From 113c2cbb1a4b8437bd4719f1f1d13bdf3d3470c6 Mon Sep 17 00:00:00 2001
From: Mark Phelps <209477+markphelps@users.noreply.github.com>
Date: Sun, 9 Jun 2024 08:12:16 -0400
Subject: [PATCH] feat: Audit failed authz attempts (#3155)

* feat: authz audit events

* chore: continue with audit events for unauthorized requests

Signed-off-by: Mark Phelps <209477+markphelps@users.noreply.github.com>

* chore: fix unit test

Signed-off-by: Mark Phelps <209477+markphelps@users.noreply.github.com>

* chore: fix audit event middleware to capture failed authz requests

Signed-off-by: Mark Phelps <209477+markphelps@users.noreply.github.com>

* chore: proto regen

Signed-off-by: Mark Phelps <209477+markphelps@users.noreply.github.com>

* chore: bump audit event version

Signed-off-by: Mark Phelps <209477+markphelps@users.noreply.github.com>

* chore: fix tests

Signed-off-by: Mark Phelps <209477+markphelps@users.noreply.github.com>

* chore: fix marshal log test

Signed-off-by: Mark Phelps <209477+markphelps@users.noreply.github.com>

---------

Signed-off-by: Mark Phelps <209477+markphelps@users.noreply.github.com>
---
 .gitignore                                    |   1 +
 errors/errors.go                              |   8 ++
 internal/cmd/grpc.go                          |  90 ++++++-------
 internal/server/analytics/sink.go             |   4 +-
 internal/server/audit/checker.go              |  16 +++
 internal/server/audit/events.go               |  20 ++-
 internal/server/audit/events_test.go          |  27 ++--
 internal/server/audit/log/log_test.go         |  16 ++-
 .../authz/middleware/grpc/middleware.go       |  19 ++-
 .../authz/middleware/grpc/middleware_test.go  |   3 +-
 internal/server/middleware/grpc/middleware.go |  24 ++--
 .../server/middleware/grpc/middleware_test.go |   4 +
 rpc/flipt/analytics/analytics_grpc.pb.go      |   9 +-
 rpc/flipt/auth/auth_grpc.pb.go                |  42 +++---
 rpc/flipt/evaluation/evaluation_grpc.pb.go    |  22 +++-
 rpc/flipt/flipt_grpc.pb.go                    | 120 ++++++++++++------
 rpc/flipt/meta/meta_grpc.pb.go                |  12 +-
 rpc/flipt/request.go                          |  14 ++
 18 files changed, 291 insertions(+), 160 deletions(-)

diff --git a/.gitignore b/.gitignore
index 3e02ffa91b..db50cc7dce 100644
--- a/.gitignore
+++ b/.gitignore
@@ -55,3 +55,4 @@ devenv.local.nix
 .pre-commit-config.yaml
 
 build/mage_output_file.go
+*.rego
diff --git a/errors/errors.go b/errors/errors.go
index 3cff8184da..48ae2c0222 100644
--- a/errors/errors.go
+++ b/errors/errors.go
@@ -90,6 +90,14 @@ func (e ErrUnauthenticated) Error() string {
 	return string(e)
 }
 
+type ErrUnauthorized string
+
+var ErrUnauthorizedf = NewErrorf[ErrUnauthorized]
+
+func (e ErrUnauthorized) Error() string {
+	return string(e)
+}
+
 // StringError is any error that also happens to have an underlying type of string.
 type StringError interface {
 	error
diff --git a/internal/cmd/grpc.go b/internal/cmd/grpc.go
index df2d9260d2..172ceb157f 100644
--- a/internal/cmd/grpc.go
+++ b/internal/cmd/grpc.go
@@ -267,7 +267,7 @@ func NewGRPCServer(
 	skipAuthnIfExcluded(evalsrv, cfg.Authentication.Exclude.Evaluation)
 	skipAuthnIfExcluded(evaldatasrv, cfg.Authentication.Exclude.Evaluation)
 
-	var checker *audit.Checker
+	var checker audit.EventPairChecker = &audit.NoOpChecker{}
 
 	// We have to check if audit logging is enabled here for informing the authentication service that
 	// the user would like to receive token:deleted events.
@@ -345,50 +345,6 @@ func NewGRPCServer(
 		)...,
 	)
 
-	// cache must come after auth interceptors
-	if cfg.Cache.Enabled && cacher != nil {
-		interceptors = append(interceptors, middlewaregrpc.CacheUnaryInterceptor(cacher, logger))
-	}
-
-	if cfg.Authorization.Required {
-		authzOpts := []containers.Option[authzmiddlewaregrpc.InterceptorOptions]{
-			authzmiddlewaregrpc.WithServerSkipsAuthorization(healthsrv),
-		}
-
-		engineOpts := []containers.Option[authz.Engine]{
-			authz.WithPollDuration(cfg.Authorization.Policy.PollInterval),
-		}
-
-		if cfg.Authorization.Data != nil {
-			switch cfg.Authorization.Data.Backend {
-			case config.AuthorizationBackendLocal:
-				engineOpts = append(engineOpts, authz.WithDataSource(
-					filesystem.DataSourceFromPath(cfg.Authorization.Data.Local.Path),
-					cfg.Authorization.Data.PollInterval,
-				))
-			default:
-				return nil, fmt.Errorf("unexpected authz data backend type: %q", cfg.Authorization.Data.Backend)
-			}
-		}
-
-		var source authz.PolicySource
-		switch cfg.Authorization.Policy.Backend {
-		case config.AuthorizationBackendLocal:
-			source = filesystem.PolicySourceFromPath(cfg.Authorization.Policy.Local.Path)
-		default:
-			return nil, fmt.Errorf("unexpected authz policy backend type: %q", cfg.Authorization.Policy.Backend)
-		}
-
-		policyEngine, err := authz.NewEngine(ctx, logger, source, engineOpts...)
-		if err != nil {
-			return nil, fmt.Errorf("creating authorization policy engine: %w", err)
-		}
-
-		interceptors = append(interceptors, authzmiddlewaregrpc.AuthorizationRequiredInterceptor(logger, policyEngine, authzOpts...))
-
-		logger.Info("authorization middleware enabled")
-	}
-
 	// audit sinks configuration
 	sinks := make([]audit.Sink, 0)
 
@@ -488,6 +444,50 @@ func NewGRPCServer(
 	}
 	otel.SetTextMapPropagator(textMapPropagator)
 
+	if cfg.Authorization.Required {
+		authzOpts := []containers.Option[authzmiddlewaregrpc.InterceptorOptions]{
+			authzmiddlewaregrpc.WithServerSkipsAuthorization(healthsrv),
+		}
+
+		engineOpts := []containers.Option[authz.Engine]{
+			authz.WithPollDuration(cfg.Authorization.Policy.PollInterval),
+		}
+
+		if cfg.Authorization.Data != nil {
+			switch cfg.Authorization.Data.Backend {
+			case config.AuthorizationBackendLocal:
+				engineOpts = append(engineOpts, authz.WithDataSource(
+					filesystem.DataSourceFromPath(cfg.Authorization.Data.Local.Path),
+					cfg.Authorization.Data.PollInterval,
+				))
+			default:
+				return nil, fmt.Errorf("unexpected authz data backend type: %q", cfg.Authorization.Data.Backend)
+			}
+		}
+
+		var source authz.PolicySource
+		switch cfg.Authorization.Policy.Backend {
+		case config.AuthorizationBackendLocal:
+			source = filesystem.PolicySourceFromPath(cfg.Authorization.Policy.Local.Path)
+		default:
+			return nil, fmt.Errorf("unexpected authz policy backend type: %q", cfg.Authorization.Policy.Backend)
+		}
+
+		policyEngine, err := authz.NewEngine(ctx, logger, source, engineOpts...)
+		if err != nil {
+			return nil, fmt.Errorf("creating authorization policy engine: %w", err)
+		}
+
+		interceptors = append(interceptors, authzmiddlewaregrpc.AuthorizationRequiredInterceptor(logger, policyEngine, authzOpts...))
+
+		logger.Info("authorization middleware enabled")
+	}
+
+	// cache must come after authn and authz interceptors
+	if cfg.Cache.Enabled && cacher != nil {
+		interceptors = append(interceptors, middlewaregrpc.CacheUnaryInterceptor(cacher, logger))
+	}
+
 	grpcOpts := []grpc.ServerOption{
 		grpc.ChainUnaryInterceptor(interceptors...),
 		grpc.KeepaliveParams(keepalive.ServerParameters{
diff --git a/internal/server/analytics/sink.go b/internal/server/analytics/sink.go
index df011f5442..21db9548e2 100644
--- a/internal/server/analytics/sink.go
+++ b/internal/server/analytics/sink.go
@@ -42,10 +42,12 @@ func NewAnalyticsSinkSpanExporter(logger *zap.Logger, analyticsStoreMutator Anal
 	}
 }
 
+const evaluationResponseKey = "flipt.evaluation.response"
+
 // transformSpanEventToEvaluationResponses is a convenience function to transform a span event into an []*EvaluationResponse.
 func transformSpanEventToEvaluationResponses(event sdktrace.Event) ([]*EvaluationResponse, error) {
 	for _, attr := range event.Attributes {
-		if string(attr.Key) == "flipt.evaluation.response" {
+		if string(attr.Key) == evaluationResponseKey {
 			evaluationResponseBytes := []byte(attr.Value.AsString())
 			var evaluationResponse []*EvaluationResponse
 
diff --git a/internal/server/audit/checker.go b/internal/server/audit/checker.go
index 2c188bcc07..7e16a5c9b1 100644
--- a/internal/server/audit/checker.go
+++ b/internal/server/audit/checker.go
@@ -6,6 +6,12 @@ import (
 	"strings"
 )
 
+// EventPairChecker is the contract for checking if an event pair exists and if it should be emitted to configured sinks.
+type EventPairChecker interface {
+	Check(eventPair string) bool
+	Events() []string
+}
+
 // Checker holds a map that maps event pairs to a dummy struct. It is basically
 // used as a set to check for existence.
 type Checker struct {
@@ -93,3 +99,13 @@ func (c *Checker) Events() []string {
 
 	return events
 }
+
+type NoOpChecker struct{}
+
+func (n *NoOpChecker) Check(eventPair string) bool {
+	return false
+}
+
+func (n *NoOpChecker) Events() []string {
+	return []string{}
+}
diff --git a/internal/server/audit/events.go b/internal/server/audit/events.go
index 17b8f91664..f95d6d87a2 100644
--- a/internal/server/audit/events.go
+++ b/internal/server/audit/events.go
@@ -13,16 +13,17 @@ import (
 )
 
 const (
-	eventVersion          = "0.1"
+	eventVersion          = "0.2"
 	eventVersionKey       = "flipt.event.version"
 	eventActionKey        = "flipt.event.action"
 	eventTypeKey          = "flipt.event.type"
 	eventMetadataActorKey = "flipt.event.metadata.actor"
 	eventPayloadKey       = "flipt.event.payload"
 	eventTimestampKey     = "flipt.event.timestamp"
+	eventStatusKey        = "flipt.event.status"
 )
 
-// Event holds information that represents an action that has occurred in the system.
+// Event holds information that represents an action that was attempted in the system.
 type Event struct {
 	Version string `json:"version"`
 
@@ -35,6 +36,8 @@ type Event struct {
 	Payload interface{} `json:"payload"`
 
 	Timestamp string `json:"timestamp"`
+
+	Status string `json:"status"`
 }
 
 // NewEvent is the constructor for an event.
@@ -61,6 +64,7 @@ func NewEvent(r flipt.Request, actor *Actor, payload interface{}) *Event {
 		Version: eventVersion,
 		Action:  action,
 		Type:    typ,
+		Status:  string(r.Status),
 		Metadata: Metadata{
 			Actor: actor,
 		},
@@ -102,6 +106,13 @@ func (e Event) DecodeToAttributes() []attribute.KeyValue {
 		})
 	}
 
+	if e.Status != "" {
+		akv = append(akv, attribute.KeyValue{
+			Key:   eventStatusKey,
+			Value: attribute.StringValue(e.Status),
+		})
+	}
+
 	b, err := json.Marshal(e.Metadata.Actor)
 	if err == nil {
 		akv = append(akv, attribute.KeyValue{
@@ -129,13 +140,14 @@ func (e *Event) AddToSpan(ctx context.Context) {
 }
 
 func (e *Event) Valid() bool {
-	return e.Version != "" && e.Action != "" && e.Type != "" && e.Timestamp != "" && e.Payload != nil
+	return e.Version != "" && e.Action != "" && e.Type != "" && e.Timestamp != ""
 }
 
 func (e Event) MarshalLogObject(enc zapcore.ObjectEncoder) error {
 	enc.AddString("version", e.Version)
 	enc.AddString("type", e.Type)
 	enc.AddString("action", e.Action)
+	enc.AddString("status", e.Status)
 	if err := enc.AddReflected("metadata", e.Metadata); err != nil {
 		return err
 	}
@@ -162,6 +174,8 @@ func decodeToEvent(kvs []attribute.KeyValue) (*Event, error) {
 			e.Type = kv.Value.AsString()
 		case eventTimestampKey:
 			e.Timestamp = kv.Value.AsString()
+		case eventStatusKey:
+			e.Status = kv.Value.AsString()
 		case eventMetadataActorKey:
 			var actor Actor
 			if err := json.Unmarshal([]byte(kv.Value.AsString()), &actor); err != nil {
diff --git a/internal/server/audit/events_test.go b/internal/server/audit/events_test.go
index ef939914c3..09163b589a 100644
--- a/internal/server/audit/events_test.go
+++ b/internal/server/audit/events_test.go
@@ -9,23 +9,28 @@ import (
 )
 
 func TestMarshalLogObject(t *testing.T) {
-	actor := Actor{Authentication: "github"}
-	e := Event{
-		Version:  "0.1",
-		Type:     "sometype",
-		Action:   "modified",
-		Metadata: Metadata{Actor: &actor},
-		Payload:  "custom payload",
-	}
-	enc := zapcore.NewMapObjectEncoder()
-	err := e.MarshalLogObject(enc)
+	var (
+		actor = Actor{Authentication: "github"}
+		e     = Event{
+			Version:  "0.2",
+			Type:     "sometype",
+			Action:   "modified",
+			Metadata: Metadata{Actor: &actor},
+			Payload:  "custom payload",
+			Status:   "success",
+		}
+		enc = zapcore.NewMapObjectEncoder()
+		err = e.MarshalLogObject(enc)
+	)
+
 	require.NoError(t, err)
 	assert.Equal(t, map[string]any{
-		"version":   "0.1",
+		"version":   "0.2",
 		"action":    "modified",
 		"type":      "sometype",
 		"metadata":  Metadata{Actor: &actor},
 		"payload":   "custom payload",
 		"timestamp": "",
+		"status":    "success",
 	}, enc.Fields)
 }
diff --git a/internal/server/audit/log/log_test.go b/internal/server/audit/log/log_test.go
index af8619537b..3edd9aa7b7 100644
--- a/internal/server/audit/log/log_test.go
+++ b/internal/server/audit/log/log_test.go
@@ -33,14 +33,16 @@ func TestSink(t *testing.T) {
 
 	err = s.SendAudits(context.TODO(), []audit.Event{
 		{
-			Version: "0.1",
+			Version: "0.2",
 			Type:    string(flipt.SubjectFlag),
 			Action:  string(flipt.ActionCreate),
+			Status:  string(flipt.StatusSuccess),
 		},
 		{
-			Version: "0.1",
+			Version: "0.2",
 			Type:    string(flipt.SubjectConstraint),
 			Action:  string(flipt.ActionUpdate),
+			Status:  string(flipt.StatusSuccess),
 		},
 	})
 
@@ -58,7 +60,7 @@ func TestSink(t *testing.T) {
 	assert.NotEmpty(t, lines)
 	assert.NotEmpty(t, lines[0])
 
-	assert.JSONEq(t, `{"version": "0.1", "type": "flag", "action": "create", "metadata": {}, "payload": null, "timestamp": ""}`, lines[0])
+	assert.JSONEq(t, `{"version": "0.2", "type": "flag", "action": "create", "metadata": {}, "payload": null, "timestamp": "", "status": "success"}`, lines[0])
 }
 
 func TestSink_DirNotExists(t *testing.T) {
@@ -87,14 +89,16 @@ func TestSink_DirNotExists(t *testing.T) {
 
 			err = s.SendAudits(context.TODO(), []audit.Event{
 				{
-					Version: "0.1",
+					Version: "0.2",
 					Type:    string(flipt.SubjectFlag),
 					Action:  string(flipt.ActionCreate),
+					Status:  string(flipt.StatusSuccess),
 				},
 				{
-					Version: "0.1",
+					Version: "0.2",
 					Type:    string(flipt.SubjectConstraint),
 					Action:  string(flipt.ActionUpdate),
+					Status:  string(flipt.StatusSuccess),
 				},
 			})
 
@@ -113,7 +117,7 @@ func TestSink_DirNotExists(t *testing.T) {
 			assert.NotEmpty(t, lines)
 			assert.NotEmpty(t, lines[0])
 
-			assert.JSONEq(t, `{"version": "0.1", "type": "flag", "action": "create", "metadata": {}, "payload": null, "timestamp": ""}`, lines[0])
+			assert.JSONEq(t, `{"version": "0.2", "type": "flag", "action": "create", "metadata": {}, "payload": null, "timestamp": "", "status": "success"}`, lines[0])
 		})
 	}
 }
diff --git a/internal/server/authz/middleware/grpc/middleware.go b/internal/server/authz/middleware/grpc/middleware.go
index 6991d81fb6..f4f1b2a3fb 100644
--- a/internal/server/authz/middleware/grpc/middleware.go
+++ b/internal/server/authz/middleware/grpc/middleware.go
@@ -3,24 +3,21 @@ package grpc_middleware
 import (
 	"context"
 
+	"go.flipt.io/flipt/errors"
 	"go.flipt.io/flipt/internal/containers"
 	authmiddlewaregrpc "go.flipt.io/flipt/internal/server/authn/middleware/grpc"
 	"go.flipt.io/flipt/internal/server/authz"
 	"go.flipt.io/flipt/rpc/flipt"
 	"go.uber.org/zap"
 	"google.golang.org/grpc"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
 )
 
-var errUnauthorized = status.Error(codes.PermissionDenied, "request was not authorized")
-
 // SkipsAuthorizationServer is a grpc.Server which should always skip authentication.
 type SkipsAuthorizationServer interface {
 	SkipsAuthorization(ctx context.Context) bool
 }
 
-// InterceptorOptions configure the basic AuthUnaryInterceptors
+// InterceptorOptions configure the basic AuthzUnaryInterceptors
 type InterceptorOptions struct {
 	skippedServers []any
 }
@@ -82,28 +79,30 @@ func AuthorizationRequiredInterceptor(logger *zap.Logger, policyVerifier authz.V
 		requester, ok := req.(flipt.Requester)
 		if !ok {
 			logger.Error("request must implement flipt.Requester", zap.String("method", info.FullMethod))
-			return ctx, errUnauthorized
+			return ctx, errors.ErrUnauthorized("request not authorized")
 		}
 
 		auth := authmiddlewaregrpc.GetAuthenticationFrom(ctx)
 		if auth == nil {
 			logger.Error("unauthorized", zap.String("reason", "authentication required"))
-			return ctx, errUnauthorized
+			return ctx, errors.ErrUnauthorized("authentication required")
 		}
 
+		request := requester.Request()
+
 		allowed, err := policyVerifier.IsAllowed(ctx, map[string]interface{}{
-			"request":        requester.Request(),
+			"request":        request,
 			"authentication": auth,
 		})
 
 		if err != nil {
 			logger.Error("unauthorized", zap.Error(err))
-			return ctx, errUnauthorized
+			return ctx, errors.ErrUnauthorized("permission denied")
 		}
 
 		if !allowed {
 			logger.Error("unauthorized", zap.String("reason", "permission denied"))
-			return ctx, errUnauthorized
+			return ctx, errors.ErrUnauthorized("permission denied")
 		}
 
 		return handler(ctx, req)
diff --git a/internal/server/authz/middleware/grpc/middleware_test.go b/internal/server/authz/middleware/grpc/middleware_test.go
index 3352ed5484..e469b3abd7 100644
--- a/internal/server/authz/middleware/grpc/middleware_test.go
+++ b/internal/server/authz/middleware/grpc/middleware_test.go
@@ -68,6 +68,7 @@ func TestAuthorizationRequiredInterceptor(t *testing.T) {
 					Resource:  flipt.ResourceFlag,
 					Subject:   flipt.SubjectFlag,
 					Action:    flipt.ActionCreate,
+					Status:    flipt.StatusSuccess,
 				},
 				"authentication": adminAuth,
 			},
@@ -153,7 +154,7 @@ func TestAuthorizationRequiredInterceptor(t *testing.T) {
 				return
 			}
 
-			require.EqualError(t, err, errUnauthorized.Error())
+			require.Error(t, err)
 		})
 	}
 }
diff --git a/internal/server/middleware/grpc/middleware.go b/internal/server/middleware/grpc/middleware.go
index 8e56d19090..88330dd5e5 100644
--- a/internal/server/middleware/grpc/middleware.go
+++ b/internal/server/middleware/grpc/middleware.go
@@ -72,6 +72,8 @@ func ErrorUnaryInterceptor(ctx context.Context, req interface{}, _ *grpc.UnarySe
 		code = codes.InvalidArgument
 	case errs.AsMatch[errs.ErrUnauthenticated](err):
 		code = codes.Unauthenticated
+	case errs.AsMatch[errs.ErrUnauthorized](err):
+		code = codes.PermissionDenied
 	}
 
 	err = status.Error(code, err.Error())
@@ -423,13 +425,8 @@ func CacheUnaryInterceptor(cache cache.Cacher, logger *zap.Logger) grpc.UnarySer
 	}
 }
 
-// EventPairChecker is the middleware side contract for checking if an event pair exists.
-type EventPairChecker interface {
-	Check(eventPair string) bool
-}
-
 // AuditEventUnaryInterceptor captures events and adds them to the trace span to be consumed downstream.
-func AuditEventUnaryInterceptor(logger *zap.Logger, eventPairChecker EventPairChecker) grpc.UnaryServerInterceptor {
+func AuditEventUnaryInterceptor(logger *zap.Logger, eventPairChecker audit.EventPairChecker) grpc.UnaryServerInterceptor {
 	return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
 		var request flipt.Request
 		r, ok := req.(flipt.Requester)
@@ -440,11 +437,6 @@ func AuditEventUnaryInterceptor(logger *zap.Logger, eventPairChecker EventPairCh
 
 		request = r.Request()
 
-		resp, err := handler(ctx, req)
-		if err != nil {
-			return resp, err
-		}
-
 		var event *audit.Event
 
 		actor := authn.ActorFromContext(ctx)
@@ -461,6 +453,16 @@ func AuditEventUnaryInterceptor(logger *zap.Logger, eventPairChecker EventPairCh
 			}
 		}()
 
+		resp, err := handler(ctx, req)
+		if err != nil {
+			var uerr errs.ErrUnauthorized
+			if errors.As(err, &uerr) {
+				request.Status = flipt.StatusDenied
+				event = audit.NewEvent(request, actor, nil)
+			}
+			return resp, err
+		}
+
 		// Delete and Order request(s) have to be handled separately because they do not
 		// return the concrete type but rather an *empty.Empty response.
 		if request.Action == flipt.ActionDelete {
diff --git a/internal/server/middleware/grpc/middleware_test.go b/internal/server/middleware/grpc/middleware_test.go
index 53b7cc5e50..3c3b50a0db 100644
--- a/internal/server/middleware/grpc/middleware_test.go
+++ b/internal/server/middleware/grpc/middleware_test.go
@@ -1081,6 +1081,10 @@ func (c *checkerDummy) Check(e string) bool {
 	return true
 }
 
+func (c *checkerDummy) Events() []string {
+	return []string{"event"}
+}
+
 func TestAuditUnaryInterceptor_CreateFlag(t *testing.T) {
 	var (
 		store       = &common.StoreMock{}
diff --git a/rpc/flipt/analytics/analytics_grpc.pb.go b/rpc/flipt/analytics/analytics_grpc.pb.go
index c98bb4011a..79b590f33e 100644
--- a/rpc/flipt/analytics/analytics_grpc.pb.go
+++ b/rpc/flipt/analytics/analytics_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: analytics/analytics.proto
 
@@ -15,8 +15,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	AnalyticsService_GetFlagEvaluationsCount_FullMethodName = "/flipt.analytics.AnalyticsService/GetFlagEvaluationsCount"
@@ -38,8 +38,9 @@ func NewAnalyticsServiceClient(cc grpc.ClientConnInterface) AnalyticsServiceClie
 }
 
 func (c *analyticsServiceClient) GetFlagEvaluationsCount(ctx context.Context, in *GetFlagEvaluationsCountRequest, opts ...grpc.CallOption) (*GetFlagEvaluationsCountResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetFlagEvaluationsCountResponse)
-	err := c.cc.Invoke(ctx, AnalyticsService_GetFlagEvaluationsCount_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AnalyticsService_GetFlagEvaluationsCount_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
diff --git a/rpc/flipt/auth/auth_grpc.pb.go b/rpc/flipt/auth/auth_grpc.pb.go
index c7086660fb..58ef0d3034 100644
--- a/rpc/flipt/auth/auth_grpc.pb.go
+++ b/rpc/flipt/auth/auth_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: auth/auth.proto
 
@@ -16,8 +16,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	PublicAuthenticationService_ListAuthenticationMethods_FullMethodName = "/flipt.auth.PublicAuthenticationService/ListAuthenticationMethods"
@@ -39,8 +39,9 @@ func NewPublicAuthenticationServiceClient(cc grpc.ClientConnInterface) PublicAut
 }
 
 func (c *publicAuthenticationServiceClient) ListAuthenticationMethods(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*ListAuthenticationMethodsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListAuthenticationMethodsResponse)
-	err := c.cc.Invoke(ctx, PublicAuthenticationService_ListAuthenticationMethods_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, PublicAuthenticationService_ListAuthenticationMethods_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -138,8 +139,9 @@ func NewAuthenticationServiceClient(cc grpc.ClientConnInterface) AuthenticationS
 }
 
 func (c *authenticationServiceClient) GetAuthenticationSelf(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*Authentication, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Authentication)
-	err := c.cc.Invoke(ctx, AuthenticationService_GetAuthenticationSelf_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AuthenticationService_GetAuthenticationSelf_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -147,8 +149,9 @@ func (c *authenticationServiceClient) GetAuthenticationSelf(ctx context.Context,
 }
 
 func (c *authenticationServiceClient) GetAuthentication(ctx context.Context, in *GetAuthenticationRequest, opts ...grpc.CallOption) (*Authentication, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Authentication)
-	err := c.cc.Invoke(ctx, AuthenticationService_GetAuthentication_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AuthenticationService_GetAuthentication_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -156,8 +159,9 @@ func (c *authenticationServiceClient) GetAuthentication(ctx context.Context, in
 }
 
 func (c *authenticationServiceClient) ListAuthentications(ctx context.Context, in *ListAuthenticationsRequest, opts ...grpc.CallOption) (*ListAuthenticationsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListAuthenticationsResponse)
-	err := c.cc.Invoke(ctx, AuthenticationService_ListAuthentications_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AuthenticationService_ListAuthentications_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -165,8 +169,9 @@ func (c *authenticationServiceClient) ListAuthentications(ctx context.Context, i
 }
 
 func (c *authenticationServiceClient) DeleteAuthentication(ctx context.Context, in *DeleteAuthenticationRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, AuthenticationService_DeleteAuthentication_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AuthenticationService_DeleteAuthentication_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -174,8 +179,9 @@ func (c *authenticationServiceClient) DeleteAuthentication(ctx context.Context,
 }
 
 func (c *authenticationServiceClient) ExpireAuthenticationSelf(ctx context.Context, in *ExpireAuthenticationSelfRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, AuthenticationService_ExpireAuthenticationSelf_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AuthenticationService_ExpireAuthenticationSelf_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -368,8 +374,9 @@ func NewAuthenticationMethodTokenServiceClient(cc grpc.ClientConnInterface) Auth
 }
 
 func (c *authenticationMethodTokenServiceClient) CreateToken(ctx context.Context, in *CreateTokenRequest, opts ...grpc.CallOption) (*CreateTokenResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(CreateTokenResponse)
-	err := c.cc.Invoke(ctx, AuthenticationMethodTokenService_CreateToken_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AuthenticationMethodTokenService_CreateToken_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -461,8 +468,9 @@ func NewAuthenticationMethodOIDCServiceClient(cc grpc.ClientConnInterface) Authe
 }
 
 func (c *authenticationMethodOIDCServiceClient) AuthorizeURL(ctx context.Context, in *AuthorizeURLRequest, opts ...grpc.CallOption) (*AuthorizeURLResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(AuthorizeURLResponse)
-	err := c.cc.Invoke(ctx, AuthenticationMethodOIDCService_AuthorizeURL_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AuthenticationMethodOIDCService_AuthorizeURL_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -470,8 +478,9 @@ func (c *authenticationMethodOIDCServiceClient) AuthorizeURL(ctx context.Context
 }
 
 func (c *authenticationMethodOIDCServiceClient) Callback(ctx context.Context, in *CallbackRequest, opts ...grpc.CallOption) (*CallbackResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(CallbackResponse)
-	err := c.cc.Invoke(ctx, AuthenticationMethodOIDCService_Callback_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AuthenticationMethodOIDCService_Callback_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -587,8 +596,9 @@ func NewAuthenticationMethodKubernetesServiceClient(cc grpc.ClientConnInterface)
 }
 
 func (c *authenticationMethodKubernetesServiceClient) VerifyServiceAccount(ctx context.Context, in *VerifyServiceAccountRequest, opts ...grpc.CallOption) (*VerifyServiceAccountResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(VerifyServiceAccountResponse)
-	err := c.cc.Invoke(ctx, AuthenticationMethodKubernetesService_VerifyServiceAccount_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AuthenticationMethodKubernetesService_VerifyServiceAccount_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -680,8 +690,9 @@ func NewAuthenticationMethodGithubServiceClient(cc grpc.ClientConnInterface) Aut
 }
 
 func (c *authenticationMethodGithubServiceClient) AuthorizeURL(ctx context.Context, in *AuthorizeURLRequest, opts ...grpc.CallOption) (*AuthorizeURLResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(AuthorizeURLResponse)
-	err := c.cc.Invoke(ctx, AuthenticationMethodGithubService_AuthorizeURL_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AuthenticationMethodGithubService_AuthorizeURL_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -689,8 +700,9 @@ func (c *authenticationMethodGithubServiceClient) AuthorizeURL(ctx context.Conte
 }
 
 func (c *authenticationMethodGithubServiceClient) Callback(ctx context.Context, in *CallbackRequest, opts ...grpc.CallOption) (*CallbackResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(CallbackResponse)
-	err := c.cc.Invoke(ctx, AuthenticationMethodGithubService_Callback_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AuthenticationMethodGithubService_Callback_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
diff --git a/rpc/flipt/evaluation/evaluation_grpc.pb.go b/rpc/flipt/evaluation/evaluation_grpc.pb.go
index 537d680e50..ca73df5e75 100644
--- a/rpc/flipt/evaluation/evaluation_grpc.pb.go
+++ b/rpc/flipt/evaluation/evaluation_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: evaluation/evaluation.proto
 
@@ -15,8 +15,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	EvaluationService_Boolean_FullMethodName = "/flipt.evaluation.EvaluationService/Boolean"
@@ -42,8 +42,9 @@ func NewEvaluationServiceClient(cc grpc.ClientConnInterface) EvaluationServiceCl
 }
 
 func (c *evaluationServiceClient) Boolean(ctx context.Context, in *EvaluationRequest, opts ...grpc.CallOption) (*BooleanEvaluationResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(BooleanEvaluationResponse)
-	err := c.cc.Invoke(ctx, EvaluationService_Boolean_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, EvaluationService_Boolean_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -51,8 +52,9 @@ func (c *evaluationServiceClient) Boolean(ctx context.Context, in *EvaluationReq
 }
 
 func (c *evaluationServiceClient) Variant(ctx context.Context, in *EvaluationRequest, opts ...grpc.CallOption) (*VariantEvaluationResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(VariantEvaluationResponse)
-	err := c.cc.Invoke(ctx, EvaluationService_Variant_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, EvaluationService_Variant_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -60,8 +62,9 @@ func (c *evaluationServiceClient) Variant(ctx context.Context, in *EvaluationReq
 }
 
 func (c *evaluationServiceClient) Batch(ctx context.Context, in *BatchEvaluationRequest, opts ...grpc.CallOption) (*BatchEvaluationResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(BatchEvaluationResponse)
-	err := c.cc.Invoke(ctx, EvaluationService_Batch_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, EvaluationService_Batch_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -189,6 +192,8 @@ const (
 // DataServiceClient is the client API for DataService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// flipt:sdk:ignore
 type DataServiceClient interface {
 	EvaluationSnapshotNamespace(ctx context.Context, in *EvaluationNamespaceSnapshotRequest, opts ...grpc.CallOption) (*EvaluationNamespaceSnapshot, error)
 }
@@ -202,8 +207,9 @@ func NewDataServiceClient(cc grpc.ClientConnInterface) DataServiceClient {
 }
 
 func (c *dataServiceClient) EvaluationSnapshotNamespace(ctx context.Context, in *EvaluationNamespaceSnapshotRequest, opts ...grpc.CallOption) (*EvaluationNamespaceSnapshot, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(EvaluationNamespaceSnapshot)
-	err := c.cc.Invoke(ctx, DataService_EvaluationSnapshotNamespace_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DataService_EvaluationSnapshotNamespace_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -213,6 +219,8 @@ func (c *dataServiceClient) EvaluationSnapshotNamespace(ctx context.Context, in
 // DataServiceServer is the server API for DataService service.
 // All implementations must embed UnimplementedDataServiceServer
 // for forward compatibility
+//
+// flipt:sdk:ignore
 type DataServiceServer interface {
 	EvaluationSnapshotNamespace(context.Context, *EvaluationNamespaceSnapshotRequest) (*EvaluationNamespaceSnapshot, error)
 	mustEmbedUnimplementedDataServiceServer()
diff --git a/rpc/flipt/flipt_grpc.pb.go b/rpc/flipt/flipt_grpc.pb.go
index 590715cfc3..af6d0f57ae 100644
--- a/rpc/flipt/flipt_grpc.pb.go
+++ b/rpc/flipt/flipt_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: flipt.proto
 
@@ -16,8 +16,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	Flipt_Evaluate_FullMethodName           = "/flipt.Flipt/Evaluate"
@@ -116,8 +116,9 @@ func NewFliptClient(cc grpc.ClientConnInterface) FliptClient {
 
 // Deprecated: Do not use.
 func (c *fliptClient) Evaluate(ctx context.Context, in *EvaluationRequest, opts ...grpc.CallOption) (*EvaluationResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(EvaluationResponse)
-	err := c.cc.Invoke(ctx, Flipt_Evaluate_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_Evaluate_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -126,8 +127,9 @@ func (c *fliptClient) Evaluate(ctx context.Context, in *EvaluationRequest, opts
 
 // Deprecated: Do not use.
 func (c *fliptClient) BatchEvaluate(ctx context.Context, in *BatchEvaluationRequest, opts ...grpc.CallOption) (*BatchEvaluationResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(BatchEvaluationResponse)
-	err := c.cc.Invoke(ctx, Flipt_BatchEvaluate_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_BatchEvaluate_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -135,8 +137,9 @@ func (c *fliptClient) BatchEvaluate(ctx context.Context, in *BatchEvaluationRequ
 }
 
 func (c *fliptClient) GetNamespace(ctx context.Context, in *GetNamespaceRequest, opts ...grpc.CallOption) (*Namespace, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Namespace)
-	err := c.cc.Invoke(ctx, Flipt_GetNamespace_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_GetNamespace_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -144,8 +147,9 @@ func (c *fliptClient) GetNamespace(ctx context.Context, in *GetNamespaceRequest,
 }
 
 func (c *fliptClient) ListNamespaces(ctx context.Context, in *ListNamespaceRequest, opts ...grpc.CallOption) (*NamespaceList, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(NamespaceList)
-	err := c.cc.Invoke(ctx, Flipt_ListNamespaces_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_ListNamespaces_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -153,8 +157,9 @@ func (c *fliptClient) ListNamespaces(ctx context.Context, in *ListNamespaceReque
 }
 
 func (c *fliptClient) CreateNamespace(ctx context.Context, in *CreateNamespaceRequest, opts ...grpc.CallOption) (*Namespace, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Namespace)
-	err := c.cc.Invoke(ctx, Flipt_CreateNamespace_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_CreateNamespace_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -162,8 +167,9 @@ func (c *fliptClient) CreateNamespace(ctx context.Context, in *CreateNamespaceRe
 }
 
 func (c *fliptClient) UpdateNamespace(ctx context.Context, in *UpdateNamespaceRequest, opts ...grpc.CallOption) (*Namespace, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Namespace)
-	err := c.cc.Invoke(ctx, Flipt_UpdateNamespace_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_UpdateNamespace_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -171,8 +177,9 @@ func (c *fliptClient) UpdateNamespace(ctx context.Context, in *UpdateNamespaceRe
 }
 
 func (c *fliptClient) DeleteNamespace(ctx context.Context, in *DeleteNamespaceRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, Flipt_DeleteNamespace_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_DeleteNamespace_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -180,8 +187,9 @@ func (c *fliptClient) DeleteNamespace(ctx context.Context, in *DeleteNamespaceRe
 }
 
 func (c *fliptClient) GetFlag(ctx context.Context, in *GetFlagRequest, opts ...grpc.CallOption) (*Flag, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Flag)
-	err := c.cc.Invoke(ctx, Flipt_GetFlag_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_GetFlag_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -189,8 +197,9 @@ func (c *fliptClient) GetFlag(ctx context.Context, in *GetFlagRequest, opts ...g
 }
 
 func (c *fliptClient) ListFlags(ctx context.Context, in *ListFlagRequest, opts ...grpc.CallOption) (*FlagList, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(FlagList)
-	err := c.cc.Invoke(ctx, Flipt_ListFlags_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_ListFlags_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -198,8 +207,9 @@ func (c *fliptClient) ListFlags(ctx context.Context, in *ListFlagRequest, opts .
 }
 
 func (c *fliptClient) CreateFlag(ctx context.Context, in *CreateFlagRequest, opts ...grpc.CallOption) (*Flag, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Flag)
-	err := c.cc.Invoke(ctx, Flipt_CreateFlag_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_CreateFlag_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -207,8 +217,9 @@ func (c *fliptClient) CreateFlag(ctx context.Context, in *CreateFlagRequest, opt
 }
 
 func (c *fliptClient) UpdateFlag(ctx context.Context, in *UpdateFlagRequest, opts ...grpc.CallOption) (*Flag, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Flag)
-	err := c.cc.Invoke(ctx, Flipt_UpdateFlag_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_UpdateFlag_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -216,8 +227,9 @@ func (c *fliptClient) UpdateFlag(ctx context.Context, in *UpdateFlagRequest, opt
 }
 
 func (c *fliptClient) DeleteFlag(ctx context.Context, in *DeleteFlagRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, Flipt_DeleteFlag_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_DeleteFlag_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -225,8 +237,9 @@ func (c *fliptClient) DeleteFlag(ctx context.Context, in *DeleteFlagRequest, opt
 }
 
 func (c *fliptClient) CreateVariant(ctx context.Context, in *CreateVariantRequest, opts ...grpc.CallOption) (*Variant, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Variant)
-	err := c.cc.Invoke(ctx, Flipt_CreateVariant_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_CreateVariant_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -234,8 +247,9 @@ func (c *fliptClient) CreateVariant(ctx context.Context, in *CreateVariantReques
 }
 
 func (c *fliptClient) UpdateVariant(ctx context.Context, in *UpdateVariantRequest, opts ...grpc.CallOption) (*Variant, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Variant)
-	err := c.cc.Invoke(ctx, Flipt_UpdateVariant_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_UpdateVariant_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -243,8 +257,9 @@ func (c *fliptClient) UpdateVariant(ctx context.Context, in *UpdateVariantReques
 }
 
 func (c *fliptClient) DeleteVariant(ctx context.Context, in *DeleteVariantRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, Flipt_DeleteVariant_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_DeleteVariant_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -252,8 +267,9 @@ func (c *fliptClient) DeleteVariant(ctx context.Context, in *DeleteVariantReques
 }
 
 func (c *fliptClient) GetRule(ctx context.Context, in *GetRuleRequest, opts ...grpc.CallOption) (*Rule, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Rule)
-	err := c.cc.Invoke(ctx, Flipt_GetRule_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_GetRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -261,8 +277,9 @@ func (c *fliptClient) GetRule(ctx context.Context, in *GetRuleRequest, opts ...g
 }
 
 func (c *fliptClient) ListRules(ctx context.Context, in *ListRuleRequest, opts ...grpc.CallOption) (*RuleList, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(RuleList)
-	err := c.cc.Invoke(ctx, Flipt_ListRules_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_ListRules_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -270,8 +287,9 @@ func (c *fliptClient) ListRules(ctx context.Context, in *ListRuleRequest, opts .
 }
 
 func (c *fliptClient) CreateRule(ctx context.Context, in *CreateRuleRequest, opts ...grpc.CallOption) (*Rule, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Rule)
-	err := c.cc.Invoke(ctx, Flipt_CreateRule_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_CreateRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -279,8 +297,9 @@ func (c *fliptClient) CreateRule(ctx context.Context, in *CreateRuleRequest, opt
 }
 
 func (c *fliptClient) UpdateRule(ctx context.Context, in *UpdateRuleRequest, opts ...grpc.CallOption) (*Rule, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Rule)
-	err := c.cc.Invoke(ctx, Flipt_UpdateRule_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_UpdateRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -288,8 +307,9 @@ func (c *fliptClient) UpdateRule(ctx context.Context, in *UpdateRuleRequest, opt
 }
 
 func (c *fliptClient) OrderRules(ctx context.Context, in *OrderRulesRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, Flipt_OrderRules_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_OrderRules_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -297,8 +317,9 @@ func (c *fliptClient) OrderRules(ctx context.Context, in *OrderRulesRequest, opt
 }
 
 func (c *fliptClient) DeleteRule(ctx context.Context, in *DeleteRuleRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, Flipt_DeleteRule_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_DeleteRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -306,8 +327,9 @@ func (c *fliptClient) DeleteRule(ctx context.Context, in *DeleteRuleRequest, opt
 }
 
 func (c *fliptClient) GetRollout(ctx context.Context, in *GetRolloutRequest, opts ...grpc.CallOption) (*Rollout, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Rollout)
-	err := c.cc.Invoke(ctx, Flipt_GetRollout_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_GetRollout_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -315,8 +337,9 @@ func (c *fliptClient) GetRollout(ctx context.Context, in *GetRolloutRequest, opt
 }
 
 func (c *fliptClient) ListRollouts(ctx context.Context, in *ListRolloutRequest, opts ...grpc.CallOption) (*RolloutList, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(RolloutList)
-	err := c.cc.Invoke(ctx, Flipt_ListRollouts_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_ListRollouts_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -324,8 +347,9 @@ func (c *fliptClient) ListRollouts(ctx context.Context, in *ListRolloutRequest,
 }
 
 func (c *fliptClient) CreateRollout(ctx context.Context, in *CreateRolloutRequest, opts ...grpc.CallOption) (*Rollout, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Rollout)
-	err := c.cc.Invoke(ctx, Flipt_CreateRollout_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_CreateRollout_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -333,8 +357,9 @@ func (c *fliptClient) CreateRollout(ctx context.Context, in *CreateRolloutReques
 }
 
 func (c *fliptClient) UpdateRollout(ctx context.Context, in *UpdateRolloutRequest, opts ...grpc.CallOption) (*Rollout, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Rollout)
-	err := c.cc.Invoke(ctx, Flipt_UpdateRollout_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_UpdateRollout_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -342,8 +367,9 @@ func (c *fliptClient) UpdateRollout(ctx context.Context, in *UpdateRolloutReques
 }
 
 func (c *fliptClient) DeleteRollout(ctx context.Context, in *DeleteRolloutRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, Flipt_DeleteRollout_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_DeleteRollout_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -351,8 +377,9 @@ func (c *fliptClient) DeleteRollout(ctx context.Context, in *DeleteRolloutReques
 }
 
 func (c *fliptClient) OrderRollouts(ctx context.Context, in *OrderRolloutsRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, Flipt_OrderRollouts_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_OrderRollouts_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -360,8 +387,9 @@ func (c *fliptClient) OrderRollouts(ctx context.Context, in *OrderRolloutsReques
 }
 
 func (c *fliptClient) CreateDistribution(ctx context.Context, in *CreateDistributionRequest, opts ...grpc.CallOption) (*Distribution, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Distribution)
-	err := c.cc.Invoke(ctx, Flipt_CreateDistribution_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_CreateDistribution_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -369,8 +397,9 @@ func (c *fliptClient) CreateDistribution(ctx context.Context, in *CreateDistribu
 }
 
 func (c *fliptClient) UpdateDistribution(ctx context.Context, in *UpdateDistributionRequest, opts ...grpc.CallOption) (*Distribution, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Distribution)
-	err := c.cc.Invoke(ctx, Flipt_UpdateDistribution_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_UpdateDistribution_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -378,8 +407,9 @@ func (c *fliptClient) UpdateDistribution(ctx context.Context, in *UpdateDistribu
 }
 
 func (c *fliptClient) DeleteDistribution(ctx context.Context, in *DeleteDistributionRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, Flipt_DeleteDistribution_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_DeleteDistribution_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -387,8 +417,9 @@ func (c *fliptClient) DeleteDistribution(ctx context.Context, in *DeleteDistribu
 }
 
 func (c *fliptClient) GetSegment(ctx context.Context, in *GetSegmentRequest, opts ...grpc.CallOption) (*Segment, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Segment)
-	err := c.cc.Invoke(ctx, Flipt_GetSegment_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_GetSegment_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -396,8 +427,9 @@ func (c *fliptClient) GetSegment(ctx context.Context, in *GetSegmentRequest, opt
 }
 
 func (c *fliptClient) ListSegments(ctx context.Context, in *ListSegmentRequest, opts ...grpc.CallOption) (*SegmentList, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(SegmentList)
-	err := c.cc.Invoke(ctx, Flipt_ListSegments_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_ListSegments_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -405,8 +437,9 @@ func (c *fliptClient) ListSegments(ctx context.Context, in *ListSegmentRequest,
 }
 
 func (c *fliptClient) CreateSegment(ctx context.Context, in *CreateSegmentRequest, opts ...grpc.CallOption) (*Segment, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Segment)
-	err := c.cc.Invoke(ctx, Flipt_CreateSegment_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_CreateSegment_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -414,8 +447,9 @@ func (c *fliptClient) CreateSegment(ctx context.Context, in *CreateSegmentReques
 }
 
 func (c *fliptClient) UpdateSegment(ctx context.Context, in *UpdateSegmentRequest, opts ...grpc.CallOption) (*Segment, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Segment)
-	err := c.cc.Invoke(ctx, Flipt_UpdateSegment_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_UpdateSegment_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -423,8 +457,9 @@ func (c *fliptClient) UpdateSegment(ctx context.Context, in *UpdateSegmentReques
 }
 
 func (c *fliptClient) DeleteSegment(ctx context.Context, in *DeleteSegmentRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, Flipt_DeleteSegment_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_DeleteSegment_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -432,8 +467,9 @@ func (c *fliptClient) DeleteSegment(ctx context.Context, in *DeleteSegmentReques
 }
 
 func (c *fliptClient) CreateConstraint(ctx context.Context, in *CreateConstraintRequest, opts ...grpc.CallOption) (*Constraint, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Constraint)
-	err := c.cc.Invoke(ctx, Flipt_CreateConstraint_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_CreateConstraint_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -441,8 +477,9 @@ func (c *fliptClient) CreateConstraint(ctx context.Context, in *CreateConstraint
 }
 
 func (c *fliptClient) UpdateConstraint(ctx context.Context, in *UpdateConstraintRequest, opts ...grpc.CallOption) (*Constraint, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Constraint)
-	err := c.cc.Invoke(ctx, Flipt_UpdateConstraint_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_UpdateConstraint_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -450,8 +487,9 @@ func (c *fliptClient) UpdateConstraint(ctx context.Context, in *UpdateConstraint
 }
 
 func (c *fliptClient) DeleteConstraint(ctx context.Context, in *DeleteConstraintRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, Flipt_DeleteConstraint_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Flipt_DeleteConstraint_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
diff --git a/rpc/flipt/meta/meta_grpc.pb.go b/rpc/flipt/meta/meta_grpc.pb.go
index a570e2e6f7..6b13f1187c 100644
--- a/rpc/flipt/meta/meta_grpc.pb.go
+++ b/rpc/flipt/meta/meta_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: meta/meta.proto
 
@@ -17,8 +17,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	MetadataService_GetConfiguration_FullMethodName = "/flipt.meta.MetadataService/GetConfiguration"
@@ -42,8 +42,9 @@ func NewMetadataServiceClient(cc grpc.ClientConnInterface) MetadataServiceClient
 }
 
 func (c *metadataServiceClient) GetConfiguration(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*httpbody.HttpBody, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(httpbody.HttpBody)
-	err := c.cc.Invoke(ctx, MetadataService_GetConfiguration_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, MetadataService_GetConfiguration_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -51,8 +52,9 @@ func (c *metadataServiceClient) GetConfiguration(ctx context.Context, in *emptyp
 }
 
 func (c *metadataServiceClient) GetInfo(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*httpbody.HttpBody, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(httpbody.HttpBody)
-	err := c.cc.Invoke(ctx, MetadataService_GetInfo_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, MetadataService_GetInfo_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
diff --git a/rpc/flipt/request.go b/rpc/flipt/request.go
index 1c62138375..1c7c911a4c 100644
--- a/rpc/flipt/request.go
+++ b/rpc/flipt/request.go
@@ -13,6 +13,9 @@ type Subject string
 // Action represents the action being taken on the resource.
 type Action string
 
+// Status represents the status of the request.
+type Status string
+
 const (
 	ResourceNamespace      Resource = "namespace"
 	ResourceFlag           Resource = "flag"
@@ -33,6 +36,9 @@ const (
 	ActionDelete Action = "delete"
 	ActionUpdate Action = "update"
 	ActionRead   Action = "read"
+
+	StatusSuccess Status = "success"
+	StatusDenied  Status = "denied"
 )
 
 type Request struct {
@@ -40,6 +46,7 @@ type Request struct {
 	Resource  Resource `json:"resource"`
 	Subject   Subject  `json:"subject"`
 	Action    Action   `json:"action"`
+	Status    Status   `json:"status"`
 }
 
 func WithNamespace(ns string) func(*Request) {
@@ -48,6 +55,12 @@ func WithNamespace(ns string) func(*Request) {
 	}
 }
 
+func WithStatus(s Status) func(*Request) {
+	return func(r *Request) {
+		r.Status = s
+	}
+}
+
 func WithSubject(s Subject) func(*Request) {
 	return func(r *Request) {
 		r.Subject = s
@@ -58,6 +71,7 @@ func NewRequest(r Resource, a Action, opts ...func(*Request)) Request {
 	req := Request{
 		Resource: r,
 		Action:   a,
+		Status:   StatusSuccess,
 	}
 
 	for _, opt := range opts {