From 40358645be0b0b703b77d95cbc14985cf3f572e5 Mon Sep 17 00:00:00 2001
From: Valentin Knabel <dev@vknabel.com>
Date: Fri, 11 Sep 2026 11:46:45 +0200
Subject: [PATCH] feat: tokens

---
 doc/index.html                              | 280 +++++++-
 go/fits/api/v1/predefined_rules.pb.go       | 118 +++-
 go/fits/api/v1/token.pb.go                  | 666 ++++++++++++++++----
 js/fits/api/v1/predefined_rules_pb.d.ts     |  30 +
 js/fits/api/v1/predefined_rules_pb.js       |  44 +-
 js/fits/api/v1/predefined_rules_pb.ts       |  54 +-
 js/fits/api/v1/token_pb.d.ts                | 177 +++++-
 js/fits/api/v1/token_pb.js                  |  54 +-
 js/fits/api/v1/token_pb.ts                  | 218 ++++++-
 proto/fits/api/v1/predefined_rules.proto    |  31 +
 proto/fits/api/v1/token.proto               |  62 +-
 python/fits/api/v1/predefined_rules_pb2.py  |  12 +-
 python/fits/api/v1/predefined_rules_pb2.pyi |  10 +
 python/fits/api/v1/token_pb2.py             |  86 ++-
 python/fits/api/v1/token_pb2.pyi            |  56 +-
 15 files changed, 1666 insertions(+), 232 deletions(-)

diff --git a/doc/index.html b/doc/index.html
index 1d54944..821f16f 100644
--- a/doc/index.html
+++ b/doc/index.html
@@ -236,6 +236,26 @@ <h2>Table of Contents</h2>
                   <a href="#fits%2fapi%2fv1%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
                 </li>
               
+                <li>
+                  <a href="#fits%2fapi%2fv1%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                </li>
+              
+                <li>
+                  <a href="#fits%2fapi%2fv1%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                </li>
+              
+                <li>
+                  <a href="#fits%2fapi%2fv1%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                </li>
+              
+                <li>
+                  <a href="#fits%2fapi%2fv1%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                </li>
+              
+                <li>
+                  <a href="#fits%2fapi%2fv1%2fpredefined_rules.proto-extensions"><span class="badge">X</span>File-level Extensions</a>
+                </li>
+              
               
             </ul>
           </li>
@@ -446,10 +466,34 @@ <h2>Table of Contents</h2>
             <a href="#fits%2fapi%2fv1%2ftoken.proto">fits/api/v1/token.proto</a>
             <ul>
               
+                <li>
+                  <a href="#fits.api.v1.AdminPermissions"><span class="badge">M</span>AdminPermissions</a>
+                </li>
+              
                 <li>
                   <a href="#fits.api.v1.MethodPermission"><span class="badge">M</span>MethodPermission</a>
                 </li>
               
+                <li>
+                  <a href="#fits.api.v1.PermissionsByVisibility"><span class="badge">M</span>PermissionsByVisibility</a>
+                </li>
+              
+                <li>
+                  <a href="#fits.api.v1.ProjectPermissions"><span class="badge">M</span>ProjectPermissions</a>
+                </li>
+              
+                <li>
+                  <a href="#fits.api.v1.PublicPermissions"><span class="badge">M</span>PublicPermissions</a>
+                </li>
+              
+                <li>
+                  <a href="#fits.api.v1.SelfPermissions"><span class="badge">M</span>SelfPermissions</a>
+                </li>
+              
+                <li>
+                  <a href="#fits.api.v1.TenantPermissions"><span class="badge">M</span>TenantPermissions</a>
+                </li>
+              
                 <li>
                   <a href="#fits.api.v1.Token"><span class="badge">M</span>Token</a>
                 </li>
@@ -763,6 +807,22 @@ <h3 id="fits/api/v1/predefined_rules.proto-extensions">File-level Extensions</h3
                 <td><p>Keys trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end</p></td>
               </tr>
             
+              <tr>
+                <td>project_roles_keys_valid</td>
+                <td><a href="#bool">bool</a></td>
+                <td><a href="#buf.validate.MapRules">.buf.validate.MapRules</a></td>
+                <td>80068953</td>
+                <td><p>ProjectRolesKeysValid ensures that project roles keys met our requirements.</p></td>
+              </tr>
+            
+              <tr>
+                <td>tenant_roles_keys_valid</td>
+                <td><a href="#bool">bool</a></td>
+                <td><a href="#buf.validate.MapRules">.buf.validate.MapRules</a></td>
+                <td>80068954</td>
+                <td><p>TenantRolesKeysValid ensures that tenant roles keys met our requirements.</p></td>
+              </tr>
+            
               <tr>
                 <td>all_trimmed</td>
                 <td><a href="#bool">bool</a></td>
@@ -835,6 +895,30 @@ <h3 id="fits/api/v1/predefined_rules.proto-extensions">File-level Extensions</h3
                 <td><p>IsPrefix validates if the given string is a valid prefix</p></td>
               </tr>
             
+              <tr>
+                <td>is_project_subject_permission</td>
+                <td><a href="#bool">bool</a></td>
+                <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
+                <td>80048964</td>
+                <td><p>IsProjectSubjectPermission returns true if name field satisfies our requirements.</p></td>
+              </tr>
+            
+              <tr>
+                <td>is_tenant_login</td>
+                <td><a href="#bool">bool</a></td>
+                <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
+                <td>80048962</td>
+                <td><p>IsTenantLogin returns true if name field satisfies our requirements.</p></td>
+              </tr>
+            
+              <tr>
+                <td>is_tenant_subject_permission</td>
+                <td><a href="#bool">bool</a></td>
+                <td><a href="#buf.validate.StringRules">.buf.validate.StringRules</a></td>
+                <td>80048963</td>
+                <td><p>IsTenantSubjectPermission returns true if name field satisfies our requirements.</p></td>
+              </tr>
+            
               <tr>
                 <td>is_uri</td>
                 <td><a href="#bool">bool</a></td>
@@ -2241,6 +2325,30 @@ <h2 id="fits/api/v1/token.proto">fits/api/v1/token.proto</h2><a href="#title">To
       <p></p>
 
       
+        <h3 id="fits.api.v1.AdminPermissions">AdminPermissions</h3>
+        <p>AdminPermissions carries admin method permissions.</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>methods</td>
+                  <td><a href="#string">string</a></td>
+                  <td>repeated</td>
+                  <td><p>Methods which should be accessible. </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
         <h3 id="fits.api.v1.MethodPermission">MethodPermission</h3>
         <p>MethodPermission is a mapping from a subject/project to a service method</p>
 
@@ -2277,6 +2385,170 @@ <h3 id="fits.api.v1.MethodPermission">MethodPermission</h3>
 
         
       
+        <h3 id="fits.api.v1.PermissionsByVisibility">PermissionsByVisibility</h3>
+        <p>PermissionsByVisibility contains method permissions by visibility.</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>public</td>
+                  <td><a href="#fits.api.v1.PublicPermissions">PublicPermissions</a></td>
+                  <td></td>
+                  <td><p>PublicPermissions carries public method permissions. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>self</td>
+                  <td><a href="#fits.api.v1.SelfPermissions">SelfPermissions</a></td>
+                  <td></td>
+                  <td><p>SelfPermissions carries self method permissions. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>project</td>
+                  <td><a href="#fits.api.v1.ProjectPermissions">ProjectPermissions</a></td>
+                  <td></td>
+                  <td><p>ProjectPermissions carries project method permissions. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>tenant</td>
+                  <td><a href="#fits.api.v1.TenantPermissions">TenantPermissions</a></td>
+                  <td></td>
+                  <td><p>TenantPermissions carries tenant method permissions. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>admin</td>
+                  <td><a href="#fits.api.v1.AdminPermissions">AdminPermissions</a></td>
+                  <td></td>
+                  <td><p>AdminPermissions carries admin method permissions. </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="fits.api.v1.ProjectPermissions">ProjectPermissions</h3>
+        <p>ProjectPermissions carries project method permissions.</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>project</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Project scope for the permissions.
+Asterisk (*) can be specified to match any subject. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>methods</td>
+                  <td><a href="#string">string</a></td>
+                  <td>repeated</td>
+                  <td><p>Methods which should be accessible. </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="fits.api.v1.PublicPermissions">PublicPermissions</h3>
+        <p>PublicPermissions carries public method permissions.</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>methods</td>
+                  <td><a href="#string">string</a></td>
+                  <td>repeated</td>
+                  <td><p>Methods which should be accessible. </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="fits.api.v1.SelfPermissions">SelfPermissions</h3>
+        <p>SelfPermissions carries self method permissions.</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>methods</td>
+                  <td><a href="#string">string</a></td>
+                  <td>repeated</td>
+                  <td><p>Methods which should be accessible. </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
+        <h3 id="fits.api.v1.TenantPermissions">TenantPermissions</h3>
+        <p>TenantPermissions carries tenant method permissions.</p>
+
+        
+          <table class="field-table">
+            <thead>
+              <tr><td>Field</td><td>Type</td><td>Label</td><td>Description</td></tr>
+            </thead>
+            <tbody>
+              
+                <tr>
+                  <td>login</td>
+                  <td><a href="#string">string</a></td>
+                  <td></td>
+                  <td><p>Login of the tenant.
+Asterisk (*) can be specified to match any subject. </p></td>
+                </tr>
+              
+                <tr>
+                  <td>methods</td>
+                  <td><a href="#string">string</a></td>
+                  <td>repeated</td>
+                  <td><p>Methods which should be accessible. </p></td>
+                </tr>
+              
+            </tbody>
+          </table>
+
+          
+
+        
+      
         <h3 id="fits.api.v1.Token">Token</h3>
         <p>Token generates a jwt authentication token to access the api</p><p>There are two different types of tokens, api- and user- tokens</p><p>A user token is used to authenticate end user requests for example from a cli.</p><p>The configured roles in a user token are expanded in the api server</p><p>based on the memberships in other projects and tenants based on the role granted there.</p><p>User tokens will never contain permissions.</p><p>Permissions are always derived from the tenant and project roles and memberships.</p><p>The api token should be used to authenticate services.</p><p>In contrast to a user token, the api token permissions and roles apply as configured during the token create process.</p>
 
@@ -2452,9 +2724,9 @@ <h3 id="fits.api.v1.TokenServiceCreateRequest">TokenServiceCreateRequest</h3>
               
                 <tr>
                   <td>permissions</td>
-                  <td><a href="#fits.api.v1.MethodPermission">MethodPermission</a></td>
+                  <td><a href="#fits.api.v1.PermissionsByVisibility">PermissionsByVisibility</a></td>
                   <td>repeated</td>
-                  <td><p>Permissions is a list of service methods this token can be used for </p></td>
+                  <td><p>Permissions is a list of service methods this token can be used for. </p></td>
                 </tr>
               
                 <tr>
@@ -2774,9 +3046,9 @@ <h3 id="fits.api.v1.TokenServiceUpdateRequest">TokenServiceUpdateRequest</h3>
               
                 <tr>
                   <td>permissions</td>
-                  <td><a href="#fits.api.v1.MethodPermission">MethodPermission</a></td>
+                  <td><a href="#fits.api.v1.PermissionsByVisibility">PermissionsByVisibility</a></td>
                   <td>repeated</td>
-                  <td><p>Permissions is a list of service methods this token can be used for </p></td>
+                  <td><p>Permissions is a list of service methods this token can be used for. </p></td>
                 </tr>
               
                 <tr>
diff --git a/go/fits/api/v1/predefined_rules.pb.go b/go/fits/api/v1/predefined_rules.pb.go
index 534ebe2..898c1c5 100644
--- a/go/fits/api/v1/predefined_rules.pb.go
+++ b/go/fits/api/v1/predefined_rules.pb.go
@@ -86,6 +86,30 @@ var file_fits_api_v1_predefined_rules_proto_extTypes = []protoimpl.ExtensionInfo
 		Tag:           "varint,80048958,opt,name=trimmed",
 		Filename:      "fits/api/v1/predefined_rules.proto",
 	},
+	{
+		ExtendedType:  (*validate.StringRules)(nil),
+		ExtensionType: (*bool)(nil),
+		Field:         80048962,
+		Name:          "fits.api.v1.is_tenant_login",
+		Tag:           "varint,80048962,opt,name=is_tenant_login",
+		Filename:      "fits/api/v1/predefined_rules.proto",
+	},
+	{
+		ExtendedType:  (*validate.StringRules)(nil),
+		ExtensionType: (*bool)(nil),
+		Field:         80048963,
+		Name:          "fits.api.v1.is_tenant_subject_permission",
+		Tag:           "varint,80048963,opt,name=is_tenant_subject_permission",
+		Filename:      "fits/api/v1/predefined_rules.proto",
+	},
+	{
+		ExtendedType:  (*validate.StringRules)(nil),
+		ExtensionType: (*bool)(nil),
+		Field:         80048964,
+		Name:          "fits.api.v1.is_project_subject_permission",
+		Tag:           "varint,80048964,opt,name=is_project_subject_permission",
+		Filename:      "fits/api/v1/predefined_rules.proto",
+	},
 	{
 		ExtendedType:  (*validate.RepeatedRules)(nil),
 		ExtensionType: (*bool)(nil),
@@ -134,6 +158,22 @@ var file_fits_api_v1_predefined_rules_proto_extTypes = []protoimpl.ExtensionInfo
 		Tag:           "varint,80068952,opt,name=keys_trimmed",
 		Filename:      "fits/api/v1/predefined_rules.proto",
 	},
+	{
+		ExtendedType:  (*validate.MapRules)(nil),
+		ExtensionType: (*bool)(nil),
+		Field:         80068953,
+		Name:          "fits.api.v1.project_roles_keys_valid",
+		Tag:           "varint,80068953,opt,name=project_roles_keys_valid",
+		Filename:      "fits/api/v1/predefined_rules.proto",
+	},
+	{
+		ExtendedType:  (*validate.MapRules)(nil),
+		ExtensionType: (*bool)(nil),
+		Field:         80068954,
+		Name:          "fits.api.v1.tenant_roles_keys_valid",
+		Tag:           "varint,80068954,opt,name=tenant_roles_keys_valid",
+		Filename:      "fits/api/v1/predefined_rules.proto",
+	},
 }
 
 // Extension fields to validate.StringRules.
@@ -170,6 +210,18 @@ var (
 	//
 	// optional bool trimmed = 80048958;
 	E_Trimmed = &file_fits_api_v1_predefined_rules_proto_extTypes[7]
+	// IsTenantLogin returns true if name field satisfies our requirements.
+	//
+	// optional bool is_tenant_login = 80048962;
+	E_IsTenantLogin = &file_fits_api_v1_predefined_rules_proto_extTypes[8]
+	// IsTenantSubjectPermission returns true if name field satisfies our requirements.
+	//
+	// optional bool is_tenant_subject_permission = 80048963;
+	E_IsTenantSubjectPermission = &file_fits_api_v1_predefined_rules_proto_extTypes[9]
+	// IsProjectSubjectPermission returns true if name field satisfies our requirements.
+	//
+	// optional bool is_project_subject_permission = 80048964;
+	E_IsProjectSubjectPermission = &file_fits_api_v1_predefined_rules_proto_extTypes[10]
 )
 
 // Extension fields to validate.RepeatedRules.
@@ -177,19 +229,19 @@ var (
 	// Prefixes validates if a slice of prefixes in string form are valid
 	//
 	// optional bool prefixes = 80058951;
-	E_Prefixes = &file_fits_api_v1_predefined_rules_proto_extTypes[8]
+	E_Prefixes = &file_fits_api_v1_predefined_rules_proto_extTypes[11]
 	// Ips validates if a slice of ips in string form are valid
 	//
 	// optional bool ips = 80058952;
-	E_Ips = &file_fits_api_v1_predefined_rules_proto_extTypes[9]
+	E_Ips = &file_fits_api_v1_predefined_rules_proto_extTypes[12]
 	// AreHostAndPort validates if a slice of strings are all in the form of <ip | host>:<port>
 	//
 	// optional bool are_host_and_port = 80058953;
-	E_AreHostAndPort = &file_fits_api_v1_predefined_rules_proto_extTypes[10]
+	E_AreHostAndPort = &file_fits_api_v1_predefined_rules_proto_extTypes[13]
 	// All Trimmed enforces all strings to be trimmed, e.g. no whitespaces at the begin and end
 	//
 	// optional bool all_trimmed = 80058954;
-	E_AllTrimmed = &file_fits_api_v1_predefined_rules_proto_extTypes[11]
+	E_AllTrimmed = &file_fits_api_v1_predefined_rules_proto_extTypes[14]
 )
 
 // Extension fields to validate.MapRules.
@@ -197,11 +249,19 @@ var (
 	// Keys and Values trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
 	//
 	// optional bool keys_and_values_trimmed = 80068951;
-	E_KeysAndValuesTrimmed = &file_fits_api_v1_predefined_rules_proto_extTypes[12]
+	E_KeysAndValuesTrimmed = &file_fits_api_v1_predefined_rules_proto_extTypes[15]
 	// Keys trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
 	//
 	// optional bool keys_trimmed = 80068952;
-	E_KeysTrimmed = &file_fits_api_v1_predefined_rules_proto_extTypes[13]
+	E_KeysTrimmed = &file_fits_api_v1_predefined_rules_proto_extTypes[16]
+	// ProjectRolesKeysValid ensures that project roles keys met our requirements.
+	//
+	// optional bool project_roles_keys_valid = 80068953;
+	E_ProjectRolesKeysValid = &file_fits_api_v1_predefined_rules_proto_extTypes[17]
+	// TenantRolesKeysValid ensures that tenant roles keys met our requirements.
+	//
+	// optional bool tenant_roles_keys_valid = 80068954;
+	E_TenantRolesKeysValid = &file_fits_api_v1_predefined_rules_proto_extTypes[18]
 )
 
 var File_fits_api_v1_predefined_rules_proto protoreflect.FileDescriptor
@@ -235,7 +295,16 @@ const file_fits_api_v1_predefined_rules_proto_rawDesc = "" +
 	"\rvalid_address\x12&must be a valid IP address or hostname\x1a this.isIp() || this.isHostname()R\x0eisIpOrHostname:\x9d\x01\n" +
 	"\atrimmed\x12\x19.buf.validate.StringRules\x18\xbe\xe6\x95& \x01(\bBe\xc2Hb\n" +
 	"`\n" +
-	"\x0estring.trimmed\x12+value must not start or end with whitespace\x1a!this.trim().size() == this.size()R\atrimmed:\x8f\x01\n" +
+	"\x0estring.trimmed\x12+value must not start or end with whitespace\x1a!this.trim().size() == this.size()R\atrimmed:\xb0\x01\n" +
+	"\x0fis_tenant_login\x12\x19.buf.validate.StringRules\x18\xc2\xe6\x95& \x01(\bBj\xc2Hg\n" +
+	"e\n" +
+	"\x16string.is_tenant_login\x12#must be within 2 and 128 characters\x1a&this.size() >= 2 && this.size() <= 128R\risTenantLogin:\xef\x01\n" +
+	"\x1cis_tenant_subject_permission\x12\x19.buf.validate.StringRules\x18\xc3\xe6\x95& \x01(\bB\x8f\x01\xc2H\x8b\x01\n" +
+	"\x88\x01\n" +
+	"#string.is_tenant_subject_permission\x12*must be '*' or within 2 and 128 characters\x1a5this == '*' || this.size() >= 2 && this.size() <= 128R\x19isTenantSubjectPermission:\x94\x02\n" +
+	"\x1dis_project_subject_permission\x12\x19.buf.validate.StringRules\x18\xc4\xe6\x95& \x01(\bB\xb2\x01\xc2H\xae\x01\n" +
+	"\xab\x01\n" +
+	"$string.is_project_subject_permission\x12\x15must be '*' or a uuid\x1althis == '*' || this.matches('^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$')R\x1aisProjectSubjectPermission:\x8f\x01\n" +
 	"\bprefixes\x12\x1b.buf.validate.RepeatedRules\x18Ǵ\x96& \x01(\bBS\xc2HP\n" +
 	"N\n" +
 	"\x11repeated.prefixes\x12\x1cgiven prefixes must be valid\x1a\x1bthis.all(m, m.isIpPrefix())R\bprefixes:u\n" +
@@ -254,7 +323,13 @@ const file_fits_api_v1_predefined_rules_proto_rawDesc = "" +
 	"\x1bmap.keys_and_values_trimmed\x125keys and values must not start or end with whitespace\x1aTthis.all(k, k.trim().size() == k.size()) && this.all(v, v.trim().size() == v.size())R\x14keysAndValuesTrimmed:\xab\x01\n" +
 	"\fkeys_trimmed\x12\x16.buf.validate.MapRules\x18\u0602\x97& \x01(\bBm\xc2Hj\n" +
 	"h\n" +
-	"\x10map.keys_trimmed\x12*keys must not start or end with whitespace\x1a(this.all(k, k.trim().size() == k.size())R\vkeysTrimmedB\xa0\x01\n" +
+	"\x10map.keys_trimmed\x12*keys must not start or end with whitespace\x1a(this.all(k, k.trim().size() == k.size())R\vkeysTrimmed:\x92\x02\n" +
+	"\x18project_roles_keys_valid\x12\x16.buf.validate.MapRules\x18ق\x97& \x01(\bB\xbd\x01\xc2H\xb9\x01\n" +
+	"\xb6\x01\n" +
+	"\x17project_roles.key.valid\x12&subject must be a '*', or a valid UUID\x1asthis.all(k, k == '*' || k.matches('^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$'))R\x15projectRolesKeysValid:\xe8\x01\n" +
+	"\x17tenant_roles_keys_valid\x12\x16.buf.validate.MapRules\x18ڂ\x97& \x01(\bB\x95\x01\xc2H\x91\x01\n" +
+	"\x8e\x01\n" +
+	"\x16tenant_roles.key.valid\x123subject must be '*' or between 2 and 128 characters\x1a?this.all(k, k == '*' || this.size() >= 2 || this.size() <=128 )R\x14tenantRolesKeysValidB\xa0\x01\n" +
 	"\x0fcom.fits.api.v1B\x14PredefinedRulesProtoP\x01Z)github.com/fi-ts/api/go/fits/api/v1;apiv1\xa2\x02\x03FAX\xaa\x02\vFits.Api.V1\xca\x02\vFits\\Api\\V1\xe2\x02\x17Fits\\Api\\V1\\GPBMetadata\xea\x02\rFits::Api::V1"
 
 var file_fits_api_v1_predefined_rules_proto_goTypes = []any{
@@ -271,16 +346,21 @@ var file_fits_api_v1_predefined_rules_proto_depIdxs = []int32{
 	0,  // 5: fits.api.v1.is_uri:extendee -> buf.validate.StringRules
 	0,  // 6: fits.api.v1.is_ip_or_hostname:extendee -> buf.validate.StringRules
 	0,  // 7: fits.api.v1.trimmed:extendee -> buf.validate.StringRules
-	1,  // 8: fits.api.v1.prefixes:extendee -> buf.validate.RepeatedRules
-	1,  // 9: fits.api.v1.ips:extendee -> buf.validate.RepeatedRules
-	1,  // 10: fits.api.v1.are_host_and_port:extendee -> buf.validate.RepeatedRules
-	1,  // 11: fits.api.v1.all_trimmed:extendee -> buf.validate.RepeatedRules
-	2,  // 12: fits.api.v1.keys_and_values_trimmed:extendee -> buf.validate.MapRules
-	2,  // 13: fits.api.v1.keys_trimmed:extendee -> buf.validate.MapRules
-	14, // [14:14] is the sub-list for method output_type
-	14, // [14:14] is the sub-list for method input_type
-	14, // [14:14] is the sub-list for extension type_name
-	0,  // [0:14] is the sub-list for extension extendee
+	0,  // 8: fits.api.v1.is_tenant_login:extendee -> buf.validate.StringRules
+	0,  // 9: fits.api.v1.is_tenant_subject_permission:extendee -> buf.validate.StringRules
+	0,  // 10: fits.api.v1.is_project_subject_permission:extendee -> buf.validate.StringRules
+	1,  // 11: fits.api.v1.prefixes:extendee -> buf.validate.RepeatedRules
+	1,  // 12: fits.api.v1.ips:extendee -> buf.validate.RepeatedRules
+	1,  // 13: fits.api.v1.are_host_and_port:extendee -> buf.validate.RepeatedRules
+	1,  // 14: fits.api.v1.all_trimmed:extendee -> buf.validate.RepeatedRules
+	2,  // 15: fits.api.v1.keys_and_values_trimmed:extendee -> buf.validate.MapRules
+	2,  // 16: fits.api.v1.keys_trimmed:extendee -> buf.validate.MapRules
+	2,  // 17: fits.api.v1.project_roles_keys_valid:extendee -> buf.validate.MapRules
+	2,  // 18: fits.api.v1.tenant_roles_keys_valid:extendee -> buf.validate.MapRules
+	19, // [19:19] is the sub-list for method output_type
+	19, // [19:19] is the sub-list for method input_type
+	19, // [19:19] is the sub-list for extension type_name
+	0,  // [0:19] is the sub-list for extension extendee
 	0,  // [0:0] is the sub-list for field type_name
 }
 
@@ -296,7 +376,7 @@ func file_fits_api_v1_predefined_rules_proto_init() {
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_fits_api_v1_predefined_rules_proto_rawDesc), len(file_fits_api_v1_predefined_rules_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   0,
-			NumExtensions: 14,
+			NumExtensions: 19,
 			NumServices:   0,
 		},
 		GoTypes:           file_fits_api_v1_predefined_rules_proto_goTypes,
diff --git a/go/fits/api/v1/token.pb.go b/go/fits/api/v1/token.pb.go
index 64e5f07..68e0336 100644
--- a/go/fits/api/v1/token.pb.go
+++ b/go/fits/api/v1/token.pb.go
@@ -229,8 +229,8 @@ type TokenServiceCreateRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// Description of the token
 	Description string `protobuf:"bytes,1,opt,name=description,proto3" json:"description,omitempty"`
-	// Permissions is a list of service methods this token can be used for
-	Permissions []*MethodPermission `protobuf:"bytes,2,rep,name=permissions,proto3" json:"permissions,omitempty"`
+	// Permissions is a list of service methods this token can be used for.
+	Permissions []*PermissionsByVisibility `protobuf:"bytes,2,rep,name=permissions,proto3" json:"permissions,omitempty"`
 	// Expires gives the duration since now, after which this token can not be used anymore
 	Expires *durationpb.Duration `protobuf:"bytes,3,opt,name=expires,proto3" json:"expires,omitempty"`
 	// ProjectRoles associates a project id with the corresponding role of the token owner
@@ -282,7 +282,7 @@ func (x *TokenServiceCreateRequest) GetDescription() string {
 	return ""
 }
 
-func (x *TokenServiceCreateRequest) GetPermissions() []*MethodPermission {
+func (x *TokenServiceCreateRequest) GetPermissions() []*PermissionsByVisibility {
 	if x != nil {
 		return x.Permissions
 	}
@@ -384,6 +384,394 @@ func (x *MethodPermission) GetMethods() []string {
 	return nil
 }
 
+// PermissionsByVisibility contains method permissions by visibility.
+type PermissionsByVisibility struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Visibility defines the visibility of the requested method permissions.
+	//
+	// Types that are valid to be assigned to Visibility:
+	//
+	//	*PermissionsByVisibility_Public
+	//	*PermissionsByVisibility_Self
+	//	*PermissionsByVisibility_Project
+	//	*PermissionsByVisibility_Tenant
+	//	*PermissionsByVisibility_Admin
+	Visibility    isPermissionsByVisibility_Visibility `protobuf_oneof:"visibility"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PermissionsByVisibility) Reset() {
+	*x = PermissionsByVisibility{}
+	mi := &file_fits_api_v1_token_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PermissionsByVisibility) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PermissionsByVisibility) ProtoMessage() {}
+
+func (x *PermissionsByVisibility) ProtoReflect() protoreflect.Message {
+	mi := &file_fits_api_v1_token_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PermissionsByVisibility.ProtoReflect.Descriptor instead.
+func (*PermissionsByVisibility) Descriptor() ([]byte, []int) {
+	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *PermissionsByVisibility) GetVisibility() isPermissionsByVisibility_Visibility {
+	if x != nil {
+		return x.Visibility
+	}
+	return nil
+}
+
+func (x *PermissionsByVisibility) GetPublic() *PublicPermissions {
+	if x != nil {
+		if x, ok := x.Visibility.(*PermissionsByVisibility_Public); ok {
+			return x.Public
+		}
+	}
+	return nil
+}
+
+func (x *PermissionsByVisibility) GetSelf() *SelfPermissions {
+	if x != nil {
+		if x, ok := x.Visibility.(*PermissionsByVisibility_Self); ok {
+			return x.Self
+		}
+	}
+	return nil
+}
+
+func (x *PermissionsByVisibility) GetProject() *ProjectPermissions {
+	if x != nil {
+		if x, ok := x.Visibility.(*PermissionsByVisibility_Project); ok {
+			return x.Project
+		}
+	}
+	return nil
+}
+
+func (x *PermissionsByVisibility) GetTenant() *TenantPermissions {
+	if x != nil {
+		if x, ok := x.Visibility.(*PermissionsByVisibility_Tenant); ok {
+			return x.Tenant
+		}
+	}
+	return nil
+}
+
+func (x *PermissionsByVisibility) GetAdmin() *AdminPermissions {
+	if x != nil {
+		if x, ok := x.Visibility.(*PermissionsByVisibility_Admin); ok {
+			return x.Admin
+		}
+	}
+	return nil
+}
+
+type isPermissionsByVisibility_Visibility interface {
+	isPermissionsByVisibility_Visibility()
+}
+
+type PermissionsByVisibility_Public struct {
+	// PublicPermissions carries public method permissions.
+	Public *PublicPermissions `protobuf:"bytes,1,opt,name=public,proto3,oneof"`
+}
+
+type PermissionsByVisibility_Self struct {
+	// SelfPermissions carries self method permissions.
+	Self *SelfPermissions `protobuf:"bytes,2,opt,name=self,proto3,oneof"`
+}
+
+type PermissionsByVisibility_Project struct {
+	// ProjectPermissions carries project method permissions.
+	Project *ProjectPermissions `protobuf:"bytes,3,opt,name=project,proto3,oneof"`
+}
+
+type PermissionsByVisibility_Tenant struct {
+	// TenantPermissions carries tenant method permissions.
+	Tenant *TenantPermissions `protobuf:"bytes,4,opt,name=tenant,proto3,oneof"`
+}
+
+type PermissionsByVisibility_Admin struct {
+	// AdminPermissions carries admin method permissions.
+	Admin *AdminPermissions `protobuf:"bytes,5,opt,name=admin,proto3,oneof"`
+}
+
+func (*PermissionsByVisibility_Public) isPermissionsByVisibility_Visibility() {}
+
+func (*PermissionsByVisibility_Self) isPermissionsByVisibility_Visibility() {}
+
+func (*PermissionsByVisibility_Project) isPermissionsByVisibility_Visibility() {}
+
+func (*PermissionsByVisibility_Tenant) isPermissionsByVisibility_Visibility() {}
+
+func (*PermissionsByVisibility_Admin) isPermissionsByVisibility_Visibility() {}
+
+// PublicPermissions carries public method permissions.
+type PublicPermissions struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Methods which should be accessible.
+	Methods       []string `protobuf:"bytes,2,rep,name=methods,proto3" json:"methods,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PublicPermissions) Reset() {
+	*x = PublicPermissions{}
+	mi := &file_fits_api_v1_token_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PublicPermissions) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PublicPermissions) ProtoMessage() {}
+
+func (x *PublicPermissions) ProtoReflect() protoreflect.Message {
+	mi := &file_fits_api_v1_token_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PublicPermissions.ProtoReflect.Descriptor instead.
+func (*PublicPermissions) Descriptor() ([]byte, []int) {
+	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *PublicPermissions) GetMethods() []string {
+	if x != nil {
+		return x.Methods
+	}
+	return nil
+}
+
+// SelfPermissions carries self method permissions.
+type SelfPermissions struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Methods which should be accessible.
+	Methods       []string `protobuf:"bytes,2,rep,name=methods,proto3" json:"methods,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SelfPermissions) Reset() {
+	*x = SelfPermissions{}
+	mi := &file_fits_api_v1_token_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SelfPermissions) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SelfPermissions) ProtoMessage() {}
+
+func (x *SelfPermissions) ProtoReflect() protoreflect.Message {
+	mi := &file_fits_api_v1_token_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SelfPermissions.ProtoReflect.Descriptor instead.
+func (*SelfPermissions) Descriptor() ([]byte, []int) {
+	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *SelfPermissions) GetMethods() []string {
+	if x != nil {
+		return x.Methods
+	}
+	return nil
+}
+
+// ProjectPermissions carries project method permissions.
+type ProjectPermissions struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Project scope for the permissions.
+	// Asterisk (*) can be specified to match any subject.
+	Project string `protobuf:"bytes,1,opt,name=project,proto3" json:"project,omitempty"`
+	// Methods which should be accessible.
+	Methods       []string `protobuf:"bytes,2,rep,name=methods,proto3" json:"methods,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ProjectPermissions) Reset() {
+	*x = ProjectPermissions{}
+	mi := &file_fits_api_v1_token_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ProjectPermissions) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ProjectPermissions) ProtoMessage() {}
+
+func (x *ProjectPermissions) ProtoReflect() protoreflect.Message {
+	mi := &file_fits_api_v1_token_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ProjectPermissions.ProtoReflect.Descriptor instead.
+func (*ProjectPermissions) Descriptor() ([]byte, []int) {
+	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *ProjectPermissions) GetProject() string {
+	if x != nil {
+		return x.Project
+	}
+	return ""
+}
+
+func (x *ProjectPermissions) GetMethods() []string {
+	if x != nil {
+		return x.Methods
+	}
+	return nil
+}
+
+// TenantPermissions carries tenant method permissions.
+type TenantPermissions struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Login of the tenant.
+	// Asterisk (*) can be specified to match any subject.
+	Login string `protobuf:"bytes,1,opt,name=login,proto3" json:"login,omitempty"`
+	// Methods which should be accessible.
+	Methods       []string `protobuf:"bytes,2,rep,name=methods,proto3" json:"methods,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *TenantPermissions) Reset() {
+	*x = TenantPermissions{}
+	mi := &file_fits_api_v1_token_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TenantPermissions) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TenantPermissions) ProtoMessage() {}
+
+func (x *TenantPermissions) ProtoReflect() protoreflect.Message {
+	mi := &file_fits_api_v1_token_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TenantPermissions.ProtoReflect.Descriptor instead.
+func (*TenantPermissions) Descriptor() ([]byte, []int) {
+	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *TenantPermissions) GetLogin() string {
+	if x != nil {
+		return x.Login
+	}
+	return ""
+}
+
+func (x *TenantPermissions) GetMethods() []string {
+	if x != nil {
+		return x.Methods
+	}
+	return nil
+}
+
+// AdminPermissions carries admin method permissions.
+type AdminPermissions struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Methods which should be accessible.
+	Methods       []string `protobuf:"bytes,2,rep,name=methods,proto3" json:"methods,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AdminPermissions) Reset() {
+	*x = AdminPermissions{}
+	mi := &file_fits_api_v1_token_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AdminPermissions) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AdminPermissions) ProtoMessage() {}
+
+func (x *AdminPermissions) ProtoReflect() protoreflect.Message {
+	mi := &file_fits_api_v1_token_proto_msgTypes[8]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AdminPermissions.ProtoReflect.Descriptor instead.
+func (*AdminPermissions) Descriptor() ([]byte, []int) {
+	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *AdminPermissions) GetMethods() []string {
+	if x != nil {
+		return x.Methods
+	}
+	return nil
+}
+
 // TokenServiceCreateResponse is the response payload of a token create request
 type TokenServiceCreateResponse struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -397,7 +785,7 @@ type TokenServiceCreateResponse struct {
 
 func (x *TokenServiceCreateResponse) Reset() {
 	*x = TokenServiceCreateResponse{}
-	mi := &file_fits_api_v1_token_proto_msgTypes[3]
+	mi := &file_fits_api_v1_token_proto_msgTypes[9]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -409,7 +797,7 @@ func (x *TokenServiceCreateResponse) String() string {
 func (*TokenServiceCreateResponse) ProtoMessage() {}
 
 func (x *TokenServiceCreateResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_fits_api_v1_token_proto_msgTypes[3]
+	mi := &file_fits_api_v1_token_proto_msgTypes[9]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -422,7 +810,7 @@ func (x *TokenServiceCreateResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenServiceCreateResponse.ProtoReflect.Descriptor instead.
 func (*TokenServiceCreateResponse) Descriptor() ([]byte, []int) {
-	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{3}
+	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *TokenServiceCreateResponse) GetToken() *Token {
@@ -448,7 +836,7 @@ type TokenServiceListRequest struct {
 
 func (x *TokenServiceListRequest) Reset() {
 	*x = TokenServiceListRequest{}
-	mi := &file_fits_api_v1_token_proto_msgTypes[4]
+	mi := &file_fits_api_v1_token_proto_msgTypes[10]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -460,7 +848,7 @@ func (x *TokenServiceListRequest) String() string {
 func (*TokenServiceListRequest) ProtoMessage() {}
 
 func (x *TokenServiceListRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_fits_api_v1_token_proto_msgTypes[4]
+	mi := &file_fits_api_v1_token_proto_msgTypes[10]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -473,7 +861,7 @@ func (x *TokenServiceListRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenServiceListRequest.ProtoReflect.Descriptor instead.
 func (*TokenServiceListRequest) Descriptor() ([]byte, []int) {
-	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{4}
+	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{10}
 }
 
 // TokenServiceListResponse is the response payload of a token list request
@@ -487,7 +875,7 @@ type TokenServiceListResponse struct {
 
 func (x *TokenServiceListResponse) Reset() {
 	*x = TokenServiceListResponse{}
-	mi := &file_fits_api_v1_token_proto_msgTypes[5]
+	mi := &file_fits_api_v1_token_proto_msgTypes[11]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -499,7 +887,7 @@ func (x *TokenServiceListResponse) String() string {
 func (*TokenServiceListResponse) ProtoMessage() {}
 
 func (x *TokenServiceListResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_fits_api_v1_token_proto_msgTypes[5]
+	mi := &file_fits_api_v1_token_proto_msgTypes[11]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -512,7 +900,7 @@ func (x *TokenServiceListResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenServiceListResponse.ProtoReflect.Descriptor instead.
 func (*TokenServiceListResponse) Descriptor() ([]byte, []int) {
-	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{5}
+	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *TokenServiceListResponse) GetTokens() []*Token {
@@ -533,7 +921,7 @@ type TokenServiceRevokeRequest struct {
 
 func (x *TokenServiceRevokeRequest) Reset() {
 	*x = TokenServiceRevokeRequest{}
-	mi := &file_fits_api_v1_token_proto_msgTypes[6]
+	mi := &file_fits_api_v1_token_proto_msgTypes[12]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -545,7 +933,7 @@ func (x *TokenServiceRevokeRequest) String() string {
 func (*TokenServiceRevokeRequest) ProtoMessage() {}
 
 func (x *TokenServiceRevokeRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_fits_api_v1_token_proto_msgTypes[6]
+	mi := &file_fits_api_v1_token_proto_msgTypes[12]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -558,7 +946,7 @@ func (x *TokenServiceRevokeRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenServiceRevokeRequest.ProtoReflect.Descriptor instead.
 func (*TokenServiceRevokeRequest) Descriptor() ([]byte, []int) {
-	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{6}
+	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *TokenServiceRevokeRequest) GetUuid() string {
@@ -577,7 +965,7 @@ type TokenServiceRevokeResponse struct {
 
 func (x *TokenServiceRevokeResponse) Reset() {
 	*x = TokenServiceRevokeResponse{}
-	mi := &file_fits_api_v1_token_proto_msgTypes[7]
+	mi := &file_fits_api_v1_token_proto_msgTypes[13]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -589,7 +977,7 @@ func (x *TokenServiceRevokeResponse) String() string {
 func (*TokenServiceRevokeResponse) ProtoMessage() {}
 
 func (x *TokenServiceRevokeResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_fits_api_v1_token_proto_msgTypes[7]
+	mi := &file_fits_api_v1_token_proto_msgTypes[13]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -602,7 +990,7 @@ func (x *TokenServiceRevokeResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenServiceRevokeResponse.ProtoReflect.Descriptor instead.
 func (*TokenServiceRevokeResponse) Descriptor() ([]byte, []int) {
-	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{7}
+	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{13}
 }
 
 // TokenServiceUpdateRequest is the request payload of a token update request
@@ -615,8 +1003,8 @@ type TokenServiceUpdateRequest struct {
 	UpdateMeta *UpdateMeta `protobuf:"bytes,2,opt,name=update_meta,json=updateMeta,proto3" json:"update_meta,omitempty"`
 	// Description is a user given description of this token.
 	Description *string `protobuf:"bytes,3,opt,name=description,proto3,oneof" json:"description,omitempty"`
-	// Permissions is a list of service methods this token can be used for
-	Permissions []*MethodPermission `protobuf:"bytes,4,rep,name=permissions,proto3" json:"permissions,omitempty"`
+	// Permissions is a list of service methods this token can be used for.
+	Permissions []*PermissionsByVisibility `protobuf:"bytes,4,rep,name=permissions,proto3" json:"permissions,omitempty"`
 	// ProjectRoles associates a project id with the corresponding role of the token owner
 	ProjectRoles map[string]ProjectRole `protobuf:"bytes,5,rep,name=project_roles,json=projectRoles,proto3" json:"project_roles,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"varint,2,opt,name=value,enum=fits.api.v1.ProjectRole"`
 	// TenantRoles associates a tenant id with the corresponding role of the token owner
@@ -631,7 +1019,7 @@ type TokenServiceUpdateRequest struct {
 
 func (x *TokenServiceUpdateRequest) Reset() {
 	*x = TokenServiceUpdateRequest{}
-	mi := &file_fits_api_v1_token_proto_msgTypes[8]
+	mi := &file_fits_api_v1_token_proto_msgTypes[14]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -643,7 +1031,7 @@ func (x *TokenServiceUpdateRequest) String() string {
 func (*TokenServiceUpdateRequest) ProtoMessage() {}
 
 func (x *TokenServiceUpdateRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_fits_api_v1_token_proto_msgTypes[8]
+	mi := &file_fits_api_v1_token_proto_msgTypes[14]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -656,7 +1044,7 @@ func (x *TokenServiceUpdateRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenServiceUpdateRequest.ProtoReflect.Descriptor instead.
 func (*TokenServiceUpdateRequest) Descriptor() ([]byte, []int) {
-	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{8}
+	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{14}
 }
 
 func (x *TokenServiceUpdateRequest) GetUuid() string {
@@ -680,7 +1068,7 @@ func (x *TokenServiceUpdateRequest) GetDescription() string {
 	return ""
 }
 
-func (x *TokenServiceUpdateRequest) GetPermissions() []*MethodPermission {
+func (x *TokenServiceUpdateRequest) GetPermissions() []*PermissionsByVisibility {
 	if x != nil {
 		return x.Permissions
 	}
@@ -726,7 +1114,7 @@ type TokenServiceUpdateResponse struct {
 
 func (x *TokenServiceUpdateResponse) Reset() {
 	*x = TokenServiceUpdateResponse{}
-	mi := &file_fits_api_v1_token_proto_msgTypes[9]
+	mi := &file_fits_api_v1_token_proto_msgTypes[15]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -738,7 +1126,7 @@ func (x *TokenServiceUpdateResponse) String() string {
 func (*TokenServiceUpdateResponse) ProtoMessage() {}
 
 func (x *TokenServiceUpdateResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_fits_api_v1_token_proto_msgTypes[9]
+	mi := &file_fits_api_v1_token_proto_msgTypes[15]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -751,7 +1139,7 @@ func (x *TokenServiceUpdateResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenServiceUpdateResponse.ProtoReflect.Descriptor instead.
 func (*TokenServiceUpdateResponse) Descriptor() ([]byte, []int) {
-	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{9}
+	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *TokenServiceUpdateResponse) GetToken() *Token {
@@ -772,7 +1160,7 @@ type TokenServiceGetRequest struct {
 
 func (x *TokenServiceGetRequest) Reset() {
 	*x = TokenServiceGetRequest{}
-	mi := &file_fits_api_v1_token_proto_msgTypes[10]
+	mi := &file_fits_api_v1_token_proto_msgTypes[16]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -784,7 +1172,7 @@ func (x *TokenServiceGetRequest) String() string {
 func (*TokenServiceGetRequest) ProtoMessage() {}
 
 func (x *TokenServiceGetRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_fits_api_v1_token_proto_msgTypes[10]
+	mi := &file_fits_api_v1_token_proto_msgTypes[16]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -797,7 +1185,7 @@ func (x *TokenServiceGetRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenServiceGetRequest.ProtoReflect.Descriptor instead.
 func (*TokenServiceGetRequest) Descriptor() ([]byte, []int) {
-	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{10}
+	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *TokenServiceGetRequest) GetUuid() string {
@@ -818,7 +1206,7 @@ type TokenServiceGetResponse struct {
 
 func (x *TokenServiceGetResponse) Reset() {
 	*x = TokenServiceGetResponse{}
-	mi := &file_fits_api_v1_token_proto_msgTypes[11]
+	mi := &file_fits_api_v1_token_proto_msgTypes[17]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -830,7 +1218,7 @@ func (x *TokenServiceGetResponse) String() string {
 func (*TokenServiceGetResponse) ProtoMessage() {}
 
 func (x *TokenServiceGetResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_fits_api_v1_token_proto_msgTypes[11]
+	mi := &file_fits_api_v1_token_proto_msgTypes[17]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -843,7 +1231,7 @@ func (x *TokenServiceGetResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenServiceGetResponse.ProtoReflect.Descriptor instead.
 func (*TokenServiceGetResponse) Descriptor() ([]byte, []int) {
-	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{11}
+	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{17}
 }
 
 func (x *TokenServiceGetResponse) GetToken() *Token {
@@ -864,7 +1252,7 @@ type TokenServiceRefreshRequest struct {
 
 func (x *TokenServiceRefreshRequest) Reset() {
 	*x = TokenServiceRefreshRequest{}
-	mi := &file_fits_api_v1_token_proto_msgTypes[12]
+	mi := &file_fits_api_v1_token_proto_msgTypes[18]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -876,7 +1264,7 @@ func (x *TokenServiceRefreshRequest) String() string {
 func (*TokenServiceRefreshRequest) ProtoMessage() {}
 
 func (x *TokenServiceRefreshRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_fits_api_v1_token_proto_msgTypes[12]
+	mi := &file_fits_api_v1_token_proto_msgTypes[18]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -889,7 +1277,7 @@ func (x *TokenServiceRefreshRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenServiceRefreshRequest.ProtoReflect.Descriptor instead.
 func (*TokenServiceRefreshRequest) Descriptor() ([]byte, []int) {
-	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{12}
+	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{18}
 }
 
 // TokenServiceRefreshResponse is the response payload of a token refresh request
@@ -905,7 +1293,7 @@ type TokenServiceRefreshResponse struct {
 
 func (x *TokenServiceRefreshResponse) Reset() {
 	*x = TokenServiceRefreshResponse{}
-	mi := &file_fits_api_v1_token_proto_msgTypes[13]
+	mi := &file_fits_api_v1_token_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -917,7 +1305,7 @@ func (x *TokenServiceRefreshResponse) String() string {
 func (*TokenServiceRefreshResponse) ProtoMessage() {}
 
 func (x *TokenServiceRefreshResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_fits_api_v1_token_proto_msgTypes[13]
+	mi := &file_fits_api_v1_token_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -930,7 +1318,7 @@ func (x *TokenServiceRefreshResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenServiceRefreshResponse.ProtoReflect.Descriptor instead.
 func (*TokenServiceRefreshResponse) Descriptor() ([]byte, []int) {
-	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{13}
+	return file_fits_api_v1_token_proto_rawDescGZIP(), []int{19}
 }
 
 func (x *TokenServiceRefreshResponse) GetToken() *Token {
@@ -975,10 +1363,10 @@ const file_fits_api_v1_token_proto_rawDesc = "" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12-\n" +
 	"\x05value\x18\x02 \x01(\x0e2\x17.fits.api.v1.TenantRoleR\x05value:\x028\x01:\x9f\x01\xbaH\x9b\x01\x1a\x98\x01\n" +
 	"\x1btoken.permissions.usertoken\x12)token type user must not have permissions\x1aN(this.token_type == 2 && this.permissions.size() == 0) || this.token_type != 2B\r\n" +
-	"\v_admin_role\"\x89\x06\n" +
+	"\v_admin_role\"\x90\x06\n" +
 	"\x19TokenServiceCreateRequest\x12-\n" +
-	"\vdescription\x18\x01 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01R\vdescription\x12I\n" +
-	"\vpermissions\x18\x02 \x03(\v2\x1d.fits.api.v1.MethodPermissionB\b\xbaH\x05\x92\x01\x02\x10dR\vpermissions\x12G\n" +
+	"\vdescription\x18\x01 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01R\vdescription\x12P\n" +
+	"\vpermissions\x18\x02 \x03(\v2$.fits.api.v1.PermissionsByVisibilityB\b\xbaH\x05\x92\x01\x02\x10dR\vpermissions\x12G\n" +
 	"\aexpires\x18\x03 \x01(\v2\x19.google.protobuf.DurationB\x12\xbaH\x0f\xaa\x01\f\x1a\x05\b\x81\xe7\x84\x0f2\x03\b\xd8\x04R\aexpires\x12y\n" +
 	"\rproject_roles\x18\x04 \x03(\v28.fits.api.v1.TokenServiceCreateRequest.ProjectRolesEntryB\x1a\xbaH\x17\x9a\x01\x14\xc0\x95\xb8\xb1\x02\x01\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01R\fprojectRoles\x12x\n" +
 	"\ftenant_roles\x18\x05 \x03(\v27.fits.api.v1.TokenServiceCreateRequest.TenantRolesEntryB\x1c\xbaH\x19\x9a\x01\x16\xc0\x95\xb8\xb1\x02\x01\"\ar\x05\x10\x03\x18\x80\x01*\x05\x82\x01\x02\x10\x01R\vtenantRoles\x12D\n" +
@@ -994,6 +1382,26 @@ const file_fits_api_v1_token_proto_rawDesc = "" +
 	"\v_admin_role\"[\n" +
 	"\x10MethodPermission\x12\"\n" +
 	"\asubject\x18\x01 \x01(\tB\b\xbaH\x05r\x03\x18\x80\x02R\asubject\x12#\n" +
+	"\amethods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\amethods\"\xc3\x02\n" +
+	"\x17PermissionsByVisibility\x128\n" +
+	"\x06public\x18\x01 \x01(\v2\x1e.fits.api.v1.PublicPermissionsH\x00R\x06public\x122\n" +
+	"\x04self\x18\x02 \x01(\v2\x1c.fits.api.v1.SelfPermissionsH\x00R\x04self\x12;\n" +
+	"\aproject\x18\x03 \x01(\v2\x1f.fits.api.v1.ProjectPermissionsH\x00R\aproject\x128\n" +
+	"\x06tenant\x18\x04 \x01(\v2\x1e.fits.api.v1.TenantPermissionsH\x00R\x06tenant\x125\n" +
+	"\x05admin\x18\x05 \x01(\v2\x1d.fits.api.v1.AdminPermissionsH\x00R\x05adminB\f\n" +
+	"\n" +
+	"visibility\"8\n" +
+	"\x11PublicPermissions\x12#\n" +
+	"\amethods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\amethods\"6\n" +
+	"\x0fSelfPermissions\x12#\n" +
+	"\amethods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\amethods\"`\n" +
+	"\x12ProjectPermissions\x12%\n" +
+	"\aproject\x18\x01 \x01(\tB\v\xbaH\br\x06\xa0\xb4\xae\xb1\x02\x01R\aproject\x12#\n" +
+	"\amethods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\amethods\"[\n" +
+	"\x11TenantPermissions\x12!\n" +
+	"\x05login\x18\x01 \x01(\tB\v\xbaH\br\x06\x98\xb4\xae\xb1\x02\x01R\x05login\x12#\n" +
+	"\amethods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\amethods\"7\n" +
+	"\x10AdminPermissions\x12#\n" +
 	"\amethods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\amethods\"^\n" +
 	"\x1aTokenServiceCreateResponse\x12(\n" +
 	"\x05token\x18\x01 \x01(\v2\x12.fits.api.v1.TokenR\x05token\x12\x16\n" +
@@ -1003,13 +1411,13 @@ const file_fits_api_v1_token_proto_rawDesc = "" +
 	"\x06tokens\x18\x01 \x03(\v2\x12.fits.api.v1.TokenR\x06tokens\"9\n" +
 	"\x19TokenServiceRevokeRequest\x12\x1c\n" +
 	"\x04uuid\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"\x1c\n" +
-	"\x1aTokenServiceRevokeResponse\"\xb1\x06\n" +
+	"\x1aTokenServiceRevokeResponse\"\xb8\x06\n" +
 	"\x19TokenServiceUpdateRequest\x12\x1c\n" +
 	"\x04uuid\x18\x01 \x01(\tB\b\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12@\n" +
 	"\vupdate_meta\x18\x02 \x01(\v2\x17.fits.api.v1.UpdateMetaB\x06\xbaH\x03\xc8\x01\x00R\n" +
 	"updateMeta\x122\n" +
-	"\vdescription\x18\x03 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01H\x00R\vdescription\x88\x01\x01\x12?\n" +
-	"\vpermissions\x18\x04 \x03(\v2\x1d.fits.api.v1.MethodPermissionR\vpermissions\x12y\n" +
+	"\vdescription\x18\x03 \x01(\tB\v\xbaH\br\x06ȳ\xae\xb1\x02\x01H\x00R\vdescription\x88\x01\x01\x12F\n" +
+	"\vpermissions\x18\x04 \x03(\v2$.fits.api.v1.PermissionsByVisibilityR\vpermissions\x12y\n" +
 	"\rproject_roles\x18\x05 \x03(\v28.fits.api.v1.TokenServiceUpdateRequest.ProjectRolesEntryB\x1a\xbaH\x17\x9a\x01\x14\xc0\x95\xb8\xb1\x02\x01\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01R\fprojectRoles\x12x\n" +
 	"\ftenant_roles\x18\x06 \x03(\v27.fits.api.v1.TokenServiceUpdateRequest.TenantRolesEntryB\x1c\xbaH\x19\x9a\x01\x16\xc0\x95\xb8\xb1\x02\x01\"\ar\x05\x10\x03\x18\x80\x01*\x05\x82\x01\x02\x10\x01R\vtenantRoles\x12D\n" +
 	"\n" +
@@ -1060,88 +1468,99 @@ func file_fits_api_v1_token_proto_rawDescGZIP() []byte {
 }
 
 var file_fits_api_v1_token_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_fits_api_v1_token_proto_msgTypes = make([]protoimpl.MessageInfo, 20)
+var file_fits_api_v1_token_proto_msgTypes = make([]protoimpl.MessageInfo, 26)
 var file_fits_api_v1_token_proto_goTypes = []any{
 	(TokenType)(0),                      // 0: fits.api.v1.TokenType
 	(*Token)(nil),                       // 1: fits.api.v1.Token
 	(*TokenServiceCreateRequest)(nil),   // 2: fits.api.v1.TokenServiceCreateRequest
 	(*MethodPermission)(nil),            // 3: fits.api.v1.MethodPermission
-	(*TokenServiceCreateResponse)(nil),  // 4: fits.api.v1.TokenServiceCreateResponse
-	(*TokenServiceListRequest)(nil),     // 5: fits.api.v1.TokenServiceListRequest
-	(*TokenServiceListResponse)(nil),    // 6: fits.api.v1.TokenServiceListResponse
-	(*TokenServiceRevokeRequest)(nil),   // 7: fits.api.v1.TokenServiceRevokeRequest
-	(*TokenServiceRevokeResponse)(nil),  // 8: fits.api.v1.TokenServiceRevokeResponse
-	(*TokenServiceUpdateRequest)(nil),   // 9: fits.api.v1.TokenServiceUpdateRequest
-	(*TokenServiceUpdateResponse)(nil),  // 10: fits.api.v1.TokenServiceUpdateResponse
-	(*TokenServiceGetRequest)(nil),      // 11: fits.api.v1.TokenServiceGetRequest
-	(*TokenServiceGetResponse)(nil),     // 12: fits.api.v1.TokenServiceGetResponse
-	(*TokenServiceRefreshRequest)(nil),  // 13: fits.api.v1.TokenServiceRefreshRequest
-	(*TokenServiceRefreshResponse)(nil), // 14: fits.api.v1.TokenServiceRefreshResponse
-	nil,                                 // 15: fits.api.v1.Token.ProjectRolesEntry
-	nil,                                 // 16: fits.api.v1.Token.TenantRolesEntry
-	nil,                                 // 17: fits.api.v1.TokenServiceCreateRequest.ProjectRolesEntry
-	nil,                                 // 18: fits.api.v1.TokenServiceCreateRequest.TenantRolesEntry
-	nil,                                 // 19: fits.api.v1.TokenServiceUpdateRequest.ProjectRolesEntry
-	nil,                                 // 20: fits.api.v1.TokenServiceUpdateRequest.TenantRolesEntry
-	(*Meta)(nil),                        // 21: fits.api.v1.Meta
-	(*timestamppb.Timestamp)(nil),       // 22: google.protobuf.Timestamp
-	(AdminRole)(0),                      // 23: fits.api.v1.AdminRole
-	(*durationpb.Duration)(nil),         // 24: google.protobuf.Duration
-	(*Labels)(nil),                      // 25: fits.api.v1.Labels
-	(*UpdateMeta)(nil),                  // 26: fits.api.v1.UpdateMeta
-	(*UpdateLabels)(nil),                // 27: fits.api.v1.UpdateLabels
-	(ProjectRole)(0),                    // 28: fits.api.v1.ProjectRole
-	(TenantRole)(0),                     // 29: fits.api.v1.TenantRole
+	(*PermissionsByVisibility)(nil),     // 4: fits.api.v1.PermissionsByVisibility
+	(*PublicPermissions)(nil),           // 5: fits.api.v1.PublicPermissions
+	(*SelfPermissions)(nil),             // 6: fits.api.v1.SelfPermissions
+	(*ProjectPermissions)(nil),          // 7: fits.api.v1.ProjectPermissions
+	(*TenantPermissions)(nil),           // 8: fits.api.v1.TenantPermissions
+	(*AdminPermissions)(nil),            // 9: fits.api.v1.AdminPermissions
+	(*TokenServiceCreateResponse)(nil),  // 10: fits.api.v1.TokenServiceCreateResponse
+	(*TokenServiceListRequest)(nil),     // 11: fits.api.v1.TokenServiceListRequest
+	(*TokenServiceListResponse)(nil),    // 12: fits.api.v1.TokenServiceListResponse
+	(*TokenServiceRevokeRequest)(nil),   // 13: fits.api.v1.TokenServiceRevokeRequest
+	(*TokenServiceRevokeResponse)(nil),  // 14: fits.api.v1.TokenServiceRevokeResponse
+	(*TokenServiceUpdateRequest)(nil),   // 15: fits.api.v1.TokenServiceUpdateRequest
+	(*TokenServiceUpdateResponse)(nil),  // 16: fits.api.v1.TokenServiceUpdateResponse
+	(*TokenServiceGetRequest)(nil),      // 17: fits.api.v1.TokenServiceGetRequest
+	(*TokenServiceGetResponse)(nil),     // 18: fits.api.v1.TokenServiceGetResponse
+	(*TokenServiceRefreshRequest)(nil),  // 19: fits.api.v1.TokenServiceRefreshRequest
+	(*TokenServiceRefreshResponse)(nil), // 20: fits.api.v1.TokenServiceRefreshResponse
+	nil,                                 // 21: fits.api.v1.Token.ProjectRolesEntry
+	nil,                                 // 22: fits.api.v1.Token.TenantRolesEntry
+	nil,                                 // 23: fits.api.v1.TokenServiceCreateRequest.ProjectRolesEntry
+	nil,                                 // 24: fits.api.v1.TokenServiceCreateRequest.TenantRolesEntry
+	nil,                                 // 25: fits.api.v1.TokenServiceUpdateRequest.ProjectRolesEntry
+	nil,                                 // 26: fits.api.v1.TokenServiceUpdateRequest.TenantRolesEntry
+	(*Meta)(nil),                        // 27: fits.api.v1.Meta
+	(*timestamppb.Timestamp)(nil),       // 28: google.protobuf.Timestamp
+	(AdminRole)(0),                      // 29: fits.api.v1.AdminRole
+	(*durationpb.Duration)(nil),         // 30: google.protobuf.Duration
+	(*Labels)(nil),                      // 31: fits.api.v1.Labels
+	(*UpdateMeta)(nil),                  // 32: fits.api.v1.UpdateMeta
+	(*UpdateLabels)(nil),                // 33: fits.api.v1.UpdateLabels
+	(ProjectRole)(0),                    // 34: fits.api.v1.ProjectRole
+	(TenantRole)(0),                     // 35: fits.api.v1.TenantRole
 }
 var file_fits_api_v1_token_proto_depIdxs = []int32{
-	21, // 0: fits.api.v1.Token.meta:type_name -> fits.api.v1.Meta
+	27, // 0: fits.api.v1.Token.meta:type_name -> fits.api.v1.Meta
 	3,  // 1: fits.api.v1.Token.permissions:type_name -> fits.api.v1.MethodPermission
-	22, // 2: fits.api.v1.Token.expires:type_name -> google.protobuf.Timestamp
-	22, // 3: fits.api.v1.Token.issued_at:type_name -> google.protobuf.Timestamp
+	28, // 2: fits.api.v1.Token.expires:type_name -> google.protobuf.Timestamp
+	28, // 3: fits.api.v1.Token.issued_at:type_name -> google.protobuf.Timestamp
 	0,  // 4: fits.api.v1.Token.token_type:type_name -> fits.api.v1.TokenType
-	15, // 5: fits.api.v1.Token.project_roles:type_name -> fits.api.v1.Token.ProjectRolesEntry
-	16, // 6: fits.api.v1.Token.tenant_roles:type_name -> fits.api.v1.Token.TenantRolesEntry
-	23, // 7: fits.api.v1.Token.admin_role:type_name -> fits.api.v1.AdminRole
-	3,  // 8: fits.api.v1.TokenServiceCreateRequest.permissions:type_name -> fits.api.v1.MethodPermission
-	24, // 9: fits.api.v1.TokenServiceCreateRequest.expires:type_name -> google.protobuf.Duration
-	17, // 10: fits.api.v1.TokenServiceCreateRequest.project_roles:type_name -> fits.api.v1.TokenServiceCreateRequest.ProjectRolesEntry
-	18, // 11: fits.api.v1.TokenServiceCreateRequest.tenant_roles:type_name -> fits.api.v1.TokenServiceCreateRequest.TenantRolesEntry
-	23, // 12: fits.api.v1.TokenServiceCreateRequest.admin_role:type_name -> fits.api.v1.AdminRole
-	25, // 13: fits.api.v1.TokenServiceCreateRequest.labels:type_name -> fits.api.v1.Labels
-	1,  // 14: fits.api.v1.TokenServiceCreateResponse.token:type_name -> fits.api.v1.Token
-	1,  // 15: fits.api.v1.TokenServiceListResponse.tokens:type_name -> fits.api.v1.Token
-	26, // 16: fits.api.v1.TokenServiceUpdateRequest.update_meta:type_name -> fits.api.v1.UpdateMeta
-	3,  // 17: fits.api.v1.TokenServiceUpdateRequest.permissions:type_name -> fits.api.v1.MethodPermission
-	19, // 18: fits.api.v1.TokenServiceUpdateRequest.project_roles:type_name -> fits.api.v1.TokenServiceUpdateRequest.ProjectRolesEntry
-	20, // 19: fits.api.v1.TokenServiceUpdateRequest.tenant_roles:type_name -> fits.api.v1.TokenServiceUpdateRequest.TenantRolesEntry
-	23, // 20: fits.api.v1.TokenServiceUpdateRequest.admin_role:type_name -> fits.api.v1.AdminRole
-	27, // 21: fits.api.v1.TokenServiceUpdateRequest.labels:type_name -> fits.api.v1.UpdateLabels
-	1,  // 22: fits.api.v1.TokenServiceUpdateResponse.token:type_name -> fits.api.v1.Token
-	1,  // 23: fits.api.v1.TokenServiceGetResponse.token:type_name -> fits.api.v1.Token
-	1,  // 24: fits.api.v1.TokenServiceRefreshResponse.token:type_name -> fits.api.v1.Token
-	28, // 25: fits.api.v1.Token.ProjectRolesEntry.value:type_name -> fits.api.v1.ProjectRole
-	29, // 26: fits.api.v1.Token.TenantRolesEntry.value:type_name -> fits.api.v1.TenantRole
-	28, // 27: fits.api.v1.TokenServiceCreateRequest.ProjectRolesEntry.value:type_name -> fits.api.v1.ProjectRole
-	29, // 28: fits.api.v1.TokenServiceCreateRequest.TenantRolesEntry.value:type_name -> fits.api.v1.TenantRole
-	28, // 29: fits.api.v1.TokenServiceUpdateRequest.ProjectRolesEntry.value:type_name -> fits.api.v1.ProjectRole
-	29, // 30: fits.api.v1.TokenServiceUpdateRequest.TenantRolesEntry.value:type_name -> fits.api.v1.TenantRole
-	11, // 31: fits.api.v1.TokenService.Get:input_type -> fits.api.v1.TokenServiceGetRequest
-	2,  // 32: fits.api.v1.TokenService.Create:input_type -> fits.api.v1.TokenServiceCreateRequest
-	9,  // 33: fits.api.v1.TokenService.Update:input_type -> fits.api.v1.TokenServiceUpdateRequest
-	5,  // 34: fits.api.v1.TokenService.List:input_type -> fits.api.v1.TokenServiceListRequest
-	7,  // 35: fits.api.v1.TokenService.Revoke:input_type -> fits.api.v1.TokenServiceRevokeRequest
-	13, // 36: fits.api.v1.TokenService.Refresh:input_type -> fits.api.v1.TokenServiceRefreshRequest
-	12, // 37: fits.api.v1.TokenService.Get:output_type -> fits.api.v1.TokenServiceGetResponse
-	4,  // 38: fits.api.v1.TokenService.Create:output_type -> fits.api.v1.TokenServiceCreateResponse
-	10, // 39: fits.api.v1.TokenService.Update:output_type -> fits.api.v1.TokenServiceUpdateResponse
-	6,  // 40: fits.api.v1.TokenService.List:output_type -> fits.api.v1.TokenServiceListResponse
-	8,  // 41: fits.api.v1.TokenService.Revoke:output_type -> fits.api.v1.TokenServiceRevokeResponse
-	14, // 42: fits.api.v1.TokenService.Refresh:output_type -> fits.api.v1.TokenServiceRefreshResponse
-	37, // [37:43] is the sub-list for method output_type
-	31, // [31:37] is the sub-list for method input_type
-	31, // [31:31] is the sub-list for extension type_name
-	31, // [31:31] is the sub-list for extension extendee
-	0,  // [0:31] is the sub-list for field type_name
+	21, // 5: fits.api.v1.Token.project_roles:type_name -> fits.api.v1.Token.ProjectRolesEntry
+	22, // 6: fits.api.v1.Token.tenant_roles:type_name -> fits.api.v1.Token.TenantRolesEntry
+	29, // 7: fits.api.v1.Token.admin_role:type_name -> fits.api.v1.AdminRole
+	4,  // 8: fits.api.v1.TokenServiceCreateRequest.permissions:type_name -> fits.api.v1.PermissionsByVisibility
+	30, // 9: fits.api.v1.TokenServiceCreateRequest.expires:type_name -> google.protobuf.Duration
+	23, // 10: fits.api.v1.TokenServiceCreateRequest.project_roles:type_name -> fits.api.v1.TokenServiceCreateRequest.ProjectRolesEntry
+	24, // 11: fits.api.v1.TokenServiceCreateRequest.tenant_roles:type_name -> fits.api.v1.TokenServiceCreateRequest.TenantRolesEntry
+	29, // 12: fits.api.v1.TokenServiceCreateRequest.admin_role:type_name -> fits.api.v1.AdminRole
+	31, // 13: fits.api.v1.TokenServiceCreateRequest.labels:type_name -> fits.api.v1.Labels
+	5,  // 14: fits.api.v1.PermissionsByVisibility.public:type_name -> fits.api.v1.PublicPermissions
+	6,  // 15: fits.api.v1.PermissionsByVisibility.self:type_name -> fits.api.v1.SelfPermissions
+	7,  // 16: fits.api.v1.PermissionsByVisibility.project:type_name -> fits.api.v1.ProjectPermissions
+	8,  // 17: fits.api.v1.PermissionsByVisibility.tenant:type_name -> fits.api.v1.TenantPermissions
+	9,  // 18: fits.api.v1.PermissionsByVisibility.admin:type_name -> fits.api.v1.AdminPermissions
+	1,  // 19: fits.api.v1.TokenServiceCreateResponse.token:type_name -> fits.api.v1.Token
+	1,  // 20: fits.api.v1.TokenServiceListResponse.tokens:type_name -> fits.api.v1.Token
+	32, // 21: fits.api.v1.TokenServiceUpdateRequest.update_meta:type_name -> fits.api.v1.UpdateMeta
+	4,  // 22: fits.api.v1.TokenServiceUpdateRequest.permissions:type_name -> fits.api.v1.PermissionsByVisibility
+	25, // 23: fits.api.v1.TokenServiceUpdateRequest.project_roles:type_name -> fits.api.v1.TokenServiceUpdateRequest.ProjectRolesEntry
+	26, // 24: fits.api.v1.TokenServiceUpdateRequest.tenant_roles:type_name -> fits.api.v1.TokenServiceUpdateRequest.TenantRolesEntry
+	29, // 25: fits.api.v1.TokenServiceUpdateRequest.admin_role:type_name -> fits.api.v1.AdminRole
+	33, // 26: fits.api.v1.TokenServiceUpdateRequest.labels:type_name -> fits.api.v1.UpdateLabels
+	1,  // 27: fits.api.v1.TokenServiceUpdateResponse.token:type_name -> fits.api.v1.Token
+	1,  // 28: fits.api.v1.TokenServiceGetResponse.token:type_name -> fits.api.v1.Token
+	1,  // 29: fits.api.v1.TokenServiceRefreshResponse.token:type_name -> fits.api.v1.Token
+	34, // 30: fits.api.v1.Token.ProjectRolesEntry.value:type_name -> fits.api.v1.ProjectRole
+	35, // 31: fits.api.v1.Token.TenantRolesEntry.value:type_name -> fits.api.v1.TenantRole
+	34, // 32: fits.api.v1.TokenServiceCreateRequest.ProjectRolesEntry.value:type_name -> fits.api.v1.ProjectRole
+	35, // 33: fits.api.v1.TokenServiceCreateRequest.TenantRolesEntry.value:type_name -> fits.api.v1.TenantRole
+	34, // 34: fits.api.v1.TokenServiceUpdateRequest.ProjectRolesEntry.value:type_name -> fits.api.v1.ProjectRole
+	35, // 35: fits.api.v1.TokenServiceUpdateRequest.TenantRolesEntry.value:type_name -> fits.api.v1.TenantRole
+	17, // 36: fits.api.v1.TokenService.Get:input_type -> fits.api.v1.TokenServiceGetRequest
+	2,  // 37: fits.api.v1.TokenService.Create:input_type -> fits.api.v1.TokenServiceCreateRequest
+	15, // 38: fits.api.v1.TokenService.Update:input_type -> fits.api.v1.TokenServiceUpdateRequest
+	11, // 39: fits.api.v1.TokenService.List:input_type -> fits.api.v1.TokenServiceListRequest
+	13, // 40: fits.api.v1.TokenService.Revoke:input_type -> fits.api.v1.TokenServiceRevokeRequest
+	19, // 41: fits.api.v1.TokenService.Refresh:input_type -> fits.api.v1.TokenServiceRefreshRequest
+	18, // 42: fits.api.v1.TokenService.Get:output_type -> fits.api.v1.TokenServiceGetResponse
+	10, // 43: fits.api.v1.TokenService.Create:output_type -> fits.api.v1.TokenServiceCreateResponse
+	16, // 44: fits.api.v1.TokenService.Update:output_type -> fits.api.v1.TokenServiceUpdateResponse
+	12, // 45: fits.api.v1.TokenService.List:output_type -> fits.api.v1.TokenServiceListResponse
+	14, // 46: fits.api.v1.TokenService.Revoke:output_type -> fits.api.v1.TokenServiceRevokeResponse
+	20, // 47: fits.api.v1.TokenService.Refresh:output_type -> fits.api.v1.TokenServiceRefreshResponse
+	42, // [42:48] is the sub-list for method output_type
+	36, // [36:42] is the sub-list for method input_type
+	36, // [36:36] is the sub-list for extension type_name
+	36, // [36:36] is the sub-list for extension extendee
+	0,  // [0:36] is the sub-list for field type_name
 }
 
 func init() { file_fits_api_v1_token_proto_init() }
@@ -1153,14 +1572,21 @@ func file_fits_api_v1_token_proto_init() {
 	file_fits_api_v1_predefined_rules_proto_init()
 	file_fits_api_v1_token_proto_msgTypes[0].OneofWrappers = []any{}
 	file_fits_api_v1_token_proto_msgTypes[1].OneofWrappers = []any{}
-	file_fits_api_v1_token_proto_msgTypes[8].OneofWrappers = []any{}
+	file_fits_api_v1_token_proto_msgTypes[3].OneofWrappers = []any{
+		(*PermissionsByVisibility_Public)(nil),
+		(*PermissionsByVisibility_Self)(nil),
+		(*PermissionsByVisibility_Project)(nil),
+		(*PermissionsByVisibility_Tenant)(nil),
+		(*PermissionsByVisibility_Admin)(nil),
+	}
+	file_fits_api_v1_token_proto_msgTypes[14].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_fits_api_v1_token_proto_rawDesc), len(file_fits_api_v1_token_proto_rawDesc)),
 			NumEnums:      1,
-			NumMessages:   20,
+			NumMessages:   26,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/js/fits/api/v1/predefined_rules_pb.d.ts b/js/fits/api/v1/predefined_rules_pb.d.ts
index 050c8c5..36a8e8b 100644
--- a/js/fits/api/v1/predefined_rules_pb.d.ts
+++ b/js/fits/api/v1/predefined_rules_pb.d.ts
@@ -52,6 +52,24 @@ export declare const is_ip_or_hostname: GenExtension<StringRules, boolean>;
  * @generated from extension: optional bool trimmed = 80048958;
  */
 export declare const trimmed: GenExtension<StringRules, boolean>;
+/**
+ * IsTenantLogin returns true if name field satisfies our requirements.
+ *
+ * @generated from extension: optional bool is_tenant_login = 80048962;
+ */
+export declare const is_tenant_login: GenExtension<StringRules, boolean>;
+/**
+ * IsTenantSubjectPermission returns true if name field satisfies our requirements.
+ *
+ * @generated from extension: optional bool is_tenant_subject_permission = 80048963;
+ */
+export declare const is_tenant_subject_permission: GenExtension<StringRules, boolean>;
+/**
+ * IsProjectSubjectPermission returns true if name field satisfies our requirements.
+ *
+ * @generated from extension: optional bool is_project_subject_permission = 80048964;
+ */
+export declare const is_project_subject_permission: GenExtension<StringRules, boolean>;
 /**
  * Prefixes validates if a slice of prefixes in string form are valid
  *
@@ -88,3 +106,15 @@ export declare const keys_and_values_trimmed: GenExtension<MapRules, boolean>;
  * @generated from extension: optional bool keys_trimmed = 80068952;
  */
 export declare const keys_trimmed: GenExtension<MapRules, boolean>;
+/**
+ * ProjectRolesKeysValid ensures that project roles keys met our requirements.
+ *
+ * @generated from extension: optional bool project_roles_keys_valid = 80068953;
+ */
+export declare const project_roles_keys_valid: GenExtension<MapRules, boolean>;
+/**
+ * TenantRolesKeysValid ensures that tenant roles keys met our requirements.
+ *
+ * @generated from extension: optional bool tenant_roles_keys_valid = 80068954;
+ */
+export declare const tenant_roles_keys_valid: GenExtension<MapRules, boolean>;
diff --git a/js/fits/api/v1/predefined_rules_pb.js b/js/fits/api/v1/predefined_rules_pb.js
index f2f2ee5..36af8d0 100644
--- a/js/fits/api/v1/predefined_rules_pb.js
+++ b/js/fits/api/v1/predefined_rules_pb.js
@@ -6,7 +6,7 @@ import { file_buf_validate_validate } from "../../../buf/validate/validate_pb";
 /**
  * Describes the file fits/api/v1/predefined_rules.proto.
  */
-export const file_fits_api_v1_predefined_rules = /*@__PURE__*/ fileDesc("CiJmaXRzL2FwaS92MS9wcmVkZWZpbmVkX3J1bGVzLnByb3RvEgtmaXRzLmFwaS52MTq4AQoKbWFjYWRkcmVzcxIZLmJ1Zi52YWxpZGF0ZS5TdHJpbmdSdWxlcxi35pUmIAEoCEJ6wkh3CnUKEXN0cmluZy5tYWNhZGRyZXNzEiZ0aGlzIHN0cmluZyBtdXN0IGJlIGEgdmFsaWQgbWFjYWRkcmVzcxo4dGhpcy5tYXRjaGVzKCdeKFswLTlBLUZhLWZdezJ9WzpdKXs1fShbMC05QS1GYS1mXXsyfSkkJylSCm1hY2FkZHJlc3M6mQEKB2lzX25hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuOaVJiABKAhCYsJIXwpdCg5zdHJpbmcuaXNfbmFtZRIjbXVzdCBiZSB3aXRoaW4gMiBhbmQgMTI4IGNoYXJhY3RlcnMaJnRoaXMuc2l6ZSgpID49IDIgJiYgdGhpcy5zaXplKCkgPD0gMTI4UgZpc05hbWU6mgEKDmlzX2Rlc2NyaXB0aW9uEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGLnmlSYgASgIQlXCSFIKUAoVc3RyaW5nLmlzX2Rlc2NyaXB0aW9uEiNtdXN0IGJlIHNob3J0ZXIgdGhhbiAyNTYgY2hhcmFjdGVycxoSdGhpcy5zaXplKCkgPD0gMjU2Ug1pc0Rlc2NyaXB0aW9uOqgBCgxpc19wYXJ0aXRpb24SGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuuaVJiABKAhCZ8JIZApiChNzdHJpbmcuaXNfcGFydGl0aW9uEiNtdXN0IGJlIHdpdGhpbiAyIGFuZCAxMjggY2hhcmFjdGVycxomdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSAxMjhSC2lzUGFydGl0aW9uOoIBCglpc19wcmVmaXgSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYu+aVJiABKAhCR8JIRApCCg9zdHJpbmcucHJlZml4ZXMSHGdpdmVuIHByZWZpeGVzIG11c3QgYmUgdmFsaWQaEXRoaXMuaXNJcFByZWZpeCgpUghpc1ByZWZpeDptCgZpc191cmkSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYvOaVJiABKAhCOMJINQozCgpzdHJpbmcudXJpEhdnaXZlbiB1cmkgbXVzdCBiZSB2YWxpZBoMdGhpcy5pc1VyaSgpUgVpc1VyaTqnAQoRaXNfaXBfb3JfaG9zdG5hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYveaVJiABKAhCXsJIWwpZCg12YWxpZF9hZGRyZXNzEiZtdXN0IGJlIGEgdmFsaWQgSVAgYWRkcmVzcyBvciBob3N0bmFtZRogdGhpcy5pc0lwKCkgfHwgdGhpcy5pc0hvc3RuYW1lKClSDmlzSXBPckhvc3RuYW1lOp0BCgd0cmltbWVkEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGL7mlSYgASgIQmXCSGIKYAoOc3RyaW5nLnRyaW1tZWQSK3ZhbHVlIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaIXRoaXMudHJpbSgpLnNpemUoKSA9PSB0aGlzLnNpemUoKVIHdHJpbW1lZDqPAQoIcHJlZml4ZXMSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjHtJYmIAEoCEJTwkhQCk4KEXJlcGVhdGVkLnByZWZpeGVzEhxnaXZlbiBwcmVmaXhlcyBtdXN0IGJlIHZhbGlkGht0aGlzLmFsbChtLCBtLmlzSXBQcmVmaXgoKSlSCHByZWZpeGVzOnUKA2lwcxIbLmJ1Zi52YWxpZGF0ZS5SZXBlYXRlZFJ1bGVzGMi0liYgASgIQkPCSEAKPgoMcmVwZWF0ZWQuaXBzEhdnaXZlbiBpcHMgbXVzdCBiZSB2YWxpZBoVdGhpcy5hbGwobSwgbS5pc0lwKCkpUgNpcHM65gEKEWFyZV9ob3N0X2FuZF9wb3J0EhsuYnVmLnZhbGlkYXRlLlJlcGVhdGVkUnVsZXMYybSWJiABKAhCmgHCSJYBCpMBChpyZXBlYXRlZC5hcmVfaG9zdF9hbmRfcG9ydBJQZ2l2ZW4gZW50cmllcyBtdXN0IGFsbCBiZSBpbiB0aGUgZm9ybSBvZiA8aXAgfCBob3N0Pjo8cG9ydD4gYnV0IHBvcnQgaXMgb3B0aW9uYWwaI3RoaXMuYWxsKG0sIG0uaXNIb3N0QW5kUG9ydChmYWxzZSkpUg5hcmVIb3N0QW5kUG9ydDq6AQoLYWxsX3RyaW1tZWQSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjKtJYmIAEoCEJ5wkh2CnQKFHJlcGVhdGVkLmFsbF90cmltbWVkEjJnaXZlbiB2YWx1ZXMgbXVzdCBub3Qgc3RhcnQgb3IgZW5kIHdpdGggd2hpdGVzcGFjZRoodGhpcy5hbGwobSwgbS50cmltKCkuc2l6ZSgpID09IG0uc2l6ZSgpKVIKYWxsVHJpbW1lZDqEAgoXa2V5c19hbmRfdmFsdWVzX3RyaW1tZWQSFi5idWYudmFsaWRhdGUuTWFwUnVsZXMY14KXJiABKAhCsQHCSK0BCqoBChttYXAua2V5c19hbmRfdmFsdWVzX3RyaW1tZWQSNWtleXMgYW5kIHZhbHVlcyBtdXN0IG5vdCBzdGFydCBvciBlbmQgd2l0aCB3aGl0ZXNwYWNlGlR0aGlzLmFsbChrLCBrLnRyaW0oKS5zaXplKCkgPT0gay5zaXplKCkpICYmIHRoaXMuYWxsKHYsIHYudHJpbSgpLnNpemUoKSA9PSB2LnNpemUoKSlSFGtleXNBbmRWYWx1ZXNUcmltbWVkOqsBCgxrZXlzX3RyaW1tZWQSFi5idWYudmFsaWRhdGUuTWFwUnVsZXMY2IKXJiABKAhCbcJIagpoChBtYXAua2V5c190cmltbWVkEiprZXlzIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaKHRoaXMuYWxsKGssIGsudHJpbSgpLnNpemUoKSA9PSBrLnNpemUoKSlSC2tleXNUcmltbWVkQqABCg9jb20uZml0cy5hcGkudjFCFFByZWRlZmluZWRSdWxlc1Byb3RvUAFaKWdpdGh1Yi5jb20vZmktdHMvYXBpL2dvL2ZpdHMvYXBpL3YxO2FwaXYxogIDRkFYqgILRml0cy5BcGkuVjHKAgtGaXRzXEFwaVxWMeICF0ZpdHNcQXBpXFYxXEdQQk1ldGFkYXRh6gINRml0czo6QXBpOjpWMQ", [file_buf_validate_validate]);
+export const file_fits_api_v1_predefined_rules = /*@__PURE__*/ fileDesc("CiJmaXRzL2FwaS92MS9wcmVkZWZpbmVkX3J1bGVzLnByb3RvEgtmaXRzLmFwaS52MTq4AQoKbWFjYWRkcmVzcxIZLmJ1Zi52YWxpZGF0ZS5TdHJpbmdSdWxlcxi35pUmIAEoCEJ6wkh3CnUKEXN0cmluZy5tYWNhZGRyZXNzEiZ0aGlzIHN0cmluZyBtdXN0IGJlIGEgdmFsaWQgbWFjYWRkcmVzcxo4dGhpcy5tYXRjaGVzKCdeKFswLTlBLUZhLWZdezJ9WzpdKXs1fShbMC05QS1GYS1mXXsyfSkkJylSCm1hY2FkZHJlc3M6mQEKB2lzX25hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuOaVJiABKAhCYsJIXwpdCg5zdHJpbmcuaXNfbmFtZRIjbXVzdCBiZSB3aXRoaW4gMiBhbmQgMTI4IGNoYXJhY3RlcnMaJnRoaXMuc2l6ZSgpID49IDIgJiYgdGhpcy5zaXplKCkgPD0gMTI4UgZpc05hbWU6mgEKDmlzX2Rlc2NyaXB0aW9uEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGLnmlSYgASgIQlXCSFIKUAoVc3RyaW5nLmlzX2Rlc2NyaXB0aW9uEiNtdXN0IGJlIHNob3J0ZXIgdGhhbiAyNTYgY2hhcmFjdGVycxoSdGhpcy5zaXplKCkgPD0gMjU2Ug1pc0Rlc2NyaXB0aW9uOqgBCgxpc19wYXJ0aXRpb24SGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuuaVJiABKAhCZ8JIZApiChNzdHJpbmcuaXNfcGFydGl0aW9uEiNtdXN0IGJlIHdpdGhpbiAyIGFuZCAxMjggY2hhcmFjdGVycxomdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSAxMjhSC2lzUGFydGl0aW9uOoIBCglpc19wcmVmaXgSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYu+aVJiABKAhCR8JIRApCCg9zdHJpbmcucHJlZml4ZXMSHGdpdmVuIHByZWZpeGVzIG11c3QgYmUgdmFsaWQaEXRoaXMuaXNJcFByZWZpeCgpUghpc1ByZWZpeDptCgZpc191cmkSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYvOaVJiABKAhCOMJINQozCgpzdHJpbmcudXJpEhdnaXZlbiB1cmkgbXVzdCBiZSB2YWxpZBoMdGhpcy5pc1VyaSgpUgVpc1VyaTqnAQoRaXNfaXBfb3JfaG9zdG5hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYveaVJiABKAhCXsJIWwpZCg12YWxpZF9hZGRyZXNzEiZtdXN0IGJlIGEgdmFsaWQgSVAgYWRkcmVzcyBvciBob3N0bmFtZRogdGhpcy5pc0lwKCkgfHwgdGhpcy5pc0hvc3RuYW1lKClSDmlzSXBPckhvc3RuYW1lOp0BCgd0cmltbWVkEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGL7mlSYgASgIQmXCSGIKYAoOc3RyaW5nLnRyaW1tZWQSK3ZhbHVlIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaIXRoaXMudHJpbSgpLnNpemUoKSA9PSB0aGlzLnNpemUoKVIHdHJpbW1lZDqwAQoPaXNfdGVuYW50X2xvZ2luEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGMLmlSYgASgIQmrCSGcKZQoWc3RyaW5nLmlzX3RlbmFudF9sb2dpbhIjbXVzdCBiZSB3aXRoaW4gMiBhbmQgMTI4IGNoYXJhY3RlcnMaJnRoaXMuc2l6ZSgpID49IDIgJiYgdGhpcy5zaXplKCkgPD0gMTI4Ug1pc1RlbmFudExvZ2luOu8BChxpc190ZW5hbnRfc3ViamVjdF9wZXJtaXNzaW9uEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGMPmlSYgASgIQo8BwkiLAQqIAQojc3RyaW5nLmlzX3RlbmFudF9zdWJqZWN0X3Blcm1pc3Npb24SKm11c3QgYmUgJyonIG9yIHdpdGhpbiAyIGFuZCAxMjggY2hhcmFjdGVycxo1dGhpcyA9PSAnKicgfHwgdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSAxMjhSGWlzVGVuYW50U3ViamVjdFBlcm1pc3Npb246lAIKHWlzX3Byb2plY3Rfc3ViamVjdF9wZXJtaXNzaW9uEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGMTmlSYgASgIQrIBwkiuAQqrAQokc3RyaW5nLmlzX3Byb2plY3Rfc3ViamVjdF9wZXJtaXNzaW9uEhVtdXN0IGJlICcqJyBvciBhIHV1aWQabHRoaXMgPT0gJyonIHx8IHRoaXMubWF0Y2hlcygnXlswLTlhLWZBLUZdezh9LVswLTlhLWZBLUZdezR9LVswLTlhLWZBLUZdezR9LVswLTlhLWZBLUZdezR9LVswLTlhLWZBLUZdezEyfSQnKVIaaXNQcm9qZWN0U3ViamVjdFBlcm1pc3Npb246jwEKCHByZWZpeGVzEhsuYnVmLnZhbGlkYXRlLlJlcGVhdGVkUnVsZXMYx7SWJiABKAhCU8JIUApOChFyZXBlYXRlZC5wcmVmaXhlcxIcZ2l2ZW4gcHJlZml4ZXMgbXVzdCBiZSB2YWxpZBobdGhpcy5hbGwobSwgbS5pc0lwUHJlZml4KCkpUghwcmVmaXhlczp1CgNpcHMSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjItJYmIAEoCEJDwkhACj4KDHJlcGVhdGVkLmlwcxIXZ2l2ZW4gaXBzIG11c3QgYmUgdmFsaWQaFXRoaXMuYWxsKG0sIG0uaXNJcCgpKVIDaXBzOuYBChFhcmVfaG9zdF9hbmRfcG9ydBIbLmJ1Zi52YWxpZGF0ZS5SZXBlYXRlZFJ1bGVzGMm0liYgASgIQpoBwkiWAQqTAQoacmVwZWF0ZWQuYXJlX2hvc3RfYW5kX3BvcnQSUGdpdmVuIGVudHJpZXMgbXVzdCBhbGwgYmUgaW4gdGhlIGZvcm0gb2YgPGlwIHwgaG9zdD46PHBvcnQ+IGJ1dCBwb3J0IGlzIG9wdGlvbmFsGiN0aGlzLmFsbChtLCBtLmlzSG9zdEFuZFBvcnQoZmFsc2UpKVIOYXJlSG9zdEFuZFBvcnQ6ugEKC2FsbF90cmltbWVkEhsuYnVmLnZhbGlkYXRlLlJlcGVhdGVkUnVsZXMYyrSWJiABKAhCecJIdgp0ChRyZXBlYXRlZC5hbGxfdHJpbW1lZBIyZ2l2ZW4gdmFsdWVzIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaKHRoaXMuYWxsKG0sIG0udHJpbSgpLnNpemUoKSA9PSBtLnNpemUoKSlSCmFsbFRyaW1tZWQ6hAIKF2tleXNfYW5kX3ZhbHVlc190cmltbWVkEhYuYnVmLnZhbGlkYXRlLk1hcFJ1bGVzGNeClyYgASgIQrEBwkitAQqqAQobbWFwLmtleXNfYW5kX3ZhbHVlc190cmltbWVkEjVrZXlzIGFuZCB2YWx1ZXMgbXVzdCBub3Qgc3RhcnQgb3IgZW5kIHdpdGggd2hpdGVzcGFjZRpUdGhpcy5hbGwoaywgay50cmltKCkuc2l6ZSgpID09IGsuc2l6ZSgpKSAmJiB0aGlzLmFsbCh2LCB2LnRyaW0oKS5zaXplKCkgPT0gdi5zaXplKCkpUhRrZXlzQW5kVmFsdWVzVHJpbW1lZDqrAQoMa2V5c190cmltbWVkEhYuYnVmLnZhbGlkYXRlLk1hcFJ1bGVzGNiClyYgASgIQm3CSGoKaAoQbWFwLmtleXNfdHJpbW1lZBIqa2V5cyBtdXN0IG5vdCBzdGFydCBvciBlbmQgd2l0aCB3aGl0ZXNwYWNlGih0aGlzLmFsbChrLCBrLnRyaW0oKS5zaXplKCkgPT0gay5zaXplKCkpUgtrZXlzVHJpbW1lZDqSAgoYcHJvamVjdF9yb2xlc19rZXlzX3ZhbGlkEhYuYnVmLnZhbGlkYXRlLk1hcFJ1bGVzGNmClyYgASgIQr0Bwki5AQq2AQoXcHJvamVjdF9yb2xlcy5rZXkudmFsaWQSJnN1YmplY3QgbXVzdCBiZSBhICcqJywgb3IgYSB2YWxpZCBVVUlEGnN0aGlzLmFsbChrLCBrID09ICcqJyB8fCBrLm1hdGNoZXMoJ15bMC05YS1mQS1GXXs4fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXsxMn0kJykpUhVwcm9qZWN0Um9sZXNLZXlzVmFsaWQ66AEKF3RlbmFudF9yb2xlc19rZXlzX3ZhbGlkEhYuYnVmLnZhbGlkYXRlLk1hcFJ1bGVzGNqClyYgASgIQpUBwkiRAQqOAQoWdGVuYW50X3JvbGVzLmtleS52YWxpZBIzc3ViamVjdCBtdXN0IGJlICcqJyBvciBiZXR3ZWVuIDIgYW5kIDEyOCBjaGFyYWN0ZXJzGj90aGlzLmFsbChrLCBrID09ICcqJyB8fCB0aGlzLnNpemUoKSA+PSAyIHx8IHRoaXMuc2l6ZSgpIDw9MTI4IClSFHRlbmFudFJvbGVzS2V5c1ZhbGlkQqABCg9jb20uZml0cy5hcGkudjFCFFByZWRlZmluZWRSdWxlc1Byb3RvUAFaKWdpdGh1Yi5jb20vZmktdHMvYXBpL2dvL2ZpdHMvYXBpL3YxO2FwaXYxogIDRkFYqgILRml0cy5BcGkuVjHKAgtGaXRzXEFwaVxWMeICF0ZpdHNcQXBpXFYxXEdQQk1ldGFkYXRh6gINRml0czo6QXBpOjpWMQ", [file_buf_validate_validate]);
 /**
  * Macaddress returns true if the given string is a valid macadress
  *
@@ -55,39 +55,69 @@ export const is_ip_or_hostname = /*@__PURE__*/ extDesc(file_fits_api_v1_predefin
  * @generated from extension: optional bool trimmed = 80048958;
  */
 export const trimmed = /*@__PURE__*/ extDesc(file_fits_api_v1_predefined_rules, 7);
+/**
+ * IsTenantLogin returns true if name field satisfies our requirements.
+ *
+ * @generated from extension: optional bool is_tenant_login = 80048962;
+ */
+export const is_tenant_login = /*@__PURE__*/ extDesc(file_fits_api_v1_predefined_rules, 8);
+/**
+ * IsTenantSubjectPermission returns true if name field satisfies our requirements.
+ *
+ * @generated from extension: optional bool is_tenant_subject_permission = 80048963;
+ */
+export const is_tenant_subject_permission = /*@__PURE__*/ extDesc(file_fits_api_v1_predefined_rules, 9);
+/**
+ * IsProjectSubjectPermission returns true if name field satisfies our requirements.
+ *
+ * @generated from extension: optional bool is_project_subject_permission = 80048964;
+ */
+export const is_project_subject_permission = /*@__PURE__*/ extDesc(file_fits_api_v1_predefined_rules, 10);
 /**
  * Prefixes validates if a slice of prefixes in string form are valid
  *
  * @generated from extension: optional bool prefixes = 80058951;
  */
-export const prefixes = /*@__PURE__*/ extDesc(file_fits_api_v1_predefined_rules, 8);
+export const prefixes = /*@__PURE__*/ extDesc(file_fits_api_v1_predefined_rules, 11);
 /**
  * Ips validates if a slice of ips in string form are valid
  *
  * @generated from extension: optional bool ips = 80058952;
  */
-export const ips = /*@__PURE__*/ extDesc(file_fits_api_v1_predefined_rules, 9);
+export const ips = /*@__PURE__*/ extDesc(file_fits_api_v1_predefined_rules, 12);
 /**
  * AreHostAndPort validates if a slice of strings are all in the form of <ip | host>:<port>
  *
  * @generated from extension: optional bool are_host_and_port = 80058953;
  */
-export const are_host_and_port = /*@__PURE__*/ extDesc(file_fits_api_v1_predefined_rules, 10);
+export const are_host_and_port = /*@__PURE__*/ extDesc(file_fits_api_v1_predefined_rules, 13);
 /**
  * All Trimmed enforces all strings to be trimmed, e.g. no whitespaces at the begin and end
  *
  * @generated from extension: optional bool all_trimmed = 80058954;
  */
-export const all_trimmed = /*@__PURE__*/ extDesc(file_fits_api_v1_predefined_rules, 11);
+export const all_trimmed = /*@__PURE__*/ extDesc(file_fits_api_v1_predefined_rules, 14);
 /**
  * Keys and Values trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
  *
  * @generated from extension: optional bool keys_and_values_trimmed = 80068951;
  */
-export const keys_and_values_trimmed = /*@__PURE__*/ extDesc(file_fits_api_v1_predefined_rules, 12);
+export const keys_and_values_trimmed = /*@__PURE__*/ extDesc(file_fits_api_v1_predefined_rules, 15);
 /**
  * Keys trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
  *
  * @generated from extension: optional bool keys_trimmed = 80068952;
  */
-export const keys_trimmed = /*@__PURE__*/ extDesc(file_fits_api_v1_predefined_rules, 13);
+export const keys_trimmed = /*@__PURE__*/ extDesc(file_fits_api_v1_predefined_rules, 16);
+/**
+ * ProjectRolesKeysValid ensures that project roles keys met our requirements.
+ *
+ * @generated from extension: optional bool project_roles_keys_valid = 80068953;
+ */
+export const project_roles_keys_valid = /*@__PURE__*/ extDesc(file_fits_api_v1_predefined_rules, 17);
+/**
+ * TenantRolesKeysValid ensures that tenant roles keys met our requirements.
+ *
+ * @generated from extension: optional bool tenant_roles_keys_valid = 80068954;
+ */
+export const tenant_roles_keys_valid = /*@__PURE__*/ extDesc(file_fits_api_v1_predefined_rules, 18);
diff --git a/js/fits/api/v1/predefined_rules_pb.ts b/js/fits/api/v1/predefined_rules_pb.ts
index 695cce4..f724fe7 100644
--- a/js/fits/api/v1/predefined_rules_pb.ts
+++ b/js/fits/api/v1/predefined_rules_pb.ts
@@ -11,7 +11,7 @@ import { file_buf_validate_validate } from "../../../buf/validate/validate_pb";
  * Describes the file fits/api/v1/predefined_rules.proto.
  */
 export const file_fits_api_v1_predefined_rules: GenFile = /*@__PURE__*/
-  fileDesc("CiJmaXRzL2FwaS92MS9wcmVkZWZpbmVkX3J1bGVzLnByb3RvEgtmaXRzLmFwaS52MTq4AQoKbWFjYWRkcmVzcxIZLmJ1Zi52YWxpZGF0ZS5TdHJpbmdSdWxlcxi35pUmIAEoCEJ6wkh3CnUKEXN0cmluZy5tYWNhZGRyZXNzEiZ0aGlzIHN0cmluZyBtdXN0IGJlIGEgdmFsaWQgbWFjYWRkcmVzcxo4dGhpcy5tYXRjaGVzKCdeKFswLTlBLUZhLWZdezJ9WzpdKXs1fShbMC05QS1GYS1mXXsyfSkkJylSCm1hY2FkZHJlc3M6mQEKB2lzX25hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuOaVJiABKAhCYsJIXwpdCg5zdHJpbmcuaXNfbmFtZRIjbXVzdCBiZSB3aXRoaW4gMiBhbmQgMTI4IGNoYXJhY3RlcnMaJnRoaXMuc2l6ZSgpID49IDIgJiYgdGhpcy5zaXplKCkgPD0gMTI4UgZpc05hbWU6mgEKDmlzX2Rlc2NyaXB0aW9uEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGLnmlSYgASgIQlXCSFIKUAoVc3RyaW5nLmlzX2Rlc2NyaXB0aW9uEiNtdXN0IGJlIHNob3J0ZXIgdGhhbiAyNTYgY2hhcmFjdGVycxoSdGhpcy5zaXplKCkgPD0gMjU2Ug1pc0Rlc2NyaXB0aW9uOqgBCgxpc19wYXJ0aXRpb24SGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuuaVJiABKAhCZ8JIZApiChNzdHJpbmcuaXNfcGFydGl0aW9uEiNtdXN0IGJlIHdpdGhpbiAyIGFuZCAxMjggY2hhcmFjdGVycxomdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSAxMjhSC2lzUGFydGl0aW9uOoIBCglpc19wcmVmaXgSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYu+aVJiABKAhCR8JIRApCCg9zdHJpbmcucHJlZml4ZXMSHGdpdmVuIHByZWZpeGVzIG11c3QgYmUgdmFsaWQaEXRoaXMuaXNJcFByZWZpeCgpUghpc1ByZWZpeDptCgZpc191cmkSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYvOaVJiABKAhCOMJINQozCgpzdHJpbmcudXJpEhdnaXZlbiB1cmkgbXVzdCBiZSB2YWxpZBoMdGhpcy5pc1VyaSgpUgVpc1VyaTqnAQoRaXNfaXBfb3JfaG9zdG5hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYveaVJiABKAhCXsJIWwpZCg12YWxpZF9hZGRyZXNzEiZtdXN0IGJlIGEgdmFsaWQgSVAgYWRkcmVzcyBvciBob3N0bmFtZRogdGhpcy5pc0lwKCkgfHwgdGhpcy5pc0hvc3RuYW1lKClSDmlzSXBPckhvc3RuYW1lOp0BCgd0cmltbWVkEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGL7mlSYgASgIQmXCSGIKYAoOc3RyaW5nLnRyaW1tZWQSK3ZhbHVlIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaIXRoaXMudHJpbSgpLnNpemUoKSA9PSB0aGlzLnNpemUoKVIHdHJpbW1lZDqPAQoIcHJlZml4ZXMSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjHtJYmIAEoCEJTwkhQCk4KEXJlcGVhdGVkLnByZWZpeGVzEhxnaXZlbiBwcmVmaXhlcyBtdXN0IGJlIHZhbGlkGht0aGlzLmFsbChtLCBtLmlzSXBQcmVmaXgoKSlSCHByZWZpeGVzOnUKA2lwcxIbLmJ1Zi52YWxpZGF0ZS5SZXBlYXRlZFJ1bGVzGMi0liYgASgIQkPCSEAKPgoMcmVwZWF0ZWQuaXBzEhdnaXZlbiBpcHMgbXVzdCBiZSB2YWxpZBoVdGhpcy5hbGwobSwgbS5pc0lwKCkpUgNpcHM65gEKEWFyZV9ob3N0X2FuZF9wb3J0EhsuYnVmLnZhbGlkYXRlLlJlcGVhdGVkUnVsZXMYybSWJiABKAhCmgHCSJYBCpMBChpyZXBlYXRlZC5hcmVfaG9zdF9hbmRfcG9ydBJQZ2l2ZW4gZW50cmllcyBtdXN0IGFsbCBiZSBpbiB0aGUgZm9ybSBvZiA8aXAgfCBob3N0Pjo8cG9ydD4gYnV0IHBvcnQgaXMgb3B0aW9uYWwaI3RoaXMuYWxsKG0sIG0uaXNIb3N0QW5kUG9ydChmYWxzZSkpUg5hcmVIb3N0QW5kUG9ydDq6AQoLYWxsX3RyaW1tZWQSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjKtJYmIAEoCEJ5wkh2CnQKFHJlcGVhdGVkLmFsbF90cmltbWVkEjJnaXZlbiB2YWx1ZXMgbXVzdCBub3Qgc3RhcnQgb3IgZW5kIHdpdGggd2hpdGVzcGFjZRoodGhpcy5hbGwobSwgbS50cmltKCkuc2l6ZSgpID09IG0uc2l6ZSgpKVIKYWxsVHJpbW1lZDqEAgoXa2V5c19hbmRfdmFsdWVzX3RyaW1tZWQSFi5idWYudmFsaWRhdGUuTWFwUnVsZXMY14KXJiABKAhCsQHCSK0BCqoBChttYXAua2V5c19hbmRfdmFsdWVzX3RyaW1tZWQSNWtleXMgYW5kIHZhbHVlcyBtdXN0IG5vdCBzdGFydCBvciBlbmQgd2l0aCB3aGl0ZXNwYWNlGlR0aGlzLmFsbChrLCBrLnRyaW0oKS5zaXplKCkgPT0gay5zaXplKCkpICYmIHRoaXMuYWxsKHYsIHYudHJpbSgpLnNpemUoKSA9PSB2LnNpemUoKSlSFGtleXNBbmRWYWx1ZXNUcmltbWVkOqsBCgxrZXlzX3RyaW1tZWQSFi5idWYudmFsaWRhdGUuTWFwUnVsZXMY2IKXJiABKAhCbcJIagpoChBtYXAua2V5c190cmltbWVkEiprZXlzIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaKHRoaXMuYWxsKGssIGsudHJpbSgpLnNpemUoKSA9PSBrLnNpemUoKSlSC2tleXNUcmltbWVkQqABCg9jb20uZml0cy5hcGkudjFCFFByZWRlZmluZWRSdWxlc1Byb3RvUAFaKWdpdGh1Yi5jb20vZmktdHMvYXBpL2dvL2ZpdHMvYXBpL3YxO2FwaXYxogIDRkFYqgILRml0cy5BcGkuVjHKAgtGaXRzXEFwaVxWMeICF0ZpdHNcQXBpXFYxXEdQQk1ldGFkYXRh6gINRml0czo6QXBpOjpWMQ", [file_buf_validate_validate]);
+  fileDesc("CiJmaXRzL2FwaS92MS9wcmVkZWZpbmVkX3J1bGVzLnByb3RvEgtmaXRzLmFwaS52MTq4AQoKbWFjYWRkcmVzcxIZLmJ1Zi52YWxpZGF0ZS5TdHJpbmdSdWxlcxi35pUmIAEoCEJ6wkh3CnUKEXN0cmluZy5tYWNhZGRyZXNzEiZ0aGlzIHN0cmluZyBtdXN0IGJlIGEgdmFsaWQgbWFjYWRkcmVzcxo4dGhpcy5tYXRjaGVzKCdeKFswLTlBLUZhLWZdezJ9WzpdKXs1fShbMC05QS1GYS1mXXsyfSkkJylSCm1hY2FkZHJlc3M6mQEKB2lzX25hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuOaVJiABKAhCYsJIXwpdCg5zdHJpbmcuaXNfbmFtZRIjbXVzdCBiZSB3aXRoaW4gMiBhbmQgMTI4IGNoYXJhY3RlcnMaJnRoaXMuc2l6ZSgpID49IDIgJiYgdGhpcy5zaXplKCkgPD0gMTI4UgZpc05hbWU6mgEKDmlzX2Rlc2NyaXB0aW9uEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGLnmlSYgASgIQlXCSFIKUAoVc3RyaW5nLmlzX2Rlc2NyaXB0aW9uEiNtdXN0IGJlIHNob3J0ZXIgdGhhbiAyNTYgY2hhcmFjdGVycxoSdGhpcy5zaXplKCkgPD0gMjU2Ug1pc0Rlc2NyaXB0aW9uOqgBCgxpc19wYXJ0aXRpb24SGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYuuaVJiABKAhCZ8JIZApiChNzdHJpbmcuaXNfcGFydGl0aW9uEiNtdXN0IGJlIHdpdGhpbiAyIGFuZCAxMjggY2hhcmFjdGVycxomdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSAxMjhSC2lzUGFydGl0aW9uOoIBCglpc19wcmVmaXgSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYu+aVJiABKAhCR8JIRApCCg9zdHJpbmcucHJlZml4ZXMSHGdpdmVuIHByZWZpeGVzIG11c3QgYmUgdmFsaWQaEXRoaXMuaXNJcFByZWZpeCgpUghpc1ByZWZpeDptCgZpc191cmkSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYvOaVJiABKAhCOMJINQozCgpzdHJpbmcudXJpEhdnaXZlbiB1cmkgbXVzdCBiZSB2YWxpZBoMdGhpcy5pc1VyaSgpUgVpc1VyaTqnAQoRaXNfaXBfb3JfaG9zdG5hbWUSGS5idWYudmFsaWRhdGUuU3RyaW5nUnVsZXMYveaVJiABKAhCXsJIWwpZCg12YWxpZF9hZGRyZXNzEiZtdXN0IGJlIGEgdmFsaWQgSVAgYWRkcmVzcyBvciBob3N0bmFtZRogdGhpcy5pc0lwKCkgfHwgdGhpcy5pc0hvc3RuYW1lKClSDmlzSXBPckhvc3RuYW1lOp0BCgd0cmltbWVkEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGL7mlSYgASgIQmXCSGIKYAoOc3RyaW5nLnRyaW1tZWQSK3ZhbHVlIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaIXRoaXMudHJpbSgpLnNpemUoKSA9PSB0aGlzLnNpemUoKVIHdHJpbW1lZDqwAQoPaXNfdGVuYW50X2xvZ2luEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGMLmlSYgASgIQmrCSGcKZQoWc3RyaW5nLmlzX3RlbmFudF9sb2dpbhIjbXVzdCBiZSB3aXRoaW4gMiBhbmQgMTI4IGNoYXJhY3RlcnMaJnRoaXMuc2l6ZSgpID49IDIgJiYgdGhpcy5zaXplKCkgPD0gMTI4Ug1pc1RlbmFudExvZ2luOu8BChxpc190ZW5hbnRfc3ViamVjdF9wZXJtaXNzaW9uEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGMPmlSYgASgIQo8BwkiLAQqIAQojc3RyaW5nLmlzX3RlbmFudF9zdWJqZWN0X3Blcm1pc3Npb24SKm11c3QgYmUgJyonIG9yIHdpdGhpbiAyIGFuZCAxMjggY2hhcmFjdGVycxo1dGhpcyA9PSAnKicgfHwgdGhpcy5zaXplKCkgPj0gMiAmJiB0aGlzLnNpemUoKSA8PSAxMjhSGWlzVGVuYW50U3ViamVjdFBlcm1pc3Npb246lAIKHWlzX3Byb2plY3Rfc3ViamVjdF9wZXJtaXNzaW9uEhkuYnVmLnZhbGlkYXRlLlN0cmluZ1J1bGVzGMTmlSYgASgIQrIBwkiuAQqrAQokc3RyaW5nLmlzX3Byb2plY3Rfc3ViamVjdF9wZXJtaXNzaW9uEhVtdXN0IGJlICcqJyBvciBhIHV1aWQabHRoaXMgPT0gJyonIHx8IHRoaXMubWF0Y2hlcygnXlswLTlhLWZBLUZdezh9LVswLTlhLWZBLUZdezR9LVswLTlhLWZBLUZdezR9LVswLTlhLWZBLUZdezR9LVswLTlhLWZBLUZdezEyfSQnKVIaaXNQcm9qZWN0U3ViamVjdFBlcm1pc3Npb246jwEKCHByZWZpeGVzEhsuYnVmLnZhbGlkYXRlLlJlcGVhdGVkUnVsZXMYx7SWJiABKAhCU8JIUApOChFyZXBlYXRlZC5wcmVmaXhlcxIcZ2l2ZW4gcHJlZml4ZXMgbXVzdCBiZSB2YWxpZBobdGhpcy5hbGwobSwgbS5pc0lwUHJlZml4KCkpUghwcmVmaXhlczp1CgNpcHMSGy5idWYudmFsaWRhdGUuUmVwZWF0ZWRSdWxlcxjItJYmIAEoCEJDwkhACj4KDHJlcGVhdGVkLmlwcxIXZ2l2ZW4gaXBzIG11c3QgYmUgdmFsaWQaFXRoaXMuYWxsKG0sIG0uaXNJcCgpKVIDaXBzOuYBChFhcmVfaG9zdF9hbmRfcG9ydBIbLmJ1Zi52YWxpZGF0ZS5SZXBlYXRlZFJ1bGVzGMm0liYgASgIQpoBwkiWAQqTAQoacmVwZWF0ZWQuYXJlX2hvc3RfYW5kX3BvcnQSUGdpdmVuIGVudHJpZXMgbXVzdCBhbGwgYmUgaW4gdGhlIGZvcm0gb2YgPGlwIHwgaG9zdD46PHBvcnQ+IGJ1dCBwb3J0IGlzIG9wdGlvbmFsGiN0aGlzLmFsbChtLCBtLmlzSG9zdEFuZFBvcnQoZmFsc2UpKVIOYXJlSG9zdEFuZFBvcnQ6ugEKC2FsbF90cmltbWVkEhsuYnVmLnZhbGlkYXRlLlJlcGVhdGVkUnVsZXMYyrSWJiABKAhCecJIdgp0ChRyZXBlYXRlZC5hbGxfdHJpbW1lZBIyZ2l2ZW4gdmFsdWVzIG11c3Qgbm90IHN0YXJ0IG9yIGVuZCB3aXRoIHdoaXRlc3BhY2UaKHRoaXMuYWxsKG0sIG0udHJpbSgpLnNpemUoKSA9PSBtLnNpemUoKSlSCmFsbFRyaW1tZWQ6hAIKF2tleXNfYW5kX3ZhbHVlc190cmltbWVkEhYuYnVmLnZhbGlkYXRlLk1hcFJ1bGVzGNeClyYgASgIQrEBwkitAQqqAQobbWFwLmtleXNfYW5kX3ZhbHVlc190cmltbWVkEjVrZXlzIGFuZCB2YWx1ZXMgbXVzdCBub3Qgc3RhcnQgb3IgZW5kIHdpdGggd2hpdGVzcGFjZRpUdGhpcy5hbGwoaywgay50cmltKCkuc2l6ZSgpID09IGsuc2l6ZSgpKSAmJiB0aGlzLmFsbCh2LCB2LnRyaW0oKS5zaXplKCkgPT0gdi5zaXplKCkpUhRrZXlzQW5kVmFsdWVzVHJpbW1lZDqrAQoMa2V5c190cmltbWVkEhYuYnVmLnZhbGlkYXRlLk1hcFJ1bGVzGNiClyYgASgIQm3CSGoKaAoQbWFwLmtleXNfdHJpbW1lZBIqa2V5cyBtdXN0IG5vdCBzdGFydCBvciBlbmQgd2l0aCB3aGl0ZXNwYWNlGih0aGlzLmFsbChrLCBrLnRyaW0oKS5zaXplKCkgPT0gay5zaXplKCkpUgtrZXlzVHJpbW1lZDqSAgoYcHJvamVjdF9yb2xlc19rZXlzX3ZhbGlkEhYuYnVmLnZhbGlkYXRlLk1hcFJ1bGVzGNmClyYgASgIQr0Bwki5AQq2AQoXcHJvamVjdF9yb2xlcy5rZXkudmFsaWQSJnN1YmplY3QgbXVzdCBiZSBhICcqJywgb3IgYSB2YWxpZCBVVUlEGnN0aGlzLmFsbChrLCBrID09ICcqJyB8fCBrLm1hdGNoZXMoJ15bMC05YS1mQS1GXXs4fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXs0fS1bMC05YS1mQS1GXXsxMn0kJykpUhVwcm9qZWN0Um9sZXNLZXlzVmFsaWQ66AEKF3RlbmFudF9yb2xlc19rZXlzX3ZhbGlkEhYuYnVmLnZhbGlkYXRlLk1hcFJ1bGVzGNqClyYgASgIQpUBwkiRAQqOAQoWdGVuYW50X3JvbGVzLmtleS52YWxpZBIzc3ViamVjdCBtdXN0IGJlICcqJyBvciBiZXR3ZWVuIDIgYW5kIDEyOCBjaGFyYWN0ZXJzGj90aGlzLmFsbChrLCBrID09ICcqJyB8fCB0aGlzLnNpemUoKSA+PSAyIHx8IHRoaXMuc2l6ZSgpIDw9MTI4IClSFHRlbmFudFJvbGVzS2V5c1ZhbGlkQqABCg9jb20uZml0cy5hcGkudjFCFFByZWRlZmluZWRSdWxlc1Byb3RvUAFaKWdpdGh1Yi5jb20vZmktdHMvYXBpL2dvL2ZpdHMvYXBpL3YxO2FwaXYxogIDRkFYqgILRml0cy5BcGkuVjHKAgtGaXRzXEFwaVxWMeICF0ZpdHNcQXBpXFYxXEdQQk1ldGFkYXRh6gINRml0czo6QXBpOjpWMQ", [file_buf_validate_validate]);
 
 /**
  * Macaddress returns true if the given string is a valid macadress
@@ -77,13 +77,37 @@ export const is_ip_or_hostname: GenExtension<StringRules, boolean> = /*@__PURE__
 export const trimmed: GenExtension<StringRules, boolean> = /*@__PURE__*/
   extDesc(file_fits_api_v1_predefined_rules, 7);
 
+/**
+ * IsTenantLogin returns true if name field satisfies our requirements.
+ *
+ * @generated from extension: optional bool is_tenant_login = 80048962;
+ */
+export const is_tenant_login: GenExtension<StringRules, boolean> = /*@__PURE__*/
+  extDesc(file_fits_api_v1_predefined_rules, 8);
+
+/**
+ * IsTenantSubjectPermission returns true if name field satisfies our requirements.
+ *
+ * @generated from extension: optional bool is_tenant_subject_permission = 80048963;
+ */
+export const is_tenant_subject_permission: GenExtension<StringRules, boolean> = /*@__PURE__*/
+  extDesc(file_fits_api_v1_predefined_rules, 9);
+
+/**
+ * IsProjectSubjectPermission returns true if name field satisfies our requirements.
+ *
+ * @generated from extension: optional bool is_project_subject_permission = 80048964;
+ */
+export const is_project_subject_permission: GenExtension<StringRules, boolean> = /*@__PURE__*/
+  extDesc(file_fits_api_v1_predefined_rules, 10);
+
 /**
  * Prefixes validates if a slice of prefixes in string form are valid
  *
  * @generated from extension: optional bool prefixes = 80058951;
  */
 export const prefixes: GenExtension<RepeatedRules, boolean> = /*@__PURE__*/
-  extDesc(file_fits_api_v1_predefined_rules, 8);
+  extDesc(file_fits_api_v1_predefined_rules, 11);
 
 /**
  * Ips validates if a slice of ips in string form are valid
@@ -91,7 +115,7 @@ export const prefixes: GenExtension<RepeatedRules, boolean> = /*@__PURE__*/
  * @generated from extension: optional bool ips = 80058952;
  */
 export const ips: GenExtension<RepeatedRules, boolean> = /*@__PURE__*/
-  extDesc(file_fits_api_v1_predefined_rules, 9);
+  extDesc(file_fits_api_v1_predefined_rules, 12);
 
 /**
  * AreHostAndPort validates if a slice of strings are all in the form of <ip | host>:<port>
@@ -99,7 +123,7 @@ export const ips: GenExtension<RepeatedRules, boolean> = /*@__PURE__*/
  * @generated from extension: optional bool are_host_and_port = 80058953;
  */
 export const are_host_and_port: GenExtension<RepeatedRules, boolean> = /*@__PURE__*/
-  extDesc(file_fits_api_v1_predefined_rules, 10);
+  extDesc(file_fits_api_v1_predefined_rules, 13);
 
 /**
  * All Trimmed enforces all strings to be trimmed, e.g. no whitespaces at the begin and end
@@ -107,7 +131,7 @@ export const are_host_and_port: GenExtension<RepeatedRules, boolean> = /*@__PURE
  * @generated from extension: optional bool all_trimmed = 80058954;
  */
 export const all_trimmed: GenExtension<RepeatedRules, boolean> = /*@__PURE__*/
-  extDesc(file_fits_api_v1_predefined_rules, 11);
+  extDesc(file_fits_api_v1_predefined_rules, 14);
 
 /**
  * Keys and Values trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
@@ -115,7 +139,7 @@ export const all_trimmed: GenExtension<RepeatedRules, boolean> = /*@__PURE__*/
  * @generated from extension: optional bool keys_and_values_trimmed = 80068951;
  */
 export const keys_and_values_trimmed: GenExtension<MapRules, boolean> = /*@__PURE__*/
-  extDesc(file_fits_api_v1_predefined_rules, 12);
+  extDesc(file_fits_api_v1_predefined_rules, 15);
 
 /**
  * Keys trimmed enforces all map keys and values to be trimmed, e.g. no whitespaces at the begin and end
@@ -123,5 +147,21 @@ export const keys_and_values_trimmed: GenExtension<MapRules, boolean> = /*@__PUR
  * @generated from extension: optional bool keys_trimmed = 80068952;
  */
 export const keys_trimmed: GenExtension<MapRules, boolean> = /*@__PURE__*/
-  extDesc(file_fits_api_v1_predefined_rules, 13);
+  extDesc(file_fits_api_v1_predefined_rules, 16);
+
+/**
+ * ProjectRolesKeysValid ensures that project roles keys met our requirements.
+ *
+ * @generated from extension: optional bool project_roles_keys_valid = 80068953;
+ */
+export const project_roles_keys_valid: GenExtension<MapRules, boolean> = /*@__PURE__*/
+  extDesc(file_fits_api_v1_predefined_rules, 17);
+
+/**
+ * TenantRolesKeysValid ensures that tenant roles keys met our requirements.
+ *
+ * @generated from extension: optional bool tenant_roles_keys_valid = 80068954;
+ */
+export const tenant_roles_keys_valid: GenExtension<MapRules, boolean> = /*@__PURE__*/
+  extDesc(file_fits_api_v1_predefined_rules, 18);
 
diff --git a/js/fits/api/v1/token_pb.d.ts b/js/fits/api/v1/token_pb.d.ts
index 1be49ab..e8ab617 100644
--- a/js/fits/api/v1/token_pb.d.ts
+++ b/js/fits/api/v1/token_pb.d.ts
@@ -112,11 +112,11 @@ export type TokenServiceCreateRequest = Message<"fits.api.v1.TokenServiceCreateR
      */
     description: string;
     /**
-     * Permissions is a list of service methods this token can be used for
+     * Permissions is a list of service methods this token can be used for.
      *
-     * @generated from field: repeated fits.api.v1.MethodPermission permissions = 2;
+     * @generated from field: repeated fits.api.v1.PermissionsByVisibility permissions = 2;
      */
-    permissions: MethodPermission[];
+    permissions: PermissionsByVisibility[];
     /**
      * Expires gives the duration since now, after which this token can not be used anymore
      *
@@ -186,6 +186,171 @@ export type MethodPermission = Message<"fits.api.v1.MethodPermission"> & {
  * Use `create(MethodPermissionSchema)` to create a new message.
  */
 export declare const MethodPermissionSchema: GenMessage<MethodPermission>;
+/**
+ * PermissionsByVisibility contains method permissions by visibility.
+ *
+ * @generated from message fits.api.v1.PermissionsByVisibility
+ */
+export type PermissionsByVisibility = Message<"fits.api.v1.PermissionsByVisibility"> & {
+    /**
+     * Visibility defines the visibility of the requested method permissions.
+     *
+     * @generated from oneof fits.api.v1.PermissionsByVisibility.visibility
+     */
+    visibility: {
+        /**
+         * PublicPermissions carries public method permissions.
+         *
+         * @generated from field: fits.api.v1.PublicPermissions public = 1;
+         */
+        value: PublicPermissions;
+        case: "public";
+    } | {
+        /**
+         * SelfPermissions carries self method permissions.
+         *
+         * @generated from field: fits.api.v1.SelfPermissions self = 2;
+         */
+        value: SelfPermissions;
+        case: "self";
+    } | {
+        /**
+         * ProjectPermissions carries project method permissions.
+         *
+         * @generated from field: fits.api.v1.ProjectPermissions project = 3;
+         */
+        value: ProjectPermissions;
+        case: "project";
+    } | {
+        /**
+         * TenantPermissions carries tenant method permissions.
+         *
+         * @generated from field: fits.api.v1.TenantPermissions tenant = 4;
+         */
+        value: TenantPermissions;
+        case: "tenant";
+    } | {
+        /**
+         * AdminPermissions carries admin method permissions.
+         *
+         * @generated from field: fits.api.v1.AdminPermissions admin = 5;
+         */
+        value: AdminPermissions;
+        case: "admin";
+    } | {
+        case: undefined;
+        value?: undefined;
+    };
+};
+/**
+ * Describes the message fits.api.v1.PermissionsByVisibility.
+ * Use `create(PermissionsByVisibilitySchema)` to create a new message.
+ */
+export declare const PermissionsByVisibilitySchema: GenMessage<PermissionsByVisibility>;
+/**
+ * PublicPermissions carries public method permissions.
+ *
+ * @generated from message fits.api.v1.PublicPermissions
+ */
+export type PublicPermissions = Message<"fits.api.v1.PublicPermissions"> & {
+    /**
+     * Methods which should be accessible.
+     *
+     * @generated from field: repeated string methods = 2;
+     */
+    methods: string[];
+};
+/**
+ * Describes the message fits.api.v1.PublicPermissions.
+ * Use `create(PublicPermissionsSchema)` to create a new message.
+ */
+export declare const PublicPermissionsSchema: GenMessage<PublicPermissions>;
+/**
+ * SelfPermissions carries self method permissions.
+ *
+ * @generated from message fits.api.v1.SelfPermissions
+ */
+export type SelfPermissions = Message<"fits.api.v1.SelfPermissions"> & {
+    /**
+     * Methods which should be accessible.
+     *
+     * @generated from field: repeated string methods = 2;
+     */
+    methods: string[];
+};
+/**
+ * Describes the message fits.api.v1.SelfPermissions.
+ * Use `create(SelfPermissionsSchema)` to create a new message.
+ */
+export declare const SelfPermissionsSchema: GenMessage<SelfPermissions>;
+/**
+ * ProjectPermissions carries project method permissions.
+ *
+ * @generated from message fits.api.v1.ProjectPermissions
+ */
+export type ProjectPermissions = Message<"fits.api.v1.ProjectPermissions"> & {
+    /**
+     * Project scope for the permissions.
+     * Asterisk (*) can be specified to match any subject.
+     *
+     * @generated from field: string project = 1;
+     */
+    project: string;
+    /**
+     * Methods which should be accessible.
+     *
+     * @generated from field: repeated string methods = 2;
+     */
+    methods: string[];
+};
+/**
+ * Describes the message fits.api.v1.ProjectPermissions.
+ * Use `create(ProjectPermissionsSchema)` to create a new message.
+ */
+export declare const ProjectPermissionsSchema: GenMessage<ProjectPermissions>;
+/**
+ * TenantPermissions carries tenant method permissions.
+ *
+ * @generated from message fits.api.v1.TenantPermissions
+ */
+export type TenantPermissions = Message<"fits.api.v1.TenantPermissions"> & {
+    /**
+     * Login of the tenant.
+     * Asterisk (*) can be specified to match any subject.
+     *
+     * @generated from field: string login = 1;
+     */
+    login: string;
+    /**
+     * Methods which should be accessible.
+     *
+     * @generated from field: repeated string methods = 2;
+     */
+    methods: string[];
+};
+/**
+ * Describes the message fits.api.v1.TenantPermissions.
+ * Use `create(TenantPermissionsSchema)` to create a new message.
+ */
+export declare const TenantPermissionsSchema: GenMessage<TenantPermissions>;
+/**
+ * AdminPermissions carries admin method permissions.
+ *
+ * @generated from message fits.api.v1.AdminPermissions
+ */
+export type AdminPermissions = Message<"fits.api.v1.AdminPermissions"> & {
+    /**
+     * Methods which should be accessible.
+     *
+     * @generated from field: repeated string methods = 2;
+     */
+    methods: string[];
+};
+/**
+ * Describes the message fits.api.v1.AdminPermissions.
+ * Use `create(AdminPermissionsSchema)` to create a new message.
+ */
+export declare const AdminPermissionsSchema: GenMessage<AdminPermissions>;
 /**
  * TokenServiceCreateResponse is the response payload of a token create request
  *
@@ -294,11 +459,11 @@ export type TokenServiceUpdateRequest = Message<"fits.api.v1.TokenServiceUpdateR
      */
     description?: string | undefined;
     /**
-     * Permissions is a list of service methods this token can be used for
+     * Permissions is a list of service methods this token can be used for.
      *
-     * @generated from field: repeated fits.api.v1.MethodPermission permissions = 4;
+     * @generated from field: repeated fits.api.v1.PermissionsByVisibility permissions = 4;
      */
-    permissions: MethodPermission[];
+    permissions: PermissionsByVisibility[];
     /**
      * ProjectRoles associates a project id with the corresponding role of the token owner
      *
diff --git a/js/fits/api/v1/token_pb.js b/js/fits/api/v1/token_pb.js
index a2bcf16..661ed4f 100644
--- a/js/fits/api/v1/token_pb.js
+++ b/js/fits/api/v1/token_pb.js
@@ -9,7 +9,7 @@ import { file_google_protobuf_duration, file_google_protobuf_timestamp } from "@
 /**
  * Describes the file fits/api/v1/token.proto.
  */
-export const file_fits_api_v1_token = /*@__PURE__*/ fileDesc("ChdmaXRzL2FwaS92MS90b2tlbi5wcm90bxILZml0cy5hcGkudjEizQYKBVRva2VuEhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEhgKBHVzZXIYAiABKAlCCrpIB3IFEAIYgAQSHwoEbWV0YRgDIAEoCzIRLmZpdHMuYXBpLnYxLk1ldGESIAoLZGVzY3JpcHRpb24YBCABKAlCC7pICHIGyLOusQIBEj0KC3Blcm1pc3Npb25zGAUgAygLMh0uZml0cy5hcGkudjEuTWV0aG9kUGVybWlzc2lvbkIJukgGkgEDEPQDEisKB2V4cGlyZXMYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi0KCWlzc3VlZF9hdBgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASNAoKdG9rZW5fdHlwZRgIIAEoDjIWLmZpdHMuYXBpLnYxLlRva2VuVHlwZUIIukgFggECEAESOwoNcHJvamVjdF9yb2xlcxgJIAMoCzIkLmZpdHMuYXBpLnYxLlRva2VuLlByb2plY3RSb2xlc0VudHJ5EjkKDHRlbmFudF9yb2xlcxgKIAMoCzIjLmZpdHMuYXBpLnYxLlRva2VuLlRlbmFudFJvbGVzRW50cnkSOQoKYWRtaW5fcm9sZRgLIAEoDjIWLmZpdHMuYXBpLnYxLkFkbWluUm9sZUIIukgFggECEAFIAIgBARpNChFQcm9qZWN0Um9sZXNFbnRyeRILCgNrZXkYASABKAkSJwoFdmFsdWUYAiABKA4yGC5maXRzLmFwaS52MS5Qcm9qZWN0Um9sZToCOAEaSwoQVGVuYW50Um9sZXNFbnRyeRILCgNrZXkYASABKAkSJgoFdmFsdWUYAiABKA4yFy5maXRzLmFwaS52MS5UZW5hbnRSb2xlOgI4ATqfAbpImwEamAEKG3Rva2VuLnBlcm1pc3Npb25zLnVzZXJ0b2tlbhIpdG9rZW4gdHlwZSB1c2VyIG11c3Qgbm90IGhhdmUgcGVybWlzc2lvbnMaTih0aGlzLnRva2VuX3R5cGUgPT0gMiAmJiB0aGlzLnBlcm1pc3Npb25zLnNpemUoKSA9PSAwKSB8fCB0aGlzLnRva2VuX3R5cGUgIT0gMkINCgtfYWRtaW5fcm9sZSKgBQoZVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdBIgCgtkZXNjcmlwdGlvbhgBIAEoCUILukgIcgbIs66xAgESPAoLcGVybWlzc2lvbnMYAiADKAsyHS5maXRzLmFwaS52MS5NZXRob2RQZXJtaXNzaW9uQgi6SAWSAQIQZBI+CgdleHBpcmVzGAMgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQhK6SA+qAQwaBQiB54QPMgMI2AQSawoNcHJvamVjdF9yb2xlcxgEIAMoCzI4LmZpdHMuYXBpLnYxLlRva2VuU2VydmljZUNyZWF0ZVJlcXVlc3QuUHJvamVjdFJvbGVzRW50cnlCGrpIF5oBFMCVuLECASIFcgOwAQEqBYIBAhABEmsKDHRlbmFudF9yb2xlcxgFIAMoCzI3LmZpdHMuYXBpLnYxLlRva2VuU2VydmljZUNyZWF0ZVJlcXVlc3QuVGVuYW50Um9sZXNFbnRyeUIcukgZmgEWwJW4sQIBIgdyBRADGIABKgWCAQIQARI5CgphZG1pbl9yb2xlGAYgASgOMhYuZml0cy5hcGkudjEuQWRtaW5Sb2xlQgi6SAWCAQIQAUgAiAEBEiMKBmxhYmVscxgHIAEoCzITLmZpdHMuYXBpLnYxLkxhYmVscxpNChFQcm9qZWN0Um9sZXNFbnRyeRILCgNrZXkYASABKAkSJwoFdmFsdWUYAiABKA4yGC5maXRzLmFwaS52MS5Qcm9qZWN0Um9sZToCOAEaSwoQVGVuYW50Um9sZXNFbnRyeRILCgNrZXkYASABKAkSJgoFdmFsdWUYAiABKA4yFy5maXRzLmFwaS52MS5UZW5hbnRSb2xlOgI4AUINCgtfYWRtaW5fcm9sZSJJChBNZXRob2RQZXJtaXNzaW9uEhkKB3N1YmplY3QYASABKAlCCLpIBXIDGIACEhoKB21ldGhvZHMYAiADKAlCCbpIBpIBAxD0AyJPChpUb2tlblNlcnZpY2VDcmVhdGVSZXNwb25zZRIhCgV0b2tlbhgBIAEoCzISLmZpdHMuYXBpLnYxLlRva2VuEg4KBnNlY3JldBgCIAEoCSIZChdUb2tlblNlcnZpY2VMaXN0UmVxdWVzdCI+ChhUb2tlblNlcnZpY2VMaXN0UmVzcG9uc2USIgoGdG9rZW5zGAEgAygLMhIuZml0cy5hcGkudjEuVG9rZW4iMwoZVG9rZW5TZXJ2aWNlUmV2b2tlUmVxdWVzdBIWCgR1dWlkGAEgASgJQgi6SAVyA7ABASIcChpUb2tlblNlcnZpY2VSZXZva2VSZXNwb25zZSK/BQoZVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdBIWCgR1dWlkGAEgASgJQgi6SAVyA7ABARI0Cgt1cGRhdGVfbWV0YRgCIAEoCzIXLmZpdHMuYXBpLnYxLlVwZGF0ZU1ldGFCBrpIA8gBABIlCgtkZXNjcmlwdGlvbhgDIAEoCUILukgIcgbIs66xAgFIAIgBARIyCgtwZXJtaXNzaW9ucxgEIAMoCzIdLmZpdHMuYXBpLnYxLk1ldGhvZFBlcm1pc3Npb24SawoNcHJvamVjdF9yb2xlcxgFIAMoCzI4LmZpdHMuYXBpLnYxLlRva2VuU2VydmljZVVwZGF0ZVJlcXVlc3QuUHJvamVjdFJvbGVzRW50cnlCGrpIF5oBFMCVuLECASIFcgOwAQEqBYIBAhABEmsKDHRlbmFudF9yb2xlcxgGIAMoCzI3LmZpdHMuYXBpLnYxLlRva2VuU2VydmljZVVwZGF0ZVJlcXVlc3QuVGVuYW50Um9sZXNFbnRyeUIcukgZmgEWwJW4sQIBIgdyBRADGIABKgWCAQIQARI5CgphZG1pbl9yb2xlGAcgASgOMhYuZml0cy5hcGkudjEuQWRtaW5Sb2xlQgi6SAWCAQIQAUgBiAEBEikKBmxhYmVscxgIIAEoCzIZLmZpdHMuYXBpLnYxLlVwZGF0ZUxhYmVscxpNChFQcm9qZWN0Um9sZXNFbnRyeRILCgNrZXkYASABKAkSJwoFdmFsdWUYAiABKA4yGC5maXRzLmFwaS52MS5Qcm9qZWN0Um9sZToCOAEaSwoQVGVuYW50Um9sZXNFbnRyeRILCgNrZXkYASABKAkSJgoFdmFsdWUYAiABKA4yFy5maXRzLmFwaS52MS5UZW5hbnRSb2xlOgI4AUIOCgxfZGVzY3JpcHRpb25CDQoLX2FkbWluX3JvbGUiPwoaVG9rZW5TZXJ2aWNlVXBkYXRlUmVzcG9uc2USIQoFdG9rZW4YASABKAsyEi5maXRzLmFwaS52MS5Ub2tlbiIwChZUb2tlblNlcnZpY2VHZXRSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBIjwKF1Rva2VuU2VydmljZUdldFJlc3BvbnNlEiEKBXRva2VuGAEgASgLMhIuZml0cy5hcGkudjEuVG9rZW4iHAoaVG9rZW5TZXJ2aWNlUmVmcmVzaFJlcXVlc3QiUAobVG9rZW5TZXJ2aWNlUmVmcmVzaFJlc3BvbnNlEiEKBXRva2VuGAEgASgLMhIuZml0cy5hcGkudjEuVG9rZW4SDgoGc2VjcmV0GAIgASgJKlAKCVRva2VuVHlwZRIaChZUT0tFTl9UWVBFX1VOU1BFQ0lGSUVEEAASEgoOVE9LRU5fVFlQRV9BUEkQARITCg9UT0tFTl9UWVBFX1VTRVIQAjLgBAoMVG9rZW5TZXJ2aWNlEloKA0dldBIjLmZpdHMuYXBpLnYxLlRva2VuU2VydmljZUdldFJlcXVlc3QaJC5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VHZXRSZXNwb25zZSII2PMYAuDzGAESYwoGQ3JlYXRlEiYuZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdBonLmZpdHMuYXBpLnYxLlRva2VuU2VydmljZUNyZWF0ZVJlc3BvbnNlIgjY8xgC4PMYARJjCgZVcGRhdGUSJi5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0GicuZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlVXBkYXRlUmVzcG9uc2UiCNjzGALg8xgBEl0KBExpc3QSJC5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VMaXN0UmVxdWVzdBolLmZpdHMuYXBpLnYxLlRva2VuU2VydmljZUxpc3RSZXNwb25zZSII2PMYAuDzGAESYwoGUmV2b2tlEiYuZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlUmV2b2tlUmVxdWVzdBonLmZpdHMuYXBpLnYxLlRva2VuU2VydmljZVJldm9rZVJlc3BvbnNlIgjY8xgC4PMYARJmCgdSZWZyZXNoEicuZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlUmVmcmVzaFJlcXVlc3QaKC5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VSZWZyZXNoUmVzcG9uc2UiCNjzGALg8xgBQpYBCg9jb20uZml0cy5hcGkudjFCClRva2VuUHJvdG9QAVopZ2l0aHViLmNvbS9maS10cy9hcGkvZ28vZml0cy9hcGkvdjE7YXBpdjGiAgNGQViqAgtGaXRzLkFwaS5WMcoCC0ZpdHNcQXBpXFYx4gIXRml0c1xBcGlcVjFcR1BCTWV0YWRhdGHqAg1GaXRzOjpBcGk6OlYxYgZwcm90bzM", [file_buf_validate_validate, file_fits_api_v1_common, file_fits_api_v1_predefined_rules, file_google_protobuf_duration, file_google_protobuf_timestamp]);
+export const file_fits_api_v1_token = /*@__PURE__*/ fileDesc("ChdmaXRzL2FwaS92MS90b2tlbi5wcm90bxILZml0cy5hcGkudjEizQYKBVRva2VuEhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEhgKBHVzZXIYAiABKAlCCrpIB3IFEAIYgAQSHwoEbWV0YRgDIAEoCzIRLmZpdHMuYXBpLnYxLk1ldGESIAoLZGVzY3JpcHRpb24YBCABKAlCC7pICHIGyLOusQIBEj0KC3Blcm1pc3Npb25zGAUgAygLMh0uZml0cy5hcGkudjEuTWV0aG9kUGVybWlzc2lvbkIJukgGkgEDEPQDEisKB2V4cGlyZXMYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi0KCWlzc3VlZF9hdBgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASNAoKdG9rZW5fdHlwZRgIIAEoDjIWLmZpdHMuYXBpLnYxLlRva2VuVHlwZUIIukgFggECEAESOwoNcHJvamVjdF9yb2xlcxgJIAMoCzIkLmZpdHMuYXBpLnYxLlRva2VuLlByb2plY3RSb2xlc0VudHJ5EjkKDHRlbmFudF9yb2xlcxgKIAMoCzIjLmZpdHMuYXBpLnYxLlRva2VuLlRlbmFudFJvbGVzRW50cnkSOQoKYWRtaW5fcm9sZRgLIAEoDjIWLmZpdHMuYXBpLnYxLkFkbWluUm9sZUIIukgFggECEAFIAIgBARpNChFQcm9qZWN0Um9sZXNFbnRyeRILCgNrZXkYASABKAkSJwoFdmFsdWUYAiABKA4yGC5maXRzLmFwaS52MS5Qcm9qZWN0Um9sZToCOAEaSwoQVGVuYW50Um9sZXNFbnRyeRILCgNrZXkYASABKAkSJgoFdmFsdWUYAiABKA4yFy5maXRzLmFwaS52MS5UZW5hbnRSb2xlOgI4ATqfAbpImwEamAEKG3Rva2VuLnBlcm1pc3Npb25zLnVzZXJ0b2tlbhIpdG9rZW4gdHlwZSB1c2VyIG11c3Qgbm90IGhhdmUgcGVybWlzc2lvbnMaTih0aGlzLnRva2VuX3R5cGUgPT0gMiAmJiB0aGlzLnBlcm1pc3Npb25zLnNpemUoKSA9PSAwKSB8fCB0aGlzLnRva2VuX3R5cGUgIT0gMkINCgtfYWRtaW5fcm9sZSKnBQoZVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdBIgCgtkZXNjcmlwdGlvbhgBIAEoCUILukgIcgbIs66xAgESQwoLcGVybWlzc2lvbnMYAiADKAsyJC5maXRzLmFwaS52MS5QZXJtaXNzaW9uc0J5VmlzaWJpbGl0eUIIukgFkgECEGQSPgoHZXhwaXJlcxgDIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbkISukgPqgEMGgUIgeeEDzIDCNgEEmsKDXByb2plY3Rfcm9sZXMYBCADKAsyOC5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0LlByb2plY3RSb2xlc0VudHJ5Qhq6SBeaARTAlbixAgEiBXIDsAEBKgWCAQIQARJrCgx0ZW5hbnRfcm9sZXMYBSADKAsyNy5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0LlRlbmFudFJvbGVzRW50cnlCHLpIGZoBFsCVuLECASIHcgUQAxiAASoFggECEAESOQoKYWRtaW5fcm9sZRgGIAEoDjIWLmZpdHMuYXBpLnYxLkFkbWluUm9sZUIIukgFggECEAFIAIgBARIjCgZsYWJlbHMYByABKAsyEy5maXRzLmFwaS52MS5MYWJlbHMaTQoRUHJvamVjdFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEicKBXZhbHVlGAIgASgOMhguZml0cy5hcGkudjEuUHJvamVjdFJvbGU6AjgBGksKEFRlbmFudFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEiYKBXZhbHVlGAIgASgOMhcuZml0cy5hcGkudjEuVGVuYW50Um9sZToCOAFCDQoLX2FkbWluX3JvbGUiSQoQTWV0aG9kUGVybWlzc2lvbhIZCgdzdWJqZWN0GAEgASgJQgi6SAVyAxiAAhIaCgdtZXRob2RzGAIgAygJQgm6SAaSAQMQ9AMinQIKF1Blcm1pc3Npb25zQnlWaXNpYmlsaXR5EjAKBnB1YmxpYxgBIAEoCzIeLmZpdHMuYXBpLnYxLlB1YmxpY1Blcm1pc3Npb25zSAASLAoEc2VsZhgCIAEoCzIcLmZpdHMuYXBpLnYxLlNlbGZQZXJtaXNzaW9uc0gAEjIKB3Byb2plY3QYAyABKAsyHy5maXRzLmFwaS52MS5Qcm9qZWN0UGVybWlzc2lvbnNIABIwCgZ0ZW5hbnQYBCABKAsyHi5maXRzLmFwaS52MS5UZW5hbnRQZXJtaXNzaW9uc0gAEi4KBWFkbWluGAUgASgLMh0uZml0cy5hcGkudjEuQWRtaW5QZXJtaXNzaW9uc0gAQgwKCnZpc2liaWxpdHkiLwoRUHVibGljUGVybWlzc2lvbnMSGgoHbWV0aG9kcxgCIAMoCUIJukgGkgEDEPQDIi0KD1NlbGZQZXJtaXNzaW9ucxIaCgdtZXRob2RzGAIgAygJQgm6SAaSAQMQ9AMiTgoSUHJvamVjdFBlcm1pc3Npb25zEhwKB3Byb2plY3QYASABKAlCC7pICHIGoLSusQIBEhoKB21ldGhvZHMYAiADKAlCCbpIBpIBAxD0AyJLChFUZW5hbnRQZXJtaXNzaW9ucxIaCgVsb2dpbhgBIAEoCUILukgIcgaYtK6xAgESGgoHbWV0aG9kcxgCIAMoCUIJukgGkgEDEPQDIi4KEEFkbWluUGVybWlzc2lvbnMSGgoHbWV0aG9kcxgCIAMoCUIJukgGkgEDEPQDIk8KGlRva2VuU2VydmljZUNyZWF0ZVJlc3BvbnNlEiEKBXRva2VuGAEgASgLMhIuZml0cy5hcGkudjEuVG9rZW4SDgoGc2VjcmV0GAIgASgJIhkKF1Rva2VuU2VydmljZUxpc3RSZXF1ZXN0Ij4KGFRva2VuU2VydmljZUxpc3RSZXNwb25zZRIiCgZ0b2tlbnMYASADKAsyEi5maXRzLmFwaS52MS5Ub2tlbiIzChlUb2tlblNlcnZpY2VSZXZva2VSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBIhwKGlRva2VuU2VydmljZVJldm9rZVJlc3BvbnNlIsYFChlUb2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEjQKC3VwZGF0ZV9tZXRhGAIgASgLMhcuZml0cy5hcGkudjEuVXBkYXRlTWV0YUIGukgDyAEAEiUKC2Rlc2NyaXB0aW9uGAMgASgJQgu6SAhyBsizrrECAUgAiAEBEjkKC3Blcm1pc3Npb25zGAQgAygLMiQuZml0cy5hcGkudjEuUGVybWlzc2lvbnNCeVZpc2liaWxpdHkSawoNcHJvamVjdF9yb2xlcxgFIAMoCzI4LmZpdHMuYXBpLnYxLlRva2VuU2VydmljZVVwZGF0ZVJlcXVlc3QuUHJvamVjdFJvbGVzRW50cnlCGrpIF5oBFMCVuLECASIFcgOwAQEqBYIBAhABEmsKDHRlbmFudF9yb2xlcxgGIAMoCzI3LmZpdHMuYXBpLnYxLlRva2VuU2VydmljZVVwZGF0ZVJlcXVlc3QuVGVuYW50Um9sZXNFbnRyeUIcukgZmgEWwJW4sQIBIgdyBRADGIABKgWCAQIQARI5CgphZG1pbl9yb2xlGAcgASgOMhYuZml0cy5hcGkudjEuQWRtaW5Sb2xlQgi6SAWCAQIQAUgBiAEBEikKBmxhYmVscxgIIAEoCzIZLmZpdHMuYXBpLnYxLlVwZGF0ZUxhYmVscxpNChFQcm9qZWN0Um9sZXNFbnRyeRILCgNrZXkYASABKAkSJwoFdmFsdWUYAiABKA4yGC5maXRzLmFwaS52MS5Qcm9qZWN0Um9sZToCOAEaSwoQVGVuYW50Um9sZXNFbnRyeRILCgNrZXkYASABKAkSJgoFdmFsdWUYAiABKA4yFy5maXRzLmFwaS52MS5UZW5hbnRSb2xlOgI4AUIOCgxfZGVzY3JpcHRpb25CDQoLX2FkbWluX3JvbGUiPwoaVG9rZW5TZXJ2aWNlVXBkYXRlUmVzcG9uc2USIQoFdG9rZW4YASABKAsyEi5maXRzLmFwaS52MS5Ub2tlbiIwChZUb2tlblNlcnZpY2VHZXRSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBIjwKF1Rva2VuU2VydmljZUdldFJlc3BvbnNlEiEKBXRva2VuGAEgASgLMhIuZml0cy5hcGkudjEuVG9rZW4iHAoaVG9rZW5TZXJ2aWNlUmVmcmVzaFJlcXVlc3QiUAobVG9rZW5TZXJ2aWNlUmVmcmVzaFJlc3BvbnNlEiEKBXRva2VuGAEgASgLMhIuZml0cy5hcGkudjEuVG9rZW4SDgoGc2VjcmV0GAIgASgJKlAKCVRva2VuVHlwZRIaChZUT0tFTl9UWVBFX1VOU1BFQ0lGSUVEEAASEgoOVE9LRU5fVFlQRV9BUEkQARITCg9UT0tFTl9UWVBFX1VTRVIQAjLgBAoMVG9rZW5TZXJ2aWNlEloKA0dldBIjLmZpdHMuYXBpLnYxLlRva2VuU2VydmljZUdldFJlcXVlc3QaJC5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VHZXRSZXNwb25zZSII2PMYAuDzGAESYwoGQ3JlYXRlEiYuZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdBonLmZpdHMuYXBpLnYxLlRva2VuU2VydmljZUNyZWF0ZVJlc3BvbnNlIgjY8xgC4PMYARJjCgZVcGRhdGUSJi5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0GicuZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlVXBkYXRlUmVzcG9uc2UiCNjzGALg8xgBEl0KBExpc3QSJC5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VMaXN0UmVxdWVzdBolLmZpdHMuYXBpLnYxLlRva2VuU2VydmljZUxpc3RSZXNwb25zZSII2PMYAuDzGAESYwoGUmV2b2tlEiYuZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlUmV2b2tlUmVxdWVzdBonLmZpdHMuYXBpLnYxLlRva2VuU2VydmljZVJldm9rZVJlc3BvbnNlIgjY8xgC4PMYARJmCgdSZWZyZXNoEicuZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlUmVmcmVzaFJlcXVlc3QaKC5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VSZWZyZXNoUmVzcG9uc2UiCNjzGALg8xgBQpYBCg9jb20uZml0cy5hcGkudjFCClRva2VuUHJvdG9QAVopZ2l0aHViLmNvbS9maS10cy9hcGkvZ28vZml0cy9hcGkvdjE7YXBpdjGiAgNGQViqAgtGaXRzLkFwaS5WMcoCC0ZpdHNcQXBpXFYx4gIXRml0c1xBcGlcVjFcR1BCTWV0YWRhdGHqAg1GaXRzOjpBcGk6OlYxYgZwcm90bzM", [file_buf_validate_validate, file_fits_api_v1_common, file_fits_api_v1_predefined_rules, file_google_protobuf_duration, file_google_protobuf_timestamp]);
 /**
  * Describes the message fits.api.v1.Token.
  * Use `create(TokenSchema)` to create a new message.
@@ -25,61 +25,91 @@ export const TokenServiceCreateRequestSchema = /*@__PURE__*/ messageDesc(file_fi
  * Use `create(MethodPermissionSchema)` to create a new message.
  */
 export const MethodPermissionSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 2);
+/**
+ * Describes the message fits.api.v1.PermissionsByVisibility.
+ * Use `create(PermissionsByVisibilitySchema)` to create a new message.
+ */
+export const PermissionsByVisibilitySchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 3);
+/**
+ * Describes the message fits.api.v1.PublicPermissions.
+ * Use `create(PublicPermissionsSchema)` to create a new message.
+ */
+export const PublicPermissionsSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 4);
+/**
+ * Describes the message fits.api.v1.SelfPermissions.
+ * Use `create(SelfPermissionsSchema)` to create a new message.
+ */
+export const SelfPermissionsSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 5);
+/**
+ * Describes the message fits.api.v1.ProjectPermissions.
+ * Use `create(ProjectPermissionsSchema)` to create a new message.
+ */
+export const ProjectPermissionsSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 6);
+/**
+ * Describes the message fits.api.v1.TenantPermissions.
+ * Use `create(TenantPermissionsSchema)` to create a new message.
+ */
+export const TenantPermissionsSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 7);
+/**
+ * Describes the message fits.api.v1.AdminPermissions.
+ * Use `create(AdminPermissionsSchema)` to create a new message.
+ */
+export const AdminPermissionsSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 8);
 /**
  * Describes the message fits.api.v1.TokenServiceCreateResponse.
  * Use `create(TokenServiceCreateResponseSchema)` to create a new message.
  */
-export const TokenServiceCreateResponseSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 3);
+export const TokenServiceCreateResponseSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 9);
 /**
  * Describes the message fits.api.v1.TokenServiceListRequest.
  * Use `create(TokenServiceListRequestSchema)` to create a new message.
  */
-export const TokenServiceListRequestSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 4);
+export const TokenServiceListRequestSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 10);
 /**
  * Describes the message fits.api.v1.TokenServiceListResponse.
  * Use `create(TokenServiceListResponseSchema)` to create a new message.
  */
-export const TokenServiceListResponseSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 5);
+export const TokenServiceListResponseSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 11);
 /**
  * Describes the message fits.api.v1.TokenServiceRevokeRequest.
  * Use `create(TokenServiceRevokeRequestSchema)` to create a new message.
  */
-export const TokenServiceRevokeRequestSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 6);
+export const TokenServiceRevokeRequestSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 12);
 /**
  * Describes the message fits.api.v1.TokenServiceRevokeResponse.
  * Use `create(TokenServiceRevokeResponseSchema)` to create a new message.
  */
-export const TokenServiceRevokeResponseSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 7);
+export const TokenServiceRevokeResponseSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 13);
 /**
  * Describes the message fits.api.v1.TokenServiceUpdateRequest.
  * Use `create(TokenServiceUpdateRequestSchema)` to create a new message.
  */
-export const TokenServiceUpdateRequestSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 8);
+export const TokenServiceUpdateRequestSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 14);
 /**
  * Describes the message fits.api.v1.TokenServiceUpdateResponse.
  * Use `create(TokenServiceUpdateResponseSchema)` to create a new message.
  */
-export const TokenServiceUpdateResponseSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 9);
+export const TokenServiceUpdateResponseSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 15);
 /**
  * Describes the message fits.api.v1.TokenServiceGetRequest.
  * Use `create(TokenServiceGetRequestSchema)` to create a new message.
  */
-export const TokenServiceGetRequestSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 10);
+export const TokenServiceGetRequestSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 16);
 /**
  * Describes the message fits.api.v1.TokenServiceGetResponse.
  * Use `create(TokenServiceGetResponseSchema)` to create a new message.
  */
-export const TokenServiceGetResponseSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 11);
+export const TokenServiceGetResponseSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 17);
 /**
  * Describes the message fits.api.v1.TokenServiceRefreshRequest.
  * Use `create(TokenServiceRefreshRequestSchema)` to create a new message.
  */
-export const TokenServiceRefreshRequestSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 12);
+export const TokenServiceRefreshRequestSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 18);
 /**
  * Describes the message fits.api.v1.TokenServiceRefreshResponse.
  * Use `create(TokenServiceRefreshResponseSchema)` to create a new message.
  */
-export const TokenServiceRefreshResponseSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 13);
+export const TokenServiceRefreshResponseSchema = /*@__PURE__*/ messageDesc(file_fits_api_v1_token, 19);
 /**
  * TokenType specifies different use cases of tokens
  *
diff --git a/js/fits/api/v1/token_pb.ts b/js/fits/api/v1/token_pb.ts
index db1b664..f1f3270 100644
--- a/js/fits/api/v1/token_pb.ts
+++ b/js/fits/api/v1/token_pb.ts
@@ -16,7 +16,7 @@ import type { Message } from "@bufbuild/protobuf";
  * Describes the file fits/api/v1/token.proto.
  */
 export const file_fits_api_v1_token: GenFile = /*@__PURE__*/
-  fileDesc("ChdmaXRzL2FwaS92MS90b2tlbi5wcm90bxILZml0cy5hcGkudjEizQYKBVRva2VuEhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEhgKBHVzZXIYAiABKAlCCrpIB3IFEAIYgAQSHwoEbWV0YRgDIAEoCzIRLmZpdHMuYXBpLnYxLk1ldGESIAoLZGVzY3JpcHRpb24YBCABKAlCC7pICHIGyLOusQIBEj0KC3Blcm1pc3Npb25zGAUgAygLMh0uZml0cy5hcGkudjEuTWV0aG9kUGVybWlzc2lvbkIJukgGkgEDEPQDEisKB2V4cGlyZXMYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi0KCWlzc3VlZF9hdBgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASNAoKdG9rZW5fdHlwZRgIIAEoDjIWLmZpdHMuYXBpLnYxLlRva2VuVHlwZUIIukgFggECEAESOwoNcHJvamVjdF9yb2xlcxgJIAMoCzIkLmZpdHMuYXBpLnYxLlRva2VuLlByb2plY3RSb2xlc0VudHJ5EjkKDHRlbmFudF9yb2xlcxgKIAMoCzIjLmZpdHMuYXBpLnYxLlRva2VuLlRlbmFudFJvbGVzRW50cnkSOQoKYWRtaW5fcm9sZRgLIAEoDjIWLmZpdHMuYXBpLnYxLkFkbWluUm9sZUIIukgFggECEAFIAIgBARpNChFQcm9qZWN0Um9sZXNFbnRyeRILCgNrZXkYASABKAkSJwoFdmFsdWUYAiABKA4yGC5maXRzLmFwaS52MS5Qcm9qZWN0Um9sZToCOAEaSwoQVGVuYW50Um9sZXNFbnRyeRILCgNrZXkYASABKAkSJgoFdmFsdWUYAiABKA4yFy5maXRzLmFwaS52MS5UZW5hbnRSb2xlOgI4ATqfAbpImwEamAEKG3Rva2VuLnBlcm1pc3Npb25zLnVzZXJ0b2tlbhIpdG9rZW4gdHlwZSB1c2VyIG11c3Qgbm90IGhhdmUgcGVybWlzc2lvbnMaTih0aGlzLnRva2VuX3R5cGUgPT0gMiAmJiB0aGlzLnBlcm1pc3Npb25zLnNpemUoKSA9PSAwKSB8fCB0aGlzLnRva2VuX3R5cGUgIT0gMkINCgtfYWRtaW5fcm9sZSKgBQoZVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdBIgCgtkZXNjcmlwdGlvbhgBIAEoCUILukgIcgbIs66xAgESPAoLcGVybWlzc2lvbnMYAiADKAsyHS5maXRzLmFwaS52MS5NZXRob2RQZXJtaXNzaW9uQgi6SAWSAQIQZBI+CgdleHBpcmVzGAMgASgLMhkuZ29vZ2xlLnByb3RvYnVmLkR1cmF0aW9uQhK6SA+qAQwaBQiB54QPMgMI2AQSawoNcHJvamVjdF9yb2xlcxgEIAMoCzI4LmZpdHMuYXBpLnYxLlRva2VuU2VydmljZUNyZWF0ZVJlcXVlc3QuUHJvamVjdFJvbGVzRW50cnlCGrpIF5oBFMCVuLECASIFcgOwAQEqBYIBAhABEmsKDHRlbmFudF9yb2xlcxgFIAMoCzI3LmZpdHMuYXBpLnYxLlRva2VuU2VydmljZUNyZWF0ZVJlcXVlc3QuVGVuYW50Um9sZXNFbnRyeUIcukgZmgEWwJW4sQIBIgdyBRADGIABKgWCAQIQARI5CgphZG1pbl9yb2xlGAYgASgOMhYuZml0cy5hcGkudjEuQWRtaW5Sb2xlQgi6SAWCAQIQAUgAiAEBEiMKBmxhYmVscxgHIAEoCzITLmZpdHMuYXBpLnYxLkxhYmVscxpNChFQcm9qZWN0Um9sZXNFbnRyeRILCgNrZXkYASABKAkSJwoFdmFsdWUYAiABKA4yGC5maXRzLmFwaS52MS5Qcm9qZWN0Um9sZToCOAEaSwoQVGVuYW50Um9sZXNFbnRyeRILCgNrZXkYASABKAkSJgoFdmFsdWUYAiABKA4yFy5maXRzLmFwaS52MS5UZW5hbnRSb2xlOgI4AUINCgtfYWRtaW5fcm9sZSJJChBNZXRob2RQZXJtaXNzaW9uEhkKB3N1YmplY3QYASABKAlCCLpIBXIDGIACEhoKB21ldGhvZHMYAiADKAlCCbpIBpIBAxD0AyJPChpUb2tlblNlcnZpY2VDcmVhdGVSZXNwb25zZRIhCgV0b2tlbhgBIAEoCzISLmZpdHMuYXBpLnYxLlRva2VuEg4KBnNlY3JldBgCIAEoCSIZChdUb2tlblNlcnZpY2VMaXN0UmVxdWVzdCI+ChhUb2tlblNlcnZpY2VMaXN0UmVzcG9uc2USIgoGdG9rZW5zGAEgAygLMhIuZml0cy5hcGkudjEuVG9rZW4iMwoZVG9rZW5TZXJ2aWNlUmV2b2tlUmVxdWVzdBIWCgR1dWlkGAEgASgJQgi6SAVyA7ABASIcChpUb2tlblNlcnZpY2VSZXZva2VSZXNwb25zZSK/BQoZVG9rZW5TZXJ2aWNlVXBkYXRlUmVxdWVzdBIWCgR1dWlkGAEgASgJQgi6SAVyA7ABARI0Cgt1cGRhdGVfbWV0YRgCIAEoCzIXLmZpdHMuYXBpLnYxLlVwZGF0ZU1ldGFCBrpIA8gBABIlCgtkZXNjcmlwdGlvbhgDIAEoCUILukgIcgbIs66xAgFIAIgBARIyCgtwZXJtaXNzaW9ucxgEIAMoCzIdLmZpdHMuYXBpLnYxLk1ldGhvZFBlcm1pc3Npb24SawoNcHJvamVjdF9yb2xlcxgFIAMoCzI4LmZpdHMuYXBpLnYxLlRva2VuU2VydmljZVVwZGF0ZVJlcXVlc3QuUHJvamVjdFJvbGVzRW50cnlCGrpIF5oBFMCVuLECASIFcgOwAQEqBYIBAhABEmsKDHRlbmFudF9yb2xlcxgGIAMoCzI3LmZpdHMuYXBpLnYxLlRva2VuU2VydmljZVVwZGF0ZVJlcXVlc3QuVGVuYW50Um9sZXNFbnRyeUIcukgZmgEWwJW4sQIBIgdyBRADGIABKgWCAQIQARI5CgphZG1pbl9yb2xlGAcgASgOMhYuZml0cy5hcGkudjEuQWRtaW5Sb2xlQgi6SAWCAQIQAUgBiAEBEikKBmxhYmVscxgIIAEoCzIZLmZpdHMuYXBpLnYxLlVwZGF0ZUxhYmVscxpNChFQcm9qZWN0Um9sZXNFbnRyeRILCgNrZXkYASABKAkSJwoFdmFsdWUYAiABKA4yGC5maXRzLmFwaS52MS5Qcm9qZWN0Um9sZToCOAEaSwoQVGVuYW50Um9sZXNFbnRyeRILCgNrZXkYASABKAkSJgoFdmFsdWUYAiABKA4yFy5maXRzLmFwaS52MS5UZW5hbnRSb2xlOgI4AUIOCgxfZGVzY3JpcHRpb25CDQoLX2FkbWluX3JvbGUiPwoaVG9rZW5TZXJ2aWNlVXBkYXRlUmVzcG9uc2USIQoFdG9rZW4YASABKAsyEi5maXRzLmFwaS52MS5Ub2tlbiIwChZUb2tlblNlcnZpY2VHZXRSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBIjwKF1Rva2VuU2VydmljZUdldFJlc3BvbnNlEiEKBXRva2VuGAEgASgLMhIuZml0cy5hcGkudjEuVG9rZW4iHAoaVG9rZW5TZXJ2aWNlUmVmcmVzaFJlcXVlc3QiUAobVG9rZW5TZXJ2aWNlUmVmcmVzaFJlc3BvbnNlEiEKBXRva2VuGAEgASgLMhIuZml0cy5hcGkudjEuVG9rZW4SDgoGc2VjcmV0GAIgASgJKlAKCVRva2VuVHlwZRIaChZUT0tFTl9UWVBFX1VOU1BFQ0lGSUVEEAASEgoOVE9LRU5fVFlQRV9BUEkQARITCg9UT0tFTl9UWVBFX1VTRVIQAjLgBAoMVG9rZW5TZXJ2aWNlEloKA0dldBIjLmZpdHMuYXBpLnYxLlRva2VuU2VydmljZUdldFJlcXVlc3QaJC5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VHZXRSZXNwb25zZSII2PMYAuDzGAESYwoGQ3JlYXRlEiYuZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdBonLmZpdHMuYXBpLnYxLlRva2VuU2VydmljZUNyZWF0ZVJlc3BvbnNlIgjY8xgC4PMYARJjCgZVcGRhdGUSJi5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0GicuZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlVXBkYXRlUmVzcG9uc2UiCNjzGALg8xgBEl0KBExpc3QSJC5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VMaXN0UmVxdWVzdBolLmZpdHMuYXBpLnYxLlRva2VuU2VydmljZUxpc3RSZXNwb25zZSII2PMYAuDzGAESYwoGUmV2b2tlEiYuZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlUmV2b2tlUmVxdWVzdBonLmZpdHMuYXBpLnYxLlRva2VuU2VydmljZVJldm9rZVJlc3BvbnNlIgjY8xgC4PMYARJmCgdSZWZyZXNoEicuZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlUmVmcmVzaFJlcXVlc3QaKC5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VSZWZyZXNoUmVzcG9uc2UiCNjzGALg8xgBQpYBCg9jb20uZml0cy5hcGkudjFCClRva2VuUHJvdG9QAVopZ2l0aHViLmNvbS9maS10cy9hcGkvZ28vZml0cy9hcGkvdjE7YXBpdjGiAgNGQViqAgtGaXRzLkFwaS5WMcoCC0ZpdHNcQXBpXFYx4gIXRml0c1xBcGlcVjFcR1BCTWV0YWRhdGHqAg1GaXRzOjpBcGk6OlYxYgZwcm90bzM", [file_buf_validate_validate, file_fits_api_v1_common, file_fits_api_v1_predefined_rules, file_google_protobuf_duration, file_google_protobuf_timestamp]);
+  fileDesc("ChdmaXRzL2FwaS92MS90b2tlbi5wcm90bxILZml0cy5hcGkudjEizQYKBVRva2VuEhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEhgKBHVzZXIYAiABKAlCCrpIB3IFEAIYgAQSHwoEbWV0YRgDIAEoCzIRLmZpdHMuYXBpLnYxLk1ldGESIAoLZGVzY3JpcHRpb24YBCABKAlCC7pICHIGyLOusQIBEj0KC3Blcm1pc3Npb25zGAUgAygLMh0uZml0cy5hcGkudjEuTWV0aG9kUGVybWlzc2lvbkIJukgGkgEDEPQDEisKB2V4cGlyZXMYBiABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wEi0KCWlzc3VlZF9hdBgHIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASNAoKdG9rZW5fdHlwZRgIIAEoDjIWLmZpdHMuYXBpLnYxLlRva2VuVHlwZUIIukgFggECEAESOwoNcHJvamVjdF9yb2xlcxgJIAMoCzIkLmZpdHMuYXBpLnYxLlRva2VuLlByb2plY3RSb2xlc0VudHJ5EjkKDHRlbmFudF9yb2xlcxgKIAMoCzIjLmZpdHMuYXBpLnYxLlRva2VuLlRlbmFudFJvbGVzRW50cnkSOQoKYWRtaW5fcm9sZRgLIAEoDjIWLmZpdHMuYXBpLnYxLkFkbWluUm9sZUIIukgFggECEAFIAIgBARpNChFQcm9qZWN0Um9sZXNFbnRyeRILCgNrZXkYASABKAkSJwoFdmFsdWUYAiABKA4yGC5maXRzLmFwaS52MS5Qcm9qZWN0Um9sZToCOAEaSwoQVGVuYW50Um9sZXNFbnRyeRILCgNrZXkYASABKAkSJgoFdmFsdWUYAiABKA4yFy5maXRzLmFwaS52MS5UZW5hbnRSb2xlOgI4ATqfAbpImwEamAEKG3Rva2VuLnBlcm1pc3Npb25zLnVzZXJ0b2tlbhIpdG9rZW4gdHlwZSB1c2VyIG11c3Qgbm90IGhhdmUgcGVybWlzc2lvbnMaTih0aGlzLnRva2VuX3R5cGUgPT0gMiAmJiB0aGlzLnBlcm1pc3Npb25zLnNpemUoKSA9PSAwKSB8fCB0aGlzLnRva2VuX3R5cGUgIT0gMkINCgtfYWRtaW5fcm9sZSKnBQoZVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdBIgCgtkZXNjcmlwdGlvbhgBIAEoCUILukgIcgbIs66xAgESQwoLcGVybWlzc2lvbnMYAiADKAsyJC5maXRzLmFwaS52MS5QZXJtaXNzaW9uc0J5VmlzaWJpbGl0eUIIukgFkgECEGQSPgoHZXhwaXJlcxgDIAEoCzIZLmdvb2dsZS5wcm90b2J1Zi5EdXJhdGlvbkISukgPqgEMGgUIgeeEDzIDCNgEEmsKDXByb2plY3Rfcm9sZXMYBCADKAsyOC5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0LlByb2plY3RSb2xlc0VudHJ5Qhq6SBeaARTAlbixAgEiBXIDsAEBKgWCAQIQARJrCgx0ZW5hbnRfcm9sZXMYBSADKAsyNy5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VDcmVhdGVSZXF1ZXN0LlRlbmFudFJvbGVzRW50cnlCHLpIGZoBFsCVuLECASIHcgUQAxiAASoFggECEAESOQoKYWRtaW5fcm9sZRgGIAEoDjIWLmZpdHMuYXBpLnYxLkFkbWluUm9sZUIIukgFggECEAFIAIgBARIjCgZsYWJlbHMYByABKAsyEy5maXRzLmFwaS52MS5MYWJlbHMaTQoRUHJvamVjdFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEicKBXZhbHVlGAIgASgOMhguZml0cy5hcGkudjEuUHJvamVjdFJvbGU6AjgBGksKEFRlbmFudFJvbGVzRW50cnkSCwoDa2V5GAEgASgJEiYKBXZhbHVlGAIgASgOMhcuZml0cy5hcGkudjEuVGVuYW50Um9sZToCOAFCDQoLX2FkbWluX3JvbGUiSQoQTWV0aG9kUGVybWlzc2lvbhIZCgdzdWJqZWN0GAEgASgJQgi6SAVyAxiAAhIaCgdtZXRob2RzGAIgAygJQgm6SAaSAQMQ9AMinQIKF1Blcm1pc3Npb25zQnlWaXNpYmlsaXR5EjAKBnB1YmxpYxgBIAEoCzIeLmZpdHMuYXBpLnYxLlB1YmxpY1Blcm1pc3Npb25zSAASLAoEc2VsZhgCIAEoCzIcLmZpdHMuYXBpLnYxLlNlbGZQZXJtaXNzaW9uc0gAEjIKB3Byb2plY3QYAyABKAsyHy5maXRzLmFwaS52MS5Qcm9qZWN0UGVybWlzc2lvbnNIABIwCgZ0ZW5hbnQYBCABKAsyHi5maXRzLmFwaS52MS5UZW5hbnRQZXJtaXNzaW9uc0gAEi4KBWFkbWluGAUgASgLMh0uZml0cy5hcGkudjEuQWRtaW5QZXJtaXNzaW9uc0gAQgwKCnZpc2liaWxpdHkiLwoRUHVibGljUGVybWlzc2lvbnMSGgoHbWV0aG9kcxgCIAMoCUIJukgGkgEDEPQDIi0KD1NlbGZQZXJtaXNzaW9ucxIaCgdtZXRob2RzGAIgAygJQgm6SAaSAQMQ9AMiTgoSUHJvamVjdFBlcm1pc3Npb25zEhwKB3Byb2plY3QYASABKAlCC7pICHIGoLSusQIBEhoKB21ldGhvZHMYAiADKAlCCbpIBpIBAxD0AyJLChFUZW5hbnRQZXJtaXNzaW9ucxIaCgVsb2dpbhgBIAEoCUILukgIcgaYtK6xAgESGgoHbWV0aG9kcxgCIAMoCUIJukgGkgEDEPQDIi4KEEFkbWluUGVybWlzc2lvbnMSGgoHbWV0aG9kcxgCIAMoCUIJukgGkgEDEPQDIk8KGlRva2VuU2VydmljZUNyZWF0ZVJlc3BvbnNlEiEKBXRva2VuGAEgASgLMhIuZml0cy5hcGkudjEuVG9rZW4SDgoGc2VjcmV0GAIgASgJIhkKF1Rva2VuU2VydmljZUxpc3RSZXF1ZXN0Ij4KGFRva2VuU2VydmljZUxpc3RSZXNwb25zZRIiCgZ0b2tlbnMYASADKAsyEi5maXRzLmFwaS52MS5Ub2tlbiIzChlUb2tlblNlcnZpY2VSZXZva2VSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBIhwKGlRva2VuU2VydmljZVJldm9rZVJlc3BvbnNlIsYFChlUb2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBEjQKC3VwZGF0ZV9tZXRhGAIgASgLMhcuZml0cy5hcGkudjEuVXBkYXRlTWV0YUIGukgDyAEAEiUKC2Rlc2NyaXB0aW9uGAMgASgJQgu6SAhyBsizrrECAUgAiAEBEjkKC3Blcm1pc3Npb25zGAQgAygLMiQuZml0cy5hcGkudjEuUGVybWlzc2lvbnNCeVZpc2liaWxpdHkSawoNcHJvamVjdF9yb2xlcxgFIAMoCzI4LmZpdHMuYXBpLnYxLlRva2VuU2VydmljZVVwZGF0ZVJlcXVlc3QuUHJvamVjdFJvbGVzRW50cnlCGrpIF5oBFMCVuLECASIFcgOwAQEqBYIBAhABEmsKDHRlbmFudF9yb2xlcxgGIAMoCzI3LmZpdHMuYXBpLnYxLlRva2VuU2VydmljZVVwZGF0ZVJlcXVlc3QuVGVuYW50Um9sZXNFbnRyeUIcukgZmgEWwJW4sQIBIgdyBRADGIABKgWCAQIQARI5CgphZG1pbl9yb2xlGAcgASgOMhYuZml0cy5hcGkudjEuQWRtaW5Sb2xlQgi6SAWCAQIQAUgBiAEBEikKBmxhYmVscxgIIAEoCzIZLmZpdHMuYXBpLnYxLlVwZGF0ZUxhYmVscxpNChFQcm9qZWN0Um9sZXNFbnRyeRILCgNrZXkYASABKAkSJwoFdmFsdWUYAiABKA4yGC5maXRzLmFwaS52MS5Qcm9qZWN0Um9sZToCOAEaSwoQVGVuYW50Um9sZXNFbnRyeRILCgNrZXkYASABKAkSJgoFdmFsdWUYAiABKA4yFy5maXRzLmFwaS52MS5UZW5hbnRSb2xlOgI4AUIOCgxfZGVzY3JpcHRpb25CDQoLX2FkbWluX3JvbGUiPwoaVG9rZW5TZXJ2aWNlVXBkYXRlUmVzcG9uc2USIQoFdG9rZW4YASABKAsyEi5maXRzLmFwaS52MS5Ub2tlbiIwChZUb2tlblNlcnZpY2VHZXRSZXF1ZXN0EhYKBHV1aWQYASABKAlCCLpIBXIDsAEBIjwKF1Rva2VuU2VydmljZUdldFJlc3BvbnNlEiEKBXRva2VuGAEgASgLMhIuZml0cy5hcGkudjEuVG9rZW4iHAoaVG9rZW5TZXJ2aWNlUmVmcmVzaFJlcXVlc3QiUAobVG9rZW5TZXJ2aWNlUmVmcmVzaFJlc3BvbnNlEiEKBXRva2VuGAEgASgLMhIuZml0cy5hcGkudjEuVG9rZW4SDgoGc2VjcmV0GAIgASgJKlAKCVRva2VuVHlwZRIaChZUT0tFTl9UWVBFX1VOU1BFQ0lGSUVEEAASEgoOVE9LRU5fVFlQRV9BUEkQARITCg9UT0tFTl9UWVBFX1VTRVIQAjLgBAoMVG9rZW5TZXJ2aWNlEloKA0dldBIjLmZpdHMuYXBpLnYxLlRva2VuU2VydmljZUdldFJlcXVlc3QaJC5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VHZXRSZXNwb25zZSII2PMYAuDzGAESYwoGQ3JlYXRlEiYuZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlQ3JlYXRlUmVxdWVzdBonLmZpdHMuYXBpLnYxLlRva2VuU2VydmljZUNyZWF0ZVJlc3BvbnNlIgjY8xgC4PMYARJjCgZVcGRhdGUSJi5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VVcGRhdGVSZXF1ZXN0GicuZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlVXBkYXRlUmVzcG9uc2UiCNjzGALg8xgBEl0KBExpc3QSJC5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VMaXN0UmVxdWVzdBolLmZpdHMuYXBpLnYxLlRva2VuU2VydmljZUxpc3RSZXNwb25zZSII2PMYAuDzGAESYwoGUmV2b2tlEiYuZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlUmV2b2tlUmVxdWVzdBonLmZpdHMuYXBpLnYxLlRva2VuU2VydmljZVJldm9rZVJlc3BvbnNlIgjY8xgC4PMYARJmCgdSZWZyZXNoEicuZml0cy5hcGkudjEuVG9rZW5TZXJ2aWNlUmVmcmVzaFJlcXVlc3QaKC5maXRzLmFwaS52MS5Ub2tlblNlcnZpY2VSZWZyZXNoUmVzcG9uc2UiCNjzGALg8xgBQpYBCg9jb20uZml0cy5hcGkudjFCClRva2VuUHJvdG9QAVopZ2l0aHViLmNvbS9maS10cy9hcGkvZ28vZml0cy9hcGkvdjE7YXBpdjGiAgNGQViqAgtGaXRzLkFwaS5WMcoCC0ZpdHNcQXBpXFYx4gIXRml0c1xBcGlcVjFcR1BCTWV0YWRhdGHqAg1GaXRzOjpBcGk6OlYxYgZwcm90bzM", [file_buf_validate_validate, file_fits_api_v1_common, file_fits_api_v1_predefined_rules, file_google_protobuf_duration, file_google_protobuf_timestamp]);
 
 /**
  * Token generates a jwt authentication token to access the api
@@ -134,11 +134,11 @@ export type TokenServiceCreateRequest = Message<"fits.api.v1.TokenServiceCreateR
   description: string;
 
   /**
-   * Permissions is a list of service methods this token can be used for
+   * Permissions is a list of service methods this token can be used for.
    *
-   * @generated from field: repeated fits.api.v1.MethodPermission permissions = 2;
+   * @generated from field: repeated fits.api.v1.PermissionsByVisibility permissions = 2;
    */
-  permissions: MethodPermission[];
+  permissions: PermissionsByVisibility[];
 
   /**
    * Expires gives the duration since now, after which this token can not be used anymore
@@ -216,6 +216,188 @@ export type MethodPermission = Message<"fits.api.v1.MethodPermission"> & {
 export const MethodPermissionSchema: GenMessage<MethodPermission> = /*@__PURE__*/
   messageDesc(file_fits_api_v1_token, 2);
 
+/**
+ * PermissionsByVisibility contains method permissions by visibility.
+ *
+ * @generated from message fits.api.v1.PermissionsByVisibility
+ */
+export type PermissionsByVisibility = Message<"fits.api.v1.PermissionsByVisibility"> & {
+  /**
+   * Visibility defines the visibility of the requested method permissions.
+   *
+   * @generated from oneof fits.api.v1.PermissionsByVisibility.visibility
+   */
+  visibility: {
+    /**
+     * PublicPermissions carries public method permissions.
+     *
+     * @generated from field: fits.api.v1.PublicPermissions public = 1;
+     */
+    value: PublicPermissions;
+    case: "public";
+  } | {
+    /**
+     * SelfPermissions carries self method permissions.
+     *
+     * @generated from field: fits.api.v1.SelfPermissions self = 2;
+     */
+    value: SelfPermissions;
+    case: "self";
+  } | {
+    /**
+     * ProjectPermissions carries project method permissions.
+     *
+     * @generated from field: fits.api.v1.ProjectPermissions project = 3;
+     */
+    value: ProjectPermissions;
+    case: "project";
+  } | {
+    /**
+     * TenantPermissions carries tenant method permissions.
+     *
+     * @generated from field: fits.api.v1.TenantPermissions tenant = 4;
+     */
+    value: TenantPermissions;
+    case: "tenant";
+  } | {
+    /**
+     * AdminPermissions carries admin method permissions.
+     *
+     * @generated from field: fits.api.v1.AdminPermissions admin = 5;
+     */
+    value: AdminPermissions;
+    case: "admin";
+  } | { case: undefined; value?: undefined };
+};
+
+/**
+ * Describes the message fits.api.v1.PermissionsByVisibility.
+ * Use `create(PermissionsByVisibilitySchema)` to create a new message.
+ */
+export const PermissionsByVisibilitySchema: GenMessage<PermissionsByVisibility> = /*@__PURE__*/
+  messageDesc(file_fits_api_v1_token, 3);
+
+/**
+ * PublicPermissions carries public method permissions.
+ *
+ * @generated from message fits.api.v1.PublicPermissions
+ */
+export type PublicPermissions = Message<"fits.api.v1.PublicPermissions"> & {
+  /**
+   * Methods which should be accessible.
+   *
+   * @generated from field: repeated string methods = 2;
+   */
+  methods: string[];
+};
+
+/**
+ * Describes the message fits.api.v1.PublicPermissions.
+ * Use `create(PublicPermissionsSchema)` to create a new message.
+ */
+export const PublicPermissionsSchema: GenMessage<PublicPermissions> = /*@__PURE__*/
+  messageDesc(file_fits_api_v1_token, 4);
+
+/**
+ * SelfPermissions carries self method permissions.
+ *
+ * @generated from message fits.api.v1.SelfPermissions
+ */
+export type SelfPermissions = Message<"fits.api.v1.SelfPermissions"> & {
+  /**
+   * Methods which should be accessible.
+   *
+   * @generated from field: repeated string methods = 2;
+   */
+  methods: string[];
+};
+
+/**
+ * Describes the message fits.api.v1.SelfPermissions.
+ * Use `create(SelfPermissionsSchema)` to create a new message.
+ */
+export const SelfPermissionsSchema: GenMessage<SelfPermissions> = /*@__PURE__*/
+  messageDesc(file_fits_api_v1_token, 5);
+
+/**
+ * ProjectPermissions carries project method permissions.
+ *
+ * @generated from message fits.api.v1.ProjectPermissions
+ */
+export type ProjectPermissions = Message<"fits.api.v1.ProjectPermissions"> & {
+  /**
+   * Project scope for the permissions.
+   * Asterisk (*) can be specified to match any subject.
+   *
+   * @generated from field: string project = 1;
+   */
+  project: string;
+
+  /**
+   * Methods which should be accessible.
+   *
+   * @generated from field: repeated string methods = 2;
+   */
+  methods: string[];
+};
+
+/**
+ * Describes the message fits.api.v1.ProjectPermissions.
+ * Use `create(ProjectPermissionsSchema)` to create a new message.
+ */
+export const ProjectPermissionsSchema: GenMessage<ProjectPermissions> = /*@__PURE__*/
+  messageDesc(file_fits_api_v1_token, 6);
+
+/**
+ * TenantPermissions carries tenant method permissions.
+ *
+ * @generated from message fits.api.v1.TenantPermissions
+ */
+export type TenantPermissions = Message<"fits.api.v1.TenantPermissions"> & {
+  /**
+   * Login of the tenant.
+   * Asterisk (*) can be specified to match any subject.
+   *
+   * @generated from field: string login = 1;
+   */
+  login: string;
+
+  /**
+   * Methods which should be accessible.
+   *
+   * @generated from field: repeated string methods = 2;
+   */
+  methods: string[];
+};
+
+/**
+ * Describes the message fits.api.v1.TenantPermissions.
+ * Use `create(TenantPermissionsSchema)` to create a new message.
+ */
+export const TenantPermissionsSchema: GenMessage<TenantPermissions> = /*@__PURE__*/
+  messageDesc(file_fits_api_v1_token, 7);
+
+/**
+ * AdminPermissions carries admin method permissions.
+ *
+ * @generated from message fits.api.v1.AdminPermissions
+ */
+export type AdminPermissions = Message<"fits.api.v1.AdminPermissions"> & {
+  /**
+   * Methods which should be accessible.
+   *
+   * @generated from field: repeated string methods = 2;
+   */
+  methods: string[];
+};
+
+/**
+ * Describes the message fits.api.v1.AdminPermissions.
+ * Use `create(AdminPermissionsSchema)` to create a new message.
+ */
+export const AdminPermissionsSchema: GenMessage<AdminPermissions> = /*@__PURE__*/
+  messageDesc(file_fits_api_v1_token, 8);
+
 /**
  * TokenServiceCreateResponse is the response payload of a token create request
  *
@@ -242,7 +424,7 @@ export type TokenServiceCreateResponse = Message<"fits.api.v1.TokenServiceCreate
  * Use `create(TokenServiceCreateResponseSchema)` to create a new message.
  */
 export const TokenServiceCreateResponseSchema: GenMessage<TokenServiceCreateResponse> = /*@__PURE__*/
-  messageDesc(file_fits_api_v1_token, 3);
+  messageDesc(file_fits_api_v1_token, 9);
 
 /**
  * TokenServiceListRequest is the request payload to list tokens
@@ -257,7 +439,7 @@ export type TokenServiceListRequest = Message<"fits.api.v1.TokenServiceListReque
  * Use `create(TokenServiceListRequestSchema)` to create a new message.
  */
 export const TokenServiceListRequestSchema: GenMessage<TokenServiceListRequest> = /*@__PURE__*/
-  messageDesc(file_fits_api_v1_token, 4);
+  messageDesc(file_fits_api_v1_token, 10);
 
 /**
  * TokenServiceListResponse is the response payload of a token list request
@@ -278,7 +460,7 @@ export type TokenServiceListResponse = Message<"fits.api.v1.TokenServiceListResp
  * Use `create(TokenServiceListResponseSchema)` to create a new message.
  */
 export const TokenServiceListResponseSchema: GenMessage<TokenServiceListResponse> = /*@__PURE__*/
-  messageDesc(file_fits_api_v1_token, 5);
+  messageDesc(file_fits_api_v1_token, 11);
 
 /**
  * TokenServiceRevokeRequest is the request payload of a token revoke request
@@ -299,7 +481,7 @@ export type TokenServiceRevokeRequest = Message<"fits.api.v1.TokenServiceRevokeR
  * Use `create(TokenServiceRevokeRequestSchema)` to create a new message.
  */
 export const TokenServiceRevokeRequestSchema: GenMessage<TokenServiceRevokeRequest> = /*@__PURE__*/
-  messageDesc(file_fits_api_v1_token, 6);
+  messageDesc(file_fits_api_v1_token, 12);
 
 /**
  * TokenServiceRevokeResponse is the response payload of a token revoke request
@@ -314,7 +496,7 @@ export type TokenServiceRevokeResponse = Message<"fits.api.v1.TokenServiceRevoke
  * Use `create(TokenServiceRevokeResponseSchema)` to create a new message.
  */
 export const TokenServiceRevokeResponseSchema: GenMessage<TokenServiceRevokeResponse> = /*@__PURE__*/
-  messageDesc(file_fits_api_v1_token, 7);
+  messageDesc(file_fits_api_v1_token, 13);
 
 /**
  * TokenServiceUpdateRequest is the request payload of a token update request
@@ -345,11 +527,11 @@ export type TokenServiceUpdateRequest = Message<"fits.api.v1.TokenServiceUpdateR
   description?: string | undefined;
 
   /**
-   * Permissions is a list of service methods this token can be used for
+   * Permissions is a list of service methods this token can be used for.
    *
-   * @generated from field: repeated fits.api.v1.MethodPermission permissions = 4;
+   * @generated from field: repeated fits.api.v1.PermissionsByVisibility permissions = 4;
    */
-  permissions: MethodPermission[];
+  permissions: PermissionsByVisibility[];
 
   /**
    * ProjectRoles associates a project id with the corresponding role of the token owner
@@ -385,7 +567,7 @@ export type TokenServiceUpdateRequest = Message<"fits.api.v1.TokenServiceUpdateR
  * Use `create(TokenServiceUpdateRequestSchema)` to create a new message.
  */
 export const TokenServiceUpdateRequestSchema: GenMessage<TokenServiceUpdateRequest> = /*@__PURE__*/
-  messageDesc(file_fits_api_v1_token, 8);
+  messageDesc(file_fits_api_v1_token, 14);
 
 /**
  * TokenServiceUpdateResponse is the response payload of a token update request
@@ -406,7 +588,7 @@ export type TokenServiceUpdateResponse = Message<"fits.api.v1.TokenServiceUpdate
  * Use `create(TokenServiceUpdateResponseSchema)` to create a new message.
  */
 export const TokenServiceUpdateResponseSchema: GenMessage<TokenServiceUpdateResponse> = /*@__PURE__*/
-  messageDesc(file_fits_api_v1_token, 9);
+  messageDesc(file_fits_api_v1_token, 15);
 
 /**
  * TokenServiceGetRequest is the request payload of a token get request
@@ -427,7 +609,7 @@ export type TokenServiceGetRequest = Message<"fits.api.v1.TokenServiceGetRequest
  * Use `create(TokenServiceGetRequestSchema)` to create a new message.
  */
 export const TokenServiceGetRequestSchema: GenMessage<TokenServiceGetRequest> = /*@__PURE__*/
-  messageDesc(file_fits_api_v1_token, 10);
+  messageDesc(file_fits_api_v1_token, 16);
 
 /**
  * TokenServiceGetResponse is the response payload of a token get request
@@ -448,7 +630,7 @@ export type TokenServiceGetResponse = Message<"fits.api.v1.TokenServiceGetRespon
  * Use `create(TokenServiceGetResponseSchema)` to create a new message.
  */
 export const TokenServiceGetResponseSchema: GenMessage<TokenServiceGetResponse> = /*@__PURE__*/
-  messageDesc(file_fits_api_v1_token, 11);
+  messageDesc(file_fits_api_v1_token, 17);
 
 /**
  * TokenServiceRefreshRequest is the request payload of a token refresh request
@@ -465,7 +647,7 @@ export type TokenServiceRefreshRequest = Message<"fits.api.v1.TokenServiceRefres
  * Use `create(TokenServiceRefreshRequestSchema)` to create a new message.
  */
 export const TokenServiceRefreshRequestSchema: GenMessage<TokenServiceRefreshRequest> = /*@__PURE__*/
-  messageDesc(file_fits_api_v1_token, 12);
+  messageDesc(file_fits_api_v1_token, 18);
 
 /**
  * TokenServiceRefreshResponse is the response payload of a token refresh request
@@ -493,7 +675,7 @@ export type TokenServiceRefreshResponse = Message<"fits.api.v1.TokenServiceRefre
  * Use `create(TokenServiceRefreshResponseSchema)` to create a new message.
  */
 export const TokenServiceRefreshResponseSchema: GenMessage<TokenServiceRefreshResponse> = /*@__PURE__*/
-  messageDesc(file_fits_api_v1_token, 13);
+  messageDesc(file_fits_api_v1_token, 19);
 
 /**
  * TokenType specifies different use cases of tokens
diff --git a/proto/fits/api/v1/predefined_rules.proto b/proto/fits/api/v1/predefined_rules.proto
index c045824..523fcb4 100644
--- a/proto/fits/api/v1/predefined_rules.proto
+++ b/proto/fits/api/v1/predefined_rules.proto
@@ -56,6 +56,25 @@ extend buf.validate.StringRules {
     message: "value must not start or end with whitespace"
     expression: "this.trim().size() == this.size()"
   }];
+  // IsTenantLogin returns true if name field satisfies our requirements.
+  optional bool is_tenant_login = 80048962 [(buf.validate.predefined).cel = {
+    id: "string.is_tenant_login"
+    message: "must be within 2 and 128 characters"
+    expression: "this.size() >= 2 && this.size() <= 128"
+  }];
+
+  // IsTenantSubjectPermission returns true if name field satisfies our requirements.
+  optional bool is_tenant_subject_permission = 80048963 [(buf.validate.predefined).cel = {
+    id: "string.is_tenant_subject_permission"
+    message: "must be '*' or within 2 and 128 characters"
+    expression: "this == '*' || this.size() >= 2 && this.size() <= 128"
+  }];
+  // IsProjectSubjectPermission returns true if name field satisfies our requirements.
+  optional bool is_project_subject_permission = 80048964 [(buf.validate.predefined).cel = {
+    id: "string.is_project_subject_permission"
+    message: "must be '*' or a uuid"
+    expression: "this == '*' || this.matches('^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$')"
+  }];
 }
 
 extend buf.validate.RepeatedRules {
@@ -98,4 +117,16 @@ extend buf.validate.MapRules {
     message: "keys must not start or end with whitespace"
     expression: "this.all(k, k.trim().size() == k.size())"
   }];
+  // ProjectRolesKeysValid ensures that project roles keys met our requirements.
+  optional bool project_roles_keys_valid = 80068953 [(buf.validate.predefined).cel = {
+    id: "project_roles.key.valid"
+    message: "subject must be a '*', or a valid UUID"
+    expression: "this.all(k, k == '*' || k.matches('^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$'))"
+  }];
+  // TenantRolesKeysValid ensures that tenant roles keys met our requirements.
+  optional bool tenant_roles_keys_valid = 80068954 [(buf.validate.predefined).cel = {
+    id: "tenant_roles.key.valid"
+    message: "subject must be '*' or between 2 and 128 characters"
+    expression: "this.all(k, k == '*' || this.size() >= 2 || this.size() <=128 )"
+  }];
 }
diff --git a/proto/fits/api/v1/token.proto b/proto/fits/api/v1/token.proto
index 306ae51..702c223 100644
--- a/proto/fits/api/v1/token.proto
+++ b/proto/fits/api/v1/token.proto
@@ -102,8 +102,8 @@ enum TokenType {
 message TokenServiceCreateRequest {
   // Description of the token
   string description = 1 [(buf.validate.field).string.(fits.api.v1.is_description) = true];
-  // Permissions is a list of service methods this token can be used for
-  repeated MethodPermission permissions = 2 [(buf.validate.field).repeated.max_items = 100];
+  // Permissions is a list of service methods this token can be used for.
+  repeated PermissionsByVisibility permissions = 2 [(buf.validate.field).repeated.max_items = 100];
   // Expires gives the duration since now, after which this token can not be used anymore
   google.protobuf.Duration expires = 3 [(buf.validate.field).duration = {
     lt: {seconds: 31536001}
@@ -155,6 +155,60 @@ message MethodPermission {
   repeated string methods = 2 [(buf.validate.field).repeated.max_items = 500];
 }
 
+// PermissionsByVisibility contains method permissions by visibility.
+message PermissionsByVisibility {
+  // Visibility defines the visibility of the requested method permissions.
+  oneof visibility {
+    // PublicPermissions carries public method permissions.
+    PublicPermissions public = 1;
+    // SelfPermissions carries self method permissions.
+    SelfPermissions self = 2;
+    // ProjectPermissions carries project method permissions.
+    ProjectPermissions project = 3;
+    // TenantPermissions carries tenant method permissions.
+    TenantPermissions tenant = 4;
+    // AdminPermissions carries admin method permissions.
+    AdminPermissions admin = 5;
+  }
+}
+
+// PublicPermissions carries public method permissions.
+message PublicPermissions {
+  // Methods which should be accessible.
+  repeated string methods = 2 [(buf.validate.field).repeated.max_items = 500];
+}
+
+// SelfPermissions carries self method permissions.
+message SelfPermissions {
+  // Methods which should be accessible.
+  repeated string methods = 2 [(buf.validate.field).repeated.max_items = 500];
+}
+
+// ProjectPermissions carries project method permissions.
+message ProjectPermissions {
+  // Project scope for the permissions.
+  // Asterisk (*) can be specified to match any subject.
+  string project = 1 [(buf.validate.field).string.(fits.api.v1.is_project_subject_permission) = true];
+  // Methods which should be accessible.
+  repeated string methods = 2 [(buf.validate.field).repeated.max_items = 500];
+}
+
+// TenantPermissions carries tenant method permissions.
+message TenantPermissions {
+  // Login of the tenant.
+  // Asterisk (*) can be specified to match any subject.
+  string login = 1 [(buf.validate.field).string.(fits.api.v1.is_tenant_subject_permission) = true];
+
+  // Methods which should be accessible.
+  repeated string methods = 2 [(buf.validate.field).repeated.max_items = 500];
+}
+
+// AdminPermissions carries admin method permissions.
+message AdminPermissions {
+  // Methods which should be accessible.
+  repeated string methods = 2 [(buf.validate.field).repeated.max_items = 500];
+}
+
 // TokenServiceCreateResponse is the response payload of a token create request
 message TokenServiceCreateResponse {
   // Token which was created
@@ -190,8 +244,8 @@ message TokenServiceUpdateRequest {
   UpdateMeta update_meta = 2 [(buf.validate.field).required = false];
   // Description is a user given description of this token.
   optional string description = 3 [(buf.validate.field).string.(fits.api.v1.is_description) = true];
-  // Permissions is a list of service methods this token can be used for
-  repeated MethodPermission permissions = 4;
+  // Permissions is a list of service methods this token can be used for.
+  repeated PermissionsByVisibility permissions = 4;
   // ProjectRoles associates a project id with the corresponding role of the token owner
   map<string, ProjectRole> project_roles = 5 [
     (buf.validate.field).map = {
diff --git a/python/fits/api/v1/predefined_rules_pb2.py b/python/fits/api/v1/predefined_rules_pb2.py
index dcbcd24..463154b 100644
--- a/python/fits/api/v1/predefined_rules_pb2.py
+++ b/python/fits/api/v1/predefined_rules_pb2.py
@@ -25,7 +25,7 @@
 from buf.validate import validate_pb2 as buf_dot_validate_dot_validate__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\"fits/api/v1/predefined_rules.proto\x12\x0b\x66its.api.v1\x1a\x1b\x62uf/validate/validate.proto:\xb8\x01\n\nmacaddress\x12\x19.buf.validate.StringRules\x18\xb7\xe6\x95& \x01(\x08\x42z\xc2Hw\nu\n\x11string.macaddress\x12&this string must be a valid macaddress\x1a\x38this.matches(\'^([0-9A-Fa-f]{2}[:]){5}([0-9A-Fa-f]{2})$\')R\nmacaddress:\x99\x01\n\x07is_name\x12\x19.buf.validate.StringRules\x18\xb8\xe6\x95& \x01(\x08\x42\x62\xc2H_\n]\n\x0estring.is_name\x12#must be within 2 and 128 characters\x1a&this.size() >= 2 && this.size() <= 128R\x06isName:\x9a\x01\n\x0eis_description\x12\x19.buf.validate.StringRules\x18\xb9\xe6\x95& \x01(\x08\x42U\xc2HR\nP\n\x15string.is_description\x12#must be shorter than 256 characters\x1a\x12this.size() <= 256R\risDescription:\xa8\x01\n\x0cis_partition\x12\x19.buf.validate.StringRules\x18\xba\xe6\x95& \x01(\x08\x42g\xc2Hd\nb\n\x13string.is_partition\x12#must be within 2 and 128 characters\x1a&this.size() >= 2 && this.size() <= 128R\x0bisPartition:\x82\x01\n\tis_prefix\x12\x19.buf.validate.StringRules\x18\xbb\xe6\x95& \x01(\x08\x42G\xc2HD\nB\n\x0fstring.prefixes\x12\x1cgiven prefixes must be valid\x1a\x11this.isIpPrefix()R\x08isPrefix:m\n\x06is_uri\x12\x19.buf.validate.StringRules\x18\xbc\xe6\x95& \x01(\x08\x42\x38\xc2H5\n3\n\nstring.uri\x12\x17given uri must be valid\x1a\x0cthis.isUri()R\x05isUri:\xa7\x01\n\x11is_ip_or_hostname\x12\x19.buf.validate.StringRules\x18\xbd\xe6\x95& \x01(\x08\x42^\xc2H[\nY\n\rvalid_address\x12&must be a valid IP address or hostname\x1a this.isIp() || this.isHostname()R\x0eisIpOrHostname:\x9d\x01\n\x07trimmed\x12\x19.buf.validate.StringRules\x18\xbe\xe6\x95& \x01(\x08\x42\x65\xc2Hb\n`\n\x0estring.trimmed\x12+value must not start or end with whitespace\x1a!this.trim().size() == this.size()R\x07trimmed:\x8f\x01\n\x08prefixes\x12\x1b.buf.validate.RepeatedRules\x18\xc7\xb4\x96& \x01(\x08\x42S\xc2HP\nN\n\x11repeated.prefixes\x12\x1cgiven prefixes must be valid\x1a\x1bthis.all(m, m.isIpPrefix())R\x08prefixes:u\n\x03ips\x12\x1b.buf.validate.RepeatedRules\x18\xc8\xb4\x96& \x01(\x08\x42\x43\xc2H@\n>\n\x0crepeated.ips\x12\x17given ips must be valid\x1a\x15this.all(m, m.isIp())R\x03ips:\xe6\x01\n\x11\x61re_host_and_port\x12\x1b.buf.validate.RepeatedRules\x18\xc9\xb4\x96& \x01(\x08\x42\x9a\x01\xc2H\x96\x01\n\x93\x01\n\x1arepeated.are_host_and_port\x12Pgiven entries must all be in the form of <ip | host>:<port> but port is optional\x1a#this.all(m, m.isHostAndPort(false))R\x0e\x61reHostAndPort:\xba\x01\n\x0b\x61ll_trimmed\x12\x1b.buf.validate.RepeatedRules\x18\xca\xb4\x96& \x01(\x08\x42y\xc2Hv\nt\n\x14repeated.all_trimmed\x12\x32given values must not start or end with whitespace\x1a(this.all(m, m.trim().size() == m.size())R\nallTrimmed:\x84\x02\n\x17keys_and_values_trimmed\x12\x16.buf.validate.MapRules\x18\xd7\x82\x97& \x01(\x08\x42\xb1\x01\xc2H\xad\x01\n\xaa\x01\n\x1bmap.keys_and_values_trimmed\x12\x35keys and values must not start or end with whitespace\x1aTthis.all(k, k.trim().size() == k.size()) && this.all(v, v.trim().size() == v.size())R\x14keysAndValuesTrimmed:\xab\x01\n\x0ckeys_trimmed\x12\x16.buf.validate.MapRules\x18\xd8\x82\x97& \x01(\x08\x42m\xc2Hj\nh\n\x10map.keys_trimmed\x12*keys must not start or end with whitespace\x1a(this.all(k, k.trim().size() == k.size())R\x0bkeysTrimmedB\xa0\x01\n\x0f\x63om.fits.api.v1B\x14PredefinedRulesProtoP\x01Z)github.com/fi-ts/api/go/fits/api/v1;apiv1\xa2\x02\x03\x46\x41X\xaa\x02\x0b\x46its.Api.V1\xca\x02\x0b\x46its\\Api\\V1\xe2\x02\x17\x46its\\Api\\V1\\GPBMetadata\xea\x02\rFits::Api::V1')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\"fits/api/v1/predefined_rules.proto\x12\x0b\x66its.api.v1\x1a\x1b\x62uf/validate/validate.proto:\xb8\x01\n\nmacaddress\x12\x19.buf.validate.StringRules\x18\xb7\xe6\x95& \x01(\x08\x42z\xc2Hw\nu\n\x11string.macaddress\x12&this string must be a valid macaddress\x1a\x38this.matches(\'^([0-9A-Fa-f]{2}[:]){5}([0-9A-Fa-f]{2})$\')R\nmacaddress:\x99\x01\n\x07is_name\x12\x19.buf.validate.StringRules\x18\xb8\xe6\x95& \x01(\x08\x42\x62\xc2H_\n]\n\x0estring.is_name\x12#must be within 2 and 128 characters\x1a&this.size() >= 2 && this.size() <= 128R\x06isName:\x9a\x01\n\x0eis_description\x12\x19.buf.validate.StringRules\x18\xb9\xe6\x95& \x01(\x08\x42U\xc2HR\nP\n\x15string.is_description\x12#must be shorter than 256 characters\x1a\x12this.size() <= 256R\risDescription:\xa8\x01\n\x0cis_partition\x12\x19.buf.validate.StringRules\x18\xba\xe6\x95& \x01(\x08\x42g\xc2Hd\nb\n\x13string.is_partition\x12#must be within 2 and 128 characters\x1a&this.size() >= 2 && this.size() <= 128R\x0bisPartition:\x82\x01\n\tis_prefix\x12\x19.buf.validate.StringRules\x18\xbb\xe6\x95& \x01(\x08\x42G\xc2HD\nB\n\x0fstring.prefixes\x12\x1cgiven prefixes must be valid\x1a\x11this.isIpPrefix()R\x08isPrefix:m\n\x06is_uri\x12\x19.buf.validate.StringRules\x18\xbc\xe6\x95& \x01(\x08\x42\x38\xc2H5\n3\n\nstring.uri\x12\x17given uri must be valid\x1a\x0cthis.isUri()R\x05isUri:\xa7\x01\n\x11is_ip_or_hostname\x12\x19.buf.validate.StringRules\x18\xbd\xe6\x95& \x01(\x08\x42^\xc2H[\nY\n\rvalid_address\x12&must be a valid IP address or hostname\x1a this.isIp() || this.isHostname()R\x0eisIpOrHostname:\x9d\x01\n\x07trimmed\x12\x19.buf.validate.StringRules\x18\xbe\xe6\x95& \x01(\x08\x42\x65\xc2Hb\n`\n\x0estring.trimmed\x12+value must not start or end with whitespace\x1a!this.trim().size() == this.size()R\x07trimmed:\xb0\x01\n\x0fis_tenant_login\x12\x19.buf.validate.StringRules\x18\xc2\xe6\x95& \x01(\x08\x42j\xc2Hg\ne\n\x16string.is_tenant_login\x12#must be within 2 and 128 characters\x1a&this.size() >= 2 && this.size() <= 128R\risTenantLogin:\xef\x01\n\x1cis_tenant_subject_permission\x12\x19.buf.validate.StringRules\x18\xc3\xe6\x95& \x01(\x08\x42\x8f\x01\xc2H\x8b\x01\n\x88\x01\n#string.is_tenant_subject_permission\x12*must be \'*\' or within 2 and 128 characters\x1a\x35this == \'*\' || this.size() >= 2 && this.size() <= 128R\x19isTenantSubjectPermission:\x94\x02\n\x1dis_project_subject_permission\x12\x19.buf.validate.StringRules\x18\xc4\xe6\x95& \x01(\x08\x42\xb2\x01\xc2H\xae\x01\n\xab\x01\n$string.is_project_subject_permission\x12\x15must be \'*\' or a uuid\x1althis == \'*\' || this.matches(\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\')R\x1aisProjectSubjectPermission:\x8f\x01\n\x08prefixes\x12\x1b.buf.validate.RepeatedRules\x18\xc7\xb4\x96& \x01(\x08\x42S\xc2HP\nN\n\x11repeated.prefixes\x12\x1cgiven prefixes must be valid\x1a\x1bthis.all(m, m.isIpPrefix())R\x08prefixes:u\n\x03ips\x12\x1b.buf.validate.RepeatedRules\x18\xc8\xb4\x96& \x01(\x08\x42\x43\xc2H@\n>\n\x0crepeated.ips\x12\x17given ips must be valid\x1a\x15this.all(m, m.isIp())R\x03ips:\xe6\x01\n\x11\x61re_host_and_port\x12\x1b.buf.validate.RepeatedRules\x18\xc9\xb4\x96& \x01(\x08\x42\x9a\x01\xc2H\x96\x01\n\x93\x01\n\x1arepeated.are_host_and_port\x12Pgiven entries must all be in the form of <ip | host>:<port> but port is optional\x1a#this.all(m, m.isHostAndPort(false))R\x0e\x61reHostAndPort:\xba\x01\n\x0b\x61ll_trimmed\x12\x1b.buf.validate.RepeatedRules\x18\xca\xb4\x96& \x01(\x08\x42y\xc2Hv\nt\n\x14repeated.all_trimmed\x12\x32given values must not start or end with whitespace\x1a(this.all(m, m.trim().size() == m.size())R\nallTrimmed:\x84\x02\n\x17keys_and_values_trimmed\x12\x16.buf.validate.MapRules\x18\xd7\x82\x97& \x01(\x08\x42\xb1\x01\xc2H\xad\x01\n\xaa\x01\n\x1bmap.keys_and_values_trimmed\x12\x35keys and values must not start or end with whitespace\x1aTthis.all(k, k.trim().size() == k.size()) && this.all(v, v.trim().size() == v.size())R\x14keysAndValuesTrimmed:\xab\x01\n\x0ckeys_trimmed\x12\x16.buf.validate.MapRules\x18\xd8\x82\x97& \x01(\x08\x42m\xc2Hj\nh\n\x10map.keys_trimmed\x12*keys must not start or end with whitespace\x1a(this.all(k, k.trim().size() == k.size())R\x0bkeysTrimmed:\x92\x02\n\x18project_roles_keys_valid\x12\x16.buf.validate.MapRules\x18\xd9\x82\x97& \x01(\x08\x42\xbd\x01\xc2H\xb9\x01\n\xb6\x01\n\x17project_roles.key.valid\x12&subject must be a \'*\', or a valid UUID\x1asthis.all(k, k == \'*\' || k.matches(\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\'))R\x15projectRolesKeysValid:\xe8\x01\n\x17tenant_roles_keys_valid\x12\x16.buf.validate.MapRules\x18\xda\x82\x97& \x01(\x08\x42\x95\x01\xc2H\x91\x01\n\x8e\x01\n\x16tenant_roles.key.valid\x12\x33subject must be \'*\' or between 2 and 128 characters\x1a?this.all(k, k == \'*\' || this.size() >= 2 || this.size() <=128 )R\x14tenantRolesKeysValidB\xa0\x01\n\x0f\x63om.fits.api.v1B\x14PredefinedRulesProtoP\x01Z)github.com/fi-ts/api/go/fits/api/v1;apiv1\xa2\x02\x03\x46\x41X\xaa\x02\x0b\x46its.Api.V1\xca\x02\x0b\x46its\\Api\\V1\xe2\x02\x17\x46its\\Api\\V1\\GPBMetadata\xea\x02\rFits::Api::V1')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -49,6 +49,12 @@
   _globals['is_ip_or_hostname']._serialized_options = b'\302H[\nY\n\rvalid_address\022&must be a valid IP address or hostname\032 this.isIp() || this.isHostname()'
   _globals['trimmed']._loaded_options = None
   _globals['trimmed']._serialized_options = b'\302Hb\n`\n\016string.trimmed\022+value must not start or end with whitespace\032!this.trim().size() == this.size()'
+  _globals['is_tenant_login']._loaded_options = None
+  _globals['is_tenant_login']._serialized_options = b'\302Hg\ne\n\026string.is_tenant_login\022#must be within 2 and 128 characters\032&this.size() >= 2 && this.size() <= 128'
+  _globals['is_tenant_subject_permission']._loaded_options = None
+  _globals['is_tenant_subject_permission']._serialized_options = b'\302H\213\001\n\210\001\n#string.is_tenant_subject_permission\022*must be \'*\' or within 2 and 128 characters\0325this == \'*\' || this.size() >= 2 && this.size() <= 128'
+  _globals['is_project_subject_permission']._loaded_options = None
+  _globals['is_project_subject_permission']._serialized_options = b'\302H\256\001\n\253\001\n$string.is_project_subject_permission\022\025must be \'*\' or a uuid\032lthis == \'*\' || this.matches(\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\')'
   _globals['prefixes']._loaded_options = None
   _globals['prefixes']._serialized_options = b'\302HP\nN\n\021repeated.prefixes\022\034given prefixes must be valid\032\033this.all(m, m.isIpPrefix())'
   _globals['ips']._loaded_options = None
@@ -61,4 +67,8 @@
   _globals['keys_and_values_trimmed']._serialized_options = b'\302H\255\001\n\252\001\n\033map.keys_and_values_trimmed\0225keys and values must not start or end with whitespace\032Tthis.all(k, k.trim().size() == k.size()) && this.all(v, v.trim().size() == v.size())'
   _globals['keys_trimmed']._loaded_options = None
   _globals['keys_trimmed']._serialized_options = b'\302Hj\nh\n\020map.keys_trimmed\022*keys must not start or end with whitespace\032(this.all(k, k.trim().size() == k.size())'
+  _globals['project_roles_keys_valid']._loaded_options = None
+  _globals['project_roles_keys_valid']._serialized_options = b'\302H\271\001\n\266\001\n\027project_roles.key.valid\022&subject must be a \'*\', or a valid UUID\032sthis.all(k, k == \'*\' || k.matches(\'^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$\'))'
+  _globals['tenant_roles_keys_valid']._loaded_options = None
+  _globals['tenant_roles_keys_valid']._serialized_options = b'\302H\221\001\n\216\001\n\026tenant_roles.key.valid\0223subject must be \'*\' or between 2 and 128 characters\032?this.all(k, k == \'*\' || this.size() >= 2 || this.size() <=128 )'
 # @@protoc_insertion_point(module_scope)
diff --git a/python/fits/api/v1/predefined_rules_pb2.pyi b/python/fits/api/v1/predefined_rules_pb2.pyi
index 6290e37..2829eba 100644
--- a/python/fits/api/v1/predefined_rules_pb2.pyi
+++ b/python/fits/api/v1/predefined_rules_pb2.pyi
@@ -19,6 +19,12 @@ IS_IP_OR_HOSTNAME_FIELD_NUMBER: _ClassVar[int]
 is_ip_or_hostname: _descriptor.FieldDescriptor
 TRIMMED_FIELD_NUMBER: _ClassVar[int]
 trimmed: _descriptor.FieldDescriptor
+IS_TENANT_LOGIN_FIELD_NUMBER: _ClassVar[int]
+is_tenant_login: _descriptor.FieldDescriptor
+IS_TENANT_SUBJECT_PERMISSION_FIELD_NUMBER: _ClassVar[int]
+is_tenant_subject_permission: _descriptor.FieldDescriptor
+IS_PROJECT_SUBJECT_PERMISSION_FIELD_NUMBER: _ClassVar[int]
+is_project_subject_permission: _descriptor.FieldDescriptor
 PREFIXES_FIELD_NUMBER: _ClassVar[int]
 prefixes: _descriptor.FieldDescriptor
 IPS_FIELD_NUMBER: _ClassVar[int]
@@ -31,3 +37,7 @@ KEYS_AND_VALUES_TRIMMED_FIELD_NUMBER: _ClassVar[int]
 keys_and_values_trimmed: _descriptor.FieldDescriptor
 KEYS_TRIMMED_FIELD_NUMBER: _ClassVar[int]
 keys_trimmed: _descriptor.FieldDescriptor
+PROJECT_ROLES_KEYS_VALID_FIELD_NUMBER: _ClassVar[int]
+project_roles_keys_valid: _descriptor.FieldDescriptor
+TENANT_ROLES_KEYS_VALID_FIELD_NUMBER: _ClassVar[int]
+tenant_roles_keys_valid: _descriptor.FieldDescriptor
diff --git a/python/fits/api/v1/token_pb2.py b/python/fits/api/v1/token_pb2.py
index d404835..44b37fc 100644
--- a/python/fits/api/v1/token_pb2.py
+++ b/python/fits/api/v1/token_pb2.py
@@ -29,7 +29,7 @@
 from google.protobuf import timestamp_pb2 as google_dot_protobuf_dot_timestamp__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x17\x66its/api/v1/token.proto\x12\x0b\x66its.api.v1\x1a\x1b\x62uf/validate/validate.proto\x1a\x18\x66its/api/v1/common.proto\x1a\"fits/api/v1/predefined_rules.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"\xd5\x07\n\x05Token\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x1e\n\x04user\x18\x02 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x04R\x04user\x12%\n\x04meta\x18\x03 \x01(\x0b\x32\x11.fits.api.v1.MetaR\x04meta\x12-\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12J\n\x0bpermissions\x18\x05 \x03(\x0b\x32\x1d.fits.api.v1.MethodPermissionB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x0bpermissions\x12\x34\n\x07\x65xpires\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x07\x65xpires\x12\x37\n\tissued_at\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x08issuedAt\x12?\n\ntoken_type\x18\x08 \x01(\x0e\x32\x16.fits.api.v1.TokenTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\ttokenType\x12I\n\rproject_roles\x18\t \x03(\x0b\x32$.fits.api.v1.Token.ProjectRolesEntryR\x0cprojectRoles\x12\x46\n\x0ctenant_roles\x18\n \x03(\x0b\x32#.fits.api.v1.Token.TenantRolesEntryR\x0btenantRoles\x12\x44\n\nadmin_role\x18\x0b \x01(\x0e\x32\x16.fits.api.v1.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x1aY\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12.\n\x05value\x18\x02 \x01(\x0e\x32\x18.fits.api.v1.ProjectRoleR\x05value:\x02\x38\x01\x1aW\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12-\n\x05value\x18\x02 \x01(\x0e\x32\x17.fits.api.v1.TenantRoleR\x05value:\x02\x38\x01:\x9f\x01\xbaH\x9b\x01\x1a\x98\x01\n\x1btoken.permissions.usertoken\x12)token type user must not have permissions\x1aN(this.token_type == 2 && this.permissions.size() == 0) || this.token_type != 2B\r\n\x0b_admin_role\"\x89\x06\n\x19TokenServiceCreateRequest\x12-\n\x0b\x64\x65scription\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12I\n\x0bpermissions\x18\x02 \x03(\x0b\x32\x1d.fits.api.v1.MethodPermissionB\x08\xbaH\x05\x92\x01\x02\x10\x64R\x0bpermissions\x12G\n\x07\x65xpires\x18\x03 \x01(\x0b\x32\x19.google.protobuf.DurationB\x12\xbaH\x0f\xaa\x01\x0c\x1a\x05\x08\x81\xe7\x84\x0f\x32\x03\x08\xd8\x04R\x07\x65xpires\x12y\n\rproject_roles\x18\x04 \x03(\x0b\x32\x38.fits.api.v1.TokenServiceCreateRequest.ProjectRolesEntryB\x1a\xbaH\x17\x9a\x01\x14\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01R\x0cprojectRoles\x12x\n\x0ctenant_roles\x18\x05 \x03(\x0b\x32\x37.fits.api.v1.TokenServiceCreateRequest.TenantRolesEntryB\x1c\xbaH\x19\x9a\x01\x16\"\x07r\x05\x10\x03\x18\x80\x01*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01R\x0btenantRoles\x12\x44\n\nadmin_role\x18\x06 \x01(\x0e\x32\x16.fits.api.v1.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12+\n\x06labels\x18\x07 \x01(\x0b\x32\x13.fits.api.v1.LabelsR\x06labels\x1aY\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12.\n\x05value\x18\x02 \x01(\x0e\x32\x18.fits.api.v1.ProjectRoleR\x05value:\x02\x38\x01\x1aW\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12-\n\x05value\x18\x02 \x01(\x0e\x32\x17.fits.api.v1.TenantRoleR\x05value:\x02\x38\x01\x42\r\n\x0b_admin_role\"[\n\x10MethodPermission\x12\"\n\x07subject\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x07subject\x12#\n\x07methods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x07methods\"^\n\x1aTokenServiceCreateResponse\x12(\n\x05token\x18\x01 \x01(\x0b\x32\x12.fits.api.v1.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret\"\x19\n\x17TokenServiceListRequest\"F\n\x18TokenServiceListResponse\x12*\n\x06tokens\x18\x01 \x03(\x0b\x32\x12.fits.api.v1.TokenR\x06tokens\"9\n\x19TokenServiceRevokeRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"\x1c\n\x1aTokenServiceRevokeResponse\"\xb1\x06\n\x19TokenServiceUpdateRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12@\n\x0bupdate_meta\x18\x02 \x01(\x0b\x32\x17.fits.api.v1.UpdateMetaB\x06\xbaH\x03\xc8\x01\x00R\nupdateMeta\x12\x32\n\x0b\x64\x65scription\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x00R\x0b\x64\x65scription\x88\x01\x01\x12?\n\x0bpermissions\x18\x04 \x03(\x0b\x32\x1d.fits.api.v1.MethodPermissionR\x0bpermissions\x12y\n\rproject_roles\x18\x05 \x03(\x0b\x32\x38.fits.api.v1.TokenServiceUpdateRequest.ProjectRolesEntryB\x1a\xbaH\x17\x9a\x01\x14\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01R\x0cprojectRoles\x12x\n\x0ctenant_roles\x18\x06 \x03(\x0b\x32\x37.fits.api.v1.TokenServiceUpdateRequest.TenantRolesEntryB\x1c\xbaH\x19\x9a\x01\x16\"\x07r\x05\x10\x03\x18\x80\x01*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01R\x0btenantRoles\x12\x44\n\nadmin_role\x18\x07 \x01(\x0e\x32\x16.fits.api.v1.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tadminRole\x88\x01\x01\x12\x31\n\x06labels\x18\x08 \x01(\x0b\x32\x19.fits.api.v1.UpdateLabelsR\x06labels\x1aY\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12.\n\x05value\x18\x02 \x01(\x0e\x32\x18.fits.api.v1.ProjectRoleR\x05value:\x02\x38\x01\x1aW\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12-\n\x05value\x18\x02 \x01(\x0e\x32\x17.fits.api.v1.TenantRoleR\x05value:\x02\x38\x01\x42\x0e\n\x0c_descriptionB\r\n\x0b_admin_role\"F\n\x1aTokenServiceUpdateResponse\x12(\n\x05token\x18\x01 \x01(\x0b\x32\x12.fits.api.v1.TokenR\x05token\"6\n\x16TokenServiceGetRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"C\n\x17TokenServiceGetResponse\x12(\n\x05token\x18\x01 \x01(\x0b\x32\x12.fits.api.v1.TokenR\x05token\"\x1c\n\x1aTokenServiceRefreshRequest\"_\n\x1bTokenServiceRefreshResponse\x12(\n\x05token\x18\x01 \x01(\x0b\x32\x12.fits.api.v1.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret*P\n\tTokenType\x12\x1a\n\x16TOKEN_TYPE_UNSPECIFIED\x10\x00\x12\x12\n\x0eTOKEN_TYPE_API\x10\x01\x12\x13\n\x0fTOKEN_TYPE_USER\x10\x02\x32\xe0\x04\n\x0cTokenService\x12Z\n\x03Get\x12#.fits.api.v1.TokenServiceGetRequest\x1a$.fits.api.v1.TokenServiceGetResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12\x63\n\x06\x43reate\x12&.fits.api.v1.TokenServiceCreateRequest\x1a\'.fits.api.v1.TokenServiceCreateResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12\x63\n\x06Update\x12&.fits.api.v1.TokenServiceUpdateRequest\x1a\'.fits.api.v1.TokenServiceUpdateResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12]\n\x04List\x12$.fits.api.v1.TokenServiceListRequest\x1a%.fits.api.v1.TokenServiceListResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12\x63\n\x06Revoke\x12&.fits.api.v1.TokenServiceRevokeRequest\x1a\'.fits.api.v1.TokenServiceRevokeResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12\x66\n\x07Refresh\x12\'.fits.api.v1.TokenServiceRefreshRequest\x1a(.fits.api.v1.TokenServiceRefreshResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x42\x96\x01\n\x0f\x63om.fits.api.v1B\nTokenProtoP\x01Z)github.com/fi-ts/api/go/fits/api/v1;apiv1\xa2\x02\x03\x46\x41X\xaa\x02\x0b\x46its.Api.V1\xca\x02\x0b\x46its\\Api\\V1\xe2\x02\x17\x46its\\Api\\V1\\GPBMetadata\xea\x02\rFits::Api::V1b\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x17\x66its/api/v1/token.proto\x12\x0b\x66its.api.v1\x1a\x1b\x62uf/validate/validate.proto\x1a\x18\x66its/api/v1/common.proto\x1a\"fits/api/v1/predefined_rules.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"\xd5\x07\n\x05Token\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12\x1e\n\x04user\x18\x02 \x01(\tB\n\xbaH\x07r\x05\x10\x02\x18\x80\x04R\x04user\x12%\n\x04meta\x18\x03 \x01(\x0b\x32\x11.fits.api.v1.MetaR\x04meta\x12-\n\x0b\x64\x65scription\x18\x04 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12J\n\x0bpermissions\x18\x05 \x03(\x0b\x32\x1d.fits.api.v1.MethodPermissionB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x0bpermissions\x12\x34\n\x07\x65xpires\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x07\x65xpires\x12\x37\n\tissued_at\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.TimestampR\x08issuedAt\x12?\n\ntoken_type\x18\x08 \x01(\x0e\x32\x16.fits.api.v1.TokenTypeB\x08\xbaH\x05\x82\x01\x02\x10\x01R\ttokenType\x12I\n\rproject_roles\x18\t \x03(\x0b\x32$.fits.api.v1.Token.ProjectRolesEntryR\x0cprojectRoles\x12\x46\n\x0ctenant_roles\x18\n \x03(\x0b\x32#.fits.api.v1.Token.TenantRolesEntryR\x0btenantRoles\x12\x44\n\nadmin_role\x18\x0b \x01(\x0e\x32\x16.fits.api.v1.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x1aY\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12.\n\x05value\x18\x02 \x01(\x0e\x32\x18.fits.api.v1.ProjectRoleR\x05value:\x02\x38\x01\x1aW\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12-\n\x05value\x18\x02 \x01(\x0e\x32\x17.fits.api.v1.TenantRoleR\x05value:\x02\x38\x01:\x9f\x01\xbaH\x9b\x01\x1a\x98\x01\n\x1btoken.permissions.usertoken\x12)token type user must not have permissions\x1aN(this.token_type == 2 && this.permissions.size() == 0) || this.token_type != 2B\r\n\x0b_admin_role\"\x90\x06\n\x19TokenServiceCreateRequest\x12-\n\x0b\x64\x65scription\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01R\x0b\x64\x65scription\x12P\n\x0bpermissions\x18\x02 \x03(\x0b\x32$.fits.api.v1.PermissionsByVisibilityB\x08\xbaH\x05\x92\x01\x02\x10\x64R\x0bpermissions\x12G\n\x07\x65xpires\x18\x03 \x01(\x0b\x32\x19.google.protobuf.DurationB\x12\xbaH\x0f\xaa\x01\x0c\x1a\x05\x08\x81\xe7\x84\x0f\x32\x03\x08\xd8\x04R\x07\x65xpires\x12y\n\rproject_roles\x18\x04 \x03(\x0b\x32\x38.fits.api.v1.TokenServiceCreateRequest.ProjectRolesEntryB\x1a\xbaH\x17\x9a\x01\x14\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01R\x0cprojectRoles\x12x\n\x0ctenant_roles\x18\x05 \x03(\x0b\x32\x37.fits.api.v1.TokenServiceCreateRequest.TenantRolesEntryB\x1c\xbaH\x19\x9a\x01\x16\"\x07r\x05\x10\x03\x18\x80\x01*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01R\x0btenantRoles\x12\x44\n\nadmin_role\x18\x06 \x01(\x0e\x32\x16.fits.api.v1.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x00R\tadminRole\x88\x01\x01\x12+\n\x06labels\x18\x07 \x01(\x0b\x32\x13.fits.api.v1.LabelsR\x06labels\x1aY\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12.\n\x05value\x18\x02 \x01(\x0e\x32\x18.fits.api.v1.ProjectRoleR\x05value:\x02\x38\x01\x1aW\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12-\n\x05value\x18\x02 \x01(\x0e\x32\x17.fits.api.v1.TenantRoleR\x05value:\x02\x38\x01\x42\r\n\x0b_admin_role\"[\n\x10MethodPermission\x12\"\n\x07subject\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\x18\x80\x02R\x07subject\x12#\n\x07methods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x07methods\"\xc3\x02\n\x17PermissionsByVisibility\x12\x38\n\x06public\x18\x01 \x01(\x0b\x32\x1e.fits.api.v1.PublicPermissionsH\x00R\x06public\x12\x32\n\x04self\x18\x02 \x01(\x0b\x32\x1c.fits.api.v1.SelfPermissionsH\x00R\x04self\x12;\n\x07project\x18\x03 \x01(\x0b\x32\x1f.fits.api.v1.ProjectPermissionsH\x00R\x07project\x12\x38\n\x06tenant\x18\x04 \x01(\x0b\x32\x1e.fits.api.v1.TenantPermissionsH\x00R\x06tenant\x12\x35\n\x05\x61\x64min\x18\x05 \x01(\x0b\x32\x1d.fits.api.v1.AdminPermissionsH\x00R\x05\x61\x64minB\x0c\n\nvisibility\"8\n\x11PublicPermissions\x12#\n\x07methods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x07methods\"6\n\x0fSelfPermissions\x12#\n\x07methods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x07methods\"`\n\x12ProjectPermissions\x12%\n\x07project\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\xa0\xb4\xae\xb1\x02\x01R\x07project\x12#\n\x07methods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x07methods\"[\n\x11TenantPermissions\x12!\n\x05login\x18\x01 \x01(\tB\x0b\xbaH\x08r\x06\x98\xb4\xae\xb1\x02\x01R\x05login\x12#\n\x07methods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x07methods\"7\n\x10\x41\x64minPermissions\x12#\n\x07methods\x18\x02 \x03(\tB\t\xbaH\x06\x92\x01\x03\x10\xf4\x03R\x07methods\"^\n\x1aTokenServiceCreateResponse\x12(\n\x05token\x18\x01 \x01(\x0b\x32\x12.fits.api.v1.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret\"\x19\n\x17TokenServiceListRequest\"F\n\x18TokenServiceListResponse\x12*\n\x06tokens\x18\x01 \x03(\x0b\x32\x12.fits.api.v1.TokenR\x06tokens\"9\n\x19TokenServiceRevokeRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"\x1c\n\x1aTokenServiceRevokeResponse\"\xb8\x06\n\x19TokenServiceUpdateRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\x12@\n\x0bupdate_meta\x18\x02 \x01(\x0b\x32\x17.fits.api.v1.UpdateMetaB\x06\xbaH\x03\xc8\x01\x00R\nupdateMeta\x12\x32\n\x0b\x64\x65scription\x18\x03 \x01(\tB\x0b\xbaH\x08r\x06\xc8\xb3\xae\xb1\x02\x01H\x00R\x0b\x64\x65scription\x88\x01\x01\x12\x46\n\x0bpermissions\x18\x04 \x03(\x0b\x32$.fits.api.v1.PermissionsByVisibilityR\x0bpermissions\x12y\n\rproject_roles\x18\x05 \x03(\x0b\x32\x38.fits.api.v1.TokenServiceUpdateRequest.ProjectRolesEntryB\x1a\xbaH\x17\x9a\x01\x14\"\x05r\x03\xb0\x01\x01*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01R\x0cprojectRoles\x12x\n\x0ctenant_roles\x18\x06 \x03(\x0b\x32\x37.fits.api.v1.TokenServiceUpdateRequest.TenantRolesEntryB\x1c\xbaH\x19\x9a\x01\x16\"\x07r\x05\x10\x03\x18\x80\x01*\x05\x82\x01\x02\x10\x01\xc0\x95\xb8\xb1\x02\x01R\x0btenantRoles\x12\x44\n\nadmin_role\x18\x07 \x01(\x0e\x32\x16.fits.api.v1.AdminRoleB\x08\xbaH\x05\x82\x01\x02\x10\x01H\x01R\tadminRole\x88\x01\x01\x12\x31\n\x06labels\x18\x08 \x01(\x0b\x32\x19.fits.api.v1.UpdateLabelsR\x06labels\x1aY\n\x11ProjectRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12.\n\x05value\x18\x02 \x01(\x0e\x32\x18.fits.api.v1.ProjectRoleR\x05value:\x02\x38\x01\x1aW\n\x10TenantRolesEntry\x12\x10\n\x03key\x18\x01 \x01(\tR\x03key\x12-\n\x05value\x18\x02 \x01(\x0e\x32\x17.fits.api.v1.TenantRoleR\x05value:\x02\x38\x01\x42\x0e\n\x0c_descriptionB\r\n\x0b_admin_role\"F\n\x1aTokenServiceUpdateResponse\x12(\n\x05token\x18\x01 \x01(\x0b\x32\x12.fits.api.v1.TokenR\x05token\"6\n\x16TokenServiceGetRequest\x12\x1c\n\x04uuid\x18\x01 \x01(\tB\x08\xbaH\x05r\x03\xb0\x01\x01R\x04uuid\"C\n\x17TokenServiceGetResponse\x12(\n\x05token\x18\x01 \x01(\x0b\x32\x12.fits.api.v1.TokenR\x05token\"\x1c\n\x1aTokenServiceRefreshRequest\"_\n\x1bTokenServiceRefreshResponse\x12(\n\x05token\x18\x01 \x01(\x0b\x32\x12.fits.api.v1.TokenR\x05token\x12\x16\n\x06secret\x18\x02 \x01(\tR\x06secret*P\n\tTokenType\x12\x1a\n\x16TOKEN_TYPE_UNSPECIFIED\x10\x00\x12\x12\n\x0eTOKEN_TYPE_API\x10\x01\x12\x13\n\x0fTOKEN_TYPE_USER\x10\x02\x32\xe0\x04\n\x0cTokenService\x12Z\n\x03Get\x12#.fits.api.v1.TokenServiceGetRequest\x1a$.fits.api.v1.TokenServiceGetResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12\x63\n\x06\x43reate\x12&.fits.api.v1.TokenServiceCreateRequest\x1a\'.fits.api.v1.TokenServiceCreateResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12\x63\n\x06Update\x12&.fits.api.v1.TokenServiceUpdateRequest\x1a\'.fits.api.v1.TokenServiceUpdateResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12]\n\x04List\x12$.fits.api.v1.TokenServiceListRequest\x1a%.fits.api.v1.TokenServiceListResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12\x63\n\x06Revoke\x12&.fits.api.v1.TokenServiceRevokeRequest\x1a\'.fits.api.v1.TokenServiceRevokeResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x12\x66\n\x07Refresh\x12\'.fits.api.v1.TokenServiceRefreshRequest\x1a(.fits.api.v1.TokenServiceRefreshResponse\"\x08\xd8\xf3\x18\x02\xe0\xf3\x18\x01\x42\x96\x01\n\x0f\x63om.fits.api.v1B\nTokenProtoP\x01Z)github.com/fi-ts/api/go/fits/api/v1;apiv1\xa2\x02\x03\x46\x41X\xaa\x02\x0b\x46its.Api.V1\xca\x02\x0b\x46its\\Api\\V1\xe2\x02\x17\x46its\\Api\\V1\\GPBMetadata\xea\x02\rFits::Api::V1b\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -75,6 +75,20 @@
   _globals['_METHODPERMISSION'].fields_by_name['subject']._serialized_options = b'\272H\005r\003\030\200\002'
   _globals['_METHODPERMISSION'].fields_by_name['methods']._loaded_options = None
   _globals['_METHODPERMISSION'].fields_by_name['methods']._serialized_options = b'\272H\006\222\001\003\020\364\003'
+  _globals['_PUBLICPERMISSIONS'].fields_by_name['methods']._loaded_options = None
+  _globals['_PUBLICPERMISSIONS'].fields_by_name['methods']._serialized_options = b'\272H\006\222\001\003\020\364\003'
+  _globals['_SELFPERMISSIONS'].fields_by_name['methods']._loaded_options = None
+  _globals['_SELFPERMISSIONS'].fields_by_name['methods']._serialized_options = b'\272H\006\222\001\003\020\364\003'
+  _globals['_PROJECTPERMISSIONS'].fields_by_name['project']._loaded_options = None
+  _globals['_PROJECTPERMISSIONS'].fields_by_name['project']._serialized_options = b'\272H\010r\006\240\264\256\261\002\001'
+  _globals['_PROJECTPERMISSIONS'].fields_by_name['methods']._loaded_options = None
+  _globals['_PROJECTPERMISSIONS'].fields_by_name['methods']._serialized_options = b'\272H\006\222\001\003\020\364\003'
+  _globals['_TENANTPERMISSIONS'].fields_by_name['login']._loaded_options = None
+  _globals['_TENANTPERMISSIONS'].fields_by_name['login']._serialized_options = b'\272H\010r\006\230\264\256\261\002\001'
+  _globals['_TENANTPERMISSIONS'].fields_by_name['methods']._loaded_options = None
+  _globals['_TENANTPERMISSIONS'].fields_by_name['methods']._serialized_options = b'\272H\006\222\001\003\020\364\003'
+  _globals['_ADMINPERMISSIONS'].fields_by_name['methods']._loaded_options = None
+  _globals['_ADMINPERMISSIONS'].fields_by_name['methods']._serialized_options = b'\272H\006\222\001\003\020\364\003'
   _globals['_TOKENSERVICEREVOKEREQUEST'].fields_by_name['uuid']._loaded_options = None
   _globals['_TOKENSERVICEREVOKEREQUEST'].fields_by_name['uuid']._serialized_options = b'\272H\005r\003\260\001\001'
   _globals['_TOKENSERVICEUPDATEREQUEST_PROJECTROLESENTRY']._loaded_options = None
@@ -107,8 +121,8 @@
   _globals['_TOKENSERVICE'].methods_by_name['Revoke']._serialized_options = b'\330\363\030\002\340\363\030\001'
   _globals['_TOKENSERVICE'].methods_by_name['Refresh']._loaded_options = None
   _globals['_TOKENSERVICE'].methods_by_name['Refresh']._serialized_options = b'\330\363\030\002\340\363\030\001'
-  _globals['_TOKENTYPE']._serialized_start=3481
-  _globals['_TOKENTYPE']._serialized_end=3561
+  _globals['_TOKENTYPE']._serialized_start=4183
+  _globals['_TOKENTYPE']._serialized_end=4263
   _globals['_TOKEN']._serialized_start=197
   _globals['_TOKEN']._serialized_end=1178
   _globals['_TOKEN_PROJECTROLESENTRY']._serialized_start=823
@@ -116,39 +130,51 @@
   _globals['_TOKEN_TENANTROLESENTRY']._serialized_start=914
   _globals['_TOKEN_TENANTROLESENTRY']._serialized_end=1001
   _globals['_TOKENSERVICECREATEREQUEST']._serialized_start=1181
-  _globals['_TOKENSERVICECREATEREQUEST']._serialized_end=1958
+  _globals['_TOKENSERVICECREATEREQUEST']._serialized_end=1965
   _globals['_TOKENSERVICECREATEREQUEST_PROJECTROLESENTRY']._serialized_start=823
   _globals['_TOKENSERVICECREATEREQUEST_PROJECTROLESENTRY']._serialized_end=912
   _globals['_TOKENSERVICECREATEREQUEST_TENANTROLESENTRY']._serialized_start=914
   _globals['_TOKENSERVICECREATEREQUEST_TENANTROLESENTRY']._serialized_end=1001
-  _globals['_METHODPERMISSION']._serialized_start=1960
-  _globals['_METHODPERMISSION']._serialized_end=2051
-  _globals['_TOKENSERVICECREATERESPONSE']._serialized_start=2053
-  _globals['_TOKENSERVICECREATERESPONSE']._serialized_end=2147
-  _globals['_TOKENSERVICELISTREQUEST']._serialized_start=2149
-  _globals['_TOKENSERVICELISTREQUEST']._serialized_end=2174
-  _globals['_TOKENSERVICELISTRESPONSE']._serialized_start=2176
-  _globals['_TOKENSERVICELISTRESPONSE']._serialized_end=2246
-  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_start=2248
-  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_end=2305
-  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_start=2307
-  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_end=2335
-  _globals['_TOKENSERVICEUPDATEREQUEST']._serialized_start=2338
-  _globals['_TOKENSERVICEUPDATEREQUEST']._serialized_end=3155
+  _globals['_METHODPERMISSION']._serialized_start=1967
+  _globals['_METHODPERMISSION']._serialized_end=2058
+  _globals['_PERMISSIONSBYVISIBILITY']._serialized_start=2061
+  _globals['_PERMISSIONSBYVISIBILITY']._serialized_end=2384
+  _globals['_PUBLICPERMISSIONS']._serialized_start=2386
+  _globals['_PUBLICPERMISSIONS']._serialized_end=2442
+  _globals['_SELFPERMISSIONS']._serialized_start=2444
+  _globals['_SELFPERMISSIONS']._serialized_end=2498
+  _globals['_PROJECTPERMISSIONS']._serialized_start=2500
+  _globals['_PROJECTPERMISSIONS']._serialized_end=2596
+  _globals['_TENANTPERMISSIONS']._serialized_start=2598
+  _globals['_TENANTPERMISSIONS']._serialized_end=2689
+  _globals['_ADMINPERMISSIONS']._serialized_start=2691
+  _globals['_ADMINPERMISSIONS']._serialized_end=2746
+  _globals['_TOKENSERVICECREATERESPONSE']._serialized_start=2748
+  _globals['_TOKENSERVICECREATERESPONSE']._serialized_end=2842
+  _globals['_TOKENSERVICELISTREQUEST']._serialized_start=2844
+  _globals['_TOKENSERVICELISTREQUEST']._serialized_end=2869
+  _globals['_TOKENSERVICELISTRESPONSE']._serialized_start=2871
+  _globals['_TOKENSERVICELISTRESPONSE']._serialized_end=2941
+  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_start=2943
+  _globals['_TOKENSERVICEREVOKEREQUEST']._serialized_end=3000
+  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_start=3002
+  _globals['_TOKENSERVICEREVOKERESPONSE']._serialized_end=3030
+  _globals['_TOKENSERVICEUPDATEREQUEST']._serialized_start=3033
+  _globals['_TOKENSERVICEUPDATEREQUEST']._serialized_end=3857
   _globals['_TOKENSERVICEUPDATEREQUEST_PROJECTROLESENTRY']._serialized_start=823
   _globals['_TOKENSERVICEUPDATEREQUEST_PROJECTROLESENTRY']._serialized_end=912
   _globals['_TOKENSERVICEUPDATEREQUEST_TENANTROLESENTRY']._serialized_start=914
   _globals['_TOKENSERVICEUPDATEREQUEST_TENANTROLESENTRY']._serialized_end=1001
-  _globals['_TOKENSERVICEUPDATERESPONSE']._serialized_start=3157
-  _globals['_TOKENSERVICEUPDATERESPONSE']._serialized_end=3227
-  _globals['_TOKENSERVICEGETREQUEST']._serialized_start=3229
-  _globals['_TOKENSERVICEGETREQUEST']._serialized_end=3283
-  _globals['_TOKENSERVICEGETRESPONSE']._serialized_start=3285
-  _globals['_TOKENSERVICEGETRESPONSE']._serialized_end=3352
-  _globals['_TOKENSERVICEREFRESHREQUEST']._serialized_start=3354
-  _globals['_TOKENSERVICEREFRESHREQUEST']._serialized_end=3382
-  _globals['_TOKENSERVICEREFRESHRESPONSE']._serialized_start=3384
-  _globals['_TOKENSERVICEREFRESHRESPONSE']._serialized_end=3479
-  _globals['_TOKENSERVICE']._serialized_start=3564
-  _globals['_TOKENSERVICE']._serialized_end=4172
+  _globals['_TOKENSERVICEUPDATERESPONSE']._serialized_start=3859
+  _globals['_TOKENSERVICEUPDATERESPONSE']._serialized_end=3929
+  _globals['_TOKENSERVICEGETREQUEST']._serialized_start=3931
+  _globals['_TOKENSERVICEGETREQUEST']._serialized_end=3985
+  _globals['_TOKENSERVICEGETRESPONSE']._serialized_start=3987
+  _globals['_TOKENSERVICEGETRESPONSE']._serialized_end=4054
+  _globals['_TOKENSERVICEREFRESHREQUEST']._serialized_start=4056
+  _globals['_TOKENSERVICEREFRESHREQUEST']._serialized_end=4084
+  _globals['_TOKENSERVICEREFRESHRESPONSE']._serialized_start=4086
+  _globals['_TOKENSERVICEREFRESHRESPONSE']._serialized_end=4181
+  _globals['_TOKENSERVICE']._serialized_start=4266
+  _globals['_TOKENSERVICE']._serialized_end=4874
 # @@protoc_insertion_point(module_scope)
diff --git a/python/fits/api/v1/token_pb2.pyi b/python/fits/api/v1/token_pb2.pyi
index 636d454..fb903bd 100644
--- a/python/fits/api/v1/token_pb2.pyi
+++ b/python/fits/api/v1/token_pb2.pyi
@@ -87,13 +87,13 @@ class TokenServiceCreateRequest(_message.Message):
     ADMIN_ROLE_FIELD_NUMBER: _ClassVar[int]
     LABELS_FIELD_NUMBER: _ClassVar[int]
     description: str
-    permissions: _containers.RepeatedCompositeFieldContainer[MethodPermission]
+    permissions: _containers.RepeatedCompositeFieldContainer[PermissionsByVisibility]
     expires: _duration_pb2.Duration
     project_roles: _containers.ScalarMap[str, _common_pb2.ProjectRole]
     tenant_roles: _containers.ScalarMap[str, _common_pb2.TenantRole]
     admin_role: _common_pb2.AdminRole
     labels: _common_pb2.Labels
-    def __init__(self, description: _Optional[str] = ..., permissions: _Optional[_Iterable[_Union[MethodPermission, _Mapping]]] = ..., expires: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., project_roles: _Optional[_Mapping[str, _common_pb2.ProjectRole]] = ..., tenant_roles: _Optional[_Mapping[str, _common_pb2.TenantRole]] = ..., admin_role: _Optional[_Union[_common_pb2.AdminRole, str]] = ..., labels: _Optional[_Union[_common_pb2.Labels, _Mapping]] = ...) -> None: ...
+    def __init__(self, description: _Optional[str] = ..., permissions: _Optional[_Iterable[_Union[PermissionsByVisibility, _Mapping]]] = ..., expires: _Optional[_Union[datetime.timedelta, _duration_pb2.Duration, _Mapping]] = ..., project_roles: _Optional[_Mapping[str, _common_pb2.ProjectRole]] = ..., tenant_roles: _Optional[_Mapping[str, _common_pb2.TenantRole]] = ..., admin_role: _Optional[_Union[_common_pb2.AdminRole, str]] = ..., labels: _Optional[_Union[_common_pb2.Labels, _Mapping]] = ...) -> None: ...
 
 class MethodPermission(_message.Message):
     __slots__ = ("subject", "methods")
@@ -103,6 +103,54 @@ class MethodPermission(_message.Message):
     methods: _containers.RepeatedScalarFieldContainer[str]
     def __init__(self, subject: _Optional[str] = ..., methods: _Optional[_Iterable[str]] = ...) -> None: ...
 
+class PermissionsByVisibility(_message.Message):
+    __slots__ = ("public", "self", "project", "tenant", "admin")
+    PUBLIC_FIELD_NUMBER: _ClassVar[int]
+    SELF_FIELD_NUMBER: _ClassVar[int]
+    PROJECT_FIELD_NUMBER: _ClassVar[int]
+    TENANT_FIELD_NUMBER: _ClassVar[int]
+    ADMIN_FIELD_NUMBER: _ClassVar[int]
+    public: PublicPermissions
+    self: SelfPermissions
+    project: ProjectPermissions
+    tenant: TenantPermissions
+    admin: AdminPermissions
+    def __init__(self_, public: _Optional[_Union[PublicPermissions, _Mapping]] = ..., self: _Optional[_Union[SelfPermissions, _Mapping]] = ..., project: _Optional[_Union[ProjectPermissions, _Mapping]] = ..., tenant: _Optional[_Union[TenantPermissions, _Mapping]] = ..., admin: _Optional[_Union[AdminPermissions, _Mapping]] = ...) -> None: ...
+
+class PublicPermissions(_message.Message):
+    __slots__ = ("methods",)
+    METHODS_FIELD_NUMBER: _ClassVar[int]
+    methods: _containers.RepeatedScalarFieldContainer[str]
+    def __init__(self, methods: _Optional[_Iterable[str]] = ...) -> None: ...
+
+class SelfPermissions(_message.Message):
+    __slots__ = ("methods",)
+    METHODS_FIELD_NUMBER: _ClassVar[int]
+    methods: _containers.RepeatedScalarFieldContainer[str]
+    def __init__(self, methods: _Optional[_Iterable[str]] = ...) -> None: ...
+
+class ProjectPermissions(_message.Message):
+    __slots__ = ("project", "methods")
+    PROJECT_FIELD_NUMBER: _ClassVar[int]
+    METHODS_FIELD_NUMBER: _ClassVar[int]
+    project: str
+    methods: _containers.RepeatedScalarFieldContainer[str]
+    def __init__(self, project: _Optional[str] = ..., methods: _Optional[_Iterable[str]] = ...) -> None: ...
+
+class TenantPermissions(_message.Message):
+    __slots__ = ("login", "methods")
+    LOGIN_FIELD_NUMBER: _ClassVar[int]
+    METHODS_FIELD_NUMBER: _ClassVar[int]
+    login: str
+    methods: _containers.RepeatedScalarFieldContainer[str]
+    def __init__(self, login: _Optional[str] = ..., methods: _Optional[_Iterable[str]] = ...) -> None: ...
+
+class AdminPermissions(_message.Message):
+    __slots__ = ("methods",)
+    METHODS_FIELD_NUMBER: _ClassVar[int]
+    methods: _containers.RepeatedScalarFieldContainer[str]
+    def __init__(self, methods: _Optional[_Iterable[str]] = ...) -> None: ...
+
 class TokenServiceCreateResponse(_message.Message):
     __slots__ = ("token", "secret")
     TOKEN_FIELD_NUMBER: _ClassVar[int]
@@ -158,12 +206,12 @@ class TokenServiceUpdateRequest(_message.Message):
     uuid: str
     update_meta: _common_pb2.UpdateMeta
     description: str
-    permissions: _containers.RepeatedCompositeFieldContainer[MethodPermission]
+    permissions: _containers.RepeatedCompositeFieldContainer[PermissionsByVisibility]
     project_roles: _containers.ScalarMap[str, _common_pb2.ProjectRole]
     tenant_roles: _containers.ScalarMap[str, _common_pb2.TenantRole]
     admin_role: _common_pb2.AdminRole
     labels: _common_pb2.UpdateLabels
-    def __init__(self, uuid: _Optional[str] = ..., update_meta: _Optional[_Union[_common_pb2.UpdateMeta, _Mapping]] = ..., description: _Optional[str] = ..., permissions: _Optional[_Iterable[_Union[MethodPermission, _Mapping]]] = ..., project_roles: _Optional[_Mapping[str, _common_pb2.ProjectRole]] = ..., tenant_roles: _Optional[_Mapping[str, _common_pb2.TenantRole]] = ..., admin_role: _Optional[_Union[_common_pb2.AdminRole, str]] = ..., labels: _Optional[_Union[_common_pb2.UpdateLabels, _Mapping]] = ...) -> None: ...
+    def __init__(self, uuid: _Optional[str] = ..., update_meta: _Optional[_Union[_common_pb2.UpdateMeta, _Mapping]] = ..., description: _Optional[str] = ..., permissions: _Optional[_Iterable[_Union[PermissionsByVisibility, _Mapping]]] = ..., project_roles: _Optional[_Mapping[str, _common_pb2.ProjectRole]] = ..., tenant_roles: _Optional[_Mapping[str, _common_pb2.TenantRole]] = ..., admin_role: _Optional[_Union[_common_pb2.AdminRole, str]] = ..., labels: _Optional[_Union[_common_pb2.UpdateLabels, _Mapping]] = ...) -> None: ...
 
 class TokenServiceUpdateResponse(_message.Message):
     __slots__ = ("token",)