9\n\x19TokenServiceRevokeRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"\x1c\n\x1aTokenServiceRevokeResponse\"\xa0\t\n\x19TokenServiceUpdateRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x46\n\x0bupdate_meta\x18\x02 \x01(\x0b\x32\x1d.metalstack.api.v2.UpdateMetaB\x06\xbaH\x03\xc8\x01\x00R\nupdateMeta\x12\x32\n\x0b\x64\x65scription\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x00R\x0b\x64\x65scription\x88\x01\x01\x12L\n\x0bpermissions\x18\x04 \x03(\x0b\x32*.metalstack.api.v2.PermissionsByVisibilityR\x0bpermissions\x12~\n\rproject_roles\x18\x05 \x03(\x0b\x32>.metalstack.api.v2.TokenServiceUpdateRequest.ProjectRolesEntryB\x19\xbaH\x16\x9a\x01\x13*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01\xc8\x95\xb8\xb1\x02\x01R\x0cprojectRoles\x12{\n\x0ctenant_roles\x18\x06 \x03(\x0b\x32=.metalstack.api.v2.TokenServiceUpdateRequest.TenantRolesEntryB\x19\xbaH\x16\x9a\x01\x13*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01\xd0\x95\xb8\xb1\x02\x01R\x0btenantRoles\x12J\n\nadmin_role\x18\x07 \x01(\x0e\x32\x1c.metalstack.api.v2.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tadminRole\x88\x01\x01\x12J\n\ninfra_role\x18\x08 \x01(\x0e\x32\x1c.metalstack.api.v2.InfraRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x02R\tinfraRole\x88\x01\x01\x12~\n\rmachine_roles\x18\t \x03(\x0b\x32>.metalstack.api.v2.TokenServiceUpdateRequest.MachineRolesEntryB\x19\xbaH\x16\x9a\x01\x13*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01\xd8\x95\xb8\xb1\x02\x01R\x0cmachineRoles\x12\x37\n\x06labels\x18\n \x01(\x0b\x32\x1f.metalstack.api.v2.UpdateLabelsR\x06labels\x1a_\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.ProjectRoleR\x05value:\x02\x38\x01\x1a]\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x33\n\x05value\x18\x02 \x01(\x0e\x32\x1d.metalstack.api.v2.TenantRoleR\x05value:\x02\x38\x01\x1a_\n\x11MachineRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x34\n\x05value\x18\x02 \x01(\x0e\x32\x1e.metalstack.api.v2.MachineRoleR\x05value:\x02\x38\x01\x42\x0e\n\x0c_descriptionB\r\n\x0b_admin_roleB\r\n\x0b_infra_role\"L\n\x1aTokenServiceUpdateResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\"6\n\x16TokenServiceGetRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"I\n\x17TokenServiceGetResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\"\x1c\n\x1aTokenServiceRefreshRequest\"e\n\x1bTokenServiceRefreshResponse\x12.\n\x05token\x18\x01 \x01(\x0b\x32\x18.metalstack.api.v2.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret\"\xc9\x02\n\nTokenQuery\x12!\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01H\x00R\x04uuid\x88\x01\x01\x12$\n\x04user\x18\x02 \x01(\tB\x0b\xbaH\x08r\x06\xf8\xb3\xae\xb1\x02\x01H\x01R\x04user\x88\x01\x01\x12\x32\n\x0b\x64\x65scription\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x02R\x0b\x64\x65scription\x88\x01\x01\x12\x36\n\x06labels\x18\x04 \x01(\x0b\x32\x19.metalstack.api.v2.LabelsH\x03R\x06labels\x88\x01\x01\x12J\n\ntoken_type\x18\x05 \x01(\x0e\x32\x1c.metalstack.api.v2.TokenTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x04R\ttokenType\x88\x01\x01\x42\x07\n\x05_uuidB\x07\n\x05_userB\x0e\n\x0c_descriptionB\t\n\x07_labelsB\r\n\x0b_token_type*P\n\tTokenType\x12\x1a\n\x16TOKEN_TYPE_UNSPECIFIED\x10\x00\x12\x12\n\x0eTOKEN_TYPE_API\x10\x01\x12\x13\n\x0fTOKEN_TYPE_USER\x10\x02\x32\xa8\x05\n\x0cTokenService\x12\x66\n\x03Get\x12).metalstack.api.v2.TokenServiceGetRequest\x1a*.metalstack.api.v2.TokenServiceGetResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12o\n\x06\x43reate\x12,.metalstack.api.v2.TokenServiceCreateRequest\x1a-.metalstack.api.v2.TokenServiceCreateResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12o\n\x06Update\x12,.metalstack.api.v2.TokenServiceUpdateRequest\x1a-.metalstack.api.v2.TokenServiceUpdateResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12i\n\x04List\x12*.metalstack.api.v2.TokenServiceListRequest\x1a+.metalstack.api.v2.TokenServiceListResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12o\n\x06Revoke\x12,.metalstack.api.v2.TokenServiceRevokeRequest\x1a-.metalstack.api.v2.TokenServiceRevokeResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12r\n\x07Refresh\x12-.metalstack.api.v2.TokenServiceRefreshRequest\x1a..metalstack.api.v2.TokenServiceRefreshResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x42\xc0\x01\n\x15\x63om.metalstack.api.v2B\nTokenProtoP\x01Z5github.com/metal-stack/api/go/metalstack/api/v2;apiv2\xa2\x02\x03MAX\xaa\x02\x11Metalstack.Api.V2\xca\x02\x11Metalstack\\Api\\V2\xe2\x02\x1dMetalstack\\Api\\V2\\GPBMetadata\xea\x02\x13Metalstack::Api::V2b\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -89,6 +89,26 @@
   _globals['_METHODPERMISSION'].fields_by_name['subject']._serialized_options = b'\272H\005r\003\030\200\002'
   _globals['_METHODPERMISSION'].fields_by_name['methods']._loaded_options = None
   _globals['_METHODPERMISSION'].fields_by_name['methods']._serialized_options = b'\272H\006\222\001\003\020\364\003'
+  _globals['_PUBLICPERMISSIONS'].fields_by_name['methods']._loaded_options = None
+  _globals['_PUBLICPERMISSIONS'].fields_by_name['methods']._serialized_options = b'\272H\006\222\001\003\020\364\003'
+  _globals['_SELFPERMISSIONS'].fields_by_name['methods']._loaded_options = None
+  _globals['_SELFPERMISSIONS'].fields_by_name['methods']._serialized_options = b'\272H\006\222\001\003\020\364\003'
+  _globals['_PROJECTPERMISSIONS'].fields_by_name['project']._loaded_options = None
+  _globals['_PROJECTPERMISSIONS'].fields_by_name['project']._serialized_options = b'\272H\010r\006\240\264\256\261\002\001'
+  _globals['_PROJECTPERMISSIONS'].fields_by_name['methods']._loaded_options = None
+  _globals['_PROJECTPERMISSIONS'].fields_by_name['methods']._serialized_options = b'\272H\006\222\001\003\020\364\003'
+  _globals['_TENANTPERMISSIONS'].fields_by_name['login']._loaded_options = None
+  _globals['_TENANTPERMISSIONS'].fields_by_name['login']._serialized_options = b'\272H\010r\006\230\264\256\261\002\001'
+  _globals['_TENANTPERMISSIONS'].fields_by_name['methods']._loaded_options = None
+  _globals['_TENANTPERMISSIONS'].fields_by_name['methods']._serialized_options = b'\272H\006\222\001\003\020\364\003'
+  _globals['_ADMINPERMISSIONS'].fields_by_name['methods']._loaded_options = None
+  _globals['_ADMINPERMISSIONS'].fields_by_name['methods']._serialized_options = b'\272H\006\222\001\003\020\364\003'
+  _globals['_MACHINEPERMISSIONS'].fields_by_name['uuid']._loaded_options = None
+  _globals['_MACHINEPERMISSIONS'].fields_by_name['uuid']._serialized_options = b'\272H\010r\006\250\264\256\261\002\001'
+  _globals['_MACHINEPERMISSIONS'].fields_by_name['methods']._loaded_options = None
+  _globals['_MACHINEPERMISSIONS'].fields_by_name['methods']._serialized_options = b'\272H\006\222\001\003\020\364\003'
+  _globals['_INFRAPERMISSIONS'].fields_by_name['methods']._loaded_options = None
+  _globals['_INFRAPERMISSIONS'].fields_by_name['methods']._serialized_options = b'\272H\006\222\001\003\020\364\003'
   _globals['_TOKENSERVICEREVOKEREQUEST'].fields_by_name['uuid']._loaded_options = None
   _globals['_TOKENSERVICEREVOKEREQUEST'].fields_by_name['uuid']._serialized_options = b'\272H\005r\003\260\001\001'
   _globals['_TOKENSERVICEUPDATEREQUEST_PROJECTROLESENTRY']._loaded_options = None
@@ -135,8 +155,8 @@
   _globals['_TOKENSERVICE'].methods_by_name['Revoke']._serialized_options = b'\330\363\030\002\340\363\030\001'
   _globals['_TOKENSERVICE'].methods_by_name['Refresh']._loaded_options = None
   _globals['_TOKENSERVICE'].methods_by_name['Refresh']._serialized_options = b'\330\363\030\002\340\363\030\001'
-  _globals['_TOKENTYPE']._serialized_start=4871
-  _globals['_TOKENTYPE']._serialized_end=4951
+  _globals['_TOKENTYPE']._serialized_start=5880
+  _globals['_TOKENTYPE']._serialized_end=5960
   _globals['_TOKEN']._serialized_start=221
   _globals['_TOKEN']._serialized_end=1439
   _globals['_TOKEN_PROJECTROLESENTRY']._serialized_start=1122
@@ -146,45 +166,61 @@
   _globals['_TOKEN_MACHINEROLESENTRY']._serialized_start=1314
   _globals['_TOKEN_MACHINEROLESENTRY']._serialized_end=1409
   _globals['_TOKENSERVICECREATEREQUEST']._serialized_start=1442
-  _globals['_TOKENSERVICECREATEREQUEST']._serialized_end=2573
+  _globals['_TOKENSERVICECREATEREQUEST']._serialized_end=2580
   _globals['_TOKENSERVICECREATEREQUEST_PROJECTROLESENTRY']._serialized_start=1122
   _globals['_TOKENSERVICECREATEREQUEST_PROJECTROLESENTRY']._serialized_end=1217
   _globals['_TOKENSERVICECREATEREQUEST_TENANTROLESENTRY']._serialized_start=1219
   _globals['_TOKENSERVICECREATEREQUEST_TENANTROLESENTRY']._serialized_end=1312
   _globals['_TOKENSERVICECREATEREQUEST_MACHINEROLESENTRY']._serialized_start=1314
   _globals['_TOKENSERVICECREATEREQUEST_MACHINEROLESENTRY']._serialized_end=1409
-  _globals['_METHODPERMISSION']._serialized_start=2575
-  _globals['_METHODPERMISSION']._serialized_end=2666
-  _globals['_TOKENSERVICECREATERESPONSE']._serialized_start=2668
-  _globals['_TOKENSERVICECREATERESPONSE']._serialized_end=2768
-  _globals['_TOKENSERVICELISTREQUEST']._serialized_start=2770
-  _globals['_TOKENSERVICELISTREQUEST']._serialized_end=2848
-  _globals['_TOKENSERVICELISTRESPONSE']._serialized_start=2850
-  _globals['_TOKENSERVICELISTRESPONSE']._serialized_end=2926
-  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_start=2928
-  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_end=2985
-  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_start=2987
-  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_end=3015
-  _globals['_TOKENSERVICEUPDATEREQUEST']._serialized_start=3018
-  _globals['_TOKENSERVICEUPDATEREQUEST']._serialized_end=4195
+  _globals['_METHODPERMISSION']._serialized_start=2582
+  _globals['_METHODPERMISSION']._serialized_end=2673
+  _globals['_PERMISSIONSBYVISIBILITY']._serialized_start=2676
+  _globals['_PERMISSIONSBYVISIBILITY']._serialized_end=3157
+  _globals['_PUBLICPERMISSIONS']._serialized_start=3159
+  _globals['_PUBLICPERMISSIONS']._serialized_end=3215
+  _globals['_SELFPERMISSIONS']._serialized_start=3217
+  _globals['_SELFPERMISSIONS']._serialized_end=3271
+  _globals['_PROJECTPERMISSIONS']._serialized_start=3273
+  _globals['_PROJECTPERMISSIONS']._serialized_end=3369
+  _globals['_TENANTPERMISSIONS']._serialized_start=3371
+  _globals['_TENANTPERMISSIONS']._serialized_end=3462
+  _globals['_ADMINPERMISSIONS']._serialized_start=3464
+  _globals['_ADMINPERMISSIONS']._serialized_end=3519
+  _globals['_MACHINEPERMISSIONS']._serialized_start=3521
+  _globals['_MACHINEPERMISSIONS']._serialized_end=3611
+  _globals['_INFRAPERMISSIONS']._serialized_start=3613
+  _globals['_INFRAPERMISSIONS']._serialized_end=3668
+  _globals['_TOKENSERVICECREATERESPONSE']._serialized_start=3670
+  _globals['_TOKENSERVICECREATERESPONSE']._serialized_end=3770
+  _globals['_TOKENSERVICELISTREQUEST']._serialized_start=3772
+  _globals['_TOKENSERVICELISTREQUEST']._serialized_end=3850
+  _globals['_TOKENSERVICELISTRESPONSE']._serialized_start=3852
+  _globals['_TOKENSERVICELISTRESPONSE']._serialized_end=3928
+  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_start=3930
+  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_end=3987
+  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_start=3989
+  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_end=4017
+  _globals['_TOKENSERVICEUPDATEREQUEST']._serialized_start=4020
+  _globals['_TOKENSERVICEUPDATEREQUEST']._serialized_end=5204
   _globals['_TOKENSERVICEUPDATEREQUEST_PROJECTROLESENTRY']._serialized_start=1122
   _globals['_TOKENSERVICEUPDATEREQUEST_PROJECTROLESENTRY']._serialized_end=1217
   _globals['_TOKENSERVICEUPDATEREQUEST_TENANTROLESENTRY']._serialized_start=1219
   _globals['_TOKENSERVICEUPDATEREQUEST_TENANTROLESENTRY']._serialized_end=1312
   _globals['_TOKENSERVICEUPDATEREQUEST_MACHINEROLESENTRY']._serialized_start=1314
   _globals['_TOKENSERVICEUPDATEREQUEST_MACHINEROLESENTRY']._serialized_end=1409
-  _globals['_TOKENSERVICEUPDATERESPONSE']._serialized_start=4197
-  _globals['_TOKENSERVICEUPDATERESPONSE']._serialized_end=4273
-  _globals['_TOKENSERVICEGETREQUEST']._serialized_start=4275
-  _globals['_TOKENSERVICEGETREQUEST']._serialized_end=4329
-  _globals['_TOKENSERVICEGETRESPONSE']._serialized_start=4331
-  _globals['_TOKENSERVICEGETRESPONSE']._serialized_end=4404
-  _globals['_TOKENSERVICEREFRESHREQUEST']._serialized_start=4406
-  _globals['_TOKENSERVICEREFRESHREQUEST']._serialized_end=4434
-  _globals['_TOKENSERVICEREFRESHRESPONSE']._serialized_start=4436
-  _globals['_TOKENSERVICEREFRESHRESPONSE']._serialized_end=4537
-  _globals['_TOKENQUERY']._serialized_start=4540
-  _globals['_TOKENQUERY']._serialized_end=4869
-  _globals['_TOKENSERVICE']._serialized_start=4954
-  _globals['_TOKENSERVICE']._serialized_end=5634
+  _globals['_TOKENSERVICEUPDATERESPONSE']._serialized_start=5206
+  _globals['_TOKENSERVICEUPDATERESPONSE']._serialized_end=5282
+  _globals['_TOKENSERVICEGETREQUEST']._serialized_start=5284
+  _globals['_TOKENSERVICEGETREQUEST']._serialized_end=5338
+  _globals['_TOKENSERVICEGETRESPONSE']._serialized_start=5340
+  _globals['_TOKENSERVICEGETRESPONSE']._serialized_end=5413
+  _globals['_TOKENSERVICEREFRESHREQUEST']._serialized_start=5415
+  _globals['_TOKENSERVICEREFRESHREQUEST']._serialized_end=5443
+  _globals['_TOKENSERVICEREFRESHRESPONSE']._serialized_start=5445
+  _globals['_TOKENSERVICEREFRESHRESPONSE']._serialized_end=5546
+  _globals['_TOKENQUERY']._serialized_start=5549
+  _globals['_TOKENQUERY']._serialized_end=5878
+  _globals['_TOKENSERVICE']._serialized_start=5963
+  _globals['_TOKENSERVICE']._serialized_end=6643
 # @@protoc_insertion_point(module_scope)
diff --git a/python/metalstack/api/v2/token_pb2.pyi b/python/metalstack/api/v2/token_pb2.pyi
index 40ad85d6..072688f6 100644
--- a/python/metalstack/api/v2/token_pb2.pyi
+++ b/python/metalstack/api/v2/token_pb2.pyi
@@ -107,7 +107,7 @@ class TokenServiceCreateRequest(_message.Message):
     MACHINE_ROLES_FIELD_NUMBER: _ClassVar[int]
     LABELS_FIELD_NUMBER: _ClassVar[int]
     description: str
-    permissions: _containers.RepeatedCompositeFieldContainer[MethodPermission]
+    permissions: _containers.RepeatedCompositeFieldContainer[PermissionsByVisibility]
     expires: _duration_pb2.Duration
     project_roles: _containers.ScalarMap[str, _common_pb2.ProjectRole]
     tenant_roles: _containers.ScalarMap[str, _common_pb2.TenantRole]
@@ -115,7 +115,7 @@ class TokenServiceCreateRequest(_message.Message):
     infra_role: _common_pb2.InfraRole
     machine_roles: _containers.ScalarMap[str, _common_pb2.MachineRole]
     labels: _common_pb2.Labels
-    def __init__(self, description: _Optional[str] = ..., permissions: _Optional[_Iterable[_Union[MethodPermission, _Mapping]]] = ..., expires: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., project_roles: _Optional[_Mapping[str, _common_pb2.ProjectRole]] = ..., tenant_roles: _Optional[_Mapping[str, _common_pb2.TenantRole]] = ..., admin_role: _Optional[_Union[_common_pb2.AdminRole, str]] = ..., infra_role: _Optional[_Union[_common_pb2.InfraRole, str]] = ..., machine_roles: _Optional[_Mapping[str, _common_pb2.MachineRole]] = ..., labels: _Optional[_Union[_common_pb2.Labels, _Mapping]] = ...) -> None: ...
+    def __init__(self, description: _Optional[str] = ..., permissions: _Optional[_Iterable[_Union[PermissionsByVisibility, _Mapping]]] = ..., expires: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., project_roles: _Optional[_Mapping[str, _common_pb2.ProjectRole]] = ..., tenant_roles: _Optional[_Mapping[str, _common_pb2.TenantRole]] = ..., admin_role: _Optional[_Union[_common_pb2.AdminRole, str]] = ..., infra_role: _Optional[_Union[_common_pb2.InfraRole, str]] = ..., machine_roles: _Optional[_Mapping[str, _common_pb2.MachineRole]] = ..., labels: _Optional[_Union[_common_pb2.Labels, _Mapping]] = ...) -> None: ...
 
 class MethodPermission(_message.Message):
     __slots__ = ("subject", "methods")
@@ -125,6 +125,72 @@ class MethodPermission(_message.Message):
     methods: _containers.RepeatedScalarFieldContainer[str]
     def __init__(self, subject: _Optional[str] = ..., methods: _Optional[_Iterable[str]] = ...) -> None: ...
 
+class PermissionsByVisibility(_message.Message):
+    __slots__ = ("public", "self", "project", "tenant", "admin", "machine", "infra")
+    PUBLIC_FIELD_NUMBER: _ClassVar[int]
+    SELF_FIELD_NUMBER: _ClassVar[int]
+    PROJECT_FIELD_NUMBER: _ClassVar[int]
+    TENANT_FIELD_NUMBER: _ClassVar[int]
+    ADMIN_FIELD_NUMBER: _ClassVar[int]
+    MACHINE_FIELD_NUMBER: _ClassVar[int]
+    INFRA_FIELD_NUMBER: _ClassVar[int]
+    public: PublicPermissions
+    self: SelfPermissions
+    project: ProjectPermissions
+    tenant: TenantPermissions
+    admin: AdminPermissions
+    machine: MachinePermissions
+    infra: InfraPermissions
+    def __init__(self_, public: _Optional[_Union[PublicPermissions, _Mapping]] = ..., self: _Optional[_Union[SelfPermissions, _Mapping]] = ..., project: _Optional[_Union[ProjectPermissions, _Mapping]] = ..., tenant: _Optional[_Union[TenantPermissions, _Mapping]] = ..., admin: _Optional[_Union[AdminPermissions, _Mapping]] = ..., machine: _Optional[_Union[MachinePermissions, _Mapping]] = ..., infra: _Optional[_Union[InfraPermissions, _Mapping]] = ...) -> None: ...
+
+class PublicPermissions(_message.Message):
+    __slots__ = ("methods",)
+    METHODS_FIELD_NUMBER: _ClassVar[int]
+    methods: _containers.RepeatedScalarFieldContainer[str]
+    def __init__(self, methods: _Optional[_Iterable[str]] = ...) -> None: ...
+
+class SelfPermissions(_message.Message):
+    __slots__ = ("methods",)
+    METHODS_FIELD_NUMBER: _ClassVar[int]
+    methods: _containers.RepeatedScalarFieldContainer[str]
+    def __init__(self, methods: _Optional[_Iterable[str]] = ...) -> None: ...
+
+class ProjectPermissions(_message.Message):
+    __slots__ = ("project", "methods")
+    PROJECT_FIELD_NUMBER: _ClassVar[int]
+    METHODS_FIELD_NUMBER: _ClassVar[int]
+    project: str
+    methods: _containers.RepeatedScalarFieldContainer[str]
+    def __init__(self, project: _Optional[str] = ..., methods: _Optional[_Iterable[str]] = ...) -> None: ...
+
+class TenantPermissions(_message.Message):
+    __slots__ = ("login", "methods")
+    LOGIN_FIELD_NUMBER: _ClassVar[int]
+    METHODS_FIELD_NUMBER: _ClassVar[int]
+    login: str
+    methods: _containers.RepeatedScalarFieldContainer[str]
+    def __init__(self, login: _Optional[str] = ..., methods: _Optional[_Iterable[str]] = ...) -> None: ...
+
+class AdminPermissions(_message.Message):
+    __slots__ = ("methods",)
+    METHODS_FIELD_NUMBER: _ClassVar[int]
+    methods: _containers.RepeatedScalarFieldContainer[str]
+    def __init__(self, methods: _Optional[_Iterable[str]] = ...) -> None: ...
+
+class MachinePermissions(_message.Message):
+    __slots__ = ("uuid", "methods")
+    UUID_FIELD_NUMBER: _ClassVar[int]
+    METHODS_FIELD_NUMBER: _ClassVar[int]
+    uuid: str
+    methods: _containers.RepeatedScalarFieldContainer[str]
+    def __init__(self, uuid: _Optional[str] = ..., methods: _Optional[_Iterable[str]] = ...) -> None: ...
+
+class InfraPermissions(_message.Message):
+    __slots__ = ("methods",)
+    METHODS_FIELD_NUMBER: _ClassVar[int]
+    methods: _containers.RepeatedScalarFieldContainer[str]
+    def __init__(self, methods: _Optional[_Iterable[str]] = ...) -> None: ...
+
 class TokenServiceCreateResponse(_message.Message):
     __slots__ = ("token", "secret")
     TOKEN_FIELD_NUMBER: _ClassVar[int]
@@ -191,14 +257,14 @@ class TokenServiceUpdateRequest(_message.Message):
     uuid: str
     update_meta: _common_pb2.UpdateMeta
     description: str
-    permissions: _containers.RepeatedCompositeFieldContainer[MethodPermission]
+    permissions: _containers.RepeatedCompositeFieldContainer[PermissionsByVisibility]
     project_roles: _containers.ScalarMap[str, _common_pb2.ProjectRole]
     tenant_roles: _containers.ScalarMap[str, _common_pb2.TenantRole]
     admin_role: _common_pb2.AdminRole
     infra_role: _common_pb2.InfraRole
     machine_roles: _containers.ScalarMap[str, _common_pb2.MachineRole]
     labels: _common_pb2.UpdateLabels
-    def __init__(self, uuid: _Optional[str] = ..., update_meta: _Optional[_Union[_common_pb2.UpdateMeta, _Mapping]] = ..., description: _Optional[str] = ..., permissions: _Optional[_Iterable[_Union[MethodPermission, _Mapping]]] = ..., project_roles: _Optional[_Mapping[str, _common_pb2.ProjectRole]] = ..., tenant_roles: _Optional[_Mapping[str, _common_pb2.TenantRole]] = ..., admin_role: _Optional[_Union[_common_pb2.AdminRole, str]] = ..., infra_role: _Optional[_Union[_common_pb2.InfraRole, str]] = ..., machine_roles: _Optional[_Mapping[str, _common_pb2.MachineRole]] = ..., labels: _Optional[_Union[_common_pb2.UpdateLabels, _Mapping]] = ...) -> None: ...
+    def __init__(self, uuid: _Optional[str] = ..., update_meta: _Optional[_Union[_common_pb2.UpdateMeta, _Mapping]] = ..., description: _Optional[str] = ..., permissions: _Optional[_Iterable[_Union[PermissionsByVisibility, _Mapping]]] = ..., project_roles: _Optional[_Mapping[str, _common_pb2.ProjectRole]] = ..., tenant_roles: _Optional[_Mapping[str, _common_pb2.TenantRole]] = ..., admin_role: _Optional[_Union[_common_pb2.AdminRole, str]] = ..., infra_role: _Optional[_Union[_common_pb2.InfraRole, str]] = ..., machine_roles: _Optional[_Mapping[str, _common_pb2.MachineRole]] = ..., labels: _Optional[_Union[_common_pb2.UpdateLabels, _Mapping]] = ...) -> None: ...
 
 class TokenServiceUpdateResponse(_message.Message):
     __slots__ = ("token",)
diff --git a/python/metalstack/infra/v2/event_pb2.py b/python/metalstack/infra/v2/event_pb2.py
index b25695ed..46ddea52 100644
--- a/python/metalstack/infra/v2/event_pb2.py
+++ b/python/metalstack/infra/v2/event_pb2.py
@@ -22,13 +22,11 @@
 _sym_db = _symbol_database.Default()
 
 
-from buf.validate import validate_pb2 as buf_dot_validate_dot_validate__pb2
-from google.protobuf import timestamp_pb2 as google_dot_protobuf_dot_timestamp__pb2
 from metalstack.api.v2 import common_pb2 as metalstack_dot_api_dot_v2_dot_common__pb2
 from metalstack.api.v2 import machine_pb2 as metalstack_dot_api_dot_v2_dot_machine__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1fmetalstack/infra/v2/event.proto\x12\x13metalstack.infra.v2\x1a\x1b\x62uf/validate/validate.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1emetalstack/api/v2/common.proto\x1a\x1fmetalstack/api/v2/machine.proto\"\xd3\x01\n\x17\x45ventServiceSendRequest\x12P\n\x06\x65vents\x18\x01 \x03(\x0b\x32\x38.metalstack.infra.v2.EventServiceSendRequest.EventsEntryR\x06\x65vents\x1a\x66\n\x0b\x45ventsEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x41\n\x05value\x18\x02 \x01(\x0b\x32+.metalstack.api.v2.MachineProvisioningEventR\x05value:\x02\x38\x01\"J\n\x18\x45ventServiceSendResponse\x12\x16\n\x06\x65vents\x18\x01 \x01(\x04R\x06\x65vents\x12\x16\n\x06\x66\x61iled\x18\x02 \x03(\tR\x06\x66\x61iled2~\n\x0c\x45ventService\x12n\n\x04Send\x12,.metalstack.infra.v2.EventServiceSendRequest\x1a-.metalstack.infra.v2.EventServiceSendResponse\"\t\xe0\xf3\x18\x02\xea\xf3\x18\x01\x01\x42\xce\x01\n\x17\x63om.metalstack.infra.v2B\nEventProtoP\x01Z9github.com/metal-stack/api/go/metalstack/infra/v2;infrav2\xa2\x02\x03MIX\xaa\x02\x13Metalstack.Infra.V2\xca\x02\x13Metalstack\\Infra\\V2\xe2\x02\x1fMetalstack\\Infra\\V2\\GPBMetadata\xea\x02\x15Metalstack::Infra::V2b\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x1fmetalstack/infra/v2/event.proto\x12\x13metalstack.infra.v2\x1a\x1emetalstack/api/v2/common.proto\x1a\x1fmetalstack/api/v2/machine.proto\"\xd3\x01\n\x17\x45ventServiceSendRequest\x12P\n\x06\x65vents\x18\x01 \x03(\x0b\x32\x38.metalstack.infra.v2.EventServiceSendRequest.EventsEntryR\x06\x65vents\x1a\x66\n\x0b\x45ventsEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12\x41\n\x05value\x18\x02 \x01(\x0b\x32+.metalstack.api.v2.MachineProvisioningEventR\x05value:\x02\x38\x01\"J\n\x18\x45ventServiceSendResponse\x12\x16\n\x06\x65vents\x18\x01 \x01(\x04R\x06\x65vents\x12\x16\n\x06\x66\x61iled\x18\x02 \x03(\tR\x06\x66\x61iled2~\n\x0c\x45ventService\x12n\n\x04Send\x12,.metalstack.infra.v2.EventServiceSendRequest\x1a-.metalstack.infra.v2.EventServiceSendResponse\"\t\xe0\xf3\x18\x02\xea\xf3\x18\x01\x01\x42\xce\x01\n\x17\x63om.metalstack.infra.v2B\nEventProtoP\x01Z9github.com/metal-stack/api/go/metalstack/infra/v2;infrav2\xa2\x02\x03MIX\xaa\x02\x13Metalstack.Infra.V2\xca\x02\x13Metalstack\\Infra\\V2\xe2\x02\x1fMetalstack\\Infra\\V2\\GPBMetadata\xea\x02\x15Metalstack::Infra::V2b\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -40,12 +38,12 @@
   _globals['_EVENTSERVICESENDREQUEST_EVENTSENTRY']._serialized_options = b'8\001'
   _globals['_EVENTSERVICE'].methods_by_name['Send']._loaded_options = None
   _globals['_EVENTSERVICE'].methods_by_name['Send']._serialized_options = b'\340\363\030\002\352\363\030\001\001'
-  _globals['_EVENTSERVICESENDREQUEST']._serialized_start=184
-  _globals['_EVENTSERVICESENDREQUEST']._serialized_end=395
-  _globals['_EVENTSERVICESENDREQUEST_EVENTSENTRY']._serialized_start=293
-  _globals['_EVENTSERVICESENDREQUEST_EVENTSENTRY']._serialized_end=395
-  _globals['_EVENTSERVICESENDRESPONSE']._serialized_start=397
-  _globals['_EVENTSERVICESENDRESPONSE']._serialized_end=471
-  _globals['_EVENTSERVICE']._serialized_start=473
-  _globals['_EVENTSERVICE']._serialized_end=599
+  _globals['_EVENTSERVICESENDREQUEST']._serialized_start=122
+  _globals['_EVENTSERVICESENDREQUEST']._serialized_end=333
+  _globals['_EVENTSERVICESENDREQUEST_EVENTSENTRY']._serialized_start=231
+  _globals['_EVENTSERVICESENDREQUEST_EVENTSENTRY']._serialized_end=333
+  _globals['_EVENTSERVICESENDRESPONSE']._serialized_start=335
+  _globals['_EVENTSERVICESENDRESPONSE']._serialized_end=409
+  _globals['_EVENTSERVICE']._serialized_start=411
+  _globals['_EVENTSERVICE']._serialized_end=537
 # @@protoc_insertion_point(module_scope)
diff --git a/python/metalstack/infra/v2/event_pb2.pyi b/python/metalstack/infra/v2/event_pb2.pyi
index ea14d0bb..b0e5b362 100644
--- a/python/metalstack/infra/v2/event_pb2.pyi
+++ b/python/metalstack/infra/v2/event_pb2.pyi
@@ -1,5 +1,3 @@
-from buf.validate import validate_pb2 as _validate_pb2
-from google.protobuf import timestamp_pb2 as _timestamp_pb2
 from metalstack.api.v2 import common_pb2 as _common_pb2
 from metalstack.api.v2 import machine_pb2 as _machine_pb2
 from google.protobuf.internal import containers as _containers