(#171 ) Refactor API to use FieldMasks

This patch refactors the API following the [API Best Practices][api] documentation. The UpdatePlatform method is modeled after a mutating operation described [by Netflix][nflx] instead of using a REST resource representation. This makes it much easier to iterate over the fields that need to be updated as the PlatformUpdateOperation is a flat data structure while a Platform resource may have nested fields. Nested fields are more complicated and less clear to handle with a FieldMask. This patch also adds a snapckbar message on save. Previously, the save button didn't give any indication of success or failure. This patch fixes the problem by adding a snackbar message that pop up at the bottom of the screen nicely. When the snackbar message is dismissed or times out the save button is re-enabled. [api]: https://protobuf.dev/programming-guides/api/ [nflx]: https://netflixtechblog.com/practical-api-design-at-netflix-part-2-protobuf-fieldmask-for-mutation-operations-2e75e1d230e4 Examples: FieldMask for ListPlatforms ``` grpcurl -H "x-oidc-id-token: $(holos token)" -d @ ${HOLOS_SERVER##*/} holos.platform.v1alpha1.PlatformService.ListPlatforms <<EOF { "org_id": "018f36fb-e3f7-7f7f-a1c5-c85fb735d215", "field_mask": { "paths": ["id","name"] } } EOF ``` ```json { "platforms": [ { "id": "018f36fb-e3ff-7f7f-a5d1-7ca2bf499e94", "name": "bare" }, { "id": "018f6b06-9e57-7223-91a9-784e145d998c", "name": "gary" }, { "id": "018f6b06-9e53-7223-8ae1-1ad53d46b158", "name": "jeff" }, { "id": "018f6b06-9e5b-7223-8b8b-ea62618e8200", "name": "nate" } ] } ``` Closes: #171
(#171 ) Refactor to API Best Practices
2026-03-19 16:54:58 +00:00 · 2024-05-13 16:20:20 -07:00 · 2024-05-10 15:55:41 -07:00 · 2024-05-08 16:34:00 -07:00 · 2024-05-08 12:04:50 -07:00 · 2024-05-07 16:58:03 -07:00
108 changed files with 9279 additions and 2690 deletions
--- a/14
+++ b/14
@@ -63,8 +63,20 @@ vet: ## Vet Go code.
 gencue: ## Generate CUE definitions
 	cd docs/examples && cue get go github.com/holos-run/holos/api/...

+.PHONY: rmgen
+rmgen: ## Remove generated code
+	git rm -rf service/gen/ internal/frontend/holos/src/app/gen/ || true
+	rm -rf service/gen/ internal/frontend/holos/src/app/gen/
+	git rm -rf internal/ent/
+	rm -rf internal/ent/
+	git restore --staged internal/ent/generate.go internal/ent/schema/
+	git restore internal/ent/generate.go internal/ent/schema/
+
+.PHONY: regenerate
+regenerate: generate ## Re-generate code (delete and re-create)
+
 .PHONY: generate
-generate: ## Generate code.
+generate: buf ## Generate code.
 	go generate ./...

 .PHONY: build
--- a/docs/examples/api/ListPlatform/listplatform.json
+++ b/docs/examples/api/ListPlatform/listplatform.json
@@ -0,0 +1,10 @@
+{
+  "org_id": "018f36fb-e3f7-7f7f-a1c5-c85fb735d215",
+  "field_mask": {
+    "paths": [
+      "id",
+      "name",
+      "displayName"
+    ]
+  }
+}
--- a/docs/examples/api/UpdatePlatform/clearform.json
+++ b/docs/examples/api/UpdatePlatform/clearform.json
@@ -0,0 +1,8 @@
+{
+  "update_mask": {
+    "paths": ["form"]
+  },
+  "update": {
+    "platform_id": "018f36fb-e3ff-7f7f-a5d1-7ca2bf499e94"
+  }
+}
--- a/docs/examples/api/UpdatePlatform/model.json
+++ b/docs/examples/api/UpdatePlatform/model.json
@@ -0,0 +1,11 @@
+{
+  "update_mask": {
+    "paths": ["model","name","display_name"]
+  },
+  "update": {
+    "platform_id": "018f36fb-e3ff-7f7f-a5d1-7ca2bf499e94",
+    "name": "bareplatform",
+    "display_name": "Bare Platform",
+    "model": {}
+  }
+}
--- a/docs/examples/api/UpdatePlatform/nomask.json
+++ b/docs/examples/api/UpdatePlatform/nomask.json
@@ -0,0 +1,6 @@
+{
+  "update": {
+    "platform_id": "018f36fb-e3ff-7f7f-a5d1-7ca2bf499e94",
+    "model": {}
+  }
+}
--- a/docs/examples/platforms/reference/clusters/workload/holos-run/dev/app/holos-run-app.cue
+++ b/docs/examples/platforms/reference/clusters/workload/holos-run/dev/app/holos-run-app.cue
@@ -34,7 +34,7 @@ let OBJECTS = #APIObjects & {
 					containers: [
 						{
 							name:            Holos
-							image:           "271053619184.dkr.ecr.us-east-2.amazonaws.com/holos-run/holos-server/holos:0.73.1"
+							image:           "271053619184.dkr.ecr.us-east-2.amazonaws.com/holos-run/holos-server/holos:0.74.0"
 							imagePullPolicy: "Always"
 							env: [
 								{
--- a/docs/runbooks/login/pgbouncer.md
+++ b/docs/runbooks/login/pgbouncer.md
@@ -0,0 +1,92 @@
+# PG Bouncer
+
+Every few days ZITADEL fails.  The problem seems to be related to pgbouncer not
+being able to resolve DNS.  Restarting the pgbouncer pod fixes the issue.
+
+See [How to load-balance queries between several servers?](https://www.pgbouncer.org/faq.html#how-to-load-balance-queries-between-several-servers)
+
+> [!NOTE]
+> DNS round-robin. Use several IPs behind one DNS name. PgBouncer does not look up DNS each time a new connection is launched. Instead, it caches all IPs and does round-robin internally. Note: if there are more than 8 IPs behind one name, the DNS backend must support the EDNS0 protocol. See README for details.
+
+## Workaround
+
+```sh
+# Get the tls based creds to bypass oidc
+(cd ~/.kube && holos get secret core2-kubeconfig-admin --print-key kubeconfig.admin > core2.admin)
+export KUBECONFIG=$HOME/.kube/core2.admin
+# Restart pgbouncer
+kubectl -n prod-iam rollout restart deployment zitadel-pgbouncer
+```
+
+## Symptom logs
+
+```sh
+kubectl -n prod-iam logs -c pgbouncer -l postgres-operator.crunchydata.com/role=pgbouncer
+```
+
+```txt
+2024-05-08 17:56:11.424 UTC [7] LOG S-0x559b03f90ff0: zitadel/zitadel@10.110.109.110:5432 SSL established: TLSv1.3/TLS_AES_256_GCM_SHA384/ECDH=prime256v1
+2024-05-08 17:56:11.429 UTC [7] LOG S-0x559b03f92820: zitadel/zitadel@10.110.109.110:5432 new connection to server (from 10.244.5.38:53658)
+2024-05-08 17:56:11.435 UTC [7] LOG S-0x559b03f92820: zitadel/zitadel@10.110.109.110:5432 SSL established: TLSv1.3/TLS_AES_256_GCM_SHA384/ECDH=prime256v1
+2024-05-08 17:56:11.476 UTC [7] LOG C-0x559b03f7a610: zitadel/zitadel@10.244.2.89:34932 closing because: client close request (age=440s)
+2024-05-08 17:56:19.708 UTC [7] LOG stats: 15 xacts/s, 42 queries/s, 0 client parses/s, 0 server parses/s, 0 binds/s, in 6159 B/s, out 6124 B/s, xact 3930 us, query 869 us, wait 490 us
+[msg] Nameserver 10.96.0.10:53 is back up
+2024-05-08 17:57:09.366 UTC [7] LOG C-0x559b03f7a610: zitadel/zitadel@10.244.3.187:58674 login attempt: db=zitadel user=zitadel tls=TLSv1.3/TLS_AES_256_GCM_SHA384
+2024-05-08 17:57:09.391 UTC [7] LOG C-0x559b03f7a610: zitadel/zitadel@10.244.3.187:58674 closing because: client close request (age=0s)
+2024-05-08 17:57:19.709 UTC [7] LOG stats: 9 xacts/s, 24 queries/s, 0 client parses/s, 0 server parses/s, 0 binds/s, in 2870 B/s, out 3018 B/s, xact 4147 us, query 958 us, wait 23 us
+2024-05-08 17:58:19.708 UTC [7] LOG stats: 12 xacts/s, 32 queries/s, 0 client parses/s, 0 server parses/s, 0 binds/s, in 3861 B/s, out 3533 B/s, xact 3843 us, query 853 us, wait 0 us
+2024-05-08 17:56:11.411 UTC [8] LOG S-0x55a894e36650: zitadel/_crunchypgbouncer@10.110.109.110:5432 new connection to server (from 10.244.3.227:58984)
+2024-05-08 17:56:11.411 UTC [8] LOG S-0x55a894e37920: zitadel/zitadel@10.110.109.110:5432 new connection to server (from 10.244.3.227:58992)
+2024-05-08 17:56:11.418 UTC [8] LOG S-0x55a894e37920: zitadel/zitadel@10.110.109.110:5432 SSL established: TLSv1.3/TLS_AES_256_GCM_SHA384/ECDH=prime256v1
+2024-05-08 17:56:11.420 UTC [8] LOG S-0x55a894e36650: zitadel/_crunchypgbouncer@10.110.109.110:5432 SSL established: TLSv1.3/TLS_AES_256_GCM_SHA384/ECDH=prime256v1
+2024-05-08 17:56:11.438 UTC [8] LOG S-0x55a894e35b90: zitadel/zitadel@10.110.109.110:5432 new connection to server (from 10.244.3.227:59004)
+2024-05-08 17:56:11.445 UTC [8] LOG S-0x55a894e35b90: zitadel/zitadel@10.110.109.110:5432 SSL established: TLSv1.3/TLS_AES_256_GCM_SHA384/ECDH=prime256v1
+2024-05-08 17:56:17.148 UTC [8] LOG stats: 9 xacts/s, 27 queries/s, 0 client parses/s, 0 server parses/s, 0 binds/s, in 3236 B/s, out 2826 B/s, xact 5224 us, query 910 us, wait 1182 us
+[msg] Nameserver 10.96.0.10:53 is back up
+2024-05-08 17:57:17.145 UTC [8] LOG stats: 10 xacts/s, 31 queries/s, 0 client parses/s, 0 server parses/s, 0 binds/s, in 4342 B/s, out 4305 B/s, xact 4536 us, query 776 us, wait 0 us
+2024-05-08 17:58:17.149 UTC [8] LOG stats: 5 xacts/s, 15 queries/s, 0 client parses/s, 0 server parses/s, 0 binds/s, in 1641 B/s, out 1582 B/s, xact 7819 us, query 1426 us, wait 0 us
+```
+
+## Relevant Configuration
+
+`/etc/pgbouncer/pgbouncer.ini` is empty.
+
+```
+bash-4.4$ cat /etc/pgbouncer/~postgres-operator.ini
+# Generated by postgres-operator. DO NOT EDIT.
+# Your changes will not be saved.
+
+[pgbouncer]
+%include /etc/pgbouncer/pgbouncer.ini
+
+[pgbouncer]
+auth_file = /etc/pgbouncer/~postgres-operator/users.txt
+auth_query = SELECT username, password from pgbouncer.get_auth($1)
+auth_user = _crunchypgbouncer
+client_tls_ca_file = /etc/pgbouncer/~postgres-operator/frontend-ca.crt
+client_tls_cert_file = /etc/pgbouncer/~postgres-operator/frontend-tls.crt
+client_tls_key_file = /etc/pgbouncer/~postgres-operator/frontend-tls.key
+client_tls_sslmode = require
+conffile = /etc/pgbouncer/~postgres-operator.ini
+ignore_startup_parameters = extra_float_digits
+listen_addr = *
+listen_port = 5432
+server_tls_ca_file = /etc/pgbouncer/~postgres-operator/backend-ca.crt
+server_tls_sslmode = verify-full
+unix_socket_dir =
+
+[databases]
+* = host=zitadel-primary port=5432
+```
+
+### [host](https://www.pgbouncer.org/config.html#host)
+
+> Host name or IP address to connect to. Host names are resolved at connection time, the result is cached per dns_max_ttl parameter. When a host name’s resolution changes, existing server connections are automatically closed when they are released (according to the pooling mode), and new server connections immediately use the new resolution. If DNS returns several results, they are used in a round-robin manner.
+
+### dns_max_ttl
+
+[dns_max_ttl](https://www.pgbouncer.org/config.html#dns_max_ttl)
+
+How long DNS lookups can be cached. The actual DNS TTL is ignored.
+
+Default: 15.0 (seconds)
--- a/go.mod
+++ b/go.mod
@@ -157,6 +157,7 @@ require (
 	github.com/lufia/plan9stats v0.0.0-20240408141607-282e7b5d6b74 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mennanov/fieldmask-utils v1.1.2 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
 	github.com/miekg/dns v1.1.58 // indirect
 	github.com/miekg/pkcs11 v1.1.1 // indirect
@@ -245,6 +246,7 @@ require (
 	golang.org/x/text v0.14.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
 	google.golang.org/appengine v1.6.8 // indirect
+	google.golang.org/genproto v0.0.0-20240123012728-ef4313101c80 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20240325203815-454cdb8f5daa // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240325203815-454cdb8f5daa // indirect
 	google.golang.org/grpc v1.62.1 // indirect
--- a/go.sum
+++ b/go.sum
@@ -86,6 +86,7 @@ github.com/agext/levenshtein v1.2.1 h1:QmvMAjj2aEICytGiWzmxoE0x2KZvE0fvmqMOfy2tj
 github.com/agext/levenshtein v1.2.1/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
 github.com/agnivade/levenshtein v1.1.1 h1:QY8M92nrzkmr798gCo3kmMyqXFzdQVpxLlGPRBij0P8=
 github.com/agnivade/levenshtein v1.1.1/go.mod h1:veldBMzWxcCG2ZvUTKD2kJNRdCk5hVbJomOvKkmgYbo=
+github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
 github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI=
 github.com/antlr4-go/antlr/v4 v4.13.0/go.mod h1:pfChB/xh/Unjila75QW7+VU4TSnWnnk9UTnmpPaOR2g=
 github.com/apparentlymart/go-textseg/v13 v13.0.0 h1:Y+KvPE1NYz0xl601PVImeQfFyEy6iT90AvPUL1NNfNw=
@@ -115,6 +116,7 @@ github.com/census-instrumentation/opencensus-proto v0.4.1 h1:iKLQ0xPNFxR/2hzXZMr
 github.com/census-instrumentation/opencensus-proto v0.4.1/go.mod h1:4T9NM4+4Vw91VeyqjLS6ao50K5bOcLKN6Q42XnYaRYw=
 github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
+github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cheekybits/genny v1.0.0 h1:uGGa4nei+j20rOSeDeP5Of12XVm7TGUd4dJA9RDitfE=
@@ -144,9 +146,13 @@ github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDk
 github.com/cloudevents/sdk-go/v2 v2.15.2 h1:54+I5xQEnI73RBhWHxbI1XJcqOFOVJN85vb41+8mHUc=
 github.com/cloudevents/sdk-go/v2 v2.15.2/go.mod h1:lL7kSWAE/V8VI4Wh0jbL2v/jvqsm6tjmaQBSvxcv4uE=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
+github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
+github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
 github.com/cncf/udpa/go v0.0.0-20220112060539-c52dc94e7fbe h1:QQ3GSy+MqSHxm/d8nCtnAiZdYFd45cYZPs8vOOIYKfk=
 github.com/cncf/udpa/go v0.0.0-20220112060539-c52dc94e7fbe/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
 github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa h1:jQCWAUqqlij9Pgj2i/PB79y4KOPYVyFYdROxgaCwdTQ=
 github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa/go.mod h1:x/1Gn8zydmfq8dk6e9PdstVsDgu9RuyIIJqAaF//0IM=
 github.com/cockroachdb/apd/v3 v3.2.1 h1:U+8j7t0axsIgvQUqthuNm82HIrYXodOV2iWLWtEaIwg=
@@ -198,6 +204,8 @@ github.com/emicklei/proto v1.10.0/go.mod h1:rn1FgRS/FANiZdD2djyH7TMA9jdRDcYQ9IEN
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
+github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
+github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1/go.mod h1:KJwIaB5Mv44NWtYuAOFCVOjcI94vtpEz2JU/D2v6IjE=
 github.com/envoyproxy/go-control-plane v0.12.0 h1:4X+VP1GHd1Mhj6IB5mMeGbLCleqxjletLK6K0rbxyZI=
 github.com/envoyproxy/go-control-plane v0.12.0/go.mod h1:ZBTaoJ23lqITozF0M6G4/IragXCQKCnYbmlmtHvwRG0=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
@@ -307,6 +315,7 @@ github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:W
 github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
 github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
@@ -356,6 +365,7 @@ github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaU
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/subcommands v1.0.1/go.mod h1:ZjhPrFU+Olkh9WazFPsl27BQ4UPiG37m3yTrtFlrHVk=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/wire v0.5.0 h1:I7ELFeVBr3yfPIcc8+MWvrjk+3VjbcSzoXm3JVa+jD8=
@@ -374,6 +384,7 @@ github.com/gosuri/uilive v0.0.4 h1:hUEBpQDj8D8jXgtCdBu7sWsy5sbW/5GhuO8KBwJ2jyY=
 github.com/gosuri/uilive v0.0.4/go.mod h1:V/epo5LjjlDE5RJUcqx8dbw+zc93y5Ya3yg8tfZ74VI=
 github.com/gosuri/uiprogress v0.0.1 h1:0kpv/XY/qTmFWl/SkaJykZXrBBzwwadmW8fRb7RJSxw=
 github.com/gosuri/uiprogress v0.0.1/go.mod h1:C1RTYn4Sc7iEyf6j8ft5dyoZ4212h8G1ol9QQluh5+0=
+github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0 h1:Wqo399gCIufwto+VfwCSvsnfGpF/w5E9CNxSwbpD6No=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0/go.mod h1:qmOFXW2epJhM0qSnUUYpldc7gVz2KMQwJ/QYCDIa7XU=
 github.com/guptarohit/asciigraph v0.7.1 h1:K+JWbRc04XEfv8BSZgNuvhCmpbvX4+9NYd/UxXVnAuk=
@@ -468,6 +479,8 @@ github.com/mattn/go-runewidth v0.0.15 h1:UNAjwbU9l54TA3KzvqLGxwWjHmMgBUVhBiTjelZ
 github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU=
 github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/mennanov/fieldmask-utils v1.1.2 h1:f5hd3hYeWdl+q2thiKYyZZmqTqn90uayWG03bca9U+E=
+github.com/mennanov/fieldmask-utils v1.1.2/go.mod h1:xRqd9Fjz/gFEDYCQw7pxGouxqLhSPrkOdx2yhEAXEls=
 github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
@@ -568,6 +581,7 @@ github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/robfig/cron v1.2.0 h1:ZjScXvvxeQ63Dbyxy76Fj3AT3Ut0aKsyd2/tl3DTMuQ=
 github.com/robfig/cron v1.2.0/go.mod h1:JGuDeoQd7Z6yL4zQhZ3OPEVHB7fL6Ka6skscFHfmt2k=
+github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
 github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
@@ -686,6 +700,7 @@ go.opentelemetry.io/otel/sdk/metric v1.19.0 h1:EJoTO5qysMsYCa+w4UghwFV/ptQgqSL/8
 go.opentelemetry.io/otel/sdk/metric v1.19.0/go.mod h1:XjG0jQyFJrv2PbMvwND7LwCEhsJzCzV5210euduKcKY=
 go.opentelemetry.io/otel/trace v1.25.0 h1:tqukZGLwQYRIFtSQM2u2+yfMVTgGVeqRLPUYx1Dq6RM=
 go.opentelemetry.io/otel/trace v1.25.0/go.mod h1:hCCs70XM/ljO+BeQkyFnbK28SBIJ/Emuha+ccrCRT7I=
+go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
 go.opentelemetry.io/proto/otlp v1.1.0 h1:2Di21piLrCqJ3U3eXGCTPHE9R8Nh+0uglSnOyxikMeI=
 go.opentelemetry.io/proto/otlp v1.1.0/go.mod h1:GpBHCBWiqvVLDqmHZsoMM3C5ySeKTC7ej/RNTae6MdY=
 go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
@@ -833,6 +848,7 @@ golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -979,12 +995,16 @@ google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfG
 google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
 google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
 google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20220531173845-685668d2de03/go.mod h1:yKyY4AMRwFiC8yMMNaMi+RkCnjZJt9LoWuvhXjMs+To=
+google.golang.org/genproto v0.0.0-20240123012728-ef4313101c80 h1:KAeGQVN3M9nD0/bQXnr/ClcEMJ968gUXJQ9pwfSynuQ=
+google.golang.org/genproto v0.0.0-20240123012728-ef4313101c80/go.mod h1:cc8bqMqtv9gMOr0zHg2Vzff5ULhhL2IXP4sbcn32Dro=
 google.golang.org/genproto/googleapis/api v0.0.0-20240325203815-454cdb8f5daa h1:Jt1XW5PaLXF1/ePZrznsh/aAUvI7Adfc3LY1dAKlzRs=
 google.golang.org/genproto/googleapis/api v0.0.0-20240325203815-454cdb8f5daa/go.mod h1:K4kfzHtI0kqWA79gecJarFtDn/Mls+GxQcg3Zox91Ac=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20240325203815-454cdb8f5daa h1:RBgMaUMP+6soRkik4VoN8ojR2nex2TqZwjSSogic+eo=
@@ -1001,6 +1021,9 @@ google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKa
 google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
 google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
+google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
+google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
+google.golang.org/grpc v1.46.2/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
 google.golang.org/grpc v1.62.1 h1:B4n+nfKzOICUXMgyrNd19h/I9oH0L1pizfk1d4zSgTk=
 google.golang.org/grpc v1.62.1/go.mod h1:IWTG0VlJLCh1SkC58F7np9ka9mx/WNkjl4PGJaiq+QE=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
@@ -1015,6 +1038,8 @@ google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGj
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 google.golang.org/protobuf v1.33.1-0.20240408130810-98873a205002 h1:V7Da7qt0MkY3noVANIMVBk28nOnijADeOR3i5Hcvpj4=
 google.golang.org/protobuf v1.33.1-0.20240408130810-98873a205002/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
@@ -1026,6 +1051,7 @@ gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
--- a/internal/cli/root.go
+++ b/internal/cli/root.go
@@ -16,6 +16,7 @@ import (
 	"github.com/holos-run/holos/internal/cli/logout"
 	"github.com/holos-run/holos/internal/cli/preflight"
 	"github.com/holos-run/holos/internal/cli/render"
+	"github.com/holos-run/holos/internal/cli/rpc"
 	"github.com/holos-run/holos/internal/cli/token"
 	"github.com/holos-run/holos/internal/cli/txtar"
 	"github.com/holos-run/holos/internal/holos"
@@ -63,6 +64,7 @@ func New(cfg *holos.Config) *cobra.Command {
 	rootCmd.AddCommand(login.New(cfg))
 	rootCmd.AddCommand(logout.New(cfg))
 	rootCmd.AddCommand(token.New(cfg))
+	rootCmd.AddCommand(rpc.New(cfg))

 	// Maybe not needed?
 	rootCmd.AddCommand(txtar.New(cfg))
--- a/internal/cli/rpc/rpc.go
+++ b/internal/cli/rpc/rpc.go
@@ -0,0 +1,70 @@
+package rpc
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"connectrpc.com/connect"
+	"github.com/holos-run/holos/internal/cli/command"
+	"github.com/holos-run/holos/internal/errors"
+	"github.com/holos-run/holos/internal/holos"
+	"github.com/holos-run/holos/internal/server/middleware/logger"
+	"github.com/holos-run/holos/internal/token"
+	platform "github.com/holos-run/holos/service/gen/holos/platform/v1alpha1"
+	"github.com/holos-run/holos/service/gen/holos/platform/v1alpha1/platformconnect"
+	"github.com/spf13/cobra"
+)
+
+// Remove these
+const BarePlatformID = "018f36fb-e3ff-7f7f-a5d1-7ca2bf499e94"
+
+type Config struct {
+	holos  *holos.Config
+	client *holos.ClientConfig
+	token  *token.Config
+}
+
+// New returns a new rpc command.
+func New(cfg *holos.Config) *cobra.Command {
+	cmd := command.New("rpc")
+	cmd.Short = "remote procedure calls"
+
+	config := &Config{
+		holos:  cfg,
+		client: holos.NewClientConfig(),
+		token:  token.NewConfig(),
+	}
+
+	cmd.PersistentFlags().AddGoFlagSet(config.client.FlagSet())
+	cmd.PersistentFlags().AddGoFlagSet(config.token.FlagSet())
+	cmd.AddCommand(NewPlatformModel(config))
+	return cmd
+}
+
+func NewPlatformModel(cfg *Config) *cobra.Command {
+	cmd := command.New("platform-model")
+	cmd.Short = "get the platform model"
+	cmd.RunE = func(cmd *cobra.Command, args []string) error {
+		ctx := cmd.Context()
+		log := logger.FromContext(ctx)
+		// client := platformconnect.NewPlatformServiceClient(token.NewClient(cfg.token), cfg.client.Server())
+		client := platformconnect.NewPlatformServiceClient(token.NewClient(cfg.token), cfg.client.Server())
+		// JEFFTODO - FieldMask
+		log.WarnContext(ctx, "JEFFTODO use the fieldmask to get only the model")
+		req := connect.NewRequest(&platform.GetPlatformRequest{PlatformId: BarePlatformID})
+		res, err := client.GetPlatform(ctx, req)
+		if err != nil {
+			return errors.Wrap(fmt.Errorf("could not get platform: %w", err))
+		}
+		if res == nil || res.Msg == nil || res.Msg.Platform == nil || res.Msg.Platform.Spec == nil {
+			return errors.Wrap(fmt.Errorf("response missing platform spec:\n\thave: (%+v)\n\twant: (response message platform.spec)", res))
+		}
+		encoder := json.NewEncoder(cmd.OutOrStdout())
+		encoder.SetIndent("", "  ")
+		if err := encoder.Encode(res.Msg.Platform.Spec.Model); err != nil {
+			return errors.Wrap(fmt.Errorf("could not encode json: %w", err))
+		}
+		return err
+	}
+	return cmd
+}
--- a/internal/ent/client.go
+++ b/internal/ent/client.go
@@ -342,6 +342,22 @@ func (c *OrganizationClient) QueryCreator(o *Organization) *UserQuery {
 	return query
 }

+// QueryEditor queries the editor edge of a Organization.
+func (c *OrganizationClient) QueryEditor(o *Organization) *UserQuery {
+	query := (&UserClient{config: c.config}).Query()
+	query.path = func(context.Context) (fromV *sql.Selector, _ error) {
+		id := o.ID
+		step := sqlgraph.NewStep(
+			sqlgraph.From(organization.Table, organization.FieldID, id),
+			sqlgraph.To(user.Table, user.FieldID),
+			sqlgraph.Edge(sqlgraph.M2O, false, organization.EditorTable, organization.EditorColumn),
+		)
+		fromV = sqlgraph.Neighbors(o.driver.Dialect(), step)
+		return fromV, nil
+	}
+	return query
+}
+
 // QueryUsers queries the users edge of a Organization.
 func (c *OrganizationClient) QueryUsers(o *Organization) *UserQuery {
 	query := (&UserClient{config: c.config}).Query()
@@ -523,6 +539,22 @@ func (c *PlatformClient) QueryCreator(pl *Platform) *UserQuery {
 	return query
 }

+// QueryEditor queries the editor edge of a Platform.
+func (c *PlatformClient) QueryEditor(pl *Platform) *UserQuery {
+	query := (&UserClient{config: c.config}).Query()
+	query.path = func(context.Context) (fromV *sql.Selector, _ error) {
+		id := pl.ID
+		step := sqlgraph.NewStep(
+			sqlgraph.From(platform.Table, platform.FieldID, id),
+			sqlgraph.To(user.Table, user.FieldID),
+			sqlgraph.Edge(sqlgraph.M2O, false, platform.EditorTable, platform.EditorColumn),
+		)
+		fromV = sqlgraph.Neighbors(pl.driver.Dialect(), step)
+		return fromV, nil
+	}
+	return query
+}
+
 // QueryOrganization queries the organization edge of a Platform.
 func (c *PlatformClient) QueryOrganization(pl *Platform) *OrganizationQuery {
 	query := (&OrganizationClient{config: c.config}).Query()
--- a/internal/ent/migrate/schema.go
+++ b/internal/ent/migrate/schema.go
@@ -15,7 +15,8 @@ var (
 		{Name: "updated_at", Type: field.TypeTime},
 		{Name: "name", Type: field.TypeString, Unique: true},
 		{Name: "display_name", Type: field.TypeString},
-		{Name: "creator_id", Type: field.TypeUUID},
+		{Name: "created_by_id", Type: field.TypeUUID},
+		{Name: "updated_by_id", Type: field.TypeUUID},
 	}
 	// OrganizationsTable holds the schema information for the "organizations" table.
 	OrganizationsTable = &schema.Table{
@@ -29,6 +30,12 @@ var (
 				RefColumns: []*schema.Column{UsersColumns[0]},
 				OnDelete:   schema.NoAction,
 			},
+			{
+				Symbol:     "organizations_users_editor",
+				Columns:    []*schema.Column{OrganizationsColumns[6]},
+				RefColumns: []*schema.Column{UsersColumns[0]},
+				OnDelete:   schema.NoAction,
+			},
 		},
 	}
 	// PlatformsColumns holds the columns for the "platforms" table.
@@ -42,7 +49,8 @@ var (
 		{Name: "model", Type: field.TypeJSON, Nullable: true},
 		{Name: "cue", Type: field.TypeBytes, Nullable: true},
 		{Name: "cue_definition", Type: field.TypeString, Nullable: true},
-		{Name: "creator_id", Type: field.TypeUUID},
+		{Name: "created_by_id", Type: field.TypeUUID},
+		{Name: "updated_by_id", Type: field.TypeUUID},
 		{Name: "org_id", Type: field.TypeUUID},
 	}
 	// PlatformsTable holds the schema information for the "platforms" table.
@@ -58,8 +66,14 @@ var (
 				OnDelete:   schema.NoAction,
 			},
 			{
-				Symbol:     "platforms_organizations_organization",
+				Symbol:     "platforms_users_editor",
 				Columns:    []*schema.Column{PlatformsColumns[10]},
+				RefColumns: []*schema.Column{UsersColumns[0]},
+				OnDelete:   schema.NoAction,
+			},
+			{
+				Symbol:     "platforms_organizations_organization",
+				Columns:    []*schema.Column{PlatformsColumns[11]},
 				RefColumns: []*schema.Column{OrganizationsColumns[0]},
 				OnDelete:   schema.NoAction,
 			},
@@ -68,7 +82,7 @@ var (
 			{
 				Name:    "platform_org_id_name",
 				Unique:  true,
-				Columns: []*schema.Column{PlatformsColumns[10], PlatformsColumns[3]},
+				Columns: []*schema.Column{PlatformsColumns[11], PlatformsColumns[3]},
 			},
 		},
 	}
@@ -131,8 +145,10 @@ var (

 func init() {
 	OrganizationsTable.ForeignKeys[0].RefTable = UsersTable
+	OrganizationsTable.ForeignKeys[1].RefTable = UsersTable
 	PlatformsTable.ForeignKeys[0].RefTable = UsersTable
-	PlatformsTable.ForeignKeys[1].RefTable = OrganizationsTable
+	PlatformsTable.ForeignKeys[1].RefTable = UsersTable
+	PlatformsTable.ForeignKeys[2].RefTable = OrganizationsTable
 	OrganizationUsersTable.ForeignKeys[0].RefTable = OrganizationsTable
 	OrganizationUsersTable.ForeignKeys[1].RefTable = UsersTable
 }
--- a/internal/ent/mutation.go
+++ b/internal/ent/mutation.go
@@ -16,7 +16,7 @@ import (
 	"github.com/holos-run/holos/internal/ent/platform"
 	"github.com/holos-run/holos/internal/ent/predicate"
 	"github.com/holos-run/holos/internal/ent/user"
-	holos "github.com/holos-run/holos/service/gen/holos/v1alpha1"
+	storage "github.com/holos-run/holos/service/gen/holos/storage/v1alpha1"
 )

 const (
@@ -46,6 +46,8 @@ type OrganizationMutation struct {
 	clearedFields    map[string]struct{}
 	creator          *uuid.UUID
 	clearedcreator   bool
+	editor           *uuid.UUID
+	clearededitor    bool
 	users            map[uuid.UUID]struct{}
 	removedusers     map[uuid.UUID]struct{}
 	clearedusers     bool
@@ -233,6 +235,78 @@ func (m *OrganizationMutation) ResetUpdatedAt() {
 	m.updated_at = nil
 }

+// SetCreatedByID sets the "created_by_id" field.
+func (m *OrganizationMutation) SetCreatedByID(u uuid.UUID) {
+	m.creator = &u
+}
+
+// CreatedByID returns the value of the "created_by_id" field in the mutation.
+func (m *OrganizationMutation) CreatedByID() (r uuid.UUID, exists bool) {
+	v := m.creator
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldCreatedByID returns the old "created_by_id" field's value of the Organization entity.
+// If the Organization object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *OrganizationMutation) OldCreatedByID(ctx context.Context) (v uuid.UUID, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldCreatedByID is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldCreatedByID requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldCreatedByID: %w", err)
+	}
+	return oldValue.CreatedByID, nil
+}
+
+// ResetCreatedByID resets all changes to the "created_by_id" field.
+func (m *OrganizationMutation) ResetCreatedByID() {
+	m.creator = nil
+}
+
+// SetUpdatedByID sets the "updated_by_id" field.
+func (m *OrganizationMutation) SetUpdatedByID(u uuid.UUID) {
+	m.editor = &u
+}
+
+// UpdatedByID returns the value of the "updated_by_id" field in the mutation.
+func (m *OrganizationMutation) UpdatedByID() (r uuid.UUID, exists bool) {
+	v := m.editor
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldUpdatedByID returns the old "updated_by_id" field's value of the Organization entity.
+// If the Organization object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *OrganizationMutation) OldUpdatedByID(ctx context.Context) (v uuid.UUID, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldUpdatedByID is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldUpdatedByID requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldUpdatedByID: %w", err)
+	}
+	return oldValue.UpdatedByID, nil
+}
+
+// ResetUpdatedByID resets all changes to the "updated_by_id" field.
+func (m *OrganizationMutation) ResetUpdatedByID() {
+	m.editor = nil
+}
+
 // SetName sets the "name" field.
 func (m *OrganizationMutation) SetName(s string) {
 	m.name = &s
@@ -305,46 +379,15 @@ func (m *OrganizationMutation) ResetDisplayName() {
 	m.display_name = nil
 }

-// SetCreatorID sets the "creator_id" field.
-func (m *OrganizationMutation) SetCreatorID(u uuid.UUID) {
-	m.creator = &u
-}
-
-// CreatorID returns the value of the "creator_id" field in the mutation.
-func (m *OrganizationMutation) CreatorID() (r uuid.UUID, exists bool) {
-	v := m.creator
-	if v == nil {
-		return
-	}
-	return *v, true
-}
-
-// OldCreatorID returns the old "creator_id" field's value of the Organization entity.
-// If the Organization object wasn't provided to the builder, the object is fetched from the database.
-// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *OrganizationMutation) OldCreatorID(ctx context.Context) (v uuid.UUID, err error) {
-	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldCreatorID is only allowed on UpdateOne operations")
-	}
-	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldCreatorID requires an ID field in the mutation")
-	}
-	oldValue, err := m.oldValue(ctx)
-	if err != nil {
-		return v, fmt.Errorf("querying old value for OldCreatorID: %w", err)
-	}
-	return oldValue.CreatorID, nil
-}
-
-// ResetCreatorID resets all changes to the "creator_id" field.
-func (m *OrganizationMutation) ResetCreatorID() {
-	m.creator = nil
+// SetCreatorID sets the "creator" edge to the User entity by id.
+func (m *OrganizationMutation) SetCreatorID(id uuid.UUID) {
+	m.creator = &id
 }

 // ClearCreator clears the "creator" edge to the User entity.
 func (m *OrganizationMutation) ClearCreator() {
 	m.clearedcreator = true
-	m.clearedFields[organization.FieldCreatorID] = struct{}{}
+	m.clearedFields[organization.FieldCreatedByID] = struct{}{}
 }

 // CreatorCleared reports if the "creator" edge to the User entity was cleared.
@@ -352,6 +395,14 @@ func (m *OrganizationMutation) CreatorCleared() bool {
 	return m.clearedcreator
 }

+// CreatorID returns the "creator" edge ID in the mutation.
+func (m *OrganizationMutation) CreatorID() (id uuid.UUID, exists bool) {
+	if m.creator != nil {
+		return *m.creator, true
+	}
+	return
+}
+
 // CreatorIDs returns the "creator" edge IDs in the mutation.
 // Note that IDs always returns len(IDs) <= 1 for unique edges, and you should use
 // CreatorID instead. It exists only for internal usage by the builders.
@@ -368,6 +419,46 @@ func (m *OrganizationMutation) ResetCreator() {
 	m.clearedcreator = false
 }

+// SetEditorID sets the "editor" edge to the User entity by id.
+func (m *OrganizationMutation) SetEditorID(id uuid.UUID) {
+	m.editor = &id
+}
+
+// ClearEditor clears the "editor" edge to the User entity.
+func (m *OrganizationMutation) ClearEditor() {
+	m.clearededitor = true
+	m.clearedFields[organization.FieldUpdatedByID] = struct{}{}
+}
+
+// EditorCleared reports if the "editor" edge to the User entity was cleared.
+func (m *OrganizationMutation) EditorCleared() bool {
+	return m.clearededitor
+}
+
+// EditorID returns the "editor" edge ID in the mutation.
+func (m *OrganizationMutation) EditorID() (id uuid.UUID, exists bool) {
+	if m.editor != nil {
+		return *m.editor, true
+	}
+	return
+}
+
+// EditorIDs returns the "editor" edge IDs in the mutation.
+// Note that IDs always returns len(IDs) <= 1 for unique edges, and you should use
+// EditorID instead. It exists only for internal usage by the builders.
+func (m *OrganizationMutation) EditorIDs() (ids []uuid.UUID) {
+	if id := m.editor; id != nil {
+		ids = append(ids, *id)
+	}
+	return
+}
+
+// ResetEditor resets all changes to the "editor" edge.
+func (m *OrganizationMutation) ResetEditor() {
+	m.editor = nil
+	m.clearededitor = false
+}
+
 // AddUserIDs adds the "users" edge to the User entity by ids.
 func (m *OrganizationMutation) AddUserIDs(ids ...uuid.UUID) {
 	if m.users == nil {
@@ -510,22 +601,25 @@ func (m *OrganizationMutation) Type() string {
 // order to get all numeric fields that were incremented/decremented, call
 // AddedFields().
 func (m *OrganizationMutation) Fields() []string {
-	fields := make([]string, 0, 5)
+	fields := make([]string, 0, 6)
 	if m.created_at != nil {
 		fields = append(fields, organization.FieldCreatedAt)
 	}
 	if m.updated_at != nil {
 		fields = append(fields, organization.FieldUpdatedAt)
 	}
+	if m.creator != nil {
+		fields = append(fields, organization.FieldCreatedByID)
+	}
+	if m.editor != nil {
+		fields = append(fields, organization.FieldUpdatedByID)
+	}
 	if m.name != nil {
 		fields = append(fields, organization.FieldName)
 	}
 	if m.display_name != nil {
 		fields = append(fields, organization.FieldDisplayName)
 	}
-	if m.creator != nil {
-		fields = append(fields, organization.FieldCreatorID)
-	}
 	return fields
 }

@@ -538,12 +632,14 @@ func (m *OrganizationMutation) Field(name string) (ent.Value, bool) {
 		return m.CreatedAt()
 	case organization.FieldUpdatedAt:
 		return m.UpdatedAt()
+	case organization.FieldCreatedByID:
+		return m.CreatedByID()
+	case organization.FieldUpdatedByID:
+		return m.UpdatedByID()
 	case organization.FieldName:
 		return m.Name()
 	case organization.FieldDisplayName:
 		return m.DisplayName()
-	case organization.FieldCreatorID:
-		return m.CreatorID()
 	}
 	return nil, false
 }
@@ -557,12 +653,14 @@ func (m *OrganizationMutation) OldField(ctx context.Context, name string) (ent.V
 		return m.OldCreatedAt(ctx)
 	case organization.FieldUpdatedAt:
 		return m.OldUpdatedAt(ctx)
+	case organization.FieldCreatedByID:
+		return m.OldCreatedByID(ctx)
+	case organization.FieldUpdatedByID:
+		return m.OldUpdatedByID(ctx)
 	case organization.FieldName:
 		return m.OldName(ctx)
 	case organization.FieldDisplayName:
 		return m.OldDisplayName(ctx)
-	case organization.FieldCreatorID:
-		return m.OldCreatorID(ctx)
 	}
 	return nil, fmt.Errorf("unknown Organization field %s", name)
 }
@@ -586,6 +684,20 @@ func (m *OrganizationMutation) SetField(name string, value ent.Value) error {
 		}
 		m.SetUpdatedAt(v)
 		return nil
+	case organization.FieldCreatedByID:
+		v, ok := value.(uuid.UUID)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetCreatedByID(v)
+		return nil
+	case organization.FieldUpdatedByID:
+		v, ok := value.(uuid.UUID)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetUpdatedByID(v)
+		return nil
 	case organization.FieldName:
 		v, ok := value.(string)
 		if !ok {
@@ -600,13 +712,6 @@ func (m *OrganizationMutation) SetField(name string, value ent.Value) error {
 		}
 		m.SetDisplayName(v)
 		return nil
-	case organization.FieldCreatorID:
-		v, ok := value.(uuid.UUID)
-		if !ok {
-			return fmt.Errorf("unexpected type %T for field %s", value, name)
-		}
-		m.SetCreatorID(v)
-		return nil
 	}
 	return fmt.Errorf("unknown Organization field %s", name)
 }
@@ -662,25 +767,31 @@ func (m *OrganizationMutation) ResetField(name string) error {
 	case organization.FieldUpdatedAt:
 		m.ResetUpdatedAt()
 		return nil
+	case organization.FieldCreatedByID:
+		m.ResetCreatedByID()
+		return nil
+	case organization.FieldUpdatedByID:
+		m.ResetUpdatedByID()
+		return nil
 	case organization.FieldName:
 		m.ResetName()
 		return nil
 	case organization.FieldDisplayName:
 		m.ResetDisplayName()
 		return nil
-	case organization.FieldCreatorID:
-		m.ResetCreatorID()
-		return nil
 	}
 	return fmt.Errorf("unknown Organization field %s", name)
 }

 // AddedEdges returns all edge names that were set/added in this mutation.
 func (m *OrganizationMutation) AddedEdges() []string {
-	edges := make([]string, 0, 3)
+	edges := make([]string, 0, 4)
 	if m.creator != nil {
 		edges = append(edges, organization.EdgeCreator)
 	}
+	if m.editor != nil {
+		edges = append(edges, organization.EdgeEditor)
+	}
 	if m.users != nil {
 		edges = append(edges, organization.EdgeUsers)
 	}
@@ -698,6 +809,10 @@ func (m *OrganizationMutation) AddedIDs(name string) []ent.Value {
 		if id := m.creator; id != nil {
 			return []ent.Value{*id}
 		}
+	case organization.EdgeEditor:
+		if id := m.editor; id != nil {
+			return []ent.Value{*id}
+		}
 	case organization.EdgeUsers:
 		ids := make([]ent.Value, 0, len(m.users))
 		for id := range m.users {
@@ -716,7 +831,7 @@ func (m *OrganizationMutation) AddedIDs(name string) []ent.Value {

 // RemovedEdges returns all edge names that were removed in this mutation.
 func (m *OrganizationMutation) RemovedEdges() []string {
-	edges := make([]string, 0, 3)
+	edges := make([]string, 0, 4)
 	if m.removedusers != nil {
 		edges = append(edges, organization.EdgeUsers)
 	}
@@ -748,10 +863,13 @@ func (m *OrganizationMutation) RemovedIDs(name string) []ent.Value {

 // ClearedEdges returns all edge names that were cleared in this mutation.
 func (m *OrganizationMutation) ClearedEdges() []string {
-	edges := make([]string, 0, 3)
+	edges := make([]string, 0, 4)
 	if m.clearedcreator {
 		edges = append(edges, organization.EdgeCreator)
 	}
+	if m.clearededitor {
+		edges = append(edges, organization.EdgeEditor)
+	}
 	if m.clearedusers {
 		edges = append(edges, organization.EdgeUsers)
 	}
@@ -767,6 +885,8 @@ func (m *OrganizationMutation) EdgeCleared(name string) bool {
 	switch name {
 	case organization.EdgeCreator:
 		return m.clearedcreator
+	case organization.EdgeEditor:
+		return m.clearededitor
 	case organization.EdgeUsers:
 		return m.clearedusers
 	case organization.EdgePlatforms:
@@ -782,6 +902,9 @@ func (m *OrganizationMutation) ClearEdge(name string) error {
 	case organization.EdgeCreator:
 		m.ClearCreator()
 		return nil
+	case organization.EdgeEditor:
+		m.ClearEditor()
+		return nil
 	}
 	return fmt.Errorf("unknown Organization unique edge %s", name)
 }
@@ -793,6 +916,9 @@ func (m *OrganizationMutation) ResetEdge(name string) error {
 	case organization.EdgeCreator:
 		m.ResetCreator()
 		return nil
+	case organization.EdgeEditor:
+		m.ResetEditor()
+		return nil
 	case organization.EdgeUsers:
 		m.ResetUsers()
 		return nil
@@ -813,13 +939,15 @@ type PlatformMutation struct {
 	updated_at          *time.Time
 	name                *string
 	display_name        *string
-	form                **holos.Form
-	model               **holos.Model
+	form                **storage.Form
+	model               **storage.Model
 	cue                 *[]byte
 	cue_definition      *string
 	clearedFields       map[string]struct{}
 	creator             *uuid.UUID
 	clearedcreator      bool
+	editor              *uuid.UUID
+	clearededitor       bool
 	organization        *uuid.UUID
 	clearedorganization bool
 	done                bool
@@ -1003,6 +1131,78 @@ func (m *PlatformMutation) ResetUpdatedAt() {
 	m.updated_at = nil
 }

+// SetCreatedByID sets the "created_by_id" field.
+func (m *PlatformMutation) SetCreatedByID(u uuid.UUID) {
+	m.creator = &u
+}
+
+// CreatedByID returns the value of the "created_by_id" field in the mutation.
+func (m *PlatformMutation) CreatedByID() (r uuid.UUID, exists bool) {
+	v := m.creator
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldCreatedByID returns the old "created_by_id" field's value of the Platform entity.
+// If the Platform object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *PlatformMutation) OldCreatedByID(ctx context.Context) (v uuid.UUID, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldCreatedByID is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldCreatedByID requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldCreatedByID: %w", err)
+	}
+	return oldValue.CreatedByID, nil
+}
+
+// ResetCreatedByID resets all changes to the "created_by_id" field.
+func (m *PlatformMutation) ResetCreatedByID() {
+	m.creator = nil
+}
+
+// SetUpdatedByID sets the "updated_by_id" field.
+func (m *PlatformMutation) SetUpdatedByID(u uuid.UUID) {
+	m.editor = &u
+}
+
+// UpdatedByID returns the value of the "updated_by_id" field in the mutation.
+func (m *PlatformMutation) UpdatedByID() (r uuid.UUID, exists bool) {
+	v := m.editor
+	if v == nil {
+		return
+	}
+	return *v, true
+}
+
+// OldUpdatedByID returns the old "updated_by_id" field's value of the Platform entity.
+// If the Platform object wasn't provided to the builder, the object is fetched from the database.
+// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
+func (m *PlatformMutation) OldUpdatedByID(ctx context.Context) (v uuid.UUID, err error) {
+	if !m.op.Is(OpUpdateOne) {
+		return v, errors.New("OldUpdatedByID is only allowed on UpdateOne operations")
+	}
+	if m.id == nil || m.oldValue == nil {
+		return v, errors.New("OldUpdatedByID requires an ID field in the mutation")
+	}
+	oldValue, err := m.oldValue(ctx)
+	if err != nil {
+		return v, fmt.Errorf("querying old value for OldUpdatedByID: %w", err)
+	}
+	return oldValue.UpdatedByID, nil
+}
+
+// ResetUpdatedByID resets all changes to the "updated_by_id" field.
+func (m *PlatformMutation) ResetUpdatedByID() {
+	m.editor = nil
+}
+
 // SetOrgID sets the "org_id" field.
 func (m *PlatformMutation) SetOrgID(u uuid.UUID) {
 	m.organization = &u
@@ -1111,49 +1311,13 @@ func (m *PlatformMutation) ResetDisplayName() {
 	m.display_name = nil
 }

-// SetCreatorID sets the "creator_id" field.
-func (m *PlatformMutation) SetCreatorID(u uuid.UUID) {
-	m.creator = &u
-}
-
-// CreatorID returns the value of the "creator_id" field in the mutation.
-func (m *PlatformMutation) CreatorID() (r uuid.UUID, exists bool) {
-	v := m.creator
-	if v == nil {
-		return
-	}
-	return *v, true
-}
-
-// OldCreatorID returns the old "creator_id" field's value of the Platform entity.
-// If the Platform object wasn't provided to the builder, the object is fetched from the database.
-// An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *PlatformMutation) OldCreatorID(ctx context.Context) (v uuid.UUID, err error) {
-	if !m.op.Is(OpUpdateOne) {
-		return v, errors.New("OldCreatorID is only allowed on UpdateOne operations")
-	}
-	if m.id == nil || m.oldValue == nil {
-		return v, errors.New("OldCreatorID requires an ID field in the mutation")
-	}
-	oldValue, err := m.oldValue(ctx)
-	if err != nil {
-		return v, fmt.Errorf("querying old value for OldCreatorID: %w", err)
-	}
-	return oldValue.CreatorID, nil
-}
-
-// ResetCreatorID resets all changes to the "creator_id" field.
-func (m *PlatformMutation) ResetCreatorID() {
-	m.creator = nil
-}
-
 // SetForm sets the "form" field.
-func (m *PlatformMutation) SetForm(h *holos.Form) {
-	m.form = &h
+func (m *PlatformMutation) SetForm(s *storage.Form) {
+	m.form = &s
 }

 // Form returns the value of the "form" field in the mutation.
-func (m *PlatformMutation) Form() (r *holos.Form, exists bool) {
+func (m *PlatformMutation) Form() (r *storage.Form, exists bool) {
 	v := m.form
 	if v == nil {
 		return
@@ -1164,7 +1328,7 @@ func (m *PlatformMutation) Form() (r *holos.Form, exists bool) {
 // OldForm returns the old "form" field's value of the Platform entity.
 // If the Platform object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *PlatformMutation) OldForm(ctx context.Context) (v *holos.Form, err error) {
+func (m *PlatformMutation) OldForm(ctx context.Context) (v *storage.Form, err error) {
 	if !m.op.Is(OpUpdateOne) {
 		return v, errors.New("OldForm is only allowed on UpdateOne operations")
 	}
@@ -1197,12 +1361,12 @@ func (m *PlatformMutation) ResetForm() {
 }

 // SetModel sets the "model" field.
-func (m *PlatformMutation) SetModel(h *holos.Model) {
-	m.model = &h
+func (m *PlatformMutation) SetModel(s *storage.Model) {
+	m.model = &s
 }

 // Model returns the value of the "model" field in the mutation.
-func (m *PlatformMutation) Model() (r *holos.Model, exists bool) {
+func (m *PlatformMutation) Model() (r *storage.Model, exists bool) {
 	v := m.model
 	if v == nil {
 		return
@@ -1213,7 +1377,7 @@ func (m *PlatformMutation) Model() (r *holos.Model, exists bool) {
 // OldModel returns the old "model" field's value of the Platform entity.
 // If the Platform object wasn't provided to the builder, the object is fetched from the database.
 // An error is returned if the mutation operation is not UpdateOne, or the database query fails.
-func (m *PlatformMutation) OldModel(ctx context.Context) (v *holos.Model, err error) {
+func (m *PlatformMutation) OldModel(ctx context.Context) (v *storage.Model, err error) {
 	if !m.op.Is(OpUpdateOne) {
 		return v, errors.New("OldModel is only allowed on UpdateOne operations")
 	}
@@ -1343,10 +1507,15 @@ func (m *PlatformMutation) ResetCueDefinition() {
 	delete(m.clearedFields, platform.FieldCueDefinition)
 }

+// SetCreatorID sets the "creator" edge to the User entity by id.
+func (m *PlatformMutation) SetCreatorID(id uuid.UUID) {
+	m.creator = &id
+}
+
 // ClearCreator clears the "creator" edge to the User entity.
 func (m *PlatformMutation) ClearCreator() {
 	m.clearedcreator = true
-	m.clearedFields[platform.FieldCreatorID] = struct{}{}
+	m.clearedFields[platform.FieldCreatedByID] = struct{}{}
 }

 // CreatorCleared reports if the "creator" edge to the User entity was cleared.
@@ -1354,6 +1523,14 @@ func (m *PlatformMutation) CreatorCleared() bool {
 	return m.clearedcreator
 }

+// CreatorID returns the "creator" edge ID in the mutation.
+func (m *PlatformMutation) CreatorID() (id uuid.UUID, exists bool) {
+	if m.creator != nil {
+		return *m.creator, true
+	}
+	return
+}
+
 // CreatorIDs returns the "creator" edge IDs in the mutation.
 // Note that IDs always returns len(IDs) <= 1 for unique edges, and you should use
 // CreatorID instead. It exists only for internal usage by the builders.
@@ -1370,6 +1547,46 @@ func (m *PlatformMutation) ResetCreator() {
 	m.clearedcreator = false
 }

+// SetEditorID sets the "editor" edge to the User entity by id.
+func (m *PlatformMutation) SetEditorID(id uuid.UUID) {
+	m.editor = &id
+}
+
+// ClearEditor clears the "editor" edge to the User entity.
+func (m *PlatformMutation) ClearEditor() {
+	m.clearededitor = true
+	m.clearedFields[platform.FieldUpdatedByID] = struct{}{}
+}
+
+// EditorCleared reports if the "editor" edge to the User entity was cleared.
+func (m *PlatformMutation) EditorCleared() bool {
+	return m.clearededitor
+}
+
+// EditorID returns the "editor" edge ID in the mutation.
+func (m *PlatformMutation) EditorID() (id uuid.UUID, exists bool) {
+	if m.editor != nil {
+		return *m.editor, true
+	}
+	return
+}
+
+// EditorIDs returns the "editor" edge IDs in the mutation.
+// Note that IDs always returns len(IDs) <= 1 for unique edges, and you should use
+// EditorID instead. It exists only for internal usage by the builders.
+func (m *PlatformMutation) EditorIDs() (ids []uuid.UUID) {
+	if id := m.editor; id != nil {
+		ids = append(ids, *id)
+	}
+	return
+}
+
+// ResetEditor resets all changes to the "editor" edge.
+func (m *PlatformMutation) ResetEditor() {
+	m.editor = nil
+	m.clearededitor = false
+}
+
 // SetOrganizationID sets the "organization" edge to the Organization entity by id.
 func (m *PlatformMutation) SetOrganizationID(id uuid.UUID) {
 	m.organization = &id
@@ -1444,13 +1661,19 @@ func (m *PlatformMutation) Type() string {
 // order to get all numeric fields that were incremented/decremented, call
 // AddedFields().
 func (m *PlatformMutation) Fields() []string {
-	fields := make([]string, 0, 10)
+	fields := make([]string, 0, 11)
 	if m.created_at != nil {
 		fields = append(fields, platform.FieldCreatedAt)
 	}
 	if m.updated_at != nil {
 		fields = append(fields, platform.FieldUpdatedAt)
 	}
+	if m.creator != nil {
+		fields = append(fields, platform.FieldCreatedByID)
+	}
+	if m.editor != nil {
+		fields = append(fields, platform.FieldUpdatedByID)
+	}
 	if m.organization != nil {
 		fields = append(fields, platform.FieldOrgID)
 	}
@@ -1460,9 +1683,6 @@ func (m *PlatformMutation) Fields() []string {
 	if m.display_name != nil {
 		fields = append(fields, platform.FieldDisplayName)
 	}
-	if m.creator != nil {
-		fields = append(fields, platform.FieldCreatorID)
-	}
 	if m.form != nil {
 		fields = append(fields, platform.FieldForm)
 	}
@@ -1487,14 +1707,16 @@ func (m *PlatformMutation) Field(name string) (ent.Value, bool) {
 		return m.CreatedAt()
 	case platform.FieldUpdatedAt:
 		return m.UpdatedAt()
+	case platform.FieldCreatedByID:
+		return m.CreatedByID()
+	case platform.FieldUpdatedByID:
+		return m.UpdatedByID()
 	case platform.FieldOrgID:
 		return m.OrgID()
 	case platform.FieldName:
 		return m.Name()
 	case platform.FieldDisplayName:
 		return m.DisplayName()
-	case platform.FieldCreatorID:
-		return m.CreatorID()
 	case platform.FieldForm:
 		return m.Form()
 	case platform.FieldModel:
@@ -1516,14 +1738,16 @@ func (m *PlatformMutation) OldField(ctx context.Context, name string) (ent.Value
 		return m.OldCreatedAt(ctx)
 	case platform.FieldUpdatedAt:
 		return m.OldUpdatedAt(ctx)
+	case platform.FieldCreatedByID:
+		return m.OldCreatedByID(ctx)
+	case platform.FieldUpdatedByID:
+		return m.OldUpdatedByID(ctx)
 	case platform.FieldOrgID:
 		return m.OldOrgID(ctx)
 	case platform.FieldName:
 		return m.OldName(ctx)
 	case platform.FieldDisplayName:
 		return m.OldDisplayName(ctx)
-	case platform.FieldCreatorID:
-		return m.OldCreatorID(ctx)
 	case platform.FieldForm:
 		return m.OldForm(ctx)
 	case platform.FieldModel:
@@ -1555,6 +1779,20 @@ func (m *PlatformMutation) SetField(name string, value ent.Value) error {
 		}
 		m.SetUpdatedAt(v)
 		return nil
+	case platform.FieldCreatedByID:
+		v, ok := value.(uuid.UUID)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetCreatedByID(v)
+		return nil
+	case platform.FieldUpdatedByID:
+		v, ok := value.(uuid.UUID)
+		if !ok {
+			return fmt.Errorf("unexpected type %T for field %s", value, name)
+		}
+		m.SetUpdatedByID(v)
+		return nil
 	case platform.FieldOrgID:
 		v, ok := value.(uuid.UUID)
 		if !ok {
@@ -1576,22 +1814,15 @@ func (m *PlatformMutation) SetField(name string, value ent.Value) error {
 		}
 		m.SetDisplayName(v)
 		return nil
-	case platform.FieldCreatorID:
-		v, ok := value.(uuid.UUID)
-		if !ok {
-			return fmt.Errorf("unexpected type %T for field %s", value, name)
-		}
-		m.SetCreatorID(v)
-		return nil
 	case platform.FieldForm:
-		v, ok := value.(*holos.Form)
+		v, ok := value.(*storage.Form)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
 		m.SetForm(v)
 		return nil
 	case platform.FieldModel:
-		v, ok := value.(*holos.Model)
+		v, ok := value.(*storage.Model)
 		if !ok {
 			return fmt.Errorf("unexpected type %T for field %s", value, name)
 		}
@@ -1693,6 +1924,12 @@ func (m *PlatformMutation) ResetField(name string) error {
 	case platform.FieldUpdatedAt:
 		m.ResetUpdatedAt()
 		return nil
+	case platform.FieldCreatedByID:
+		m.ResetCreatedByID()
+		return nil
+	case platform.FieldUpdatedByID:
+		m.ResetUpdatedByID()
+		return nil
 	case platform.FieldOrgID:
 		m.ResetOrgID()
 		return nil
@@ -1702,9 +1939,6 @@ func (m *PlatformMutation) ResetField(name string) error {
 	case platform.FieldDisplayName:
 		m.ResetDisplayName()
 		return nil
-	case platform.FieldCreatorID:
-		m.ResetCreatorID()
-		return nil
 	case platform.FieldForm:
 		m.ResetForm()
 		return nil
@@ -1723,10 +1957,13 @@ func (m *PlatformMutation) ResetField(name string) error {

 // AddedEdges returns all edge names that were set/added in this mutation.
 func (m *PlatformMutation) AddedEdges() []string {
-	edges := make([]string, 0, 2)
+	edges := make([]string, 0, 3)
 	if m.creator != nil {
 		edges = append(edges, platform.EdgeCreator)
 	}
+	if m.editor != nil {
+		edges = append(edges, platform.EdgeEditor)
+	}
 	if m.organization != nil {
 		edges = append(edges, platform.EdgeOrganization)
 	}
@@ -1741,6 +1978,10 @@ func (m *PlatformMutation) AddedIDs(name string) []ent.Value {
 		if id := m.creator; id != nil {
 			return []ent.Value{*id}
 		}
+	case platform.EdgeEditor:
+		if id := m.editor; id != nil {
+			return []ent.Value{*id}
+		}
 	case platform.EdgeOrganization:
 		if id := m.organization; id != nil {
 			return []ent.Value{*id}
@@ -1751,7 +1992,7 @@ func (m *PlatformMutation) AddedIDs(name string) []ent.Value {

 // RemovedEdges returns all edge names that were removed in this mutation.
 func (m *PlatformMutation) RemovedEdges() []string {
-	edges := make([]string, 0, 2)
+	edges := make([]string, 0, 3)
 	return edges
 }

@@ -1763,10 +2004,13 @@ func (m *PlatformMutation) RemovedIDs(name string) []ent.Value {

 // ClearedEdges returns all edge names that were cleared in this mutation.
 func (m *PlatformMutation) ClearedEdges() []string {
-	edges := make([]string, 0, 2)
+	edges := make([]string, 0, 3)
 	if m.clearedcreator {
 		edges = append(edges, platform.EdgeCreator)
 	}
+	if m.clearededitor {
+		edges = append(edges, platform.EdgeEditor)
+	}
 	if m.clearedorganization {
 		edges = append(edges, platform.EdgeOrganization)
 	}
@@ -1779,6 +2023,8 @@ func (m *PlatformMutation) EdgeCleared(name string) bool {
 	switch name {
 	case platform.EdgeCreator:
 		return m.clearedcreator
+	case platform.EdgeEditor:
+		return m.clearededitor
 	case platform.EdgeOrganization:
 		return m.clearedorganization
 	}
@@ -1792,6 +2038,9 @@ func (m *PlatformMutation) ClearEdge(name string) error {
 	case platform.EdgeCreator:
 		m.ClearCreator()
 		return nil
+	case platform.EdgeEditor:
+		m.ClearEditor()
+		return nil
 	case platform.EdgeOrganization:
 		m.ClearOrganization()
 		return nil
@@ -1806,6 +2055,9 @@ func (m *PlatformMutation) ResetEdge(name string) error {
 	case platform.EdgeCreator:
 		m.ResetCreator()
 		return nil
+	case platform.EdgeEditor:
+		m.ResetEditor()
+		return nil
 	case platform.EdgeOrganization:
 		m.ResetOrganization()
 		return nil
--- a/internal/ent/organization.go
+++ b/internal/ent/organization.go
@@ -23,12 +23,14 @@ type Organization struct {
 	CreatedAt time.Time `json:"created_at,omitempty"`
 	// UpdatedAt holds the value of the "updated_at" field.
 	UpdatedAt time.Time `json:"updated_at,omitempty"`
+	// CreatedByID holds the value of the "created_by_id" field.
+	CreatedByID uuid.UUID `json:"created_by_id,omitempty"`
+	// UpdatedByID holds the value of the "updated_by_id" field.
+	UpdatedByID uuid.UUID `json:"updated_by_id,omitempty"`
 	// Name holds the value of the "name" field.
 	Name string `json:"name,omitempty"`
 	// DisplayName holds the value of the "display_name" field.
 	DisplayName string `json:"display_name,omitempty"`
-	// CreatorID holds the value of the "creator_id" field.
-	CreatorID uuid.UUID `json:"creator_id,omitempty"`
 	// Edges holds the relations/edges for other nodes in the graph.
 	// The values are being populated by the OrganizationQuery when eager-loading is set.
 	Edges        OrganizationEdges `json:"edges"`
@@ -39,13 +41,15 @@ type Organization struct {
 type OrganizationEdges struct {
 	// Creator holds the value of the creator edge.
 	Creator *User `json:"creator,omitempty"`
+	// Editor holds the value of the editor edge.
+	Editor *User `json:"editor,omitempty"`
 	// Users holds the value of the users edge.
 	Users []*User `json:"users,omitempty"`
 	// Platforms holds the value of the platforms edge.
 	Platforms []*Platform `json:"platforms,omitempty"`
 	// loadedTypes holds the information for reporting if a
 	// type was loaded (or requested) in eager-loading or not.
-	loadedTypes [3]bool
+	loadedTypes [4]bool
 }

 // CreatorOrErr returns the Creator value or an error if the edge
@@ -59,10 +63,21 @@ func (e OrganizationEdges) CreatorOrErr() (*User, error) {
 	return nil, &NotLoadedError{edge: "creator"}
 }

+// EditorOrErr returns the Editor value or an error if the edge
+// was not loaded in eager-loading, or loaded but was not found.
+func (e OrganizationEdges) EditorOrErr() (*User, error) {
+	if e.Editor != nil {
+		return e.Editor, nil
+	} else if e.loadedTypes[1] {
+		return nil, &NotFoundError{label: user.Label}
+	}
+	return nil, &NotLoadedError{edge: "editor"}
+}
+
 // UsersOrErr returns the Users value or an error if the edge
 // was not loaded in eager-loading.
 func (e OrganizationEdges) UsersOrErr() ([]*User, error) {
-	if e.loadedTypes[1] {
+	if e.loadedTypes[2] {
 		return e.Users, nil
 	}
 	return nil, &NotLoadedError{edge: "users"}
@@ -71,7 +86,7 @@ func (e OrganizationEdges) UsersOrErr() ([]*User, error) {
 // PlatformsOrErr returns the Platforms value or an error if the edge
 // was not loaded in eager-loading.
 func (e OrganizationEdges) PlatformsOrErr() ([]*Platform, error) {
-	if e.loadedTypes[2] {
+	if e.loadedTypes[3] {
 		return e.Platforms, nil
 	}
 	return nil, &NotLoadedError{edge: "platforms"}
@@ -86,7 +101,7 @@ func (*Organization) scanValues(columns []string) ([]any, error) {
 			values[i] = new(sql.NullString)
 		case organization.FieldCreatedAt, organization.FieldUpdatedAt:
 			values[i] = new(sql.NullTime)
-		case organization.FieldID, organization.FieldCreatorID:
+		case organization.FieldID, organization.FieldCreatedByID, organization.FieldUpdatedByID:
 			values[i] = new(uuid.UUID)
 		default:
 			values[i] = new(sql.UnknownType)
@@ -121,6 +136,18 @@ func (o *Organization) assignValues(columns []string, values []any) error {
 			} else if value.Valid {
 				o.UpdatedAt = value.Time
 			}
+		case organization.FieldCreatedByID:
+			if value, ok := values[i].(*uuid.UUID); !ok {
+				return fmt.Errorf("unexpected type %T for field created_by_id", values[i])
+			} else if value != nil {
+				o.CreatedByID = *value
+			}
+		case organization.FieldUpdatedByID:
+			if value, ok := values[i].(*uuid.UUID); !ok {
+				return fmt.Errorf("unexpected type %T for field updated_by_id", values[i])
+			} else if value != nil {
+				o.UpdatedByID = *value
+			}
 		case organization.FieldName:
 			if value, ok := values[i].(*sql.NullString); !ok {
 				return fmt.Errorf("unexpected type %T for field name", values[i])
@@ -133,12 +160,6 @@ func (o *Organization) assignValues(columns []string, values []any) error {
 			} else if value.Valid {
 				o.DisplayName = value.String
 			}
-		case organization.FieldCreatorID:
-			if value, ok := values[i].(*uuid.UUID); !ok {
-				return fmt.Errorf("unexpected type %T for field creator_id", values[i])
-			} else if value != nil {
-				o.CreatorID = *value
-			}
 		default:
 			o.selectValues.Set(columns[i], values[i])
 		}
@@ -157,6 +178,11 @@ func (o *Organization) QueryCreator() *UserQuery {
 	return NewOrganizationClient(o.config).QueryCreator(o)
 }

+// QueryEditor queries the "editor" edge of the Organization entity.
+func (o *Organization) QueryEditor() *UserQuery {
+	return NewOrganizationClient(o.config).QueryEditor(o)
+}
+
 // QueryUsers queries the "users" edge of the Organization entity.
 func (o *Organization) QueryUsers() *UserQuery {
 	return NewOrganizationClient(o.config).QueryUsers(o)
@@ -196,14 +222,17 @@ func (o *Organization) String() string {
 	builder.WriteString("updated_at=")
 	builder.WriteString(o.UpdatedAt.Format(time.ANSIC))
 	builder.WriteString(", ")
+	builder.WriteString("created_by_id=")
+	builder.WriteString(fmt.Sprintf("%v", o.CreatedByID))
+	builder.WriteString(", ")
+	builder.WriteString("updated_by_id=")
+	builder.WriteString(fmt.Sprintf("%v", o.UpdatedByID))
+	builder.WriteString(", ")
 	builder.WriteString("name=")
 	builder.WriteString(o.Name)
 	builder.WriteString(", ")
 	builder.WriteString("display_name=")
 	builder.WriteString(o.DisplayName)
-	builder.WriteString(", ")
-	builder.WriteString("creator_id=")
-	builder.WriteString(fmt.Sprintf("%v", o.CreatorID))
 	builder.WriteByte(')')
 	return builder.String()
 }
--- a/internal/ent/organization/organization.go
+++ b/internal/ent/organization/organization.go
@@ -19,14 +19,18 @@ const (
 	FieldCreatedAt = "created_at"
 	// FieldUpdatedAt holds the string denoting the updated_at field in the database.
 	FieldUpdatedAt = "updated_at"
+	// FieldCreatedByID holds the string denoting the created_by_id field in the database.
+	FieldCreatedByID = "created_by_id"
+	// FieldUpdatedByID holds the string denoting the updated_by_id field in the database.
+	FieldUpdatedByID = "updated_by_id"
 	// FieldName holds the string denoting the name field in the database.
 	FieldName = "name"
 	// FieldDisplayName holds the string denoting the display_name field in the database.
 	FieldDisplayName = "display_name"
-	// FieldCreatorID holds the string denoting the creator_id field in the database.
-	FieldCreatorID = "creator_id"
 	// EdgeCreator holds the string denoting the creator edge name in mutations.
 	EdgeCreator = "creator"
+	// EdgeEditor holds the string denoting the editor edge name in mutations.
+	EdgeEditor = "editor"
 	// EdgeUsers holds the string denoting the users edge name in mutations.
 	EdgeUsers = "users"
 	// EdgePlatforms holds the string denoting the platforms edge name in mutations.
@@ -39,7 +43,14 @@ const (
 	// It exists in this package in order to avoid circular dependency with the "user" package.
 	CreatorInverseTable = "users"
 	// CreatorColumn is the table column denoting the creator relation/edge.
-	CreatorColumn = "creator_id"
+	CreatorColumn = "created_by_id"
+	// EditorTable is the table that holds the editor relation/edge.
+	EditorTable = "organizations"
+	// EditorInverseTable is the table name for the User entity.
+	// It exists in this package in order to avoid circular dependency with the "user" package.
+	EditorInverseTable = "users"
+	// EditorColumn is the table column denoting the editor relation/edge.
+	EditorColumn = "updated_by_id"
 	// UsersTable is the table that holds the users relation/edge. The primary key declared below.
 	UsersTable = "organization_users"
 	// UsersInverseTable is the table name for the User entity.
@@ -59,9 +70,10 @@ var Columns = []string{
 	FieldID,
 	FieldCreatedAt,
 	FieldUpdatedAt,
+	FieldCreatedByID,
+	FieldUpdatedByID,
 	FieldName,
 	FieldDisplayName,
-	FieldCreatorID,
 }

 var (
@@ -111,6 +123,16 @@ func ByUpdatedAt(opts ...sql.OrderTermOption) OrderOption {
 	return sql.OrderByField(FieldUpdatedAt, opts...).ToFunc()
 }

+// ByCreatedByID orders the results by the created_by_id field.
+func ByCreatedByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldCreatedByID, opts...).ToFunc()
+}
+
+// ByUpdatedByID orders the results by the updated_by_id field.
+func ByUpdatedByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldUpdatedByID, opts...).ToFunc()
+}
+
 // ByName orders the results by the name field.
 func ByName(opts ...sql.OrderTermOption) OrderOption {
 	return sql.OrderByField(FieldName, opts...).ToFunc()
@@ -121,11 +143,6 @@ func ByDisplayName(opts ...sql.OrderTermOption) OrderOption {
 	return sql.OrderByField(FieldDisplayName, opts...).ToFunc()
 }

-// ByCreatorID orders the results by the creator_id field.
-func ByCreatorID(opts ...sql.OrderTermOption) OrderOption {
-	return sql.OrderByField(FieldCreatorID, opts...).ToFunc()
-}
-
 // ByCreatorField orders the results by creator field.
 func ByCreatorField(field string, opts ...sql.OrderTermOption) OrderOption {
 	return func(s *sql.Selector) {
@@ -133,6 +150,13 @@ func ByCreatorField(field string, opts ...sql.OrderTermOption) OrderOption {
 	}
 }

+// ByEditorField orders the results by editor field.
+func ByEditorField(field string, opts ...sql.OrderTermOption) OrderOption {
+	return func(s *sql.Selector) {
+		sqlgraph.OrderByNeighborTerms(s, newEditorStep(), sql.OrderByField(field, opts...))
+	}
+}
+
 // ByUsersCount orders the results by users count.
 func ByUsersCount(opts ...sql.OrderTermOption) OrderOption {
 	return func(s *sql.Selector) {
@@ -167,6 +191,13 @@ func newCreatorStep() *sqlgraph.Step {
 		sqlgraph.Edge(sqlgraph.M2O, false, CreatorTable, CreatorColumn),
 	)
 }
+func newEditorStep() *sqlgraph.Step {
+	return sqlgraph.NewStep(
+		sqlgraph.From(Table, FieldID),
+		sqlgraph.To(EditorInverseTable, FieldID),
+		sqlgraph.Edge(sqlgraph.M2O, false, EditorTable, EditorColumn),
+	)
+}
 func newUsersStep() *sqlgraph.Step {
 	return sqlgraph.NewStep(
 		sqlgraph.From(Table, FieldID),
--- a/internal/ent/organization/where.go
+++ b/internal/ent/organization/where.go
@@ -66,6 +66,16 @@ func UpdatedAt(v time.Time) predicate.Organization {
 	return predicate.Organization(sql.FieldEQ(FieldUpdatedAt, v))
 }

+// CreatedByID applies equality check predicate on the "created_by_id" field. It's identical to CreatedByIDEQ.
+func CreatedByID(v uuid.UUID) predicate.Organization {
+	return predicate.Organization(sql.FieldEQ(FieldCreatedByID, v))
+}
+
+// UpdatedByID applies equality check predicate on the "updated_by_id" field. It's identical to UpdatedByIDEQ.
+func UpdatedByID(v uuid.UUID) predicate.Organization {
+	return predicate.Organization(sql.FieldEQ(FieldUpdatedByID, v))
+}
+
 // Name applies equality check predicate on the "name" field. It's identical to NameEQ.
 func Name(v string) predicate.Organization {
 	return predicate.Organization(sql.FieldEQ(FieldName, v))
@@ -76,11 +86,6 @@ func DisplayName(v string) predicate.Organization {
 	return predicate.Organization(sql.FieldEQ(FieldDisplayName, v))
 }

-// CreatorID applies equality check predicate on the "creator_id" field. It's identical to CreatorIDEQ.
-func CreatorID(v uuid.UUID) predicate.Organization {
-	return predicate.Organization(sql.FieldEQ(FieldCreatorID, v))
-}
-
 // CreatedAtEQ applies the EQ predicate on the "created_at" field.
 func CreatedAtEQ(v time.Time) predicate.Organization {
 	return predicate.Organization(sql.FieldEQ(FieldCreatedAt, v))
@@ -161,6 +166,46 @@ func UpdatedAtLTE(v time.Time) predicate.Organization {
 	return predicate.Organization(sql.FieldLTE(FieldUpdatedAt, v))
 }

+// CreatedByIDEQ applies the EQ predicate on the "created_by_id" field.
+func CreatedByIDEQ(v uuid.UUID) predicate.Organization {
+	return predicate.Organization(sql.FieldEQ(FieldCreatedByID, v))
+}
+
+// CreatedByIDNEQ applies the NEQ predicate on the "created_by_id" field.
+func CreatedByIDNEQ(v uuid.UUID) predicate.Organization {
+	return predicate.Organization(sql.FieldNEQ(FieldCreatedByID, v))
+}
+
+// CreatedByIDIn applies the In predicate on the "created_by_id" field.
+func CreatedByIDIn(vs ...uuid.UUID) predicate.Organization {
+	return predicate.Organization(sql.FieldIn(FieldCreatedByID, vs...))
+}
+
+// CreatedByIDNotIn applies the NotIn predicate on the "created_by_id" field.
+func CreatedByIDNotIn(vs ...uuid.UUID) predicate.Organization {
+	return predicate.Organization(sql.FieldNotIn(FieldCreatedByID, vs...))
+}
+
+// UpdatedByIDEQ applies the EQ predicate on the "updated_by_id" field.
+func UpdatedByIDEQ(v uuid.UUID) predicate.Organization {
+	return predicate.Organization(sql.FieldEQ(FieldUpdatedByID, v))
+}
+
+// UpdatedByIDNEQ applies the NEQ predicate on the "updated_by_id" field.
+func UpdatedByIDNEQ(v uuid.UUID) predicate.Organization {
+	return predicate.Organization(sql.FieldNEQ(FieldUpdatedByID, v))
+}
+
+// UpdatedByIDIn applies the In predicate on the "updated_by_id" field.
+func UpdatedByIDIn(vs ...uuid.UUID) predicate.Organization {
+	return predicate.Organization(sql.FieldIn(FieldUpdatedByID, vs...))
+}
+
+// UpdatedByIDNotIn applies the NotIn predicate on the "updated_by_id" field.
+func UpdatedByIDNotIn(vs ...uuid.UUID) predicate.Organization {
+	return predicate.Organization(sql.FieldNotIn(FieldUpdatedByID, vs...))
+}
+
 // NameEQ applies the EQ predicate on the "name" field.
 func NameEQ(v string) predicate.Organization {
 	return predicate.Organization(sql.FieldEQ(FieldName, v))
@@ -291,26 +336,6 @@ func DisplayNameContainsFold(v string) predicate.Organization {
 	return predicate.Organization(sql.FieldContainsFold(FieldDisplayName, v))
 }

-// CreatorIDEQ applies the EQ predicate on the "creator_id" field.
-func CreatorIDEQ(v uuid.UUID) predicate.Organization {
-	return predicate.Organization(sql.FieldEQ(FieldCreatorID, v))
-}
-
-// CreatorIDNEQ applies the NEQ predicate on the "creator_id" field.
-func CreatorIDNEQ(v uuid.UUID) predicate.Organization {
-	return predicate.Organization(sql.FieldNEQ(FieldCreatorID, v))
-}
-
-// CreatorIDIn applies the In predicate on the "creator_id" field.
-func CreatorIDIn(vs ...uuid.UUID) predicate.Organization {
-	return predicate.Organization(sql.FieldIn(FieldCreatorID, vs...))
-}
-
-// CreatorIDNotIn applies the NotIn predicate on the "creator_id" field.
-func CreatorIDNotIn(vs ...uuid.UUID) predicate.Organization {
-	return predicate.Organization(sql.FieldNotIn(FieldCreatorID, vs...))
-}
-
 // HasCreator applies the HasEdge predicate on the "creator" edge.
 func HasCreator() predicate.Organization {
 	return predicate.Organization(func(s *sql.Selector) {
@@ -334,6 +359,29 @@ func HasCreatorWith(preds ...predicate.User) predicate.Organization {
 	})
 }

+// HasEditor applies the HasEdge predicate on the "editor" edge.
+func HasEditor() predicate.Organization {
+	return predicate.Organization(func(s *sql.Selector) {
+		step := sqlgraph.NewStep(
+			sqlgraph.From(Table, FieldID),
+			sqlgraph.Edge(sqlgraph.M2O, false, EditorTable, EditorColumn),
+		)
+		sqlgraph.HasNeighbors(s, step)
+	})
+}
+
+// HasEditorWith applies the HasEdge predicate on the "editor" edge with a given conditions (other predicates).
+func HasEditorWith(preds ...predicate.User) predicate.Organization {
+	return predicate.Organization(func(s *sql.Selector) {
+		step := newEditorStep()
+		sqlgraph.HasNeighborsWith(s, step, func(s *sql.Selector) {
+			for _, p := range preds {
+				p(s)
+			}
+		})
+	})
+}
+
 // HasUsers applies the HasEdge predicate on the "users" edge.
 func HasUsers() predicate.Organization {
 	return predicate.Organization(func(s *sql.Selector) {
--- a/internal/ent/organization_create.go
+++ b/internal/ent/organization_create.go
@@ -54,6 +54,18 @@ func (oc *OrganizationCreate) SetNillableUpdatedAt(t *time.Time) *OrganizationCr
 	return oc
 }

+// SetCreatedByID sets the "created_by_id" field.
+func (oc *OrganizationCreate) SetCreatedByID(u uuid.UUID) *OrganizationCreate {
+	oc.mutation.SetCreatedByID(u)
+	return oc
+}
+
+// SetUpdatedByID sets the "updated_by_id" field.
+func (oc *OrganizationCreate) SetUpdatedByID(u uuid.UUID) *OrganizationCreate {
+	oc.mutation.SetUpdatedByID(u)
+	return oc
+}
+
 // SetName sets the "name" field.
 func (oc *OrganizationCreate) SetName(s string) *OrganizationCreate {
 	oc.mutation.SetName(s)
@@ -66,12 +78,6 @@ func (oc *OrganizationCreate) SetDisplayName(s string) *OrganizationCreate {
 	return oc
 }

-// SetCreatorID sets the "creator_id" field.
-func (oc *OrganizationCreate) SetCreatorID(u uuid.UUID) *OrganizationCreate {
-	oc.mutation.SetCreatorID(u)
-	return oc
-}
-
 // SetID sets the "id" field.
 func (oc *OrganizationCreate) SetID(u uuid.UUID) *OrganizationCreate {
 	oc.mutation.SetID(u)
@@ -86,11 +92,28 @@ func (oc *OrganizationCreate) SetNillableID(u *uuid.UUID) *OrganizationCreate {
 	return oc
 }

+// SetCreatorID sets the "creator" edge to the User entity by ID.
+func (oc *OrganizationCreate) SetCreatorID(id uuid.UUID) *OrganizationCreate {
+	oc.mutation.SetCreatorID(id)
+	return oc
+}
+
 // SetCreator sets the "creator" edge to the User entity.
 func (oc *OrganizationCreate) SetCreator(u *User) *OrganizationCreate {
 	return oc.SetCreatorID(u.ID)
 }

+// SetEditorID sets the "editor" edge to the User entity by ID.
+func (oc *OrganizationCreate) SetEditorID(id uuid.UUID) *OrganizationCreate {
+	oc.mutation.SetEditorID(id)
+	return oc
+}
+
+// SetEditor sets the "editor" edge to the User entity.
+func (oc *OrganizationCreate) SetEditor(u *User) *OrganizationCreate {
+	return oc.SetEditorID(u.ID)
+}
+
 // AddUserIDs adds the "users" edge to the User entity by IDs.
 func (oc *OrganizationCreate) AddUserIDs(ids ...uuid.UUID) *OrganizationCreate {
 	oc.mutation.AddUserIDs(ids...)
@@ -178,6 +201,12 @@ func (oc *OrganizationCreate) check() error {
 	if _, ok := oc.mutation.UpdatedAt(); !ok {
 		return &ValidationError{Name: "updated_at", err: errors.New(`ent: missing required field "Organization.updated_at"`)}
 	}
+	if _, ok := oc.mutation.CreatedByID(); !ok {
+		return &ValidationError{Name: "created_by_id", err: errors.New(`ent: missing required field "Organization.created_by_id"`)}
+	}
+	if _, ok := oc.mutation.UpdatedByID(); !ok {
+		return &ValidationError{Name: "updated_by_id", err: errors.New(`ent: missing required field "Organization.updated_by_id"`)}
+	}
 	if _, ok := oc.mutation.Name(); !ok {
 		return &ValidationError{Name: "name", err: errors.New(`ent: missing required field "Organization.name"`)}
 	}
@@ -189,12 +218,12 @@ func (oc *OrganizationCreate) check() error {
 	if _, ok := oc.mutation.DisplayName(); !ok {
 		return &ValidationError{Name: "display_name", err: errors.New(`ent: missing required field "Organization.display_name"`)}
 	}
-	if _, ok := oc.mutation.CreatorID(); !ok {
-		return &ValidationError{Name: "creator_id", err: errors.New(`ent: missing required field "Organization.creator_id"`)}
-	}
 	if _, ok := oc.mutation.CreatorID(); !ok {
 		return &ValidationError{Name: "creator", err: errors.New(`ent: missing required edge "Organization.creator"`)}
 	}
+	if _, ok := oc.mutation.EditorID(); !ok {
+		return &ValidationError{Name: "editor", err: errors.New(`ent: missing required edge "Organization.editor"`)}
+	}
 	return nil
 }

@@ -261,7 +290,24 @@ func (oc *OrganizationCreate) createSpec() (*Organization, *sqlgraph.CreateSpec)
 		for _, k := range nodes {
 			edge.Target.Nodes = append(edge.Target.Nodes, k)
 		}
-		_node.CreatorID = nodes[0]
+		_node.CreatedByID = nodes[0]
+		_spec.Edges = append(_spec.Edges, edge)
+	}
+	if nodes := oc.mutation.EditorIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: false,
+			Table:   organization.EditorTable,
+			Columns: []string{organization.EditorColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(user.FieldID, field.TypeUUID),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_node.UpdatedByID = nodes[0]
 		_spec.Edges = append(_spec.Edges, edge)
 	}
 	if nodes := oc.mutation.UsersIDs(); len(nodes) > 0 {
@@ -360,6 +406,18 @@ func (u *OrganizationUpsert) UpdateUpdatedAt() *OrganizationUpsert {
 	return u
 }

+// SetUpdatedByID sets the "updated_by_id" field.
+func (u *OrganizationUpsert) SetUpdatedByID(v uuid.UUID) *OrganizationUpsert {
+	u.Set(organization.FieldUpdatedByID, v)
+	return u
+}
+
+// UpdateUpdatedByID sets the "updated_by_id" field to the value that was provided on create.
+func (u *OrganizationUpsert) UpdateUpdatedByID() *OrganizationUpsert {
+	u.SetExcluded(organization.FieldUpdatedByID)
+	return u
+}
+
 // SetName sets the "name" field.
 func (u *OrganizationUpsert) SetName(v string) *OrganizationUpsert {
 	u.Set(organization.FieldName, v)
@@ -384,18 +442,6 @@ func (u *OrganizationUpsert) UpdateDisplayName() *OrganizationUpsert {
 	return u
 }

-// SetCreatorID sets the "creator_id" field.
-func (u *OrganizationUpsert) SetCreatorID(v uuid.UUID) *OrganizationUpsert {
-	u.Set(organization.FieldCreatorID, v)
-	return u
-}
-
-// UpdateCreatorID sets the "creator_id" field to the value that was provided on create.
-func (u *OrganizationUpsert) UpdateCreatorID() *OrganizationUpsert {
-	u.SetExcluded(organization.FieldCreatorID)
-	return u
-}
-
 // UpdateNewValues updates the mutable fields using the new values that were set on create except the ID field.
 // Using this option is equivalent to using:
 //
@@ -416,6 +462,9 @@ func (u *OrganizationUpsertOne) UpdateNewValues() *OrganizationUpsertOne {
 		if _, exists := u.create.mutation.CreatedAt(); exists {
 			s.SetIgnore(organization.FieldCreatedAt)
 		}
+		if _, exists := u.create.mutation.CreatedByID(); exists {
+			s.SetIgnore(organization.FieldCreatedByID)
+		}
 	}))
 	return u
 }
@@ -461,6 +510,20 @@ func (u *OrganizationUpsertOne) UpdateUpdatedAt() *OrganizationUpsertOne {
 	})
 }

+// SetUpdatedByID sets the "updated_by_id" field.
+func (u *OrganizationUpsertOne) SetUpdatedByID(v uuid.UUID) *OrganizationUpsertOne {
+	return u.Update(func(s *OrganizationUpsert) {
+		s.SetUpdatedByID(v)
+	})
+}
+
+// UpdateUpdatedByID sets the "updated_by_id" field to the value that was provided on create.
+func (u *OrganizationUpsertOne) UpdateUpdatedByID() *OrganizationUpsertOne {
+	return u.Update(func(s *OrganizationUpsert) {
+		s.UpdateUpdatedByID()
+	})
+}
+
 // SetName sets the "name" field.
 func (u *OrganizationUpsertOne) SetName(v string) *OrganizationUpsertOne {
 	return u.Update(func(s *OrganizationUpsert) {
@@ -489,20 +552,6 @@ func (u *OrganizationUpsertOne) UpdateDisplayName() *OrganizationUpsertOne {
 	})
 }

-// SetCreatorID sets the "creator_id" field.
-func (u *OrganizationUpsertOne) SetCreatorID(v uuid.UUID) *OrganizationUpsertOne {
-	return u.Update(func(s *OrganizationUpsert) {
-		s.SetCreatorID(v)
-	})
-}
-
-// UpdateCreatorID sets the "creator_id" field to the value that was provided on create.
-func (u *OrganizationUpsertOne) UpdateCreatorID() *OrganizationUpsertOne {
-	return u.Update(func(s *OrganizationUpsert) {
-		s.UpdateCreatorID()
-	})
-}
-
 // Exec executes the query.
 func (u *OrganizationUpsertOne) Exec(ctx context.Context) error {
 	if len(u.create.conflict) == 0 {
@@ -689,6 +738,9 @@ func (u *OrganizationUpsertBulk) UpdateNewValues() *OrganizationUpsertBulk {
 			if _, exists := b.mutation.CreatedAt(); exists {
 				s.SetIgnore(organization.FieldCreatedAt)
 			}
+			if _, exists := b.mutation.CreatedByID(); exists {
+				s.SetIgnore(organization.FieldCreatedByID)
+			}
 		}
 	}))
 	return u
@@ -735,6 +787,20 @@ func (u *OrganizationUpsertBulk) UpdateUpdatedAt() *OrganizationUpsertBulk {
 	})
 }

+// SetUpdatedByID sets the "updated_by_id" field.
+func (u *OrganizationUpsertBulk) SetUpdatedByID(v uuid.UUID) *OrganizationUpsertBulk {
+	return u.Update(func(s *OrganizationUpsert) {
+		s.SetUpdatedByID(v)
+	})
+}
+
+// UpdateUpdatedByID sets the "updated_by_id" field to the value that was provided on create.
+func (u *OrganizationUpsertBulk) UpdateUpdatedByID() *OrganizationUpsertBulk {
+	return u.Update(func(s *OrganizationUpsert) {
+		s.UpdateUpdatedByID()
+	})
+}
+
 // SetName sets the "name" field.
 func (u *OrganizationUpsertBulk) SetName(v string) *OrganizationUpsertBulk {
 	return u.Update(func(s *OrganizationUpsert) {
@@ -763,20 +829,6 @@ func (u *OrganizationUpsertBulk) UpdateDisplayName() *OrganizationUpsertBulk {
 	})
 }

-// SetCreatorID sets the "creator_id" field.
-func (u *OrganizationUpsertBulk) SetCreatorID(v uuid.UUID) *OrganizationUpsertBulk {
-	return u.Update(func(s *OrganizationUpsert) {
-		s.SetCreatorID(v)
-	})
-}
-
-// UpdateCreatorID sets the "creator_id" field to the value that was provided on create.
-func (u *OrganizationUpsertBulk) UpdateCreatorID() *OrganizationUpsertBulk {
-	return u.Update(func(s *OrganizationUpsert) {
-		s.UpdateCreatorID()
-	})
-}
-
 // Exec executes the query.
 func (u *OrganizationUpsertBulk) Exec(ctx context.Context) error {
 	if u.create.err != nil {
--- a/internal/ent/organization_query.go
+++ b/internal/ent/organization_query.go
@@ -26,6 +26,7 @@ type OrganizationQuery struct {
 	inters        []Interceptor
 	predicates    []predicate.Organization
 	withCreator   *UserQuery
+	withEditor    *UserQuery
 	withUsers     *UserQuery
 	withPlatforms *PlatformQuery
 	// intermediate query (i.e. traversal path).
@@ -86,6 +87,28 @@ func (oq *OrganizationQuery) QueryCreator() *UserQuery {
 	return query
 }

+// QueryEditor chains the current query on the "editor" edge.
+func (oq *OrganizationQuery) QueryEditor() *UserQuery {
+	query := (&UserClient{config: oq.config}).Query()
+	query.path = func(ctx context.Context) (fromU *sql.Selector, err error) {
+		if err := oq.prepareQuery(ctx); err != nil {
+			return nil, err
+		}
+		selector := oq.sqlQuery(ctx)
+		if err := selector.Err(); err != nil {
+			return nil, err
+		}
+		step := sqlgraph.NewStep(
+			sqlgraph.From(organization.Table, organization.FieldID, selector),
+			sqlgraph.To(user.Table, user.FieldID),
+			sqlgraph.Edge(sqlgraph.M2O, false, organization.EditorTable, organization.EditorColumn),
+		)
+		fromU = sqlgraph.SetNeighbors(oq.driver.Dialect(), step)
+		return fromU, nil
+	}
+	return query
+}
+
 // QueryUsers chains the current query on the "users" edge.
 func (oq *OrganizationQuery) QueryUsers() *UserQuery {
 	query := (&UserClient{config: oq.config}).Query()
@@ -323,6 +346,7 @@ func (oq *OrganizationQuery) Clone() *OrganizationQuery {
 		inters:        append([]Interceptor{}, oq.inters...),
 		predicates:    append([]predicate.Organization{}, oq.predicates...),
 		withCreator:   oq.withCreator.Clone(),
+		withEditor:    oq.withEditor.Clone(),
 		withUsers:     oq.withUsers.Clone(),
 		withPlatforms: oq.withPlatforms.Clone(),
 		// clone intermediate query.
@@ -342,6 +366,17 @@ func (oq *OrganizationQuery) WithCreator(opts ...func(*UserQuery)) *Organization
 	return oq
 }

+// WithEditor tells the query-builder to eager-load the nodes that are connected to
+// the "editor" edge. The optional arguments are used to configure the query builder of the edge.
+func (oq *OrganizationQuery) WithEditor(opts ...func(*UserQuery)) *OrganizationQuery {
+	query := (&UserClient{config: oq.config}).Query()
+	for _, opt := range opts {
+		opt(query)
+	}
+	oq.withEditor = query
+	return oq
+}
+
 // WithUsers tells the query-builder to eager-load the nodes that are connected to
 // the "users" edge. The optional arguments are used to configure the query builder of the edge.
 func (oq *OrganizationQuery) WithUsers(opts ...func(*UserQuery)) *OrganizationQuery {
@@ -442,8 +477,9 @@ func (oq *OrganizationQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]
 	var (
 		nodes       = []*Organization{}
 		_spec       = oq.querySpec()
-		loadedTypes = [3]bool{
+		loadedTypes = [4]bool{
 			oq.withCreator != nil,
+			oq.withEditor != nil,
 			oq.withUsers != nil,
 			oq.withPlatforms != nil,
 		}
@@ -472,6 +508,12 @@ func (oq *OrganizationQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]
 			return nil, err
 		}
 	}
+	if query := oq.withEditor; query != nil {
+		if err := oq.loadEditor(ctx, query, nodes, nil,
+			func(n *Organization, e *User) { n.Edges.Editor = e }); err != nil {
+			return nil, err
+		}
+	}
 	if query := oq.withUsers; query != nil {
 		if err := oq.loadUsers(ctx, query, nodes,
 			func(n *Organization) { n.Edges.Users = []*User{} },
@@ -493,7 +535,7 @@ func (oq *OrganizationQuery) loadCreator(ctx context.Context, query *UserQuery,
 	ids := make([]uuid.UUID, 0, len(nodes))
 	nodeids := make(map[uuid.UUID][]*Organization)
 	for i := range nodes {
-		fk := nodes[i].CreatorID
+		fk := nodes[i].CreatedByID
 		if _, ok := nodeids[fk]; !ok {
 			ids = append(ids, fk)
 		}
@@ -510,7 +552,36 @@ func (oq *OrganizationQuery) loadCreator(ctx context.Context, query *UserQuery,
 	for _, n := range neighbors {
 		nodes, ok := nodeids[n.ID]
 		if !ok {
-			return fmt.Errorf(`unexpected foreign-key "creator_id" returned %v`, n.ID)
+			return fmt.Errorf(`unexpected foreign-key "created_by_id" returned %v`, n.ID)
+		}
+		for i := range nodes {
+			assign(nodes[i], n)
+		}
+	}
+	return nil
+}
+func (oq *OrganizationQuery) loadEditor(ctx context.Context, query *UserQuery, nodes []*Organization, init func(*Organization), assign func(*Organization, *User)) error {
+	ids := make([]uuid.UUID, 0, len(nodes))
+	nodeids := make(map[uuid.UUID][]*Organization)
+	for i := range nodes {
+		fk := nodes[i].UpdatedByID
+		if _, ok := nodeids[fk]; !ok {
+			ids = append(ids, fk)
+		}
+		nodeids[fk] = append(nodeids[fk], nodes[i])
+	}
+	if len(ids) == 0 {
+		return nil
+	}
+	query.Where(user.IDIn(ids...))
+	neighbors, err := query.All(ctx)
+	if err != nil {
+		return err
+	}
+	for _, n := range neighbors {
+		nodes, ok := nodeids[n.ID]
+		if !ok {
+			return fmt.Errorf(`unexpected foreign-key "updated_by_id" returned %v`, n.ID)
 		}
 		for i := range nodes {
 			assign(nodes[i], n)
@@ -636,7 +707,10 @@ func (oq *OrganizationQuery) querySpec() *sqlgraph.QuerySpec {
 			}
 		}
 		if oq.withCreator != nil {
-			_spec.Node.AddColumnOnce(organization.FieldCreatorID)
+			_spec.Node.AddColumnOnce(organization.FieldCreatedByID)
+		}
+		if oq.withEditor != nil {
+			_spec.Node.AddColumnOnce(organization.FieldUpdatedByID)
 		}
 	}
 	if ps := oq.predicates; len(ps) > 0 {
--- a/internal/ent/organization_update.go
+++ b/internal/ent/organization_update.go
@@ -37,6 +37,20 @@ func (ou *OrganizationUpdate) SetUpdatedAt(t time.Time) *OrganizationUpdate {
 	return ou
 }

+// SetUpdatedByID sets the "updated_by_id" field.
+func (ou *OrganizationUpdate) SetUpdatedByID(u uuid.UUID) *OrganizationUpdate {
+	ou.mutation.SetUpdatedByID(u)
+	return ou
+}
+
+// SetNillableUpdatedByID sets the "updated_by_id" field if the given value is not nil.
+func (ou *OrganizationUpdate) SetNillableUpdatedByID(u *uuid.UUID) *OrganizationUpdate {
+	if u != nil {
+		ou.SetUpdatedByID(*u)
+	}
+	return ou
+}
+
 // SetName sets the "name" field.
 func (ou *OrganizationUpdate) SetName(s string) *OrganizationUpdate {
 	ou.mutation.SetName(s)
@@ -65,23 +79,15 @@ func (ou *OrganizationUpdate) SetNillableDisplayName(s *string) *OrganizationUpd
 	return ou
 }

-// SetCreatorID sets the "creator_id" field.
-func (ou *OrganizationUpdate) SetCreatorID(u uuid.UUID) *OrganizationUpdate {
-	ou.mutation.SetCreatorID(u)
+// SetEditorID sets the "editor" edge to the User entity by ID.
+func (ou *OrganizationUpdate) SetEditorID(id uuid.UUID) *OrganizationUpdate {
+	ou.mutation.SetEditorID(id)
 	return ou
 }

-// SetNillableCreatorID sets the "creator_id" field if the given value is not nil.
-func (ou *OrganizationUpdate) SetNillableCreatorID(u *uuid.UUID) *OrganizationUpdate {
-	if u != nil {
-		ou.SetCreatorID(*u)
-	}
-	return ou
-}
-
-// SetCreator sets the "creator" edge to the User entity.
-func (ou *OrganizationUpdate) SetCreator(u *User) *OrganizationUpdate {
-	return ou.SetCreatorID(u.ID)
+// SetEditor sets the "editor" edge to the User entity.
+func (ou *OrganizationUpdate) SetEditor(u *User) *OrganizationUpdate {
+	return ou.SetEditorID(u.ID)
 }

 // AddUserIDs adds the "users" edge to the User entity by IDs.
@@ -119,9 +125,9 @@ func (ou *OrganizationUpdate) Mutation() *OrganizationMutation {
 	return ou.mutation
 }

-// ClearCreator clears the "creator" edge to the User entity.
-func (ou *OrganizationUpdate) ClearCreator() *OrganizationUpdate {
-	ou.mutation.ClearCreator()
+// ClearEditor clears the "editor" edge to the User entity.
+func (ou *OrganizationUpdate) ClearEditor() *OrganizationUpdate {
+	ou.mutation.ClearEditor()
 	return ou
 }

@@ -213,6 +219,9 @@ func (ou *OrganizationUpdate) check() error {
 	if _, ok := ou.mutation.CreatorID(); ou.mutation.CreatorCleared() && !ok {
 		return errors.New(`ent: clearing a required unique edge "Organization.creator"`)
 	}
+	if _, ok := ou.mutation.EditorID(); ou.mutation.EditorCleared() && !ok {
+		return errors.New(`ent: clearing a required unique edge "Organization.editor"`)
+	}
 	return nil
 }

@@ -237,12 +246,12 @@ func (ou *OrganizationUpdate) sqlSave(ctx context.Context) (n int, err error) {
 	if value, ok := ou.mutation.DisplayName(); ok {
 		_spec.SetField(organization.FieldDisplayName, field.TypeString, value)
 	}
-	if ou.mutation.CreatorCleared() {
+	if ou.mutation.EditorCleared() {
 		edge := &sqlgraph.EdgeSpec{
 			Rel:     sqlgraph.M2O,
 			Inverse: false,
-			Table:   organization.CreatorTable,
-			Columns: []string{organization.CreatorColumn},
+			Table:   organization.EditorTable,
+			Columns: []string{organization.EditorColumn},
 			Bidi:    false,
 			Target: &sqlgraph.EdgeTarget{
 				IDSpec: sqlgraph.NewFieldSpec(user.FieldID, field.TypeUUID),
@@ -250,12 +259,12 @@ func (ou *OrganizationUpdate) sqlSave(ctx context.Context) (n int, err error) {
 		}
 		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
 	}
-	if nodes := ou.mutation.CreatorIDs(); len(nodes) > 0 {
+	if nodes := ou.mutation.EditorIDs(); len(nodes) > 0 {
 		edge := &sqlgraph.EdgeSpec{
 			Rel:     sqlgraph.M2O,
 			Inverse: false,
-			Table:   organization.CreatorTable,
-			Columns: []string{organization.CreatorColumn},
+			Table:   organization.EditorTable,
+			Columns: []string{organization.EditorColumn},
 			Bidi:    false,
 			Target: &sqlgraph.EdgeTarget{
 				IDSpec: sqlgraph.NewFieldSpec(user.FieldID, field.TypeUUID),
@@ -382,6 +391,20 @@ func (ouo *OrganizationUpdateOne) SetUpdatedAt(t time.Time) *OrganizationUpdateO
 	return ouo
 }

+// SetUpdatedByID sets the "updated_by_id" field.
+func (ouo *OrganizationUpdateOne) SetUpdatedByID(u uuid.UUID) *OrganizationUpdateOne {
+	ouo.mutation.SetUpdatedByID(u)
+	return ouo
+}
+
+// SetNillableUpdatedByID sets the "updated_by_id" field if the given value is not nil.
+func (ouo *OrganizationUpdateOne) SetNillableUpdatedByID(u *uuid.UUID) *OrganizationUpdateOne {
+	if u != nil {
+		ouo.SetUpdatedByID(*u)
+	}
+	return ouo
+}
+
 // SetName sets the "name" field.
 func (ouo *OrganizationUpdateOne) SetName(s string) *OrganizationUpdateOne {
 	ouo.mutation.SetName(s)
@@ -410,23 +433,15 @@ func (ouo *OrganizationUpdateOne) SetNillableDisplayName(s *string) *Organizatio
 	return ouo
 }

-// SetCreatorID sets the "creator_id" field.
-func (ouo *OrganizationUpdateOne) SetCreatorID(u uuid.UUID) *OrganizationUpdateOne {
-	ouo.mutation.SetCreatorID(u)
+// SetEditorID sets the "editor" edge to the User entity by ID.
+func (ouo *OrganizationUpdateOne) SetEditorID(id uuid.UUID) *OrganizationUpdateOne {
+	ouo.mutation.SetEditorID(id)
 	return ouo
 }

-// SetNillableCreatorID sets the "creator_id" field if the given value is not nil.
-func (ouo *OrganizationUpdateOne) SetNillableCreatorID(u *uuid.UUID) *OrganizationUpdateOne {
-	if u != nil {
-		ouo.SetCreatorID(*u)
-	}
-	return ouo
-}
-
-// SetCreator sets the "creator" edge to the User entity.
-func (ouo *OrganizationUpdateOne) SetCreator(u *User) *OrganizationUpdateOne {
-	return ouo.SetCreatorID(u.ID)
+// SetEditor sets the "editor" edge to the User entity.
+func (ouo *OrganizationUpdateOne) SetEditor(u *User) *OrganizationUpdateOne {
+	return ouo.SetEditorID(u.ID)
 }

 // AddUserIDs adds the "users" edge to the User entity by IDs.
@@ -464,9 +479,9 @@ func (ouo *OrganizationUpdateOne) Mutation() *OrganizationMutation {
 	return ouo.mutation
 }

-// ClearCreator clears the "creator" edge to the User entity.
-func (ouo *OrganizationUpdateOne) ClearCreator() *OrganizationUpdateOne {
-	ouo.mutation.ClearCreator()
+// ClearEditor clears the "editor" edge to the User entity.
+func (ouo *OrganizationUpdateOne) ClearEditor() *OrganizationUpdateOne {
+	ouo.mutation.ClearEditor()
 	return ouo
 }

@@ -571,6 +586,9 @@ func (ouo *OrganizationUpdateOne) check() error {
 	if _, ok := ouo.mutation.CreatorID(); ouo.mutation.CreatorCleared() && !ok {
 		return errors.New(`ent: clearing a required unique edge "Organization.creator"`)
 	}
+	if _, ok := ouo.mutation.EditorID(); ouo.mutation.EditorCleared() && !ok {
+		return errors.New(`ent: clearing a required unique edge "Organization.editor"`)
+	}
 	return nil
 }

@@ -612,12 +630,12 @@ func (ouo *OrganizationUpdateOne) sqlSave(ctx context.Context) (_node *Organizat
 	if value, ok := ouo.mutation.DisplayName(); ok {
 		_spec.SetField(organization.FieldDisplayName, field.TypeString, value)
 	}
-	if ouo.mutation.CreatorCleared() {
+	if ouo.mutation.EditorCleared() {
 		edge := &sqlgraph.EdgeSpec{
 			Rel:     sqlgraph.M2O,
 			Inverse: false,
-			Table:   organization.CreatorTable,
-			Columns: []string{organization.CreatorColumn},
+			Table:   organization.EditorTable,
+			Columns: []string{organization.EditorColumn},
 			Bidi:    false,
 			Target: &sqlgraph.EdgeTarget{
 				IDSpec: sqlgraph.NewFieldSpec(user.FieldID, field.TypeUUID),
@@ -625,12 +643,12 @@ func (ouo *OrganizationUpdateOne) sqlSave(ctx context.Context) (_node *Organizat
 		}
 		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
 	}
-	if nodes := ouo.mutation.CreatorIDs(); len(nodes) > 0 {
+	if nodes := ouo.mutation.EditorIDs(); len(nodes) > 0 {
 		edge := &sqlgraph.EdgeSpec{
 			Rel:     sqlgraph.M2O,
 			Inverse: false,
-			Table:   organization.CreatorTable,
-			Columns: []string{organization.CreatorColumn},
+			Table:   organization.EditorTable,
+			Columns: []string{organization.EditorColumn},
 			Bidi:    false,
 			Target: &sqlgraph.EdgeTarget{
 				IDSpec: sqlgraph.NewFieldSpec(user.FieldID, field.TypeUUID),
--- a/internal/ent/platform.go
+++ b/internal/ent/platform.go
@@ -14,7 +14,7 @@ import (
 	"github.com/holos-run/holos/internal/ent/organization"
 	"github.com/holos-run/holos/internal/ent/platform"
 	"github.com/holos-run/holos/internal/ent/user"
-	holos "github.com/holos-run/holos/service/gen/holos/v1alpha1"
+	storage "github.com/holos-run/holos/service/gen/holos/storage/v1alpha1"
 )

 // Platform is the model entity for the Platform schema.
@@ -26,18 +26,20 @@ type Platform struct {
 	CreatedAt time.Time `json:"created_at,omitempty"`
 	// UpdatedAt holds the value of the "updated_at" field.
 	UpdatedAt time.Time `json:"updated_at,omitempty"`
+	// CreatedByID holds the value of the "created_by_id" field.
+	CreatedByID uuid.UUID `json:"created_by_id,omitempty"`
+	// UpdatedByID holds the value of the "updated_by_id" field.
+	UpdatedByID uuid.UUID `json:"updated_by_id,omitempty"`
 	// OrgID holds the value of the "org_id" field.
 	OrgID uuid.UUID `json:"org_id,omitempty"`
 	// Name holds the value of the "name" field.
 	Name string `json:"name,omitempty"`
 	// DisplayName holds the value of the "display_name" field.
 	DisplayName string `json:"display_name,omitempty"`
-	// CreatorID holds the value of the "creator_id" field.
-	CreatorID uuid.UUID `json:"creator_id,omitempty"`
 	// JSON representation of FormlyFormConfig[] refer to https://github.com/holos-run/holos/issues/161
-	Form *holos.Form `json:"form,omitempty"`
+	Form *storage.Form `json:"form,omitempty"`
 	// JSON representation of the form model which holds user input values refer to https://github.com/holos-run/holos/issues/161
-	Model *holos.Model `json:"model,omitempty"`
+	Model *storage.Model `json:"model,omitempty"`
 	// CUE definition to vet the model against e.g. #PlatformConfig
 	Cue []byte `json:"cue,omitempty"`
 	// The definition name to vet config_values against config_cue e.g. '#PlatformSpec'
@@ -52,11 +54,13 @@ type Platform struct {
 type PlatformEdges struct {
 	// Creator holds the value of the creator edge.
 	Creator *User `json:"creator,omitempty"`
+	// Editor holds the value of the editor edge.
+	Editor *User `json:"editor,omitempty"`
 	// Organization holds the value of the organization edge.
 	Organization *Organization `json:"organization,omitempty"`
 	// loadedTypes holds the information for reporting if a
 	// type was loaded (or requested) in eager-loading or not.
-	loadedTypes [2]bool
+	loadedTypes [3]bool
 }

 // CreatorOrErr returns the Creator value or an error if the edge
@@ -70,12 +74,23 @@ func (e PlatformEdges) CreatorOrErr() (*User, error) {
 	return nil, &NotLoadedError{edge: "creator"}
 }

+// EditorOrErr returns the Editor value or an error if the edge
+// was not loaded in eager-loading, or loaded but was not found.
+func (e PlatformEdges) EditorOrErr() (*User, error) {
+	if e.Editor != nil {
+		return e.Editor, nil
+	} else if e.loadedTypes[1] {
+		return nil, &NotFoundError{label: user.Label}
+	}
+	return nil, &NotLoadedError{edge: "editor"}
+}
+
 // OrganizationOrErr returns the Organization value or an error if the edge
 // was not loaded in eager-loading, or loaded but was not found.
 func (e PlatformEdges) OrganizationOrErr() (*Organization, error) {
 	if e.Organization != nil {
 		return e.Organization, nil
-	} else if e.loadedTypes[1] {
+	} else if e.loadedTypes[2] {
 		return nil, &NotFoundError{label: organization.Label}
 	}
 	return nil, &NotLoadedError{edge: "organization"}
@@ -92,7 +107,7 @@ func (*Platform) scanValues(columns []string) ([]any, error) {
 			values[i] = new(sql.NullString)
 		case platform.FieldCreatedAt, platform.FieldUpdatedAt:
 			values[i] = new(sql.NullTime)
-		case platform.FieldID, platform.FieldOrgID, platform.FieldCreatorID:
+		case platform.FieldID, platform.FieldCreatedByID, platform.FieldUpdatedByID, platform.FieldOrgID:
 			values[i] = new(uuid.UUID)
 		default:
 			values[i] = new(sql.UnknownType)
@@ -127,6 +142,18 @@ func (pl *Platform) assignValues(columns []string, values []any) error {
 			} else if value.Valid {
 				pl.UpdatedAt = value.Time
 			}
+		case platform.FieldCreatedByID:
+			if value, ok := values[i].(*uuid.UUID); !ok {
+				return fmt.Errorf("unexpected type %T for field created_by_id", values[i])
+			} else if value != nil {
+				pl.CreatedByID = *value
+			}
+		case platform.FieldUpdatedByID:
+			if value, ok := values[i].(*uuid.UUID); !ok {
+				return fmt.Errorf("unexpected type %T for field updated_by_id", values[i])
+			} else if value != nil {
+				pl.UpdatedByID = *value
+			}
 		case platform.FieldOrgID:
 			if value, ok := values[i].(*uuid.UUID); !ok {
 				return fmt.Errorf("unexpected type %T for field org_id", values[i])
@@ -145,12 +172,6 @@ func (pl *Platform) assignValues(columns []string, values []any) error {
 			} else if value.Valid {
 				pl.DisplayName = value.String
 			}
-		case platform.FieldCreatorID:
-			if value, ok := values[i].(*uuid.UUID); !ok {
-				return fmt.Errorf("unexpected type %T for field creator_id", values[i])
-			} else if value != nil {
-				pl.CreatorID = *value
-			}
 		case platform.FieldForm:
 			if value, ok := values[i].(*[]byte); !ok {
 				return fmt.Errorf("unexpected type %T for field form", values[i])
@@ -197,6 +218,11 @@ func (pl *Platform) QueryCreator() *UserQuery {
 	return NewPlatformClient(pl.config).QueryCreator(pl)
 }

+// QueryEditor queries the "editor" edge of the Platform entity.
+func (pl *Platform) QueryEditor() *UserQuery {
+	return NewPlatformClient(pl.config).QueryEditor(pl)
+}
+
 // QueryOrganization queries the "organization" edge of the Platform entity.
 func (pl *Platform) QueryOrganization() *OrganizationQuery {
 	return NewPlatformClient(pl.config).QueryOrganization(pl)
@@ -231,6 +257,12 @@ func (pl *Platform) String() string {
 	builder.WriteString("updated_at=")
 	builder.WriteString(pl.UpdatedAt.Format(time.ANSIC))
 	builder.WriteString(", ")
+	builder.WriteString("created_by_id=")
+	builder.WriteString(fmt.Sprintf("%v", pl.CreatedByID))
+	builder.WriteString(", ")
+	builder.WriteString("updated_by_id=")
+	builder.WriteString(fmt.Sprintf("%v", pl.UpdatedByID))
+	builder.WriteString(", ")
 	builder.WriteString("org_id=")
 	builder.WriteString(fmt.Sprintf("%v", pl.OrgID))
 	builder.WriteString(", ")
@@ -240,9 +272,6 @@ func (pl *Platform) String() string {
 	builder.WriteString("display_name=")
 	builder.WriteString(pl.DisplayName)
 	builder.WriteString(", ")
-	builder.WriteString("creator_id=")
-	builder.WriteString(fmt.Sprintf("%v", pl.CreatorID))
-	builder.WriteString(", ")
 	builder.WriteString("form=")
 	builder.WriteString(fmt.Sprintf("%v", pl.Form))
 	builder.WriteString(", ")
--- a/internal/ent/platform/platform.go
+++ b/internal/ent/platform/platform.go
@@ -19,14 +19,16 @@ const (
 	FieldCreatedAt = "created_at"
 	// FieldUpdatedAt holds the string denoting the updated_at field in the database.
 	FieldUpdatedAt = "updated_at"
+	// FieldCreatedByID holds the string denoting the created_by_id field in the database.
+	FieldCreatedByID = "created_by_id"
+	// FieldUpdatedByID holds the string denoting the updated_by_id field in the database.
+	FieldUpdatedByID = "updated_by_id"
 	// FieldOrgID holds the string denoting the org_id field in the database.
 	FieldOrgID = "org_id"
 	// FieldName holds the string denoting the name field in the database.
 	FieldName = "name"
 	// FieldDisplayName holds the string denoting the display_name field in the database.
 	FieldDisplayName = "display_name"
-	// FieldCreatorID holds the string denoting the creator_id field in the database.
-	FieldCreatorID = "creator_id"
 	// FieldForm holds the string denoting the form field in the database.
 	FieldForm = "form"
 	// FieldModel holds the string denoting the model field in the database.
@@ -37,6 +39,8 @@ const (
 	FieldCueDefinition = "cue_definition"
 	// EdgeCreator holds the string denoting the creator edge name in mutations.
 	EdgeCreator = "creator"
+	// EdgeEditor holds the string denoting the editor edge name in mutations.
+	EdgeEditor = "editor"
 	// EdgeOrganization holds the string denoting the organization edge name in mutations.
 	EdgeOrganization = "organization"
 	// Table holds the table name of the platform in the database.
@@ -47,7 +51,14 @@ const (
 	// It exists in this package in order to avoid circular dependency with the "user" package.
 	CreatorInverseTable = "users"
 	// CreatorColumn is the table column denoting the creator relation/edge.
-	CreatorColumn = "creator_id"
+	CreatorColumn = "created_by_id"
+	// EditorTable is the table that holds the editor relation/edge.
+	EditorTable = "platforms"
+	// EditorInverseTable is the table name for the User entity.
+	// It exists in this package in order to avoid circular dependency with the "user" package.
+	EditorInverseTable = "users"
+	// EditorColumn is the table column denoting the editor relation/edge.
+	EditorColumn = "updated_by_id"
 	// OrganizationTable is the table that holds the organization relation/edge.
 	OrganizationTable = "platforms"
 	// OrganizationInverseTable is the table name for the Organization entity.
@@ -62,10 +73,11 @@ var Columns = []string{
 	FieldID,
 	FieldCreatedAt,
 	FieldUpdatedAt,
+	FieldCreatedByID,
+	FieldUpdatedByID,
 	FieldOrgID,
 	FieldName,
 	FieldDisplayName,
-	FieldCreatorID,
 	FieldForm,
 	FieldModel,
 	FieldCue,
@@ -113,6 +125,16 @@ func ByUpdatedAt(opts ...sql.OrderTermOption) OrderOption {
 	return sql.OrderByField(FieldUpdatedAt, opts...).ToFunc()
 }

+// ByCreatedByID orders the results by the created_by_id field.
+func ByCreatedByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldCreatedByID, opts...).ToFunc()
+}
+
+// ByUpdatedByID orders the results by the updated_by_id field.
+func ByUpdatedByID(opts ...sql.OrderTermOption) OrderOption {
+	return sql.OrderByField(FieldUpdatedByID, opts...).ToFunc()
+}
+
 // ByOrgID orders the results by the org_id field.
 func ByOrgID(opts ...sql.OrderTermOption) OrderOption {
 	return sql.OrderByField(FieldOrgID, opts...).ToFunc()
@@ -128,11 +150,6 @@ func ByDisplayName(opts ...sql.OrderTermOption) OrderOption {
 	return sql.OrderByField(FieldDisplayName, opts...).ToFunc()
 }

-// ByCreatorID orders the results by the creator_id field.
-func ByCreatorID(opts ...sql.OrderTermOption) OrderOption {
-	return sql.OrderByField(FieldCreatorID, opts...).ToFunc()
-}
-
 // ByCueDefinition orders the results by the cue_definition field.
 func ByCueDefinition(opts ...sql.OrderTermOption) OrderOption {
 	return sql.OrderByField(FieldCueDefinition, opts...).ToFunc()
@@ -145,6 +162,13 @@ func ByCreatorField(field string, opts ...sql.OrderTermOption) OrderOption {
 	}
 }

+// ByEditorField orders the results by editor field.
+func ByEditorField(field string, opts ...sql.OrderTermOption) OrderOption {
+	return func(s *sql.Selector) {
+		sqlgraph.OrderByNeighborTerms(s, newEditorStep(), sql.OrderByField(field, opts...))
+	}
+}
+
 // ByOrganizationField orders the results by organization field.
 func ByOrganizationField(field string, opts ...sql.OrderTermOption) OrderOption {
 	return func(s *sql.Selector) {
@@ -158,6 +182,13 @@ func newCreatorStep() *sqlgraph.Step {
 		sqlgraph.Edge(sqlgraph.M2O, false, CreatorTable, CreatorColumn),
 	)
 }
+func newEditorStep() *sqlgraph.Step {
+	return sqlgraph.NewStep(
+		sqlgraph.From(Table, FieldID),
+		sqlgraph.To(EditorInverseTable, FieldID),
+		sqlgraph.Edge(sqlgraph.M2O, false, EditorTable, EditorColumn),
+	)
+}
 func newOrganizationStep() *sqlgraph.Step {
 	return sqlgraph.NewStep(
 		sqlgraph.From(Table, FieldID),
--- a/internal/ent/platform/where.go
+++ b/internal/ent/platform/where.go
@@ -66,6 +66,16 @@ func UpdatedAt(v time.Time) predicate.Platform {
 	return predicate.Platform(sql.FieldEQ(FieldUpdatedAt, v))
 }

+// CreatedByID applies equality check predicate on the "created_by_id" field. It's identical to CreatedByIDEQ.
+func CreatedByID(v uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldEQ(FieldCreatedByID, v))
+}
+
+// UpdatedByID applies equality check predicate on the "updated_by_id" field. It's identical to UpdatedByIDEQ.
+func UpdatedByID(v uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldEQ(FieldUpdatedByID, v))
+}
+
 // OrgID applies equality check predicate on the "org_id" field. It's identical to OrgIDEQ.
 func OrgID(v uuid.UUID) predicate.Platform {
 	return predicate.Platform(sql.FieldEQ(FieldOrgID, v))
@@ -81,11 +91,6 @@ func DisplayName(v string) predicate.Platform {
 	return predicate.Platform(sql.FieldEQ(FieldDisplayName, v))
 }

-// CreatorID applies equality check predicate on the "creator_id" field. It's identical to CreatorIDEQ.
-func CreatorID(v uuid.UUID) predicate.Platform {
-	return predicate.Platform(sql.FieldEQ(FieldCreatorID, v))
-}
-
 // Cue applies equality check predicate on the "cue" field. It's identical to CueEQ.
 func Cue(v []byte) predicate.Platform {
 	return predicate.Platform(sql.FieldEQ(FieldCue, v))
@@ -176,6 +181,46 @@ func UpdatedAtLTE(v time.Time) predicate.Platform {
 	return predicate.Platform(sql.FieldLTE(FieldUpdatedAt, v))
 }

+// CreatedByIDEQ applies the EQ predicate on the "created_by_id" field.
+func CreatedByIDEQ(v uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldEQ(FieldCreatedByID, v))
+}
+
+// CreatedByIDNEQ applies the NEQ predicate on the "created_by_id" field.
+func CreatedByIDNEQ(v uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldNEQ(FieldCreatedByID, v))
+}
+
+// CreatedByIDIn applies the In predicate on the "created_by_id" field.
+func CreatedByIDIn(vs ...uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldIn(FieldCreatedByID, vs...))
+}
+
+// CreatedByIDNotIn applies the NotIn predicate on the "created_by_id" field.
+func CreatedByIDNotIn(vs ...uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldNotIn(FieldCreatedByID, vs...))
+}
+
+// UpdatedByIDEQ applies the EQ predicate on the "updated_by_id" field.
+func UpdatedByIDEQ(v uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldEQ(FieldUpdatedByID, v))
+}
+
+// UpdatedByIDNEQ applies the NEQ predicate on the "updated_by_id" field.
+func UpdatedByIDNEQ(v uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldNEQ(FieldUpdatedByID, v))
+}
+
+// UpdatedByIDIn applies the In predicate on the "updated_by_id" field.
+func UpdatedByIDIn(vs ...uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldIn(FieldUpdatedByID, vs...))
+}
+
+// UpdatedByIDNotIn applies the NotIn predicate on the "updated_by_id" field.
+func UpdatedByIDNotIn(vs ...uuid.UUID) predicate.Platform {
+	return predicate.Platform(sql.FieldNotIn(FieldUpdatedByID, vs...))
+}
+
 // OrgIDEQ applies the EQ predicate on the "org_id" field.
 func OrgIDEQ(v uuid.UUID) predicate.Platform {
 	return predicate.Platform(sql.FieldEQ(FieldOrgID, v))
@@ -326,26 +371,6 @@ func DisplayNameContainsFold(v string) predicate.Platform {
 	return predicate.Platform(sql.FieldContainsFold(FieldDisplayName, v))
 }

-// CreatorIDEQ applies the EQ predicate on the "creator_id" field.
-func CreatorIDEQ(v uuid.UUID) predicate.Platform {
-	return predicate.Platform(sql.FieldEQ(FieldCreatorID, v))
-}
-
-// CreatorIDNEQ applies the NEQ predicate on the "creator_id" field.
-func CreatorIDNEQ(v uuid.UUID) predicate.Platform {
-	return predicate.Platform(sql.FieldNEQ(FieldCreatorID, v))
-}
-
-// CreatorIDIn applies the In predicate on the "creator_id" field.
-func CreatorIDIn(vs ...uuid.UUID) predicate.Platform {
-	return predicate.Platform(sql.FieldIn(FieldCreatorID, vs...))
-}
-
-// CreatorIDNotIn applies the NotIn predicate on the "creator_id" field.
-func CreatorIDNotIn(vs ...uuid.UUID) predicate.Platform {
-	return predicate.Platform(sql.FieldNotIn(FieldCreatorID, vs...))
-}
-
 // FormIsNil applies the IsNil predicate on the "form" field.
 func FormIsNil() predicate.Platform {
 	return predicate.Platform(sql.FieldIsNull(FieldForm))
@@ -514,6 +539,29 @@ func HasCreatorWith(preds ...predicate.User) predicate.Platform {
 	})
 }

+// HasEditor applies the HasEdge predicate on the "editor" edge.
+func HasEditor() predicate.Platform {
+	return predicate.Platform(func(s *sql.Selector) {
+		step := sqlgraph.NewStep(
+			sqlgraph.From(Table, FieldID),
+			sqlgraph.Edge(sqlgraph.M2O, false, EditorTable, EditorColumn),
+		)
+		sqlgraph.HasNeighbors(s, step)
+	})
+}
+
+// HasEditorWith applies the HasEdge predicate on the "editor" edge with a given conditions (other predicates).
+func HasEditorWith(preds ...predicate.User) predicate.Platform {
+	return predicate.Platform(func(s *sql.Selector) {
+		step := newEditorStep()
+		sqlgraph.HasNeighborsWith(s, step, func(s *sql.Selector) {
+			for _, p := range preds {
+				p(s)
+			}
+		})
+	})
+}
+
 // HasOrganization applies the HasEdge predicate on the "organization" edge.
 func HasOrganization() predicate.Platform {
 	return predicate.Platform(func(s *sql.Selector) {
--- a/internal/ent/platform_create.go
+++ b/internal/ent/platform_create.go
@@ -16,7 +16,7 @@ import (
 	"github.com/holos-run/holos/internal/ent/organization"
 	"github.com/holos-run/holos/internal/ent/platform"
 	"github.com/holos-run/holos/internal/ent/user"
-	holos "github.com/holos-run/holos/service/gen/holos/v1alpha1"
+	storage "github.com/holos-run/holos/service/gen/holos/storage/v1alpha1"
 )

 // PlatformCreate is the builder for creating a Platform entity.
@@ -55,6 +55,18 @@ func (pc *PlatformCreate) SetNillableUpdatedAt(t *time.Time) *PlatformCreate {
 	return pc
 }

+// SetCreatedByID sets the "created_by_id" field.
+func (pc *PlatformCreate) SetCreatedByID(u uuid.UUID) *PlatformCreate {
+	pc.mutation.SetCreatedByID(u)
+	return pc
+}
+
+// SetUpdatedByID sets the "updated_by_id" field.
+func (pc *PlatformCreate) SetUpdatedByID(u uuid.UUID) *PlatformCreate {
+	pc.mutation.SetUpdatedByID(u)
+	return pc
+}
+
 // SetOrgID sets the "org_id" field.
 func (pc *PlatformCreate) SetOrgID(u uuid.UUID) *PlatformCreate {
 	pc.mutation.SetOrgID(u)
@@ -73,21 +85,15 @@ func (pc *PlatformCreate) SetDisplayName(s string) *PlatformCreate {
 	return pc
 }

-// SetCreatorID sets the "creator_id" field.
-func (pc *PlatformCreate) SetCreatorID(u uuid.UUID) *PlatformCreate {
-	pc.mutation.SetCreatorID(u)
-	return pc
-}
-
 // SetForm sets the "form" field.
-func (pc *PlatformCreate) SetForm(h *holos.Form) *PlatformCreate {
-	pc.mutation.SetForm(h)
+func (pc *PlatformCreate) SetForm(s *storage.Form) *PlatformCreate {
+	pc.mutation.SetForm(s)
 	return pc
 }

 // SetModel sets the "model" field.
-func (pc *PlatformCreate) SetModel(h *holos.Model) *PlatformCreate {
-	pc.mutation.SetModel(h)
+func (pc *PlatformCreate) SetModel(s *storage.Model) *PlatformCreate {
+	pc.mutation.SetModel(s)
 	return pc
 }

@@ -125,11 +131,28 @@ func (pc *PlatformCreate) SetNillableID(u *uuid.UUID) *PlatformCreate {
 	return pc
 }

+// SetCreatorID sets the "creator" edge to the User entity by ID.
+func (pc *PlatformCreate) SetCreatorID(id uuid.UUID) *PlatformCreate {
+	pc.mutation.SetCreatorID(id)
+	return pc
+}
+
 // SetCreator sets the "creator" edge to the User entity.
 func (pc *PlatformCreate) SetCreator(u *User) *PlatformCreate {
 	return pc.SetCreatorID(u.ID)
 }

+// SetEditorID sets the "editor" edge to the User entity by ID.
+func (pc *PlatformCreate) SetEditorID(id uuid.UUID) *PlatformCreate {
+	pc.mutation.SetEditorID(id)
+	return pc
+}
+
+// SetEditor sets the "editor" edge to the User entity.
+func (pc *PlatformCreate) SetEditor(u *User) *PlatformCreate {
+	return pc.SetEditorID(u.ID)
+}
+
 // SetOrganizationID sets the "organization" edge to the Organization entity by ID.
 func (pc *PlatformCreate) SetOrganizationID(id uuid.UUID) *PlatformCreate {
 	pc.mutation.SetOrganizationID(id)
@@ -198,6 +221,12 @@ func (pc *PlatformCreate) check() error {
 	if _, ok := pc.mutation.UpdatedAt(); !ok {
 		return &ValidationError{Name: "updated_at", err: errors.New(`ent: missing required field "Platform.updated_at"`)}
 	}
+	if _, ok := pc.mutation.CreatedByID(); !ok {
+		return &ValidationError{Name: "created_by_id", err: errors.New(`ent: missing required field "Platform.created_by_id"`)}
+	}
+	if _, ok := pc.mutation.UpdatedByID(); !ok {
+		return &ValidationError{Name: "updated_by_id", err: errors.New(`ent: missing required field "Platform.updated_by_id"`)}
+	}
 	if _, ok := pc.mutation.OrgID(); !ok {
 		return &ValidationError{Name: "org_id", err: errors.New(`ent: missing required field "Platform.org_id"`)}
 	}
@@ -212,12 +241,12 @@ func (pc *PlatformCreate) check() error {
 	if _, ok := pc.mutation.DisplayName(); !ok {
 		return &ValidationError{Name: "display_name", err: errors.New(`ent: missing required field "Platform.display_name"`)}
 	}
-	if _, ok := pc.mutation.CreatorID(); !ok {
-		return &ValidationError{Name: "creator_id", err: errors.New(`ent: missing required field "Platform.creator_id"`)}
-	}
 	if _, ok := pc.mutation.CreatorID(); !ok {
 		return &ValidationError{Name: "creator", err: errors.New(`ent: missing required edge "Platform.creator"`)}
 	}
+	if _, ok := pc.mutation.EditorID(); !ok {
+		return &ValidationError{Name: "editor", err: errors.New(`ent: missing required edge "Platform.editor"`)}
+	}
 	if _, ok := pc.mutation.OrganizationID(); !ok {
 		return &ValidationError{Name: "organization", err: errors.New(`ent: missing required edge "Platform.organization"`)}
 	}
@@ -303,7 +332,24 @@ func (pc *PlatformCreate) createSpec() (*Platform, *sqlgraph.CreateSpec) {
 		for _, k := range nodes {
 			edge.Target.Nodes = append(edge.Target.Nodes, k)
 		}
-		_node.CreatorID = nodes[0]
+		_node.CreatedByID = nodes[0]
+		_spec.Edges = append(_spec.Edges, edge)
+	}
+	if nodes := pc.mutation.EditorIDs(); len(nodes) > 0 {
+		edge := &sqlgraph.EdgeSpec{
+			Rel:     sqlgraph.M2O,
+			Inverse: false,
+			Table:   platform.EditorTable,
+			Columns: []string{platform.EditorColumn},
+			Bidi:    false,
+			Target: &sqlgraph.EdgeTarget{
+				IDSpec: sqlgraph.NewFieldSpec(user.FieldID, field.TypeUUID),
+			},
+		}
+		for _, k := range nodes {
+			edge.Target.Nodes = append(edge.Target.Nodes, k)
+		}
+		_node.UpdatedByID = nodes[0]
 		_spec.Edges = append(_spec.Edges, edge)
 	}
 	if nodes := pc.mutation.OrganizationIDs(); len(nodes) > 0 {
@@ -387,6 +433,18 @@ func (u *PlatformUpsert) UpdateUpdatedAt() *PlatformUpsert {
 	return u
 }

+// SetUpdatedByID sets the "updated_by_id" field.
+func (u *PlatformUpsert) SetUpdatedByID(v uuid.UUID) *PlatformUpsert {
+	u.Set(platform.FieldUpdatedByID, v)
+	return u
+}
+
+// UpdateUpdatedByID sets the "updated_by_id" field to the value that was provided on create.
+func (u *PlatformUpsert) UpdateUpdatedByID() *PlatformUpsert {
+	u.SetExcluded(platform.FieldUpdatedByID)
+	return u
+}
+
 // SetOrgID sets the "org_id" field.
 func (u *PlatformUpsert) SetOrgID(v uuid.UUID) *PlatformUpsert {
 	u.Set(platform.FieldOrgID, v)
@@ -423,20 +481,8 @@ func (u *PlatformUpsert) UpdateDisplayName() *PlatformUpsert {
 	return u
 }

-// SetCreatorID sets the "creator_id" field.
-func (u *PlatformUpsert) SetCreatorID(v uuid.UUID) *PlatformUpsert {
-	u.Set(platform.FieldCreatorID, v)
-	return u
-}
-
-// UpdateCreatorID sets the "creator_id" field to the value that was provided on create.
-func (u *PlatformUpsert) UpdateCreatorID() *PlatformUpsert {
-	u.SetExcluded(platform.FieldCreatorID)
-	return u
-}
-
 // SetForm sets the "form" field.
-func (u *PlatformUpsert) SetForm(v *holos.Form) *PlatformUpsert {
+func (u *PlatformUpsert) SetForm(v *storage.Form) *PlatformUpsert {
 	u.Set(platform.FieldForm, v)
 	return u
 }
@@ -454,7 +500,7 @@ func (u *PlatformUpsert) ClearForm() *PlatformUpsert {
 }

 // SetModel sets the "model" field.
-func (u *PlatformUpsert) SetModel(v *holos.Model) *PlatformUpsert {
+func (u *PlatformUpsert) SetModel(v *storage.Model) *PlatformUpsert {
 	u.Set(platform.FieldModel, v)
 	return u
 }
@@ -527,6 +573,9 @@ func (u *PlatformUpsertOne) UpdateNewValues() *PlatformUpsertOne {
 		if _, exists := u.create.mutation.CreatedAt(); exists {
 			s.SetIgnore(platform.FieldCreatedAt)
 		}
+		if _, exists := u.create.mutation.CreatedByID(); exists {
+			s.SetIgnore(platform.FieldCreatedByID)
+		}
 	}))
 	return u
 }
@@ -572,6 +621,20 @@ func (u *PlatformUpsertOne) UpdateUpdatedAt() *PlatformUpsertOne {
 	})
 }

+// SetUpdatedByID sets the "updated_by_id" field.
+func (u *PlatformUpsertOne) SetUpdatedByID(v uuid.UUID) *PlatformUpsertOne {
+	return u.Update(func(s *PlatformUpsert) {
+		s.SetUpdatedByID(v)
+	})
+}
+
+// UpdateUpdatedByID sets the "updated_by_id" field to the value that was provided on create.
+func (u *PlatformUpsertOne) UpdateUpdatedByID() *PlatformUpsertOne {
+	return u.Update(func(s *PlatformUpsert) {
+		s.UpdateUpdatedByID()
+	})
+}
+
 // SetOrgID sets the "org_id" field.
 func (u *PlatformUpsertOne) SetOrgID(v uuid.UUID) *PlatformUpsertOne {
 	return u.Update(func(s *PlatformUpsert) {
@@ -614,22 +677,8 @@ func (u *PlatformUpsertOne) UpdateDisplayName() *PlatformUpsertOne {
 	})
 }

-// SetCreatorID sets the "creator_id" field.
-func (u *PlatformUpsertOne) SetCreatorID(v uuid.UUID) *PlatformUpsertOne {
-	return u.Update(func(s *PlatformUpsert) {
-		s.SetCreatorID(v)
-	})
-}
-
-// UpdateCreatorID sets the "creator_id" field to the value that was provided on create.
-func (u *PlatformUpsertOne) UpdateCreatorID() *PlatformUpsertOne {
-	return u.Update(func(s *PlatformUpsert) {
-		s.UpdateCreatorID()
-	})
-}
-
 // SetForm sets the "form" field.
-func (u *PlatformUpsertOne) SetForm(v *holos.Form) *PlatformUpsertOne {
+func (u *PlatformUpsertOne) SetForm(v *storage.Form) *PlatformUpsertOne {
 	return u.Update(func(s *PlatformUpsert) {
 		s.SetForm(v)
 	})
@@ -650,7 +699,7 @@ func (u *PlatformUpsertOne) ClearForm() *PlatformUpsertOne {
 }

 // SetModel sets the "model" field.
-func (u *PlatformUpsertOne) SetModel(v *holos.Model) *PlatformUpsertOne {
+func (u *PlatformUpsertOne) SetModel(v *storage.Model) *PlatformUpsertOne {
 	return u.Update(func(s *PlatformUpsert) {
 		s.SetModel(v)
 	})
@@ -898,6 +947,9 @@ func (u *PlatformUpsertBulk) UpdateNewValues() *PlatformUpsertBulk {
 			if _, exists := b.mutation.CreatedAt(); exists {
 				s.SetIgnore(platform.FieldCreatedAt)
 			}
+			if _, exists := b.mutation.CreatedByID(); exists {
+				s.SetIgnore(platform.FieldCreatedByID)
+			}
 		}
 	}))
 	return u
@@ -944,6 +996,20 @@ func (u *PlatformUpsertBulk) UpdateUpdatedAt() *PlatformUpsertBulk {
 	})
 }

+// SetUpdatedByID sets the "updated_by_id" field.
+func (u *PlatformUpsertBulk) SetUpdatedByID(v uuid.UUID) *PlatformUpsertBulk {
+	return u.Update(func(s *PlatformUpsert) {
+		s.SetUpdatedByID(v)
+	})
+}
+
+// UpdateUpdatedByID sets the "updated_by_id" field to the value that was provided on create.
+func (u *PlatformUpsertBulk) UpdateUpdatedByID() *PlatformUpsertBulk {
+	return u.Update(func(s *PlatformUpsert) {
+		s.UpdateUpdatedByID()
+	})
+}
+
 // SetOrgID sets the "org_id" field.
 func (u *PlatformUpsertBulk) SetOrgID(v uuid.UUID) *PlatformUpsertBulk {
 	return u.Update(func(s *PlatformUpsert) {
@@ -986,22 +1052,8 @@ func (u *PlatformUpsertBulk) UpdateDisplayName() *PlatformUpsertBulk {
 	})
 }

-// SetCreatorID sets the "creator_id" field.
-func (u *PlatformUpsertBulk) SetCreatorID(v uuid.UUID) *PlatformUpsertBulk {
-	return u.Update(func(s *PlatformUpsert) {
-		s.SetCreatorID(v)
-	})
-}
-
-// UpdateCreatorID sets the "creator_id" field to the value that was provided on create.
-func (u *PlatformUpsertBulk) UpdateCreatorID() *PlatformUpsertBulk {
-	return u.Update(func(s *PlatformUpsert) {
-		s.UpdateCreatorID()
-	})
-}
-
 // SetForm sets the "form" field.
-func (u *PlatformUpsertBulk) SetForm(v *holos.Form) *PlatformUpsertBulk {
+func (u *PlatformUpsertBulk) SetForm(v *storage.Form) *PlatformUpsertBulk {
 	return u.Update(func(s *PlatformUpsert) {
 		s.SetForm(v)
 	})
@@ -1022,7 +1074,7 @@ func (u *PlatformUpsertBulk) ClearForm() *PlatformUpsertBulk {
 }

 // SetModel sets the "model" field.
-func (u *PlatformUpsertBulk) SetModel(v *holos.Model) *PlatformUpsertBulk {
+func (u *PlatformUpsertBulk) SetModel(v *storage.Model) *PlatformUpsertBulk {
 	return u.Update(func(s *PlatformUpsert) {
 		s.SetModel(v)
 	})
--- a/internal/ent/platform_query.go
+++ b/internal/ent/platform_query.go
@@ -25,6 +25,7 @@ type PlatformQuery struct {
 	inters           []Interceptor
 	predicates       []predicate.Platform
 	withCreator      *UserQuery
+	withEditor       *UserQuery
 	withOrganization *OrganizationQuery
 	// intermediate query (i.e. traversal path).
 	sql  *sql.Selector
@@ -84,6 +85,28 @@ func (pq *PlatformQuery) QueryCreator() *UserQuery {
 	return query
 }

+// QueryEditor chains the current query on the "editor" edge.
+func (pq *PlatformQuery) QueryEditor() *UserQuery {
+	query := (&UserClient{config: pq.config}).Query()
+	query.path = func(ctx context.Context) (fromU *sql.Selector, err error) {
+		if err := pq.prepareQuery(ctx); err != nil {
+			return nil, err
+		}
+		selector := pq.sqlQuery(ctx)
+		if err := selector.Err(); err != nil {
+			return nil, err
+		}
+		step := sqlgraph.NewStep(
+			sqlgraph.From(platform.Table, platform.FieldID, selector),
+			sqlgraph.To(user.Table, user.FieldID),
+			sqlgraph.Edge(sqlgraph.M2O, false, platform.EditorTable, platform.EditorColumn),
+		)
+		fromU = sqlgraph.SetNeighbors(pq.driver.Dialect(), step)
+		return fromU, nil
+	}
+	return query
+}
+
 // QueryOrganization chains the current query on the "organization" edge.
 func (pq *PlatformQuery) QueryOrganization() *OrganizationQuery {
 	query := (&OrganizationClient{config: pq.config}).Query()
@@ -299,6 +322,7 @@ func (pq *PlatformQuery) Clone() *PlatformQuery {
 		inters:           append([]Interceptor{}, pq.inters...),
 		predicates:       append([]predicate.Platform{}, pq.predicates...),
 		withCreator:      pq.withCreator.Clone(),
+		withEditor:       pq.withEditor.Clone(),
 		withOrganization: pq.withOrganization.Clone(),
 		// clone intermediate query.
 		sql:  pq.sql.Clone(),
@@ -317,6 +341,17 @@ func (pq *PlatformQuery) WithCreator(opts ...func(*UserQuery)) *PlatformQuery {
 	return pq
 }

+// WithEditor tells the query-builder to eager-load the nodes that are connected to
+// the "editor" edge. The optional arguments are used to configure the query builder of the edge.
+func (pq *PlatformQuery) WithEditor(opts ...func(*UserQuery)) *PlatformQuery {
+	query := (&UserClient{config: pq.config}).Query()
+	for _, opt := range opts {
+		opt(query)
+	}
+	pq.withEditor = query
+	return pq
+}
+
 // WithOrganization tells the query-builder to eager-load the nodes that are connected to
 // the "organization" edge. The optional arguments are used to configure the query builder of the edge.
 func (pq *PlatformQuery) WithOrganization(opts ...func(*OrganizationQuery)) *PlatformQuery {
@@ -406,8 +441,9 @@ func (pq *PlatformQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*Pla
 	var (
 		nodes       = []*Platform{}
 		_spec       = pq.querySpec()
-		loadedTypes = [2]bool{
+		loadedTypes = [3]bool{
 			pq.withCreator != nil,
+			pq.withEditor != nil,
 			pq.withOrganization != nil,
 		}
 	)
@@ -435,6 +471,12 @@ func (pq *PlatformQuery) sqlAll(ctx context.Context, hooks ...queryHook) ([]*Pla
 			return nil, err
 		}
 	}
+	if query := pq.withEditor; query != nil {
+		if err := pq.loadEditor(ctx, query, nodes, nil,
+			func(n *Platform, e *User) { n.Edges.Editor = e }); err != nil {
+			return nil, err
+		}
+	}
 	if query := pq.withOrganization; query != nil {
 		if err := pq.loadOrganization(ctx, query, nodes, nil,
 			func(n *Platform, e *Organization) { n.Edges.Organization = e }); err != nil {
@@ -448,7 +490,7 @@ func (pq *PlatformQuery) loadCreator(ctx context.Context, query *UserQuery, node
 	ids := make([]uuid.UUID, 0, len(nodes))
 	nodeids := make(map[uuid.UUID][]*Platform)
 	for i := range nodes {
-		fk := nodes[i].CreatorID
+		fk := nodes[i].CreatedByID
 		if _, ok := nodeids[fk]; !ok {
 			ids = append(ids, fk)
 		}
@@ -465,7 +507,36 @@ func (pq *PlatformQuery) loadCreator(ctx context.Context, query *UserQuery, node
 	for _, n := range neighbors {
 		nodes, ok := nodeids[n.ID]
 		if !ok {
-			return fmt.Errorf(`unexpected foreign-key "creator_id" returned %v`, n.ID)
+			return fmt.Errorf(`unexpected foreign-key "created_by_id" returned %v`, n.ID)
+		}
+		for i := range nodes {
+			assign(nodes[i], n)
+		}
+	}
+	return nil
+}
+func (pq *PlatformQuery) loadEditor(ctx context.Context, query *UserQuery, nodes []*Platform, init func(*Platform), assign func(*Platform, *User)) error {
+	ids := make([]uuid.UUID, 0, len(nodes))
+	nodeids := make(map[uuid.UUID][]*Platform)
+	for i := range nodes {
+		fk := nodes[i].UpdatedByID
+		if _, ok := nodeids[fk]; !ok {
+			ids = append(ids, fk)
+		}
+		nodeids[fk] = append(nodeids[fk], nodes[i])
+	}
+	if len(ids) == 0 {
+		return nil
+	}
+	query.Where(user.IDIn(ids...))
+	neighbors, err := query.All(ctx)
+	if err != nil {
+		return err
+	}
+	for _, n := range neighbors {
+		nodes, ok := nodeids[n.ID]
+		if !ok {
+			return fmt.Errorf(`unexpected foreign-key "updated_by_id" returned %v`, n.ID)
 		}
 		for i := range nodes {
 			assign(nodes[i], n)
@@ -529,7 +600,10 @@ func (pq *PlatformQuery) querySpec() *sqlgraph.QuerySpec {
 			}
 		}
 		if pq.withCreator != nil {
-			_spec.Node.AddColumnOnce(platform.FieldCreatorID)
+			_spec.Node.AddColumnOnce(platform.FieldCreatedByID)
+		}
+		if pq.withEditor != nil {
+			_spec.Node.AddColumnOnce(platform.FieldUpdatedByID)
 		}
 		if pq.withOrganization != nil {
 			_spec.Node.AddColumnOnce(platform.FieldOrgID)
--- a/internal/ent/platform_update.go
+++ b/internal/ent/platform_update.go
@@ -16,7 +16,7 @@ import (
 	"github.com/holos-run/holos/internal/ent/platform"
 	"github.com/holos-run/holos/internal/ent/predicate"
 	"github.com/holos-run/holos/internal/ent/user"
-	holos "github.com/holos-run/holos/service/gen/holos/v1alpha1"
+	storage "github.com/holos-run/holos/service/gen/holos/storage/v1alpha1"
 )

 // PlatformUpdate is the builder for updating Platform entities.
@@ -38,6 +38,20 @@ func (pu *PlatformUpdate) SetUpdatedAt(t time.Time) *PlatformUpdate {
 	return pu
 }

+// SetUpdatedByID sets the "updated_by_id" field.
+func (pu *PlatformUpdate) SetUpdatedByID(u uuid.UUID) *PlatformUpdate {
+	pu.mutation.SetUpdatedByID(u)
+	return pu
+}
+
+// SetNillableUpdatedByID sets the "updated_by_id" field if the given value is not nil.
+func (pu *PlatformUpdate) SetNillableUpdatedByID(u *uuid.UUID) *PlatformUpdate {
+	if u != nil {
+		pu.SetUpdatedByID(*u)
+	}
+	return pu
+}
+
 // SetOrgID sets the "org_id" field.
 func (pu *PlatformUpdate) SetOrgID(u uuid.UUID) *PlatformUpdate {
 	pu.mutation.SetOrgID(u)
@@ -80,23 +94,9 @@ func (pu *PlatformUpdate) SetNillableDisplayName(s *string) *PlatformUpdate {
 	return pu
 }

-// SetCreatorID sets the "creator_id" field.
-func (pu *PlatformUpdate) SetCreatorID(u uuid.UUID) *PlatformUpdate {
-	pu.mutation.SetCreatorID(u)
-	return pu
-}
-
-// SetNillableCreatorID sets the "creator_id" field if the given value is not nil.
-func (pu *PlatformUpdate) SetNillableCreatorID(u *uuid.UUID) *PlatformUpdate {
-	if u != nil {
-		pu.SetCreatorID(*u)
-	}
-	return pu
-}
-
 // SetForm sets the "form" field.
-func (pu *PlatformUpdate) SetForm(h *holos.Form) *PlatformUpdate {
-	pu.mutation.SetForm(h)
+func (pu *PlatformUpdate) SetForm(s *storage.Form) *PlatformUpdate {
+	pu.mutation.SetForm(s)
 	return pu
 }

@@ -107,8 +107,8 @@ func (pu *PlatformUpdate) ClearForm() *PlatformUpdate {
 }

 // SetModel sets the "model" field.
-func (pu *PlatformUpdate) SetModel(h *holos.Model) *PlatformUpdate {
-	pu.mutation.SetModel(h)
+func (pu *PlatformUpdate) SetModel(s *storage.Model) *PlatformUpdate {
+	pu.mutation.SetModel(s)
 	return pu
 }

@@ -150,9 +150,15 @@ func (pu *PlatformUpdate) ClearCueDefinition() *PlatformUpdate {
 	return pu
 }

-// SetCreator sets the "creator" edge to the User entity.
-func (pu *PlatformUpdate) SetCreator(u *User) *PlatformUpdate {
-	return pu.SetCreatorID(u.ID)
+// SetEditorID sets the "editor" edge to the User entity by ID.
+func (pu *PlatformUpdate) SetEditorID(id uuid.UUID) *PlatformUpdate {
+	pu.mutation.SetEditorID(id)
+	return pu
+}
+
+// SetEditor sets the "editor" edge to the User entity.
+func (pu *PlatformUpdate) SetEditor(u *User) *PlatformUpdate {
+	return pu.SetEditorID(u.ID)
 }

 // SetOrganizationID sets the "organization" edge to the Organization entity by ID.
@@ -171,9 +177,9 @@ func (pu *PlatformUpdate) Mutation() *PlatformMutation {
 	return pu.mutation
 }

-// ClearCreator clears the "creator" edge to the User entity.
-func (pu *PlatformUpdate) ClearCreator() *PlatformUpdate {
-	pu.mutation.ClearCreator()
+// ClearEditor clears the "editor" edge to the User entity.
+func (pu *PlatformUpdate) ClearEditor() *PlatformUpdate {
+	pu.mutation.ClearEditor()
 	return pu
 }

@@ -229,6 +235,9 @@ func (pu *PlatformUpdate) check() error {
 	if _, ok := pu.mutation.CreatorID(); pu.mutation.CreatorCleared() && !ok {
 		return errors.New(`ent: clearing a required unique edge "Platform.creator"`)
 	}
+	if _, ok := pu.mutation.EditorID(); pu.mutation.EditorCleared() && !ok {
+		return errors.New(`ent: clearing a required unique edge "Platform.editor"`)
+	}
 	if _, ok := pu.mutation.OrganizationID(); pu.mutation.OrganizationCleared() && !ok {
 		return errors.New(`ent: clearing a required unique edge "Platform.organization"`)
 	}
@@ -280,12 +289,12 @@ func (pu *PlatformUpdate) sqlSave(ctx context.Context) (n int, err error) {
 	if pu.mutation.CueDefinitionCleared() {
 		_spec.ClearField(platform.FieldCueDefinition, field.TypeString)
 	}
-	if pu.mutation.CreatorCleared() {
+	if pu.mutation.EditorCleared() {
 		edge := &sqlgraph.EdgeSpec{
 			Rel:     sqlgraph.M2O,
 			Inverse: false,
-			Table:   platform.CreatorTable,
-			Columns: []string{platform.CreatorColumn},
+			Table:   platform.EditorTable,
+			Columns: []string{platform.EditorColumn},
 			Bidi:    false,
 			Target: &sqlgraph.EdgeTarget{
 				IDSpec: sqlgraph.NewFieldSpec(user.FieldID, field.TypeUUID),
@@ -293,12 +302,12 @@ func (pu *PlatformUpdate) sqlSave(ctx context.Context) (n int, err error) {
 		}
 		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
 	}
-	if nodes := pu.mutation.CreatorIDs(); len(nodes) > 0 {
+	if nodes := pu.mutation.EditorIDs(); len(nodes) > 0 {
 		edge := &sqlgraph.EdgeSpec{
 			Rel:     sqlgraph.M2O,
 			Inverse: false,
-			Table:   platform.CreatorTable,
-			Columns: []string{platform.CreatorColumn},
+			Table:   platform.EditorTable,
+			Columns: []string{platform.EditorColumn},
 			Bidi:    false,
 			Target: &sqlgraph.EdgeTarget{
 				IDSpec: sqlgraph.NewFieldSpec(user.FieldID, field.TypeUUID),
@@ -364,6 +373,20 @@ func (puo *PlatformUpdateOne) SetUpdatedAt(t time.Time) *PlatformUpdateOne {
 	return puo
 }

+// SetUpdatedByID sets the "updated_by_id" field.
+func (puo *PlatformUpdateOne) SetUpdatedByID(u uuid.UUID) *PlatformUpdateOne {
+	puo.mutation.SetUpdatedByID(u)
+	return puo
+}
+
+// SetNillableUpdatedByID sets the "updated_by_id" field if the given value is not nil.
+func (puo *PlatformUpdateOne) SetNillableUpdatedByID(u *uuid.UUID) *PlatformUpdateOne {
+	if u != nil {
+		puo.SetUpdatedByID(*u)
+	}
+	return puo
+}
+
 // SetOrgID sets the "org_id" field.
 func (puo *PlatformUpdateOne) SetOrgID(u uuid.UUID) *PlatformUpdateOne {
 	puo.mutation.SetOrgID(u)
@@ -406,23 +429,9 @@ func (puo *PlatformUpdateOne) SetNillableDisplayName(s *string) *PlatformUpdateO
 	return puo
 }

-// SetCreatorID sets the "creator_id" field.
-func (puo *PlatformUpdateOne) SetCreatorID(u uuid.UUID) *PlatformUpdateOne {
-	puo.mutation.SetCreatorID(u)
-	return puo
-}
-
-// SetNillableCreatorID sets the "creator_id" field if the given value is not nil.
-func (puo *PlatformUpdateOne) SetNillableCreatorID(u *uuid.UUID) *PlatformUpdateOne {
-	if u != nil {
-		puo.SetCreatorID(*u)
-	}
-	return puo
-}
-
 // SetForm sets the "form" field.
-func (puo *PlatformUpdateOne) SetForm(h *holos.Form) *PlatformUpdateOne {
-	puo.mutation.SetForm(h)
+func (puo *PlatformUpdateOne) SetForm(s *storage.Form) *PlatformUpdateOne {
+	puo.mutation.SetForm(s)
 	return puo
 }

@@ -433,8 +442,8 @@ func (puo *PlatformUpdateOne) ClearForm() *PlatformUpdateOne {
 }

 // SetModel sets the "model" field.
-func (puo *PlatformUpdateOne) SetModel(h *holos.Model) *PlatformUpdateOne {
-	puo.mutation.SetModel(h)
+func (puo *PlatformUpdateOne) SetModel(s *storage.Model) *PlatformUpdateOne {
+	puo.mutation.SetModel(s)
 	return puo
 }

@@ -476,9 +485,15 @@ func (puo *PlatformUpdateOne) ClearCueDefinition() *PlatformUpdateOne {
 	return puo
 }

-// SetCreator sets the "creator" edge to the User entity.
-func (puo *PlatformUpdateOne) SetCreator(u *User) *PlatformUpdateOne {
-	return puo.SetCreatorID(u.ID)
+// SetEditorID sets the "editor" edge to the User entity by ID.
+func (puo *PlatformUpdateOne) SetEditorID(id uuid.UUID) *PlatformUpdateOne {
+	puo.mutation.SetEditorID(id)
+	return puo
+}
+
+// SetEditor sets the "editor" edge to the User entity.
+func (puo *PlatformUpdateOne) SetEditor(u *User) *PlatformUpdateOne {
+	return puo.SetEditorID(u.ID)
 }

 // SetOrganizationID sets the "organization" edge to the Organization entity by ID.
@@ -497,9 +512,9 @@ func (puo *PlatformUpdateOne) Mutation() *PlatformMutation {
 	return puo.mutation
 }

-// ClearCreator clears the "creator" edge to the User entity.
-func (puo *PlatformUpdateOne) ClearCreator() *PlatformUpdateOne {
-	puo.mutation.ClearCreator()
+// ClearEditor clears the "editor" edge to the User entity.
+func (puo *PlatformUpdateOne) ClearEditor() *PlatformUpdateOne {
+	puo.mutation.ClearEditor()
 	return puo
 }

@@ -568,6 +583,9 @@ func (puo *PlatformUpdateOne) check() error {
 	if _, ok := puo.mutation.CreatorID(); puo.mutation.CreatorCleared() && !ok {
 		return errors.New(`ent: clearing a required unique edge "Platform.creator"`)
 	}
+	if _, ok := puo.mutation.EditorID(); puo.mutation.EditorCleared() && !ok {
+		return errors.New(`ent: clearing a required unique edge "Platform.editor"`)
+	}
 	if _, ok := puo.mutation.OrganizationID(); puo.mutation.OrganizationCleared() && !ok {
 		return errors.New(`ent: clearing a required unique edge "Platform.organization"`)
 	}
@@ -636,12 +654,12 @@ func (puo *PlatformUpdateOne) sqlSave(ctx context.Context) (_node *Platform, err
 	if puo.mutation.CueDefinitionCleared() {
 		_spec.ClearField(platform.FieldCueDefinition, field.TypeString)
 	}
-	if puo.mutation.CreatorCleared() {
+	if puo.mutation.EditorCleared() {
 		edge := &sqlgraph.EdgeSpec{
 			Rel:     sqlgraph.M2O,
 			Inverse: false,
-			Table:   platform.CreatorTable,
-			Columns: []string{platform.CreatorColumn},
+			Table:   platform.EditorTable,
+			Columns: []string{platform.EditorColumn},
 			Bidi:    false,
 			Target: &sqlgraph.EdgeTarget{
 				IDSpec: sqlgraph.NewFieldSpec(user.FieldID, field.TypeUUID),
@@ -649,12 +667,12 @@ func (puo *PlatformUpdateOne) sqlSave(ctx context.Context) (_node *Platform, err
 		}
 		_spec.Edges.Clear = append(_spec.Edges.Clear, edge)
 	}
-	if nodes := puo.mutation.CreatorIDs(); len(nodes) > 0 {
+	if nodes := puo.mutation.EditorIDs(); len(nodes) > 0 {
 		edge := &sqlgraph.EdgeSpec{
 			Rel:     sqlgraph.M2O,
 			Inverse: false,
-			Table:   platform.CreatorTable,
-			Columns: []string{platform.CreatorColumn},
+			Table:   platform.EditorTable,
+			Columns: []string{platform.EditorColumn},
 			Bidi:    false,
 			Target: &sqlgraph.EdgeTarget{
 				IDSpec: sqlgraph.NewFieldSpec(user.FieldID, field.TypeUUID),
--- a/internal/ent/schema/mixin.go
+++ b/internal/ent/schema/mixin.go
@@ -4,6 +4,7 @@ import (
 	"time"

 	"entgo.io/ent"
+	"entgo.io/ent/schema/edge"
 	"entgo.io/ent/schema/field"
 	"entgo.io/ent/schema/mixin"
 	"github.com/gofrs/uuid"
@@ -13,23 +14,25 @@ func newUUID() uuid.UUID {
 	return uuid.Must(uuid.NewV7())
 }

-type BaseMixin struct {
+// IDMixin mixes in an id field with a server generated default.  All resource
+// objects in the storage system should be identified by a uuid.
+type IDMixin struct {
 	mixin.Schema
 }

-func (BaseMixin) Fields() []ent.Field {
+func (IDMixin) Fields() []ent.Field {
 	return []ent.Field{
 		// id represents the identity of the entity.
 		field.UUID("id", uuid.UUID{}).Default(newUUID),
 	}
 }

-// TimeMixin adds created_at and updated_at fields.
-type TimeMixin struct {
+// TimestampMixin adds created_at and updated_at fields.
+type TimestampMixin struct {
 	mixin.Schema
 }

-func (TimeMixin) Fields() []ent.Field {
+func (TimestampMixin) Fields() []ent.Field {
 	return []ent.Field{
 		field.Time("created_at").
 			Immutable().
@@ -39,3 +42,30 @@ func (TimeMixin) Fields() []ent.Field {
 			UpdateDefault(time.Now),
 	}
 }
+
+// EditorMixin adds created_by_id and updated_by_id fields representing the user
+// who created or last modified the resource.
+type EditorMixin struct {
+	mixin.Schema
+}
+
+func (EditorMixin) Fields() []ent.Field {
+	return []ent.Field{
+		field.UUID("created_by_id", uuid.UUID{}).Immutable(),
+		field.UUID("updated_by_id", uuid.UUID{}),
+	}
+}
+
+func (EditorMixin) Edges() []ent.Edge {
+	return []ent.Edge{
+		edge.To("creator", User.Type).
+			Field("created_by_id").
+			Immutable().
+			Unique().
+			Required(),
+		edge.To("editor", User.Type).
+			Field("updated_by_id").
+			Unique().
+			Required(),
+	}
+}
--- a/internal/ent/schema/organization.go
+++ b/internal/ent/schema/organization.go
@@ -4,7 +4,6 @@ import (
 	"entgo.io/ent"
 	"entgo.io/ent/schema/edge"
 	"entgo.io/ent/schema/field"
-	"github.com/gofrs/uuid"
 )

 // Organization represents an organization account.
@@ -14,8 +13,9 @@ type Organization struct {

 func (Organization) Mixin() []ent.Mixin {
 	return []ent.Mixin{
-		BaseMixin{},
-		TimeMixin{},
+		IDMixin{},
+		TimestampMixin{},
+		EditorMixin{},
 	}
 }

@@ -23,16 +23,11 @@ func (Organization) Fields() []ent.Field {
 	return []ent.Field{
 		field.String("name").NotEmpty().Unique(),
 		field.String("display_name"),
-		field.UUID("creator_id", uuid.UUID{}),
 	}
 }

 func (Organization) Edges() []ent.Edge {
 	return []ent.Edge{
-		edge.To("creator", User.Type).
-			Field("creator_id").
-			Unique().
-			Required(),
 		edge.To("users", User.Type),
 		edge.From("platforms", Platform.Type).
 			Ref("organization"),
--- a/internal/ent/schema/platform.go
+++ b/internal/ent/schema/platform.go
@@ -6,7 +6,7 @@ import (
 	"entgo.io/ent/schema/field"
 	"entgo.io/ent/schema/index"
 	"github.com/gofrs/uuid"
-	holos "github.com/holos-run/holos/service/gen/holos/v1alpha1"
+	storage "github.com/holos-run/holos/service/gen/holos/storage/v1alpha1"
 )

 type Platform struct {
@@ -15,8 +15,9 @@ type Platform struct {

 func (Platform) Mixin() []ent.Mixin {
 	return []ent.Mixin{
-		BaseMixin{},
-		TimeMixin{},
+		IDMixin{},
+		TimestampMixin{},
+		EditorMixin{},
 	}
 }

@@ -25,11 +26,10 @@ func (Platform) Fields() []ent.Field {
 		field.UUID("org_id", uuid.UUID{}),
 		field.String("name").NotEmpty(),
 		field.String("display_name"),
-		field.UUID("creator_id", uuid.UUID{}),
-		field.JSON("form", &holos.Form{}).
+		field.JSON("form", &storage.Form{}).
 			Optional().
 			Comment("JSON representation of FormlyFormConfig[] refer to https://github.com/holos-run/holos/issues/161"),
-		field.JSON("model", &holos.Model{}).
+		field.JSON("model", &storage.Model{}).
 			Optional().
 			Comment("JSON representation of the form model which holds user input values refer to https://github.com/holos-run/holos/issues/161"),
 		field.Bytes("cue").
@@ -43,10 +43,6 @@ func (Platform) Fields() []ent.Field {

 func (Platform) Edges() []ent.Edge {
 	return []ent.Edge{
-		edge.To("creator", User.Type).
-			Field("creator_id").
-			Unique().
-			Required(),
 		edge.To("organization", Organization.Type).
 			Field("org_id").
 			Unique().
--- a/internal/ent/schema/user.go
+++ b/internal/ent/schema/user.go
@@ -16,8 +16,8 @@ type User struct {

 func (User) Mixin() []ent.Mixin {
 	return []ent.Mixin{
-		BaseMixin{},
-		TimeMixin{},
+		IDMixin{},
+		TimestampMixin{},
 	}
 }

--- a/internal/frontend/holos/angular.json
+++ b/internal/frontend/holos/angular.json
@@ -116,6 +116,7 @@
  "cli": {
    "schematicCollections": [
      "@angular-eslint/schematics"
-    ]
+    ],
+    "analytics": false
  }
 }
--- a/internal/frontend/holos/package-lock.json
+++ b/internal/frontend/holos/package-lock.json
@@ -20,7 +20,7 @@
        "@angular/router": "^17.3.0",
        "@bufbuild/protobuf": "^1.9.0",
        "@connectrpc/connect": "^1.4.0",
-        "@connectrpc/connect-query": "^1.3.1",
+        "@connectrpc/connect-query": "^1.4.0",
        "@connectrpc/connect-web": "^1.4.0",
        "@ngx-formly/core": "^6.3.0",
        "@ngx-formly/material": "^6.3.0",
@@ -40,7 +40,7 @@
        "@bufbuild/buf": "^1.31.0",
        "@bufbuild/protoc-gen-es": "^1.9.0",
        "@connectrpc/protoc-gen-connect-es": "^1.4.0",
-        "@connectrpc/protoc-gen-connect-query": "^1.3.1",
+        "@connectrpc/protoc-gen-connect-query": "^1.4.0",
        "@ngx-formly/schematics": "^6.3.0",
        "@types/jasmine": "~5.1.0",
        "@typescript-eslint/eslint-plugin": "7.2.0",
@@ -2669,9 +2669,9 @@
      }
    },
    "node_modules/@connectrpc/connect-query": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/@connectrpc/connect-query/-/connect-query-1.3.1.tgz",
-      "integrity": "sha512-VAogPNGVfnH2satUhXuG+ZUMj63xmTMl4McqyzCYw0ezzqt8i/tpbpf6OetlbvO45TTUYwaR4cAbzu8AgMNaFQ==",
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/@connectrpc/connect-query/-/connect-query-1.4.0.tgz",
+      "integrity": "sha512-ij3Iktvqz++FELpe2kDIVq1pTH5RpfvUALfoZh6u7TyqDXsz6j9ZiKgqHWZkdFo0cUaXMtMpCBLIGd/klCkx3Q==",
      "dependencies": {
        "stable-hash": "^0.0.4"
      },
@@ -2679,8 +2679,8 @@
        "@bufbuild/protobuf": "^1.3.3",
        "@connectrpc/connect": "^1.1.2",
        "@tanstack/react-query": "5.x",
-        "react": "^18.2.0",
-        "react-dom": "^18.2.0"
+        "react": "^18.3.1",
+        "react-dom": "^18.3.1"
      }
    },
    "node_modules/@connectrpc/connect-web": {
@@ -2721,13 +2721,13 @@
      }
    },
    "node_modules/@connectrpc/protoc-gen-connect-query": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/@connectrpc/protoc-gen-connect-query/-/protoc-gen-connect-query-1.3.1.tgz",
-      "integrity": "sha512-/b4Fcud56MsHrpww2tmgMNB4Blb1mYcHmKGLWTJfbCy6ZOMXpp8cXLFEsvcC3dy0dZJZqqXmoROQ8SXHL4RLig==",
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/@connectrpc/protoc-gen-connect-query/-/protoc-gen-connect-query-1.4.0.tgz",
+      "integrity": "sha512-w/nsyo2p7pzkvu/kf5DtzPlGt5VaaXDHlsg8z7vJQIHgwfFgOfqRCyyw1y2mT6G9JFU3opdtKOcLlJJYfobRxg==",
      "dev": true,
      "dependencies": {
-        "@bufbuild/protobuf": "^1.7.2",
-        "@bufbuild/protoplugin": "^1.7.2"
+        "@bufbuild/protobuf": "^1.9.0",
+        "@bufbuild/protoplugin": "^1.9.0"
      },
      "bin": {
        "protoc-gen-connect-query": "bin/protoc-gen-connect-query"
@@ -13003,9 +13003,9 @@
      }
    },
    "node_modules/react": {
-      "version": "18.2.0",
-      "resolved": "https://registry.npmjs.org/react/-/react-18.2.0.tgz",
-      "integrity": "sha512-/3IjMdb2L9QbBdWiW5e3P2/npwMBaU9mHCSCUzNln0ZCYbcfTsGbTJrU/kGemdH2IWmB2ioZ+zkxtmq6g09fGQ==",
+      "version": "18.3.1",
+      "resolved": "https://registry.npmjs.org/react/-/react-18.3.1.tgz",
+      "integrity": "sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==",
      "peer": true,
      "dependencies": {
        "loose-envify": "^1.1.0"
@@ -13015,16 +13015,16 @@
      }
    },
    "node_modules/react-dom": {
-      "version": "18.2.0",
-      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-18.2.0.tgz",
-      "integrity": "sha512-6IMTriUmvsjHUjNtEDudZfuDQUoWXVxKHhlEGSk81n4YFS+r/Kl99wXiwlVXtPBtJenozv2P+hxDsw9eA7Xo6g==",
+      "version": "18.3.1",
+      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-18.3.1.tgz",
+      "integrity": "sha512-5m4nQKp+rZRb09LNH59GM4BxTh9251/ylbKIbpe7TpGxfJ+9kv6BLkLBXIjjspbgbnIBNqlI23tRnTWT0snUIw==",
      "peer": true,
      "dependencies": {
        "loose-envify": "^1.1.0",
-        "scheduler": "^0.23.0"
+        "scheduler": "^0.23.2"
      },
      "peerDependencies": {
-        "react": "^18.2.0"
+        "react": "^18.3.1"
      }
    },
    "node_modules/react-is": {
@@ -13540,9 +13540,9 @@
      "optional": true
    },
    "node_modules/scheduler": {
-      "version": "0.23.0",
-      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.23.0.tgz",
-      "integrity": "sha512-CtuThmgHNg7zIZWAXi3AsyIzA3n4xx7aNyjwC2VJldO2LMVDhFK+63xGqq6CsJH4rTAt6/M+N4GhZiDYPx9eUw==",
+      "version": "0.23.2",
+      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.23.2.tgz",
+      "integrity": "sha512-UOShsPwz7NrMUqhR6t0hWjFduvOzbtv7toDH1/hIrfRNIDBnnBWd0CwJTGvTpngVlmwGCdP9/Zl/tVrDqcuYzQ==",
      "peer": true,
      "dependencies": {
        "loose-envify": "^1.1.0"
--- a/internal/frontend/holos/package.json
+++ b/internal/frontend/holos/package.json
@@ -23,7 +23,7 @@
    "@angular/router": "^17.3.0",
    "@bufbuild/protobuf": "^1.9.0",
    "@connectrpc/connect": "^1.4.0",
-    "@connectrpc/connect-query": "^1.3.1",
+    "@connectrpc/connect-query": "^1.4.0",
    "@connectrpc/connect-web": "^1.4.0",
    "@ngx-formly/core": "^6.3.0",
    "@ngx-formly/material": "^6.3.0",
@@ -43,7 +43,7 @@
    "@bufbuild/buf": "^1.31.0",
    "@bufbuild/protoc-gen-es": "^1.9.0",
    "@connectrpc/protoc-gen-connect-es": "^1.4.0",
-    "@connectrpc/protoc-gen-connect-query": "^1.3.1",
+    "@connectrpc/protoc-gen-connect-query": "^1.4.0",
    "@ngx-formly/schematics": "^6.3.0",
    "@types/jasmine": "~5.1.0",
    "@typescript-eslint/eslint-plugin": "7.2.0",
@@ -57,4 +57,4 @@
    "karma-jasmine-html-reporter": "~2.1.0",
    "typescript": "~5.4.2"
  }
-}
+}
--- a/internal/frontend/holos/src/app/app.config.ts
+++ b/internal/frontend/holos/src/app/app.config.ts
@@ -6,9 +6,9 @@ import { routes } from './app.routes';
 import { provideAnimationsAsync } from '@angular/platform-browser/animations/async';
 import { ConnectModule } from '../connect/connect.module';
 import { provideClient } from "../connect/client.provider";
-import { UserService } from './gen/holos/v1alpha1/user_connect';
-import { OrganizationService } from './gen/holos/v1alpha1/organization_connect';
-import { PlatformService } from './gen/holos/v1alpha1/platform_connect';
+import { UserService } from './gen/holos/user/v1alpha1/user_service_connect';
+import { OrganizationService } from './gen/holos/organization/v1alpha1/organization_service_connect';
+import { PlatformService } from './gen/holos/platform/v1alpha1/platform_service_connect';
 import { HolosPanelWrapperComponent } from '../wrappers/holos-panel-wrapper/holos-panel-wrapper.component';

 export const appConfig: ApplicationConfig = {
--- a/internal/frontend/holos/src/app/gen/holos/object/v1alpha1/object_pb.ts
+++ b/internal/frontend/holos/src/app/gen/holos/object/v1alpha1/object_pb.ts
@@ -0,0 +1,327 @@
+// @generated by protoc-gen-es v1.9.0 with parameter "target=ts"
+// @generated from file holos/object/v1alpha1/object.proto (package holos.object.v1alpha1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import type { BinaryReadOptions, FieldList, JsonReadOptions, JsonValue, PartialMessage, PlainMessage } from "@bufbuild/protobuf";
+import { Message, proto3, Timestamp } from "@bufbuild/protobuf";
+
+/**
+ * @generated from message holos.object.v1alpha1.Detail
+ */
+export class Detail extends Message<Detail> {
+  /**
+   * Created by entity
+   *
+   * @generated from field: optional holos.object.v1alpha1.ResourceEditor created_by = 1;
+   */
+  createdBy?: ResourceEditor;
+
+  /**
+   * Created at timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp created_at = 2;
+   */
+  createdAt?: Timestamp;
+
+  /**
+   * Updated by entity
+   *
+   * @generated from field: optional holos.object.v1alpha1.ResourceEditor updated_by = 3;
+   */
+  updatedBy?: ResourceEditor;
+
+  /**
+   * Updated at timestamp
+   *
+   * @generated from field: google.protobuf.Timestamp updated_at = 4;
+   */
+  updatedAt?: Timestamp;
+
+  constructor(data?: PartialMessage<Detail>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.object.v1alpha1.Detail";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "created_by", kind: "message", T: ResourceEditor, opt: true },
+    { no: 2, name: "created_at", kind: "message", T: Timestamp },
+    { no: 3, name: "updated_by", kind: "message", T: ResourceEditor, opt: true },
+    { no: 4, name: "updated_at", kind: "message", T: Timestamp },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): Detail {
+    return new Detail().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): Detail {
+    return new Detail().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): Detail {
+    return new Detail().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: Detail | PlainMessage<Detail> | undefined, b: Detail | PlainMessage<Detail> | undefined): boolean {
+    return proto3.util.equals(Detail, a, b);
+  }
+}
+
+/**
+ * Subject represents the oidc iss and sub claims which uniquely identify a subject.
+ *
+ * @generated from message holos.object.v1alpha1.Subject
+ */
+export class Subject extends Message<Subject> {
+  /**
+   * iss represents the oidc id token iss claim.  Limits defined at
+   * https://openid.net/specs/openid-authentication-1_1.html#limits
+   *
+   * @generated from field: string iss = 1;
+   */
+  iss = "";
+
+  /**
+   * sub represents the oidc id token sub claim.
+   *
+   * @generated from field: string sub = 2;
+   */
+  sub = "";
+
+  constructor(data?: PartialMessage<Subject>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.object.v1alpha1.Subject";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "iss", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 2, name: "sub", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): Subject {
+    return new Subject().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): Subject {
+    return new Subject().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): Subject {
+    return new Subject().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: Subject | PlainMessage<Subject> | undefined, b: Subject | PlainMessage<Subject> | undefined): boolean {
+    return proto3.util.equals(Subject, a, b);
+  }
+}
+
+/**
+ * UserRef refers to a User by uuid, email, or by the oidc iss and sub claims.
+ *
+ * @generated from message holos.object.v1alpha1.UserRef
+ */
+export class UserRef extends Message<UserRef> {
+  /**
+   * @generated from oneof holos.object.v1alpha1.UserRef.user
+   */
+  user: {
+    /**
+     * @generated from field: string user_id = 1;
+     */
+    value: string;
+    case: "userId";
+  } | {
+    /**
+     * @generated from field: string email = 2;
+     */
+    value: string;
+    case: "email";
+  } | {
+    /**
+     * @generated from field: holos.object.v1alpha1.Subject subject = 3;
+     */
+    value: Subject;
+    case: "subject";
+  } | { case: undefined; value?: undefined } = { case: undefined };
+
+  constructor(data?: PartialMessage<UserRef>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.object.v1alpha1.UserRef";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "user_id", kind: "scalar", T: 9 /* ScalarType.STRING */, oneof: "user" },
+    { no: 2, name: "email", kind: "scalar", T: 9 /* ScalarType.STRING */, oneof: "user" },
+    { no: 3, name: "subject", kind: "message", T: Subject, oneof: "user" },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): UserRef {
+    return new UserRef().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): UserRef {
+    return new UserRef().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): UserRef {
+    return new UserRef().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: UserRef | PlainMessage<UserRef> | undefined, b: UserRef | PlainMessage<UserRef> | undefined): boolean {
+    return proto3.util.equals(UserRef, a, b);
+  }
+}
+
+/**
+ * Organization represents the ways in which a organization may be uniquely identified in the system.
+ *
+ * @generated from message holos.object.v1alpha1.OrganizationRef
+ */
+export class OrganizationRef extends Message<OrganizationRef> {
+  /**
+   * @generated from oneof holos.object.v1alpha1.OrganizationRef.org
+   */
+  org: {
+    /**
+     * @generated from field: string org_id = 1;
+     */
+    value: string;
+    case: "orgId";
+  } | {
+    /**
+     * @generated from field: string org_name = 2;
+     */
+    value: string;
+    case: "orgName";
+  } | { case: undefined; value?: undefined } = { case: undefined };
+
+  constructor(data?: PartialMessage<OrganizationRef>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.object.v1alpha1.OrganizationRef";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "org_id", kind: "scalar", T: 9 /* ScalarType.STRING */, oneof: "org" },
+    { no: 2, name: "org_name", kind: "scalar", T: 9 /* ScalarType.STRING */, oneof: "org" },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): OrganizationRef {
+    return new OrganizationRef().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): OrganizationRef {
+    return new OrganizationRef().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): OrganizationRef {
+    return new OrganizationRef().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: OrganizationRef | PlainMessage<OrganizationRef> | undefined, b: OrganizationRef | PlainMessage<OrganizationRef> | undefined): boolean {
+    return proto3.util.equals(OrganizationRef, a, b);
+  }
+}
+
+/**
+ * ResourceEditor represents the entity that most recently created or edited a resource.
+ *
+ * @generated from message holos.object.v1alpha1.ResourceEditor
+ */
+export class ResourceEditor extends Message<ResourceEditor> {
+  /**
+   * @generated from oneof holos.object.v1alpha1.ResourceEditor.editor
+   */
+  editor: {
+    /**
+     * @generated from field: string user_id = 1;
+     */
+    value: string;
+    case: "userId";
+  } | { case: undefined; value?: undefined } = { case: undefined };
+
+  constructor(data?: PartialMessage<ResourceEditor>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.object.v1alpha1.ResourceEditor";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "user_id", kind: "scalar", T: 9 /* ScalarType.STRING */, oneof: "editor" },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): ResourceEditor {
+    return new ResourceEditor().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): ResourceEditor {
+    return new ResourceEditor().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): ResourceEditor {
+    return new ResourceEditor().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: ResourceEditor | PlainMessage<ResourceEditor> | undefined, b: ResourceEditor | PlainMessage<ResourceEditor> | undefined): boolean {
+    return proto3.util.equals(ResourceEditor, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.object.v1alpha1.ResourceOwner
+ */
+export class ResourceOwner extends Message<ResourceOwner> {
+  /**
+   * @generated from oneof holos.object.v1alpha1.ResourceOwner.resource_owner
+   */
+  resourceOwner: {
+    /**
+     * @generated from field: string org_id = 1;
+     */
+    value: string;
+    case: "orgId";
+  } | {
+    /**
+     * @generated from field: string user_id = 2;
+     */
+    value: string;
+    case: "userId";
+  } | { case: undefined; value?: undefined } = { case: undefined };
+
+  constructor(data?: PartialMessage<ResourceOwner>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.object.v1alpha1.ResourceOwner";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "org_id", kind: "scalar", T: 9 /* ScalarType.STRING */, oneof: "resource_owner" },
+    { no: 2, name: "user_id", kind: "scalar", T: 9 /* ScalarType.STRING */, oneof: "resource_owner" },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): ResourceOwner {
+    return new ResourceOwner().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): ResourceOwner {
+    return new ResourceOwner().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): ResourceOwner {
+    return new ResourceOwner().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: ResourceOwner | PlainMessage<ResourceOwner> | undefined, b: ResourceOwner | PlainMessage<ResourceOwner> | undefined): boolean {
+    return proto3.util.equals(ResourceOwner, a, b);
+  }
+}
+
--- a/internal/frontend/holos/src/app/gen/holos/organization/v1alpha1/organization_pb.ts
+++ b/internal/frontend/holos/src/app/gen/holos/organization/v1alpha1/organization_pb.ts
@@ -0,0 +1,68 @@
+// @generated by protoc-gen-es v1.9.0 with parameter "target=ts"
+// @generated from file holos/organization/v1alpha1/organization.proto (package holos.organization.v1alpha1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import type { BinaryReadOptions, FieldList, JsonReadOptions, JsonValue, PartialMessage, PlainMessage } from "@bufbuild/protobuf";
+import { Message, proto3 } from "@bufbuild/protobuf";
+import { Detail } from "../../object/v1alpha1/object_pb.js";
+
+/**
+ * @generated from message holos.organization.v1alpha1.Organization
+ */
+export class Organization extends Message<Organization> {
+  /**
+   * Unique id assigned by the server.
+   *
+   * @generated from field: optional string org_id = 1;
+   */
+  orgId?: string;
+
+  /**
+   * Name is the organization name as a dns label.
+   *
+   * @generated from field: string name = 2;
+   */
+  name = "";
+
+  /**
+   * @generated from field: optional string display_name = 3;
+   */
+  displayName?: string;
+
+  /**
+   * @generated from field: optional holos.object.v1alpha1.Detail detail = 4;
+   */
+  detail?: Detail;
+
+  constructor(data?: PartialMessage<Organization>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.organization.v1alpha1.Organization";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "org_id", kind: "scalar", T: 9 /* ScalarType.STRING */, opt: true },
+    { no: 2, name: "name", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 3, name: "display_name", kind: "scalar", T: 9 /* ScalarType.STRING */, opt: true },
+    { no: 4, name: "detail", kind: "message", T: Detail, opt: true },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): Organization {
+    return new Organization().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): Organization {
+    return new Organization().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): Organization {
+    return new Organization().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: Organization | PlainMessage<Organization> | undefined, b: Organization | PlainMessage<Organization> | undefined): boolean {
+    return proto3.util.equals(Organization, a, b);
+  }
+}
+
--- a/internal/frontend/holos/src/app/gen/holos/organization/v1alpha1/organization_service_connect.ts
+++ b/internal/frontend/holos/src/app/gen/holos/organization/v1alpha1/organization_service_connect.ts
@@ -0,0 +1,35 @@
+// @generated by protoc-gen-connect-es v1.4.0 with parameter "target=ts"
+// @generated from file holos/organization/v1alpha1/organization_service.proto (package holos.organization.v1alpha1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import { CreateOrganizationRequest, CreateOrganizationResponse, ListOrganizationsRequest, ListOrganizationsResponse } from "./organization_service_pb.js";
+import { MethodKind } from "@bufbuild/protobuf";
+
+/**
+ * @generated from service holos.organization.v1alpha1.OrganizationService
+ */
+export const OrganizationService = {
+  typeName: "holos.organization.v1alpha1.OrganizationService",
+  methods: {
+    /**
+     * @generated from rpc holos.organization.v1alpha1.OrganizationService.CreateOrganization
+     */
+    createOrganization: {
+      name: "CreateOrganization",
+      I: CreateOrganizationRequest,
+      O: CreateOrganizationResponse,
+      kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc holos.organization.v1alpha1.OrganizationService.ListOrganizations
+     */
+    listOrganizations: {
+      name: "ListOrganizations",
+      I: ListOrganizationsRequest,
+      O: ListOrganizationsResponse,
+      kind: MethodKind.Unary,
+    },
+  }
+} as const;
+
--- a/internal/frontend/holos/src/app/gen/holos/organization/v1alpha1/organization_service_pb.ts
+++ b/internal/frontend/holos/src/app/gen/holos/organization/v1alpha1/organization_service_pb.ts
@@ -0,0 +1,164 @@
+// @generated by protoc-gen-es v1.9.0 with parameter "target=ts"
+// @generated from file holos/organization/v1alpha1/organization_service.proto (package holos.organization.v1alpha1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import type { BinaryReadOptions, FieldList, JsonReadOptions, JsonValue, PartialMessage, PlainMessage } from "@bufbuild/protobuf";
+import { FieldMask, Message, proto3 } from "@bufbuild/protobuf";
+import { Organization } from "./organization_pb.js";
+import { UserRef } from "../../object/v1alpha1/object_pb.js";
+
+/**
+ * @generated from message holos.organization.v1alpha1.CreateOrganizationRequest
+ */
+export class CreateOrganizationRequest extends Message<CreateOrganizationRequest> {
+  /**
+   * @generated from field: holos.organization.v1alpha1.Organization organization = 1;
+   */
+  organization?: Organization;
+
+  constructor(data?: PartialMessage<CreateOrganizationRequest>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.organization.v1alpha1.CreateOrganizationRequest";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "organization", kind: "message", T: Organization },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): CreateOrganizationRequest {
+    return new CreateOrganizationRequest().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): CreateOrganizationRequest {
+    return new CreateOrganizationRequest().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): CreateOrganizationRequest {
+    return new CreateOrganizationRequest().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: CreateOrganizationRequest | PlainMessage<CreateOrganizationRequest> | undefined, b: CreateOrganizationRequest | PlainMessage<CreateOrganizationRequest> | undefined): boolean {
+    return proto3.util.equals(CreateOrganizationRequest, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.organization.v1alpha1.CreateOrganizationResponse
+ */
+export class CreateOrganizationResponse extends Message<CreateOrganizationResponse> {
+  /**
+   * @generated from field: holos.organization.v1alpha1.Organization organization = 1;
+   */
+  organization?: Organization;
+
+  constructor(data?: PartialMessage<CreateOrganizationResponse>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.organization.v1alpha1.CreateOrganizationResponse";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "organization", kind: "message", T: Organization },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): CreateOrganizationResponse {
+    return new CreateOrganizationResponse().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): CreateOrganizationResponse {
+    return new CreateOrganizationResponse().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): CreateOrganizationResponse {
+    return new CreateOrganizationResponse().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: CreateOrganizationResponse | PlainMessage<CreateOrganizationResponse> | undefined, b: CreateOrganizationResponse | PlainMessage<CreateOrganizationResponse> | undefined): boolean {
+    return proto3.util.equals(CreateOrganizationResponse, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.organization.v1alpha1.ListOrganizationsRequest
+ */
+export class ListOrganizationsRequest extends Message<ListOrganizationsRequest> {
+  /**
+   * @generated from field: google.protobuf.FieldMask field_mask = 1;
+   */
+  fieldMask?: FieldMask;
+
+  constructor(data?: PartialMessage<ListOrganizationsRequest>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.organization.v1alpha1.ListOrganizationsRequest";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "field_mask", kind: "message", T: FieldMask },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): ListOrganizationsRequest {
+    return new ListOrganizationsRequest().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): ListOrganizationsRequest {
+    return new ListOrganizationsRequest().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): ListOrganizationsRequest {
+    return new ListOrganizationsRequest().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: ListOrganizationsRequest | PlainMessage<ListOrganizationsRequest> | undefined, b: ListOrganizationsRequest | PlainMessage<ListOrganizationsRequest> | undefined): boolean {
+    return proto3.util.equals(ListOrganizationsRequest, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.organization.v1alpha1.ListOrganizationsResponse
+ */
+export class ListOrganizationsResponse extends Message<ListOrganizationsResponse> {
+  /**
+   * @generated from field: optional holos.object.v1alpha1.UserRef user = 1;
+   */
+  user?: UserRef;
+
+  /**
+   * @generated from field: repeated holos.organization.v1alpha1.Organization organizations = 2;
+   */
+  organizations: Organization[] = [];
+
+  constructor(data?: PartialMessage<ListOrganizationsResponse>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.organization.v1alpha1.ListOrganizationsResponse";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "user", kind: "message", T: UserRef, opt: true },
+    { no: 2, name: "organizations", kind: "message", T: Organization, repeated: true },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): ListOrganizationsResponse {
+    return new ListOrganizationsResponse().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): ListOrganizationsResponse {
+    return new ListOrganizationsResponse().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): ListOrganizationsResponse {
+    return new ListOrganizationsResponse().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: ListOrganizationsResponse | PlainMessage<ListOrganizationsResponse> | undefined, b: ListOrganizationsResponse | PlainMessage<ListOrganizationsResponse> | undefined): boolean {
+    return proto3.util.equals(ListOrganizationsResponse, a, b);
+  }
+}
+
--- a/internal/frontend/holos/src/app/gen/holos/platform/v1alpha1/platform_pb.ts
+++ b/internal/frontend/holos/src/app/gen/holos/platform/v1alpha1/platform_pb.ts
@@ -0,0 +1,224 @@
+// @generated by protoc-gen-es v1.9.0 with parameter "target=ts"
+// @generated from file holos/platform/v1alpha1/platform.proto (package holos.platform.v1alpha1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import type { BinaryReadOptions, FieldList, JsonReadOptions, JsonValue, PartialMessage, PlainMessage } from "@bufbuild/protobuf";
+import { Message, proto3, Struct } from "@bufbuild/protobuf";
+import { Detail } from "../../object/v1alpha1/object_pb.js";
+
+/**
+ * @generated from message holos.platform.v1alpha1.Platform
+ */
+export class Platform extends Message<Platform> {
+  /**
+   * Unique id assigned by the server.
+   *
+   * @generated from field: string id = 1;
+   */
+  id = "";
+
+  /**
+   * Owner of the platform.
+   *
+   * @generated from field: holos.platform.v1alpha1.Owner owner = 2;
+   */
+  owner?: Owner;
+
+  /**
+   * name is the platform short name as a dns label.
+   *
+   * @generated from field: string name = 3;
+   */
+  name = "";
+
+  /**
+   * @generated from field: optional string display_name = 4;
+   */
+  displayName?: string;
+
+  /**
+   * @generated from field: optional string description = 5;
+   */
+  description?: string;
+
+  /**
+   * @generated from field: optional holos.platform.v1alpha1.Spec spec = 6;
+   */
+  spec?: Spec;
+
+  /**
+   * @generated from field: optional holos.object.v1alpha1.Detail detail = 8;
+   */
+  detail?: Detail;
+
+  constructor(data?: PartialMessage<Platform>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.platform.v1alpha1.Platform";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 2, name: "owner", kind: "message", T: Owner },
+    { no: 3, name: "name", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 4, name: "display_name", kind: "scalar", T: 9 /* ScalarType.STRING */, opt: true },
+    { no: 5, name: "description", kind: "scalar", T: 9 /* ScalarType.STRING */, opt: true },
+    { no: 6, name: "spec", kind: "message", T: Spec, opt: true },
+    { no: 8, name: "detail", kind: "message", T: Detail, opt: true },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): Platform {
+    return new Platform().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): Platform {
+    return new Platform().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): Platform {
+    return new Platform().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: Platform | PlainMessage<Platform> | undefined, b: Platform | PlainMessage<Platform> | undefined): boolean {
+    return proto3.util.equals(Platform, a, b);
+  }
+}
+
+/**
+ * Owner of a platform.
+ *
+ * @generated from message holos.platform.v1alpha1.Owner
+ */
+export class Owner extends Message<Owner> {
+  /**
+   * @generated from oneof holos.platform.v1alpha1.Owner.owner
+   */
+  owner: {
+    /**
+     * @generated from field: string org_id = 1;
+     */
+    value: string;
+    case: "orgId";
+  } | { case: undefined; value?: undefined } = { case: undefined };
+
+  constructor(data?: PartialMessage<Owner>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.platform.v1alpha1.Owner";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "org_id", kind: "scalar", T: 9 /* ScalarType.STRING */, oneof: "owner" },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): Owner {
+    return new Owner().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): Owner {
+    return new Owner().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): Owner {
+    return new Owner().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: Owner | PlainMessage<Owner> | undefined, b: Owner | PlainMessage<Owner> | undefined): boolean {
+    return proto3.util.equals(Owner, a, b);
+  }
+}
+
+/**
+ * Spec represents the top level specification of a Platform.
+ *
+ * @generated from message holos.platform.v1alpha1.Spec
+ */
+export class Spec extends Message<Spec> {
+  /**
+   * model represents the user-defined and user-supplied form field values.
+   * The model is a Struct to ensure any valid JSON object defined by the user
+   * via the form can be represented and stored.
+   *
+   * @generated from field: google.protobuf.Struct model = 1;
+   */
+  model?: Struct;
+
+  /**
+   * @generated from field: optional holos.platform.v1alpha1.Form form = 2;
+   */
+  form?: Form;
+
+  constructor(data?: PartialMessage<Spec>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.platform.v1alpha1.Spec";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "model", kind: "message", T: Struct },
+    { no: 2, name: "form", kind: "message", T: Form, opt: true },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): Spec {
+    return new Spec().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): Spec {
+    return new Spec().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): Spec {
+    return new Spec().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: Spec | PlainMessage<Spec> | undefined, b: Spec | PlainMessage<Spec> | undefined): boolean {
+    return proto3.util.equals(Spec, a, b);
+  }
+}
+
+/**
+ * Form represents the Formly input form.
+ *
+ * @generated from message holos.platform.v1alpha1.Form
+ */
+export class Form extends Message<Form> {
+  /**
+   * fields represents FormlyFieldConfig[] encoded as an array of JSON objects
+   * organized by section.
+   *
+   * @generated from field: repeated google.protobuf.Struct field_configs = 1;
+   */
+  fieldConfigs: Struct[] = [];
+
+  constructor(data?: PartialMessage<Form>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.platform.v1alpha1.Form";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "field_configs", kind: "message", T: Struct, repeated: true },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): Form {
+    return new Form().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): Form {
+    return new Form().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): Form {
+    return new Form().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: Form | PlainMessage<Form> | undefined, b: Form | PlainMessage<Form> | undefined): boolean {
+    return proto3.util.equals(Form, a, b);
+  }
+}
+
--- a/internal/frontend/holos/src/app/gen/holos/platform/v1alpha1/platform_service_connect.ts
+++ b/internal/frontend/holos/src/app/gen/holos/platform/v1alpha1/platform_service_connect.ts
@@ -0,0 +1,53 @@
+// @generated by protoc-gen-connect-es v1.4.0 with parameter "target=ts"
+// @generated from file holos/platform/v1alpha1/platform_service.proto (package holos.platform.v1alpha1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import { CreatePlatformRequest, CreatePlatformResponse, GetPlatformRequest, GetPlatformResponse, ListPlatformsRequest, ListPlatformsResponse, UpdatePlatformRequest, UpdatePlatformResponse } from "./platform_service_pb.js";
+import { MethodKind } from "@bufbuild/protobuf";
+
+/**
+ * @generated from service holos.platform.v1alpha1.PlatformService
+ */
+export const PlatformService = {
+  typeName: "holos.platform.v1alpha1.PlatformService",
+  methods: {
+    /**
+     * @generated from rpc holos.platform.v1alpha1.PlatformService.CreatePlatform
+     */
+    createPlatform: {
+      name: "CreatePlatform",
+      I: CreatePlatformRequest,
+      O: CreatePlatformResponse,
+      kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc holos.platform.v1alpha1.PlatformService.GetPlatform
+     */
+    getPlatform: {
+      name: "GetPlatform",
+      I: GetPlatformRequest,
+      O: GetPlatformResponse,
+      kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc holos.platform.v1alpha1.PlatformService.UpdatePlatform
+     */
+    updatePlatform: {
+      name: "UpdatePlatform",
+      I: UpdatePlatformRequest,
+      O: UpdatePlatformResponse,
+      kind: MethodKind.Unary,
+    },
+    /**
+     * @generated from rpc holos.platform.v1alpha1.PlatformService.ListPlatforms
+     */
+    listPlatforms: {
+      name: "ListPlatforms",
+      I: ListPlatformsRequest,
+      O: ListPlatformsResponse,
+      kind: MethodKind.Unary,
+    },
+  }
+} as const;
+
--- a/internal/frontend/holos/src/app/gen/holos/platform/v1alpha1/platform_service_pb.ts
+++ b/internal/frontend/holos/src/app/gen/holos/platform/v1alpha1/platform_service_pb.ts
@@ -0,0 +1,405 @@
+// @generated by protoc-gen-es v1.9.0 with parameter "target=ts"
+// @generated from file holos/platform/v1alpha1/platform_service.proto (package holos.platform.v1alpha1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import type { BinaryReadOptions, FieldList, JsonReadOptions, JsonValue, PartialMessage, PlainMessage } from "@bufbuild/protobuf";
+import { FieldMask, Message, proto3, Struct } from "@bufbuild/protobuf";
+import { Form, Platform } from "./platform_pb.js";
+
+/**
+ * @generated from message holos.platform.v1alpha1.CreatePlatformRequest
+ */
+export class CreatePlatformRequest extends Message<CreatePlatformRequest> {
+  /**
+   * @generated from field: holos.platform.v1alpha1.Platform platform = 1;
+   */
+  platform?: Platform;
+
+  constructor(data?: PartialMessage<CreatePlatformRequest>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.platform.v1alpha1.CreatePlatformRequest";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "platform", kind: "message", T: Platform },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): CreatePlatformRequest {
+    return new CreatePlatformRequest().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): CreatePlatformRequest {
+    return new CreatePlatformRequest().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): CreatePlatformRequest {
+    return new CreatePlatformRequest().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: CreatePlatformRequest | PlainMessage<CreatePlatformRequest> | undefined, b: CreatePlatformRequest | PlainMessage<CreatePlatformRequest> | undefined): boolean {
+    return proto3.util.equals(CreatePlatformRequest, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.platform.v1alpha1.CreatePlatformResponse
+ */
+export class CreatePlatformResponse extends Message<CreatePlatformResponse> {
+  /**
+   * @generated from field: holos.platform.v1alpha1.Platform platform = 1;
+   */
+  platform?: Platform;
+
+  constructor(data?: PartialMessage<CreatePlatformResponse>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.platform.v1alpha1.CreatePlatformResponse";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "platform", kind: "message", T: Platform },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): CreatePlatformResponse {
+    return new CreatePlatformResponse().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): CreatePlatformResponse {
+    return new CreatePlatformResponse().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): CreatePlatformResponse {
+    return new CreatePlatformResponse().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: CreatePlatformResponse | PlainMessage<CreatePlatformResponse> | undefined, b: CreatePlatformResponse | PlainMessage<CreatePlatformResponse> | undefined): boolean {
+    return proto3.util.equals(CreatePlatformResponse, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.platform.v1alpha1.GetPlatformRequest
+ */
+export class GetPlatformRequest extends Message<GetPlatformRequest> {
+  /**
+   * @generated from field: string platform_id = 1;
+   */
+  platformId = "";
+
+  /**
+   * FieldMask represents the response Platform fields to include.
+   *
+   * @generated from field: google.protobuf.FieldMask field_mask = 2;
+   */
+  fieldMask?: FieldMask;
+
+  constructor(data?: PartialMessage<GetPlatformRequest>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.platform.v1alpha1.GetPlatformRequest";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "platform_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 2, name: "field_mask", kind: "message", T: FieldMask },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetPlatformRequest {
+    return new GetPlatformRequest().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetPlatformRequest {
+    return new GetPlatformRequest().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetPlatformRequest {
+    return new GetPlatformRequest().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: GetPlatformRequest | PlainMessage<GetPlatformRequest> | undefined, b: GetPlatformRequest | PlainMessage<GetPlatformRequest> | undefined): boolean {
+    return proto3.util.equals(GetPlatformRequest, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.platform.v1alpha1.GetPlatformResponse
+ */
+export class GetPlatformResponse extends Message<GetPlatformResponse> {
+  /**
+   * @generated from field: holos.platform.v1alpha1.Platform platform = 1;
+   */
+  platform?: Platform;
+
+  constructor(data?: PartialMessage<GetPlatformResponse>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.platform.v1alpha1.GetPlatformResponse";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "platform", kind: "message", T: Platform },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetPlatformResponse {
+    return new GetPlatformResponse().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetPlatformResponse {
+    return new GetPlatformResponse().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetPlatformResponse {
+    return new GetPlatformResponse().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: GetPlatformResponse | PlainMessage<GetPlatformResponse> | undefined, b: GetPlatformResponse | PlainMessage<GetPlatformResponse> | undefined): boolean {
+    return proto3.util.equals(GetPlatformResponse, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.platform.v1alpha1.UpdatePlatformRequest
+ */
+export class UpdatePlatformRequest extends Message<UpdatePlatformRequest> {
+  /**
+   * Update operations to perform.  Fields are set to the provided value if
+   * selected by the mask.  Absent fields are cleared if they are selected by
+   * the mask.
+   *
+   * @generated from field: holos.platform.v1alpha1.UpdatePlatformOperation update = 1;
+   */
+  update?: UpdatePlatformOperation;
+
+  /**
+   * FieldMask represents the mutation operations to perform.  Marked optional
+   * for the nil guard check.  Required.
+   *
+   * @generated from field: optional google.protobuf.FieldMask update_mask = 2;
+   */
+  updateMask?: FieldMask;
+
+  constructor(data?: PartialMessage<UpdatePlatformRequest>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.platform.v1alpha1.UpdatePlatformRequest";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "update", kind: "message", T: UpdatePlatformOperation },
+    { no: 2, name: "update_mask", kind: "message", T: FieldMask, opt: true },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): UpdatePlatformRequest {
+    return new UpdatePlatformRequest().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): UpdatePlatformRequest {
+    return new UpdatePlatformRequest().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): UpdatePlatformRequest {
+    return new UpdatePlatformRequest().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: UpdatePlatformRequest | PlainMessage<UpdatePlatformRequest> | undefined, b: UpdatePlatformRequest | PlainMessage<UpdatePlatformRequest> | undefined): boolean {
+    return proto3.util.equals(UpdatePlatformRequest, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.platform.v1alpha1.UpdatePlatformResponse
+ */
+export class UpdatePlatformResponse extends Message<UpdatePlatformResponse> {
+  /**
+   * @generated from field: holos.platform.v1alpha1.Platform platform = 1;
+   */
+  platform?: Platform;
+
+  constructor(data?: PartialMessage<UpdatePlatformResponse>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.platform.v1alpha1.UpdatePlatformResponse";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "platform", kind: "message", T: Platform },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): UpdatePlatformResponse {
+    return new UpdatePlatformResponse().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): UpdatePlatformResponse {
+    return new UpdatePlatformResponse().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): UpdatePlatformResponse {
+    return new UpdatePlatformResponse().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: UpdatePlatformResponse | PlainMessage<UpdatePlatformResponse> | undefined, b: UpdatePlatformResponse | PlainMessage<UpdatePlatformResponse> | undefined): boolean {
+    return proto3.util.equals(UpdatePlatformResponse, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.platform.v1alpha1.ListPlatformsRequest
+ */
+export class ListPlatformsRequest extends Message<ListPlatformsRequest> {
+  /**
+   * @generated from field: string org_id = 1;
+   */
+  orgId = "";
+
+  /**
+   * FieldMask represents the response Platform fields to include.
+   *
+   * @generated from field: google.protobuf.FieldMask field_mask = 2;
+   */
+  fieldMask?: FieldMask;
+
+  constructor(data?: PartialMessage<ListPlatformsRequest>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.platform.v1alpha1.ListPlatformsRequest";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "org_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 2, name: "field_mask", kind: "message", T: FieldMask },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): ListPlatformsRequest {
+    return new ListPlatformsRequest().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): ListPlatformsRequest {
+    return new ListPlatformsRequest().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): ListPlatformsRequest {
+    return new ListPlatformsRequest().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: ListPlatformsRequest | PlainMessage<ListPlatformsRequest> | undefined, b: ListPlatformsRequest | PlainMessage<ListPlatformsRequest> | undefined): boolean {
+    return proto3.util.equals(ListPlatformsRequest, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.platform.v1alpha1.ListPlatformsResponse
+ */
+export class ListPlatformsResponse extends Message<ListPlatformsResponse> {
+  /**
+   * @generated from field: repeated holos.platform.v1alpha1.Platform platforms = 1;
+   */
+  platforms: Platform[] = [];
+
+  constructor(data?: PartialMessage<ListPlatformsResponse>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.platform.v1alpha1.ListPlatformsResponse";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "platforms", kind: "message", T: Platform, repeated: true },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): ListPlatformsResponse {
+    return new ListPlatformsResponse().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): ListPlatformsResponse {
+    return new ListPlatformsResponse().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): ListPlatformsResponse {
+    return new ListPlatformsResponse().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: ListPlatformsResponse | PlainMessage<ListPlatformsResponse> | undefined, b: ListPlatformsResponse | PlainMessage<ListPlatformsResponse> | undefined): boolean {
+    return proto3.util.equals(ListPlatformsResponse, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.platform.v1alpha1.UpdatePlatformOperation
+ */
+export class UpdatePlatformOperation extends Message<UpdatePlatformOperation> {
+  /**
+   * Platform UUID to update.
+   *
+   * @generated from field: string platform_id = 1;
+   */
+  platformId = "";
+
+  /**
+   * Update the platform name.
+   *
+   * @generated from field: optional string name = 2;
+   */
+  name?: string;
+
+  /**
+   * Update the platform display name.
+   *
+   * @generated from field: optional string display_name = 3;
+   */
+  displayName?: string;
+
+  /**
+   * Replace the form model.
+   *
+   * @generated from field: optional google.protobuf.Struct model = 4;
+   */
+  model?: Struct;
+
+  /**
+   * Replace the form.
+   *
+   * @generated from field: optional holos.platform.v1alpha1.Form form = 5;
+   */
+  form?: Form;
+
+  constructor(data?: PartialMessage<UpdatePlatformOperation>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.platform.v1alpha1.UpdatePlatformOperation";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "platform_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 2, name: "name", kind: "scalar", T: 9 /* ScalarType.STRING */, opt: true },
+    { no: 3, name: "display_name", kind: "scalar", T: 9 /* ScalarType.STRING */, opt: true },
+    { no: 4, name: "model", kind: "message", T: Struct, opt: true },
+    { no: 5, name: "form", kind: "message", T: Form, opt: true },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): UpdatePlatformOperation {
+    return new UpdatePlatformOperation().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): UpdatePlatformOperation {
+    return new UpdatePlatformOperation().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): UpdatePlatformOperation {
+    return new UpdatePlatformOperation().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: UpdatePlatformOperation | PlainMessage<UpdatePlatformOperation> | undefined, b: UpdatePlatformOperation | PlainMessage<UpdatePlatformOperation> | undefined): boolean {
+    return proto3.util.equals(UpdatePlatformOperation, a, b);
+  }
+}
+
--- a/internal/frontend/holos/src/app/gen/holos/storage/v1alpha1/storage_pb.ts
+++ b/internal/frontend/holos/src/app/gen/holos/storage/v1alpha1/storage_pb.ts
@@ -0,0 +1,91 @@
+// @generated by protoc-gen-es v1.9.0 with parameter "target=ts"
+// @generated from file holos/storage/v1alpha1/storage.proto (package holos.storage.v1alpha1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import type { BinaryReadOptions, FieldList, JsonReadOptions, JsonValue, PartialMessage, PlainMessage } from "@bufbuild/protobuf";
+import { Message, proto3, Struct } from "@bufbuild/protobuf";
+
+/**
+ * Model represents user-defined and user-supplied form field values stored as a
+ * marshaled JSON object.  The model is a Struct to ensure any valid JSON object
+ * defined by the user via the form can be represented and stored.
+ *
+ * @generated from message holos.storage.v1alpha1.Model
+ */
+export class Model extends Message<Model> {
+  /**
+   * @generated from field: google.protobuf.Struct model = 1;
+   */
+  model?: Struct;
+
+  constructor(data?: PartialMessage<Model>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.storage.v1alpha1.Model";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "model", kind: "message", T: Struct },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): Model {
+    return new Model().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): Model {
+    return new Model().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): Model {
+    return new Model().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: Model | PlainMessage<Model> | undefined, b: Model | PlainMessage<Model> | undefined): boolean {
+    return proto3.util.equals(Model, a, b);
+  }
+}
+
+/**
+ * Form represents the Formly input form stored as a marshaled JSON object.
+ *
+ * @generated from message holos.storage.v1alpha1.Form
+ */
+export class Form extends Message<Form> {
+  /**
+   * fields represents FormlyFieldConfig[] encoded as an array of JSON objects
+   * organized by section.
+   *
+   * @generated from field: repeated google.protobuf.Struct field_configs = 1;
+   */
+  fieldConfigs: Struct[] = [];
+
+  constructor(data?: PartialMessage<Form>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.storage.v1alpha1.Form";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "field_configs", kind: "message", T: Struct, repeated: true },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): Form {
+    return new Form().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): Form {
+    return new Form().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): Form {
+    return new Form().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: Form | PlainMessage<Form> | undefined, b: Form | PlainMessage<Form> | undefined): boolean {
+    return proto3.util.equals(Form, a, b);
+  }
+}
+
--- a/internal/frontend/holos/src/app/gen/holos/system/v1alpha1/system_service_connect.ts
+++ b/internal/frontend/holos/src/app/gen/holos/system/v1alpha1/system_service_connect.ts
@@ -1,19 +1,19 @@
 // @generated by protoc-gen-connect-es v1.4.0 with parameter "target=ts"
-// @generated from file holos/v1alpha1/system.proto (package holos.v1alpha1, syntax proto3)
+// @generated from file holos/system/v1alpha1/system_service.proto (package holos.system.v1alpha1, syntax proto3)
 /* eslint-disable */
 // @ts-nocheck

-import { DropTablesRequest, DropTablesResponse, SeedDatabaseRequest, SeedDatabaseResponse } from "./system_pb.js";
+import { DropTablesRequest, DropTablesResponse, SeedDatabaseRequest, SeedDatabaseResponse } from "./system_service_pb.js";
 import { MethodKind } from "@bufbuild/protobuf";

 /**
- * @generated from service holos.v1alpha1.SystemService
+ * @generated from service holos.system.v1alpha1.SystemService
 */
 export const SystemService = {
-  typeName: "holos.v1alpha1.SystemService",
+  typeName: "holos.system.v1alpha1.SystemService",
  methods: {
    /**
-     * @generated from rpc holos.v1alpha1.SystemService.SeedDatabase
+     * @generated from rpc holos.system.v1alpha1.SystemService.SeedDatabase
     */
    seedDatabase: {
      name: "SeedDatabase",
@@ -22,7 +22,7 @@ export const SystemService = {
      kind: MethodKind.Unary,
    },
    /**
-     * @generated from rpc holos.v1alpha1.SystemService.DropTables
+     * @generated from rpc holos.system.v1alpha1.SystemService.DropTables
     */
    dropTables: {
      name: "DropTables",
--- a/internal/frontend/holos/src/app/gen/holos/system/v1alpha1/system_service_pb.ts
+++ b/internal/frontend/holos/src/app/gen/holos/system/v1alpha1/system_service_pb.ts
@@ -1,5 +1,5 @@
 // @generated by protoc-gen-es v1.9.0 with parameter "target=ts"
-// @generated from file holos/v1alpha1/system.proto (package holos.v1alpha1, syntax proto3)
+// @generated from file holos/system/v1alpha1/system_service.proto (package holos.system.v1alpha1, syntax proto3)
 /* eslint-disable */
 // @ts-nocheck

@@ -7,7 +7,7 @@ import type { BinaryReadOptions, FieldList, JsonReadOptions, JsonValue, PartialM
 import { Message, proto3 } from "@bufbuild/protobuf";

 /**
- * @generated from message holos.v1alpha1.SeedDatabaseRequest
+ * @generated from message holos.system.v1alpha1.SeedDatabaseRequest
 */
 export class SeedDatabaseRequest extends Message<SeedDatabaseRequest> {
  constructor(data?: PartialMessage<SeedDatabaseRequest>) {
@@ -16,7 +16,7 @@ export class SeedDatabaseRequest extends Message<SeedDatabaseRequest> {
  }

  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.SeedDatabaseRequest";
+  static readonly typeName = "holos.system.v1alpha1.SeedDatabaseRequest";
  static readonly fields: FieldList = proto3.util.newFieldList(() => [
  ]);

@@ -38,7 +38,7 @@ export class SeedDatabaseRequest extends Message<SeedDatabaseRequest> {
 }

 /**
- * @generated from message holos.v1alpha1.SeedDatabaseResponse
+ * @generated from message holos.system.v1alpha1.SeedDatabaseResponse
 */
 export class SeedDatabaseResponse extends Message<SeedDatabaseResponse> {
  constructor(data?: PartialMessage<SeedDatabaseResponse>) {
@@ -47,7 +47,7 @@ export class SeedDatabaseResponse extends Message<SeedDatabaseResponse> {
  }

  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.SeedDatabaseResponse";
+  static readonly typeName = "holos.system.v1alpha1.SeedDatabaseResponse";
  static readonly fields: FieldList = proto3.util.newFieldList(() => [
  ]);

@@ -69,7 +69,7 @@ export class SeedDatabaseResponse extends Message<SeedDatabaseResponse> {
 }

 /**
- * @generated from message holos.v1alpha1.DropTablesRequest
+ * @generated from message holos.system.v1alpha1.DropTablesRequest
 */
 export class DropTablesRequest extends Message<DropTablesRequest> {
  constructor(data?: PartialMessage<DropTablesRequest>) {
@@ -78,7 +78,7 @@ export class DropTablesRequest extends Message<DropTablesRequest> {
  }

  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.DropTablesRequest";
+  static readonly typeName = "holos.system.v1alpha1.DropTablesRequest";
  static readonly fields: FieldList = proto3.util.newFieldList(() => [
  ]);

@@ -100,7 +100,7 @@ export class DropTablesRequest extends Message<DropTablesRequest> {
 }

 /**
- * @generated from message holos.v1alpha1.DropTablesResponse
+ * @generated from message holos.system.v1alpha1.DropTablesResponse
 */
 export class DropTablesResponse extends Message<DropTablesResponse> {
  constructor(data?: PartialMessage<DropTablesResponse>) {
@@ -109,7 +109,7 @@ export class DropTablesResponse extends Message<DropTablesResponse> {
  }

  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.DropTablesResponse";
+  static readonly typeName = "holos.system.v1alpha1.DropTablesResponse";
  static readonly fields: FieldList = proto3.util.newFieldList(() => [
  ]);

--- a/internal/frontend/holos/src/app/gen/holos/user/v1alpha1/user_pb.ts
+++ b/internal/frontend/holos/src/app/gen/holos/user/v1alpha1/user_pb.ts
@@ -0,0 +1,124 @@
+// @generated by protoc-gen-es v1.9.0 with parameter "target=ts"
+// @generated from file holos/user/v1alpha1/user.proto (package holos.user.v1alpha1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import type { BinaryReadOptions, FieldList, JsonReadOptions, JsonValue, PartialMessage, PlainMessage } from "@bufbuild/protobuf";
+import { Message, proto3 } from "@bufbuild/protobuf";
+import { Detail, Subject } from "../../object/v1alpha1/object_pb.js";
+
+/**
+ * User represents a human user of the system.
+ *
+ * @generated from message holos.user.v1alpha1.User
+ */
+export class User extends Message<User> {
+  /**
+   * Unique uuid assigned by the server.
+   *
+   * @generated from field: optional string id = 1;
+   */
+  id?: string;
+
+  /**
+   * Subject represents the oidc iss and sub claims of the user.
+   *
+   * @generated from field: optional holos.object.v1alpha1.Subject subject = 2;
+   */
+  subject?: Subject;
+
+  /**
+   * Email address of the user.
+   *
+   * @generated from field: string email = 3;
+   */
+  email = "";
+
+  /**
+   * True if the user email has been verified.
+   *
+   * @generated from field: optional bool email_verified = 4;
+   */
+  emailVerified?: boolean;
+
+  /**
+   * Full name provided by the user.
+   *
+   * @generated from field: optional string name = 5;
+   */
+  name?: string;
+
+  /**
+   * Given or first name of the user.
+   *
+   * @generated from field: optional string given_name = 6;
+   */
+  givenName?: string;
+
+  /**
+   * Family or last name of the user.
+   *
+   * @generated from field: optional string family_name = 7;
+   */
+  familyName?: string;
+
+  /**
+   * Groups the user is a member of.  This field represents the oidc groups
+   * claim.
+   *
+   * @generated from field: repeated string groups = 8;
+   */
+  groups: string[] = [];
+
+  /**
+   * https url to an user avatar profile picture.  Should be at least a 200x200 px square image.
+   *
+   * @generated from field: optional string picture = 9;
+   */
+  picture?: string;
+
+  /**
+   * Detail applicable to all resource objects in the system such as created and
+   * updated metadata.
+   *
+   * @generated from field: optional holos.object.v1alpha1.Detail detail = 10;
+   */
+  detail?: Detail;
+
+  constructor(data?: PartialMessage<User>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.user.v1alpha1.User";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "id", kind: "scalar", T: 9 /* ScalarType.STRING */, opt: true },
+    { no: 2, name: "subject", kind: "message", T: Subject, opt: true },
+    { no: 3, name: "email", kind: "scalar", T: 9 /* ScalarType.STRING */ },
+    { no: 4, name: "email_verified", kind: "scalar", T: 8 /* ScalarType.BOOL */, opt: true },
+    { no: 5, name: "name", kind: "scalar", T: 9 /* ScalarType.STRING */, opt: true },
+    { no: 6, name: "given_name", kind: "scalar", T: 9 /* ScalarType.STRING */, opt: true },
+    { no: 7, name: "family_name", kind: "scalar", T: 9 /* ScalarType.STRING */, opt: true },
+    { no: 8, name: "groups", kind: "scalar", T: 9 /* ScalarType.STRING */, repeated: true },
+    { no: 9, name: "picture", kind: "scalar", T: 9 /* ScalarType.STRING */, opt: true },
+    { no: 10, name: "detail", kind: "message", T: Detail, opt: true },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): User {
+    return new User().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): User {
+    return new User().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): User {
+    return new User().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: User | PlainMessage<User> | undefined, b: User | PlainMessage<User> | undefined): boolean {
+    return proto3.util.equals(User, a, b);
+  }
+}
+
--- a/internal/frontend/holos/src/app/gen/holos/user/v1alpha1/user_service_connect.ts
+++ b/internal/frontend/holos/src/app/gen/holos/user/v1alpha1/user_service_connect.ts
@@ -0,0 +1,41 @@
+// @generated by protoc-gen-connect-es v1.4.0 with parameter "target=ts"
+// @generated from file holos/user/v1alpha1/user_service.proto (package holos.user.v1alpha1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import { CreateUserRequest, CreateUserResponse, GetUserRequest, GetUserResponse } from "./user_service_pb.js";
+import { MethodKind } from "@bufbuild/protobuf";
+
+/**
+ * UserService provides CRUD methods for User resources in the system.
+ *
+ * @generated from service holos.user.v1alpha1.UserService
+ */
+export const UserService = {
+  typeName: "holos.user.v1alpha1.UserService",
+  methods: {
+    /**
+     * Create a new user from authenticated claims or the provided User resource.
+     *
+     * @generated from rpc holos.user.v1alpha1.UserService.CreateUser
+     */
+    createUser: {
+      name: "CreateUser",
+      I: CreateUserRequest,
+      O: CreateUserResponse,
+      kind: MethodKind.Unary,
+    },
+    /**
+     * Get an existing user by id, email, or subject.
+     *
+     * @generated from rpc holos.user.v1alpha1.UserService.GetUser
+     */
+    getUser: {
+      name: "GetUser",
+      I: GetUserRequest,
+      O: GetUserResponse,
+      kind: MethodKind.Unary,
+    },
+  }
+} as const;
+
--- a/internal/frontend/holos/src/app/gen/holos/user/v1alpha1/user_service_pb.ts
+++ b/internal/frontend/holos/src/app/gen/holos/user/v1alpha1/user_service_pb.ts
@@ -0,0 +1,174 @@
+// @generated by protoc-gen-es v1.9.0 with parameter "target=ts"
+// @generated from file holos/user/v1alpha1/user_service.proto (package holos.user.v1alpha1, syntax proto3)
+/* eslint-disable */
+// @ts-nocheck
+
+import type { BinaryReadOptions, FieldList, JsonReadOptions, JsonValue, PartialMessage, PlainMessage } from "@bufbuild/protobuf";
+import { FieldMask, Message, proto3 } from "@bufbuild/protobuf";
+import { User } from "./user_pb.js";
+import { UserRef } from "../../object/v1alpha1/object_pb.js";
+
+/**
+ * Create a User from the oidc id token claims or the provided user.  Each one
+ * of subject, email, and user id must be globally unique.
+ *
+ * @generated from message holos.user.v1alpha1.CreateUserRequest
+ */
+export class CreateUserRequest extends Message<CreateUserRequest> {
+  /**
+   * User resource to create.  If absent, the server populates User fields with
+   * the oidc id token claims of the authenticated request.
+   *
+   * @generated from field: optional holos.user.v1alpha1.User user = 1;
+   */
+  user?: User;
+
+  constructor(data?: PartialMessage<CreateUserRequest>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.user.v1alpha1.CreateUserRequest";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "user", kind: "message", T: User, opt: true },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): CreateUserRequest {
+    return new CreateUserRequest().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): CreateUserRequest {
+    return new CreateUserRequest().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): CreateUserRequest {
+    return new CreateUserRequest().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: CreateUserRequest | PlainMessage<CreateUserRequest> | undefined, b: CreateUserRequest | PlainMessage<CreateUserRequest> | undefined): boolean {
+    return proto3.util.equals(CreateUserRequest, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.user.v1alpha1.CreateUserResponse
+ */
+export class CreateUserResponse extends Message<CreateUserResponse> {
+  /**
+   * @generated from field: holos.user.v1alpha1.User user = 1;
+   */
+  user?: User;
+
+  constructor(data?: PartialMessage<CreateUserResponse>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.user.v1alpha1.CreateUserResponse";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "user", kind: "message", T: User },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): CreateUserResponse {
+    return new CreateUserResponse().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): CreateUserResponse {
+    return new CreateUserResponse().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): CreateUserResponse {
+    return new CreateUserResponse().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: CreateUserResponse | PlainMessage<CreateUserResponse> | undefined, b: CreateUserResponse | PlainMessage<CreateUserResponse> | undefined): boolean {
+    return proto3.util.equals(CreateUserResponse, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.user.v1alpha1.GetUserRequest
+ */
+export class GetUserRequest extends Message<GetUserRequest> {
+  /**
+   * UserRef represents the user to return in the response.
+   *
+   * @generated from field: holos.object.v1alpha1.UserRef user = 1;
+   */
+  user?: UserRef;
+
+  /**
+   * FieldMask represents the response User fields to include.
+   *
+   * @generated from field: optional google.protobuf.FieldMask field_mask = 2;
+   */
+  fieldMask?: FieldMask;
+
+  constructor(data?: PartialMessage<GetUserRequest>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.user.v1alpha1.GetUserRequest";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "user", kind: "message", T: UserRef },
+    { no: 2, name: "field_mask", kind: "message", T: FieldMask, opt: true },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetUserRequest {
+    return new GetUserRequest().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetUserRequest {
+    return new GetUserRequest().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetUserRequest {
+    return new GetUserRequest().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: GetUserRequest | PlainMessage<GetUserRequest> | undefined, b: GetUserRequest | PlainMessage<GetUserRequest> | undefined): boolean {
+    return proto3.util.equals(GetUserRequest, a, b);
+  }
+}
+
+/**
+ * @generated from message holos.user.v1alpha1.GetUserResponse
+ */
+export class GetUserResponse extends Message<GetUserResponse> {
+  /**
+   * @generated from field: holos.user.v1alpha1.User user = 1;
+   */
+  user?: User;
+
+  constructor(data?: PartialMessage<GetUserResponse>) {
+    super();
+    proto3.util.initPartial(data, this);
+  }
+
+  static readonly runtime: typeof proto3 = proto3;
+  static readonly typeName = "holos.user.v1alpha1.GetUserResponse";
+  static readonly fields: FieldList = proto3.util.newFieldList(() => [
+    { no: 1, name: "user", kind: "message", T: User },
+  ]);
+
+  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetUserResponse {
+    return new GetUserResponse().fromBinary(bytes, options);
+  }
+
+  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetUserResponse {
+    return new GetUserResponse().fromJson(jsonValue, options);
+  }
+
+  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetUserResponse {
+    return new GetUserResponse().fromJsonString(jsonString, options);
+  }
+
+  static equals(a: GetUserResponse | PlainMessage<GetUserResponse> | undefined, b: GetUserResponse | PlainMessage<GetUserResponse> | undefined): boolean {
+    return proto3.util.equals(GetUserResponse, a, b);
+  }
+}
+
--- a/internal/frontend/holos/src/app/gen/holos/v1alpha1/organization_connect.ts
+++ b/internal/frontend/holos/src/app/gen/holos/v1alpha1/organization_connect.ts
@@ -1,35 +0,0 @@
-// @generated by protoc-gen-connect-es v1.4.0 with parameter "target=ts"
-// @generated from file holos/v1alpha1/organization.proto (package holos.v1alpha1, syntax proto3)
-/* eslint-disable */
-// @ts-nocheck
-
-import { CreateCallerOrganizationRequest, CreateCallerOrganizationResponse, ListCallerOrganizationsRequest, ListCallerOrganizationsResponse } from "./organization_pb.js";
-import { MethodKind } from "@bufbuild/protobuf";
-
-/**
- * @generated from service holos.v1alpha1.OrganizationService
- */
-export const OrganizationService = {
-  typeName: "holos.v1alpha1.OrganizationService",
-  methods: {
-    /**
-     * @generated from rpc holos.v1alpha1.OrganizationService.ListCallerOrganizations
-     */
-    listCallerOrganizations: {
-      name: "ListCallerOrganizations",
-      I: ListCallerOrganizationsRequest,
-      O: ListCallerOrganizationsResponse,
-      kind: MethodKind.Unary,
-    },
-    /**
-     * @generated from rpc holos.v1alpha1.OrganizationService.CreateCallerOrganization
-     */
-    createCallerOrganization: {
-      name: "CreateCallerOrganization",
-      I: CreateCallerOrganizationRequest,
-      O: CreateCallerOrganizationResponse,
-      kind: MethodKind.Unary,
-    },
-  }
-} as const;
-
--- a/internal/frontend/holos/src/app/gen/holos/v1alpha1/organization_pb.ts
+++ b/internal/frontend/holos/src/app/gen/holos/v1alpha1/organization_pb.ts
@@ -1,221 +0,0 @@
-// @generated by protoc-gen-es v1.9.0 with parameter "target=ts"
-// @generated from file holos/v1alpha1/organization.proto (package holos.v1alpha1, syntax proto3)
-/* eslint-disable */
-// @ts-nocheck
-
-import type { BinaryReadOptions, FieldList, JsonReadOptions, JsonValue, PartialMessage, PlainMessage } from "@bufbuild/protobuf";
-import { Message, proto3 } from "@bufbuild/protobuf";
-import { Timestamps } from "./timestamps_pb.js";
-import { Creator, User } from "./user_pb.js";
-
-/**
- * @generated from message holos.v1alpha1.Organization
- */
-export class Organization extends Message<Organization> {
-  /**
-   * Unique id assigned by the server.
-   *
-   * @generated from field: string id = 1;
-   */
-  id = "";
-
-  /**
-   * @generated from field: string name = 2;
-   */
-  name = "";
-
-  /**
-   * @generated from field: string display_name = 3;
-   */
-  displayName = "";
-
-  /**
-   * @generated from field: holos.v1alpha1.Timestamps timestamps = 4;
-   */
-  timestamps?: Timestamps;
-
-  /**
-   * @generated from field: holos.v1alpha1.Creator creator = 5;
-   */
-  creator?: Creator;
-
-  constructor(data?: PartialMessage<Organization>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.Organization";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 2, name: "name", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 3, name: "display_name", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 4, name: "timestamps", kind: "message", T: Timestamps },
-    { no: 5, name: "creator", kind: "message", T: Creator },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): Organization {
-    return new Organization().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): Organization {
-    return new Organization().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): Organization {
-    return new Organization().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: Organization | PlainMessage<Organization> | undefined, b: Organization | PlainMessage<Organization> | undefined): boolean {
-    return proto3.util.equals(Organization, a, b);
-  }
-}
-
-/**
- * @generated from message holos.v1alpha1.ListCallerOrganizationsRequest
- */
-export class ListCallerOrganizationsRequest extends Message<ListCallerOrganizationsRequest> {
-  constructor(data?: PartialMessage<ListCallerOrganizationsRequest>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.ListCallerOrganizationsRequest";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): ListCallerOrganizationsRequest {
-    return new ListCallerOrganizationsRequest().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): ListCallerOrganizationsRequest {
-    return new ListCallerOrganizationsRequest().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): ListCallerOrganizationsRequest {
-    return new ListCallerOrganizationsRequest().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: ListCallerOrganizationsRequest | PlainMessage<ListCallerOrganizationsRequest> | undefined, b: ListCallerOrganizationsRequest | PlainMessage<ListCallerOrganizationsRequest> | undefined): boolean {
-    return proto3.util.equals(ListCallerOrganizationsRequest, a, b);
-  }
-}
-
-/**
- * @generated from message holos.v1alpha1.ListCallerOrganizationsResponse
- */
-export class ListCallerOrganizationsResponse extends Message<ListCallerOrganizationsResponse> {
-  /**
-   * @generated from field: holos.v1alpha1.User user = 1;
-   */
-  user?: User;
-
-  /**
-   * @generated from field: repeated holos.v1alpha1.Organization organizations = 2;
-   */
-  organizations: Organization[] = [];
-
-  constructor(data?: PartialMessage<ListCallerOrganizationsResponse>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.ListCallerOrganizationsResponse";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "user", kind: "message", T: User },
-    { no: 2, name: "organizations", kind: "message", T: Organization, repeated: true },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): ListCallerOrganizationsResponse {
-    return new ListCallerOrganizationsResponse().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): ListCallerOrganizationsResponse {
-    return new ListCallerOrganizationsResponse().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): ListCallerOrganizationsResponse {
-    return new ListCallerOrganizationsResponse().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: ListCallerOrganizationsResponse | PlainMessage<ListCallerOrganizationsResponse> | undefined, b: ListCallerOrganizationsResponse | PlainMessage<ListCallerOrganizationsResponse> | undefined): boolean {
-    return proto3.util.equals(ListCallerOrganizationsResponse, a, b);
-  }
-}
-
-/**
- * @generated from message holos.v1alpha1.CreateCallerOrganizationRequest
- */
-export class CreateCallerOrganizationRequest extends Message<CreateCallerOrganizationRequest> {
-  constructor(data?: PartialMessage<CreateCallerOrganizationRequest>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.CreateCallerOrganizationRequest";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): CreateCallerOrganizationRequest {
-    return new CreateCallerOrganizationRequest().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): CreateCallerOrganizationRequest {
-    return new CreateCallerOrganizationRequest().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): CreateCallerOrganizationRequest {
-    return new CreateCallerOrganizationRequest().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: CreateCallerOrganizationRequest | PlainMessage<CreateCallerOrganizationRequest> | undefined, b: CreateCallerOrganizationRequest | PlainMessage<CreateCallerOrganizationRequest> | undefined): boolean {
-    return proto3.util.equals(CreateCallerOrganizationRequest, a, b);
-  }
-}
-
-/**
- * @generated from message holos.v1alpha1.CreateCallerOrganizationResponse
- */
-export class CreateCallerOrganizationResponse extends Message<CreateCallerOrganizationResponse> {
-  /**
-   * @generated from field: holos.v1alpha1.User user = 1;
-   */
-  user?: User;
-
-  /**
-   * @generated from field: repeated holos.v1alpha1.Organization organizations = 2;
-   */
-  organizations: Organization[] = [];
-
-  constructor(data?: PartialMessage<CreateCallerOrganizationResponse>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.CreateCallerOrganizationResponse";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "user", kind: "message", T: User },
-    { no: 2, name: "organizations", kind: "message", T: Organization, repeated: true },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): CreateCallerOrganizationResponse {
-    return new CreateCallerOrganizationResponse().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): CreateCallerOrganizationResponse {
-    return new CreateCallerOrganizationResponse().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): CreateCallerOrganizationResponse {
-    return new CreateCallerOrganizationResponse().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: CreateCallerOrganizationResponse | PlainMessage<CreateCallerOrganizationResponse> | undefined, b: CreateCallerOrganizationResponse | PlainMessage<CreateCallerOrganizationResponse> | undefined): boolean {
-    return proto3.util.equals(CreateCallerOrganizationResponse, a, b);
-  }
-}
-
--- a/internal/frontend/holos/src/app/gen/holos/v1alpha1/platform_connect.ts
+++ b/internal/frontend/holos/src/app/gen/holos/v1alpha1/platform_connect.ts
@@ -1,80 +0,0 @@
-// @generated by protoc-gen-connect-es v1.4.0 with parameter "target=ts"
-// @generated from file holos/v1alpha1/platform.proto (package holos.v1alpha1, syntax proto3)
-/* eslint-disable */
-// @ts-nocheck
-
-import { AddPlatformRequest, AddPlatformResponse, GetFormRequest, GetFormResponse, GetModelRequest, GetModelResponse, GetPlatformRequest, GetPlatformResponse, ListPlatformsRequest, ListPlatformsResponse, PutFormRequest, PutFormResponse, PutModelRequest, PutModelResponse } from "./platform_pb.js";
-import { MethodKind } from "@bufbuild/protobuf";
-
-/**
- * @generated from service holos.v1alpha1.PlatformService
- */
-export const PlatformService = {
-  typeName: "holos.v1alpha1.PlatformService",
-  methods: {
-    /**
-     * @generated from rpc holos.v1alpha1.PlatformService.AddPlatform
-     */
-    addPlatform: {
-      name: "AddPlatform",
-      I: AddPlatformRequest,
-      O: AddPlatformResponse,
-      kind: MethodKind.Unary,
-    },
-    /**
-     * @generated from rpc holos.v1alpha1.PlatformService.GetPlatform
-     */
-    getPlatform: {
-      name: "GetPlatform",
-      I: GetPlatformRequest,
-      O: GetPlatformResponse,
-      kind: MethodKind.Unary,
-    },
-    /**
-     * @generated from rpc holos.v1alpha1.PlatformService.ListPlatforms
-     */
-    listPlatforms: {
-      name: "ListPlatforms",
-      I: ListPlatformsRequest,
-      O: ListPlatformsResponse,
-      kind: MethodKind.Unary,
-    },
-    /**
-     * @generated from rpc holos.v1alpha1.PlatformService.GetForm
-     */
-    getForm: {
-      name: "GetForm",
-      I: GetFormRequest,
-      O: GetFormResponse,
-      kind: MethodKind.Unary,
-    },
-    /**
-     * @generated from rpc holos.v1alpha1.PlatformService.PutForm
-     */
-    putForm: {
-      name: "PutForm",
-      I: PutFormRequest,
-      O: PutFormResponse,
-      kind: MethodKind.Unary,
-    },
-    /**
-     * @generated from rpc holos.v1alpha1.PlatformService.GetModel
-     */
-    getModel: {
-      name: "GetModel",
-      I: GetModelRequest,
-      O: GetModelResponse,
-      kind: MethodKind.Unary,
-    },
-    /**
-     * @generated from rpc holos.v1alpha1.PlatformService.PutModel
-     */
-    putModel: {
-      name: "PutModel",
-      I: PutModelRequest,
-      O: PutModelResponse,
-      kind: MethodKind.Unary,
-    },
-  }
-} as const;
-
--- a/internal/frontend/holos/src/app/gen/holos/v1alpha1/platform_pb.ts
+++ b/internal/frontend/holos/src/app/gen/holos/v1alpha1/platform_pb.ts
@@ -1,732 +0,0 @@
-// @generated by protoc-gen-es v1.9.0 with parameter "target=ts"
-// @generated from file holos/v1alpha1/platform.proto (package holos.v1alpha1, syntax proto3)
-/* eslint-disable */
-// @ts-nocheck
-
-import type { BinaryReadOptions, FieldList, JsonReadOptions, JsonValue, PartialMessage, PlainMessage } from "@bufbuild/protobuf";
-import { Message, proto3, Struct } from "@bufbuild/protobuf";
-
-/**
- * @generated from message holos.v1alpha1.Platform
- */
-export class Platform extends Message<Platform> {
-  /**
-   * Unique id assigned by the server.
-   *
-   * @generated from field: string id = 1;
-   */
-  id = "";
-
-  /**
-   * Organization ID resource owner.
-   *
-   * @generated from field: string org_id = 2;
-   */
-  orgId = "";
-
-  /**
-   * name is the platform short name as a dns label.
-   *
-   * @generated from field: string name = 3;
-   */
-  name = "";
-
-  /**
-   * @generated from field: string display_name = 4;
-   */
-  displayName = "";
-
-  /**
-   * @generated from field: holos.v1alpha1.PlatformSpec spec = 5;
-   */
-  spec?: PlatformSpec;
-
-  constructor(data?: PartialMessage<Platform>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.Platform";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 2, name: "org_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 3, name: "name", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 4, name: "display_name", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 5, name: "spec", kind: "message", T: PlatformSpec },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): Platform {
-    return new Platform().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): Platform {
-    return new Platform().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): Platform {
-    return new Platform().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: Platform | PlainMessage<Platform> | undefined, b: Platform | PlainMessage<Platform> | undefined): boolean {
-    return proto3.util.equals(Platform, a, b);
-  }
-}
-
-/**
- * @generated from message holos.v1alpha1.PlatformSpec
- */
-export class PlatformSpec extends Message<PlatformSpec> {
-  /**
-   * model represents the user-defined and user-supplied form field values.
-   *
-   * @generated from field: google.protobuf.Struct model = 1;
-   */
-  model?: Struct;
-
-  constructor(data?: PartialMessage<PlatformSpec>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.PlatformSpec";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "model", kind: "message", T: Struct },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): PlatformSpec {
-    return new PlatformSpec().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): PlatformSpec {
-    return new PlatformSpec().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): PlatformSpec {
-    return new PlatformSpec().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: PlatformSpec | PlainMessage<PlatformSpec> | undefined, b: PlatformSpec | PlainMessage<PlatformSpec> | undefined): boolean {
-    return proto3.util.equals(PlatformSpec, a, b);
-  }
-}
-
-/**
- * Form represents the Formly input form.
- *
- * @generated from message holos.v1alpha1.Form
- */
-export class Form extends Message<Form> {
-  /**
-   * fields represents FormlyFieldConfig[] encoded as a JSON array.
-   *
-   * @generated from field: repeated google.protobuf.Struct fields = 1;
-   */
-  fields: Struct[] = [];
-
-  constructor(data?: PartialMessage<Form>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.Form";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "fields", kind: "message", T: Struct, repeated: true },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): Form {
-    return new Form().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): Form {
-    return new Form().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): Form {
-    return new Form().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: Form | PlainMessage<Form> | undefined, b: Form | PlainMessage<Form> | undefined): boolean {
-    return proto3.util.equals(Form, a, b);
-  }
-}
-
-/**
- * Model represents the values entered into the form, stored in the form's model
- * in the web app, and persisted into the backend database.  The model is
- * ultimately intended as the input to platform rendering.
- *
- * @generated from message holos.v1alpha1.Model
- */
-export class Model extends Message<Model> {
-  /**
-   * @generated from field: google.protobuf.Struct model = 1;
-   */
-  model?: Struct;
-
-  constructor(data?: PartialMessage<Model>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.Model";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "model", kind: "message", T: Struct },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): Model {
-    return new Model().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): Model {
-    return new Model().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): Model {
-    return new Model().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: Model | PlainMessage<Model> | undefined, b: Model | PlainMessage<Model> | undefined): boolean {
-    return proto3.util.equals(Model, a, b);
-  }
-}
-
-/**
- * @generated from message holos.v1alpha1.ListPlatformsRequest
- */
-export class ListPlatformsRequest extends Message<ListPlatformsRequest> {
-  /**
-   * @generated from field: string org_id = 1;
-   */
-  orgId = "";
-
-  constructor(data?: PartialMessage<ListPlatformsRequest>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.ListPlatformsRequest";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "org_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): ListPlatformsRequest {
-    return new ListPlatformsRequest().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): ListPlatformsRequest {
-    return new ListPlatformsRequest().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): ListPlatformsRequest {
-    return new ListPlatformsRequest().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: ListPlatformsRequest | PlainMessage<ListPlatformsRequest> | undefined, b: ListPlatformsRequest | PlainMessage<ListPlatformsRequest> | undefined): boolean {
-    return proto3.util.equals(ListPlatformsRequest, a, b);
-  }
-}
-
-/**
- * @generated from message holos.v1alpha1.ListPlatformsResponse
- */
-export class ListPlatformsResponse extends Message<ListPlatformsResponse> {
-  /**
-   * @generated from field: repeated holos.v1alpha1.Platform platforms = 1;
-   */
-  platforms: Platform[] = [];
-
-  constructor(data?: PartialMessage<ListPlatformsResponse>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.ListPlatformsResponse";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "platforms", kind: "message", T: Platform, repeated: true },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): ListPlatformsResponse {
-    return new ListPlatformsResponse().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): ListPlatformsResponse {
-    return new ListPlatformsResponse().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): ListPlatformsResponse {
-    return new ListPlatformsResponse().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: ListPlatformsResponse | PlainMessage<ListPlatformsResponse> | undefined, b: ListPlatformsResponse | PlainMessage<ListPlatformsResponse> | undefined): boolean {
-    return proto3.util.equals(ListPlatformsResponse, a, b);
-  }
-}
-
-/**
- * @generated from message holos.v1alpha1.AddPlatformRequest
- */
-export class AddPlatformRequest extends Message<AddPlatformRequest> {
-  /**
-   * @generated from field: holos.v1alpha1.Platform platform = 1;
-   */
-  platform?: Platform;
-
-  constructor(data?: PartialMessage<AddPlatformRequest>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.AddPlatformRequest";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "platform", kind: "message", T: Platform },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): AddPlatformRequest {
-    return new AddPlatformRequest().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): AddPlatformRequest {
-    return new AddPlatformRequest().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): AddPlatformRequest {
-    return new AddPlatformRequest().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: AddPlatformRequest | PlainMessage<AddPlatformRequest> | undefined, b: AddPlatformRequest | PlainMessage<AddPlatformRequest> | undefined): boolean {
-    return proto3.util.equals(AddPlatformRequest, a, b);
-  }
-}
-
-/**
- * @generated from message holos.v1alpha1.AddPlatformResponse
- */
-export class AddPlatformResponse extends Message<AddPlatformResponse> {
-  /**
-   * @generated from field: repeated holos.v1alpha1.Platform platforms = 1;
-   */
-  platforms: Platform[] = [];
-
-  constructor(data?: PartialMessage<AddPlatformResponse>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.AddPlatformResponse";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "platforms", kind: "message", T: Platform, repeated: true },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): AddPlatformResponse {
-    return new AddPlatformResponse().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): AddPlatformResponse {
-    return new AddPlatformResponse().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): AddPlatformResponse {
-    return new AddPlatformResponse().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: AddPlatformResponse | PlainMessage<AddPlatformResponse> | undefined, b: AddPlatformResponse | PlainMessage<AddPlatformResponse> | undefined): boolean {
-    return proto3.util.equals(AddPlatformResponse, a, b);
-  }
-}
-
-/**
- * @generated from message holos.v1alpha1.GetPlatformRequest
- */
-export class GetPlatformRequest extends Message<GetPlatformRequest> {
-  /**
-   * @generated from field: string platform_id = 1;
-   */
-  platformId = "";
-
-  constructor(data?: PartialMessage<GetPlatformRequest>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.GetPlatformRequest";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "platform_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetPlatformRequest {
-    return new GetPlatformRequest().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetPlatformRequest {
-    return new GetPlatformRequest().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetPlatformRequest {
-    return new GetPlatformRequest().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: GetPlatformRequest | PlainMessage<GetPlatformRequest> | undefined, b: GetPlatformRequest | PlainMessage<GetPlatformRequest> | undefined): boolean {
-    return proto3.util.equals(GetPlatformRequest, a, b);
-  }
-}
-
-/**
- * @generated from message holos.v1alpha1.GetPlatformResponse
- */
-export class GetPlatformResponse extends Message<GetPlatformResponse> {
-  /**
-   * @generated from field: holos.v1alpha1.Platform platform = 1;
-   */
-  platform?: Platform;
-
-  constructor(data?: PartialMessage<GetPlatformResponse>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.GetPlatformResponse";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "platform", kind: "message", T: Platform },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetPlatformResponse {
-    return new GetPlatformResponse().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetPlatformResponse {
-    return new GetPlatformResponse().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetPlatformResponse {
-    return new GetPlatformResponse().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: GetPlatformResponse | PlainMessage<GetPlatformResponse> | undefined, b: GetPlatformResponse | PlainMessage<GetPlatformResponse> | undefined): boolean {
-    return proto3.util.equals(GetPlatformResponse, a, b);
-  }
-}
-
-/**
- * @generated from message holos.v1alpha1.GetFormRequest
- */
-export class GetFormRequest extends Message<GetFormRequest> {
-  /**
-   * @generated from field: string platform_id = 1;
-   */
-  platformId = "";
-
-  constructor(data?: PartialMessage<GetFormRequest>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.GetFormRequest";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "platform_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetFormRequest {
-    return new GetFormRequest().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetFormRequest {
-    return new GetFormRequest().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetFormRequest {
-    return new GetFormRequest().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: GetFormRequest | PlainMessage<GetFormRequest> | undefined, b: GetFormRequest | PlainMessage<GetFormRequest> | undefined): boolean {
-    return proto3.util.equals(GetFormRequest, a, b);
-  }
-}
-
-/**
- * @generated from message holos.v1alpha1.GetFormResponse
- */
-export class GetFormResponse extends Message<GetFormResponse> {
-  /**
-   * @generated from field: repeated google.protobuf.Struct fields = 1;
-   */
-  fields: Struct[] = [];
-
-  /**
-   * @generated from field: google.protobuf.Struct model = 2;
-   */
-  model?: Struct;
-
-  constructor(data?: PartialMessage<GetFormResponse>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.GetFormResponse";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "fields", kind: "message", T: Struct, repeated: true },
-    { no: 2, name: "model", kind: "message", T: Struct },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetFormResponse {
-    return new GetFormResponse().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetFormResponse {
-    return new GetFormResponse().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetFormResponse {
-    return new GetFormResponse().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: GetFormResponse | PlainMessage<GetFormResponse> | undefined, b: GetFormResponse | PlainMessage<GetFormResponse> | undefined): boolean {
-    return proto3.util.equals(GetFormResponse, a, b);
-  }
-}
-
-/**
- * @generated from message holos.v1alpha1.GetModelRequest
- */
-export class GetModelRequest extends Message<GetModelRequest> {
-  /**
-   * @generated from field: string platform_id = 1;
-   */
-  platformId = "";
-
-  constructor(data?: PartialMessage<GetModelRequest>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.GetModelRequest";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "platform_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetModelRequest {
-    return new GetModelRequest().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetModelRequest {
-    return new GetModelRequest().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetModelRequest {
-    return new GetModelRequest().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: GetModelRequest | PlainMessage<GetModelRequest> | undefined, b: GetModelRequest | PlainMessage<GetModelRequest> | undefined): boolean {
-    return proto3.util.equals(GetModelRequest, a, b);
-  }
-}
-
-/**
- * @generated from message holos.v1alpha1.GetModelResponse
- */
-export class GetModelResponse extends Message<GetModelResponse> {
-  /**
-   * @generated from field: google.protobuf.Struct model = 1;
-   */
-  model?: Struct;
-
-  constructor(data?: PartialMessage<GetModelResponse>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.GetModelResponse";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "model", kind: "message", T: Struct },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetModelResponse {
-    return new GetModelResponse().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetModelResponse {
-    return new GetModelResponse().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetModelResponse {
-    return new GetModelResponse().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: GetModelResponse | PlainMessage<GetModelResponse> | undefined, b: GetModelResponse | PlainMessage<GetModelResponse> | undefined): boolean {
-    return proto3.util.equals(GetModelResponse, a, b);
-  }
-}
-
-/**
- * @generated from message holos.v1alpha1.PutModelRequest
- */
-export class PutModelRequest extends Message<PutModelRequest> {
-  /**
-   * @generated from field: string platform_id = 1;
-   */
-  platformId = "";
-
-  /**
-   * @generated from field: google.protobuf.Struct model = 2;
-   */
-  model?: Struct;
-
-  constructor(data?: PartialMessage<PutModelRequest>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.PutModelRequest";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "platform_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 2, name: "model", kind: "message", T: Struct },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): PutModelRequest {
-    return new PutModelRequest().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): PutModelRequest {
-    return new PutModelRequest().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): PutModelRequest {
-    return new PutModelRequest().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: PutModelRequest | PlainMessage<PutModelRequest> | undefined, b: PutModelRequest | PlainMessage<PutModelRequest> | undefined): boolean {
-    return proto3.util.equals(PutModelRequest, a, b);
-  }
-}
-
-/**
- * @generated from message holos.v1alpha1.PutModelResponse
- */
-export class PutModelResponse extends Message<PutModelResponse> {
-  /**
-   * @generated from field: google.protobuf.Struct model = 1;
-   */
-  model?: Struct;
-
-  constructor(data?: PartialMessage<PutModelResponse>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.PutModelResponse";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "model", kind: "message", T: Struct },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): PutModelResponse {
-    return new PutModelResponse().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): PutModelResponse {
-    return new PutModelResponse().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): PutModelResponse {
-    return new PutModelResponse().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: PutModelResponse | PlainMessage<PutModelResponse> | undefined, b: PutModelResponse | PlainMessage<PutModelResponse> | undefined): boolean {
-    return proto3.util.equals(PutModelResponse, a, b);
-  }
-}
-
-/**
- * @generated from message holos.v1alpha1.PutFormRequest
- */
-export class PutFormRequest extends Message<PutFormRequest> {
-  /**
-   * @generated from field: string platform_id = 1;
-   */
-  platformId = "";
-
-  /**
-   * @generated from field: repeated google.protobuf.Struct fields = 2;
-   */
-  fields: Struct[] = [];
-
-  constructor(data?: PartialMessage<PutFormRequest>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.PutFormRequest";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "platform_id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 2, name: "fields", kind: "message", T: Struct, repeated: true },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): PutFormRequest {
-    return new PutFormRequest().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): PutFormRequest {
-    return new PutFormRequest().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): PutFormRequest {
-    return new PutFormRequest().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: PutFormRequest | PlainMessage<PutFormRequest> | undefined, b: PutFormRequest | PlainMessage<PutFormRequest> | undefined): boolean {
-    return proto3.util.equals(PutFormRequest, a, b);
-  }
-}
-
-/**
- * @generated from message holos.v1alpha1.PutFormResponse
- */
-export class PutFormResponse extends Message<PutFormResponse> {
-  /**
-   * @generated from field: repeated google.protobuf.Struct fields = 1;
-   */
-  fields: Struct[] = [];
-
-  constructor(data?: PartialMessage<PutFormResponse>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.PutFormResponse";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "fields", kind: "message", T: Struct, repeated: true },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): PutFormResponse {
-    return new PutFormResponse().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): PutFormResponse {
-    return new PutFormResponse().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): PutFormResponse {
-    return new PutFormResponse().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: PutFormResponse | PlainMessage<PutFormResponse> | undefined, b: PutFormResponse | PlainMessage<PutFormResponse> | undefined): boolean {
-    return proto3.util.equals(PutFormResponse, a, b);
-  }
-}
-
--- a/internal/frontend/holos/src/app/gen/holos/v1alpha1/timestamps_pb.ts
+++ b/internal/frontend/holos/src/app/gen/holos/v1alpha1/timestamps_pb.ts
@@ -1,55 +0,0 @@
-// @generated by protoc-gen-es v1.9.0 with parameter "target=ts"
-// @generated from file holos/v1alpha1/timestamps.proto (package holos.v1alpha1, syntax proto3)
-/* eslint-disable */
-// @ts-nocheck
-
-import type { BinaryReadOptions, FieldList, JsonReadOptions, JsonValue, PartialMessage, PlainMessage } from "@bufbuild/protobuf";
-import { Message, proto3, Timestamp } from "@bufbuild/protobuf";
-
-/**
- * @generated from message holos.v1alpha1.Timestamps
- */
-export class Timestamps extends Message<Timestamps> {
-  /**
-   * Created at timestamp
-   *
-   * @generated from field: google.protobuf.Timestamp created_at = 1;
-   */
-  createdAt?: Timestamp;
-
-  /**
-   * Updated at timestamp
-   *
-   * @generated from field: google.protobuf.Timestamp updated_at = 2;
-   */
-  updatedAt?: Timestamp;
-
-  constructor(data?: PartialMessage<Timestamps>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.Timestamps";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "created_at", kind: "message", T: Timestamp },
-    { no: 2, name: "updated_at", kind: "message", T: Timestamp },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): Timestamps {
-    return new Timestamps().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): Timestamps {
-    return new Timestamps().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): Timestamps {
-    return new Timestamps().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: Timestamps | PlainMessage<Timestamps> | undefined, b: Timestamps | PlainMessage<Timestamps> | undefined): boolean {
-    return proto3.util.equals(Timestamps, a, b);
-  }
-}
-
--- a/internal/frontend/holos/src/app/gen/holos/v1alpha1/user_connect.ts
+++ b/internal/frontend/holos/src/app/gen/holos/v1alpha1/user_connect.ts
@@ -1,44 +0,0 @@
-// @generated by protoc-gen-connect-es v1.4.0 with parameter "target=ts"
-// @generated from file holos/v1alpha1/user.proto (package holos.v1alpha1, syntax proto3)
-/* eslint-disable */
-// @ts-nocheck
-
-import { CreateCallerUserRequest, CreateCallerUserResponse, GetCallerClaimsRequest, GetCallerClaimsResponse, GetCallerUserRequest, GetCallerUserResponse } from "./user_pb.js";
-import { MethodKind } from "@bufbuild/protobuf";
-
-/**
- * @generated from service holos.v1alpha1.UserService
- */
-export const UserService = {
-  typeName: "holos.v1alpha1.UserService",
-  methods: {
-    /**
-     * @generated from rpc holos.v1alpha1.UserService.GetCallerClaims
-     */
-    getCallerClaims: {
-      name: "GetCallerClaims",
-      I: GetCallerClaimsRequest,
-      O: GetCallerClaimsResponse,
-      kind: MethodKind.Unary,
-    },
-    /**
-     * @generated from rpc holos.v1alpha1.UserService.GetCallerUser
-     */
-    getCallerUser: {
-      name: "GetCallerUser",
-      I: GetCallerUserRequest,
-      O: GetCallerUserResponse,
-      kind: MethodKind.Unary,
-    },
-    /**
-     * @generated from rpc holos.v1alpha1.UserService.CreateCallerUser
-     */
-    createCallerUser: {
-      name: "CreateCallerUser",
-      I: CreateCallerUserRequest,
-      O: CreateCallerUserResponse,
-      kind: MethodKind.Unary,
-    },
-  }
-} as const;
-
--- a/internal/frontend/holos/src/app/gen/holos/v1alpha1/user_pb.ts
+++ b/internal/frontend/holos/src/app/gen/holos/v1alpha1/user_pb.ts
@@ -1,404 +0,0 @@
-// @generated by protoc-gen-es v1.9.0 with parameter "target=ts"
-// @generated from file holos/v1alpha1/user.proto (package holos.v1alpha1, syntax proto3)
-/* eslint-disable */
-// @ts-nocheck
-
-import type { BinaryReadOptions, FieldList, JsonReadOptions, JsonValue, PartialMessage, PlainMessage } from "@bufbuild/protobuf";
-import { Message, proto3 } from "@bufbuild/protobuf";
-import { Timestamps } from "./timestamps_pb.js";
-
-/**
- * User represents a human user in the system.  See db schema in ent/schema/user.go
- *
- * @generated from message holos.v1alpha1.User
- */
-export class User extends Message<User> {
-  /**
-   * Unique id assigned by the server.
-   *
-   * @generated from field: string id = 1;
-   */
-  id = "";
-
-  /**
-   * @generated from field: string email = 2;
-   */
-  email = "";
-
-  /**
-   * @generated from field: bool email_verified = 3;
-   */
-  emailVerified = false;
-
-  /**
-   * @generated from field: string name = 4;
-   */
-  name = "";
-
-  /**
-   * @generated from field: holos.v1alpha1.Timestamps timestamps = 5;
-   */
-  timestamps?: Timestamps;
-
-  constructor(data?: PartialMessage<User>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.User";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 2, name: "email", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 3, name: "email_verified", kind: "scalar", T: 8 /* ScalarType.BOOL */ },
-    { no: 4, name: "name", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 5, name: "timestamps", kind: "message", T: Timestamps },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): User {
-    return new User().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): User {
-    return new User().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): User {
-    return new User().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: User | PlainMessage<User> | undefined, b: User | PlainMessage<User> | undefined): boolean {
-    return proto3.util.equals(User, a, b);
-  }
-}
-
-/**
- * @generated from message holos.v1alpha1.CreateCallerUserRequest
- */
-export class CreateCallerUserRequest extends Message<CreateCallerUserRequest> {
-  constructor(data?: PartialMessage<CreateCallerUserRequest>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.CreateCallerUserRequest";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): CreateCallerUserRequest {
-    return new CreateCallerUserRequest().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): CreateCallerUserRequest {
-    return new CreateCallerUserRequest().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): CreateCallerUserRequest {
-    return new CreateCallerUserRequest().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: CreateCallerUserRequest | PlainMessage<CreateCallerUserRequest> | undefined, b: CreateCallerUserRequest | PlainMessage<CreateCallerUserRequest> | undefined): boolean {
-    return proto3.util.equals(CreateCallerUserRequest, a, b);
-  }
-}
-
-/**
- * @generated from message holos.v1alpha1.CreateCallerUserResponse
- */
-export class CreateCallerUserResponse extends Message<CreateCallerUserResponse> {
-  /**
-   * @generated from field: holos.v1alpha1.User user = 1;
-   */
-  user?: User;
-
-  constructor(data?: PartialMessage<CreateCallerUserResponse>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.CreateCallerUserResponse";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "user", kind: "message", T: User },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): CreateCallerUserResponse {
-    return new CreateCallerUserResponse().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): CreateCallerUserResponse {
-    return new CreateCallerUserResponse().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): CreateCallerUserResponse {
-    return new CreateCallerUserResponse().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: CreateCallerUserResponse | PlainMessage<CreateCallerUserResponse> | undefined, b: CreateCallerUserResponse | PlainMessage<CreateCallerUserResponse> | undefined): boolean {
-    return proto3.util.equals(CreateCallerUserResponse, a, b);
-  }
-}
-
-/**
- * @generated from message holos.v1alpha1.GetCallerClaimsRequest
- */
-export class GetCallerClaimsRequest extends Message<GetCallerClaimsRequest> {
-  constructor(data?: PartialMessage<GetCallerClaimsRequest>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.GetCallerClaimsRequest";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetCallerClaimsRequest {
-    return new GetCallerClaimsRequest().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetCallerClaimsRequest {
-    return new GetCallerClaimsRequest().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetCallerClaimsRequest {
-    return new GetCallerClaimsRequest().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: GetCallerClaimsRequest | PlainMessage<GetCallerClaimsRequest> | undefined, b: GetCallerClaimsRequest | PlainMessage<GetCallerClaimsRequest> | undefined): boolean {
-    return proto3.util.equals(GetCallerClaimsRequest, a, b);
-  }
-}
-
-/**
- * @generated from message holos.v1alpha1.Claims
- */
-export class Claims extends Message<Claims> {
-  /**
-   * @generated from field: string iss = 1;
-   */
-  iss = "";
-
-  /**
-   * @generated from field: string sub = 2;
-   */
-  sub = "";
-
-  /**
-   * @generated from field: string email = 3;
-   */
-  email = "";
-
-  /**
-   * @generated from field: bool email_verified = 4;
-   */
-  emailVerified = false;
-
-  /**
-   * @generated from field: string name = 5;
-   */
-  name = "";
-
-  /**
-   * @generated from field: repeated string groups = 6;
-   */
-  groups: string[] = [];
-
-  /**
-   * @generated from field: string given_name = 7;
-   */
-  givenName = "";
-
-  /**
-   * @generated from field: string family_name = 8;
-   */
-  familyName = "";
-
-  /**
-   * @generated from field: string picture = 9;
-   */
-  picture = "";
-
-  constructor(data?: PartialMessage<Claims>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.Claims";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "iss", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 2, name: "sub", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 3, name: "email", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 4, name: "email_verified", kind: "scalar", T: 8 /* ScalarType.BOOL */ },
-    { no: 5, name: "name", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 6, name: "groups", kind: "scalar", T: 9 /* ScalarType.STRING */, repeated: true },
-    { no: 7, name: "given_name", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 8, name: "family_name", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-    { no: 9, name: "picture", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): Claims {
-    return new Claims().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): Claims {
-    return new Claims().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): Claims {
-    return new Claims().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: Claims | PlainMessage<Claims> | undefined, b: Claims | PlainMessage<Claims> | undefined): boolean {
-    return proto3.util.equals(Claims, a, b);
-  }
-}
-
-/**
- * @generated from message holos.v1alpha1.Creator
- */
-export class Creator extends Message<Creator> {
-  /**
-   * @generated from field: string id = 1;
-   */
-  id = "";
-
-  constructor(data?: PartialMessage<Creator>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.Creator";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "id", kind: "scalar", T: 9 /* ScalarType.STRING */ },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): Creator {
-    return new Creator().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): Creator {
-    return new Creator().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): Creator {
-    return new Creator().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: Creator | PlainMessage<Creator> | undefined, b: Creator | PlainMessage<Creator> | undefined): boolean {
-    return proto3.util.equals(Creator, a, b);
-  }
-}
-
-/**
- * UserClaims represents id token claims
- *
- * @generated from message holos.v1alpha1.GetCallerClaimsResponse
- */
-export class GetCallerClaimsResponse extends Message<GetCallerClaimsResponse> {
-  /**
-   * @generated from field: holos.v1alpha1.Claims claims = 1;
-   */
-  claims?: Claims;
-
-  constructor(data?: PartialMessage<GetCallerClaimsResponse>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.GetCallerClaimsResponse";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "claims", kind: "message", T: Claims },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetCallerClaimsResponse {
-    return new GetCallerClaimsResponse().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetCallerClaimsResponse {
-    return new GetCallerClaimsResponse().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetCallerClaimsResponse {
-    return new GetCallerClaimsResponse().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: GetCallerClaimsResponse | PlainMessage<GetCallerClaimsResponse> | undefined, b: GetCallerClaimsResponse | PlainMessage<GetCallerClaimsResponse> | undefined): boolean {
-    return proto3.util.equals(GetCallerClaimsResponse, a, b);
-  }
-}
-
-/**
- * Empty request, claims are pulled from the id token
- *
- * @generated from message holos.v1alpha1.GetCallerUserRequest
- */
-export class GetCallerUserRequest extends Message<GetCallerUserRequest> {
-  constructor(data?: PartialMessage<GetCallerUserRequest>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.GetCallerUserRequest";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetCallerUserRequest {
-    return new GetCallerUserRequest().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetCallerUserRequest {
-    return new GetCallerUserRequest().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetCallerUserRequest {
-    return new GetCallerUserRequest().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: GetCallerUserRequest | PlainMessage<GetCallerUserRequest> | undefined, b: GetCallerUserRequest | PlainMessage<GetCallerUserRequest> | undefined): boolean {
-    return proto3.util.equals(GetCallerUserRequest, a, b);
-  }
-}
-
-/**
- * @generated from message holos.v1alpha1.GetCallerUserResponse
- */
-export class GetCallerUserResponse extends Message<GetCallerUserResponse> {
-  /**
-   * @generated from field: holos.v1alpha1.User user = 1;
-   */
-  user?: User;
-
-  constructor(data?: PartialMessage<GetCallerUserResponse>) {
-    super();
-    proto3.util.initPartial(data, this);
-  }
-
-  static readonly runtime: typeof proto3 = proto3;
-  static readonly typeName = "holos.v1alpha1.GetCallerUserResponse";
-  static readonly fields: FieldList = proto3.util.newFieldList(() => [
-    { no: 1, name: "user", kind: "message", T: User },
-  ]);
-
-  static fromBinary(bytes: Uint8Array, options?: Partial<BinaryReadOptions>): GetCallerUserResponse {
-    return new GetCallerUserResponse().fromBinary(bytes, options);
-  }
-
-  static fromJson(jsonValue: JsonValue, options?: Partial<JsonReadOptions>): GetCallerUserResponse {
-    return new GetCallerUserResponse().fromJson(jsonValue, options);
-  }
-
-  static fromJsonString(jsonString: string, options?: Partial<JsonReadOptions>): GetCallerUserResponse {
-    return new GetCallerUserResponse().fromJsonString(jsonString, options);
-  }
-
-  static equals(a: GetCallerUserResponse | PlainMessage<GetCallerUserResponse> | undefined, b: GetCallerUserResponse | PlainMessage<GetCallerUserResponse> | undefined): boolean {
-    return proto3.util.equals(GetCallerUserResponse, a, b);
-  }
-}
-
--- a/internal/frontend/holos/src/app/nav/nav.component.html
+++ b/internal/frontend/holos/src/app/nav/nav.component.html
@@ -31,7 +31,7 @@
          </button>
        }
      </span>
-      <app-profile-button [claims$]="claims$"></app-profile-button>
+      <app-profile-button [user$]="user$"></app-profile-button>
    </mat-toolbar>
    <main class="main-content">
      <router-outlet></router-outlet>
--- a/internal/frontend/holos/src/app/nav/nav.component.ts
+++ b/internal/frontend/holos/src/app/nav/nav.component.ts
@@ -10,10 +10,10 @@ import { Observable } from 'rxjs';
 import { map, shareReplay } from 'rxjs/operators';
 import { RouterLink, RouterLinkActive, RouterOutlet } from '@angular/router';
 import { MatCardModule } from '@angular/material/card';
-import { Claims } from '../gen/holos/v1alpha1/user_pb';
 import { ProfileButtonComponent } from '../profile-button/profile-button.component';
+import { User } from '../gen/holos/user/v1alpha1/user_pb';
 import { UserService } from '../services/user.service';
-import { Organization } from '../gen/holos/v1alpha1/organization_pb';
+import { Organization } from '../gen/holos/organization/v1alpha1/organization_pb';
 import { OrganizationService } from '../services/organization.service';

@Component({
@@ -41,7 +41,7 @@ export class NavComponent implements OnInit {
  private userService = inject(UserService);
  private orgService = inject(OrganizationService);

-  claims$!: Observable<Claims | null>;
+  user$!: Observable<User | null>;
  org$!: Observable<Organization | undefined>;

  refreshOrg(): void {
@@ -55,7 +55,7 @@ export class NavComponent implements OnInit {
    );

  ngOnInit(): void {
-    this.claims$ = this.userService.getClaims();
+    this.user$ = this.userService.getUser();
    this.org$ = this.orgService.activeOrg();
  }
 }
--- a/internal/frontend/holos/src/app/profile-button/profile-button.component.html
+++ b/internal/frontend/holos/src/app/profile-button/profile-button.component.html
@@ -1,7 +1,7 @@
-@if (claims$ | async; as claims) {
+@if (user$ | async; as user) {
  <button mat-icon-button [matMenuTriggerFor]="menu">
-    @if (claims.picture) {
-      <img class="profile-picture" [src]="claims.picture" alt="Profile"/>
+    @if (user.picture) {
+      <img class="profile-picture" [src]="user.picture" alt="Profile"/>
    } @else {
      <mat-icon>account_circle</mat-icon>
    }
@@ -10,16 +10,16 @@
  <mat-menu class="accounts-menu" #menu="matMenu">
    <mat-card class="accounts-card">
      <mat-card-header>
-        <div mat-card-avatar class="accounts-header-image" [ngStyle]="{'background-image': claims.picture ? 'url(' + claims.picture +')' : 'url(/ui/assets/img/account_circle.svg)'}">
+        <div mat-card-avatar class="accounts-header-image" [ngStyle]="{'background-image': user.picture ? 'url(' + user.picture +')' : 'url(/ui/assets/img/account_circle.svg)'}">
        </div>
-        <mat-card-title>{{ claims.name }}</mat-card-title>
-        <mat-card-subtitle>{{ claims.email }}</mat-card-subtitle>
+        <mat-card-title>{{ user.name }}</mat-card-title>
+        <mat-card-subtitle>{{ user.email }}</mat-card-subtitle>
      </mat-card-header>
      <mat-card-actions>
-        <a mat-menu-item href="{{claims.iss}}/ui/console/users/me?id=general">
+        <a mat-menu-item href="{{user.subject?.iss}}/ui/console/users/me?id=general">
          Profile
        </a>
-        <a mat-menu-item href="{{claims.iss}}/oidc/v1/end_session">
+        <a mat-menu-item href="{{user.subject?.iss}}/oidc/v1/end_session">
          Logout
        </a>
      </mat-card-actions>
--- a/internal/frontend/holos/src/app/profile-button/profile-button.component.ts
+++ b/internal/frontend/holos/src/app/profile-button/profile-button.component.ts
@@ -1,5 +1,5 @@
 import { Component, Input } from '@angular/core';
-import { Claims } from '../gen/holos/v1alpha1/user_pb';
+import { User } from '../gen/holos/user/v1alpha1/user_pb';
 import { MatButtonModule } from '@angular/material/button';
 import { MatMenuModule } from '@angular/material/menu';
 import { Observable } from 'rxjs';
@@ -23,5 +23,5 @@ import { MatCardModule } from '@angular/material/card';
  styleUrl: './profile-button.component.scss'
 })
 export class ProfileButtonComponent {
-  @Input({ required: true }) claims$!: Observable<Claims | null>;
+  @Input({ required: true }) user$!: Observable<User | null>;
 }
--- a/internal/frontend/holos/src/app/services/organization.service.ts
+++ b/internal/frontend/holos/src/app/services/organization.service.ts
@@ -2,8 +2,8 @@ import { Inject, Injectable } from '@angular/core';
 import { Code, ConnectError } from '@connectrpc/connect';
 import { BehaviorSubject, Observable, catchError, of, shareReplay, switchMap } from 'rxjs';
 import { ObservableClient } from '../../connect/observable-client';
-import { OrganizationService as ConnectOrganizationService } from '../gen/holos/v1alpha1/organization_connect';
-import { ListCallerOrganizationsResponse, Organization } from '../gen/holos/v1alpha1/organization_pb';
+import { OrganizationService as ConnectOrganizationService } from '../gen/holos/organization/v1alpha1/organization_service_connect';
+import { Organization } from '../gen/holos/organization/v1alpha1/organization_pb';
 import { UserService } from './user.service';

@Injectable({
@@ -11,21 +11,37 @@ import { UserService } from './user.service';
 })
 export class OrganizationService {
  private callerOrganizationsTrigger$ = new BehaviorSubject<void>(undefined);
-  private callerOrganizations$: Observable<ListCallerOrganizationsResponse>;
+  private callerOrganizations$: Observable<Organization[]>;

-  private fetchCallerOrganizations(): Observable<ListCallerOrganizationsResponse> {
-    return this.client.listCallerOrganizations({ request: {} }).pipe(
+  private fetchCallerOrganizations(): Observable<Organization[]> {
+    return this.client.listOrganizations({}).pipe(
      switchMap(resp => {
        if (resp && resp.organizations.length > 0) {
-          return of(resp)
+          return of(resp.organizations)
        }
-        return this.client.createCallerOrganization({ request: {} })
+        return this.client.createOrganization({}).pipe(
+          switchMap(resp => {
+            if (resp.organization !== undefined) {
+              return of([resp.organization])
+            } else {
+              return of([])
+            }
+          })
+        )
      }),
      catchError(err => {
        if (err instanceof ConnectError) {
          if (err.code == Code.NotFound) {
            return this.userService.createUser().pipe(
-              switchMap(() => this.client.createCallerOrganization({ request: {} }))
+              switchMap(() => this.client.createOrganization({}).pipe(
+                switchMap(resp => {
+                  if (resp.organization !== undefined) {
+                    return of([resp.organization])
+                  } else {
+                    return of([])
+                  }
+                })
+              ))
            )
          }
        }
@@ -35,15 +51,9 @@ export class OrganizationService {
    )
  }

-  getOrganizations(): Observable<Organization[]> {
-    return this.callerOrganizations$.pipe(
-      switchMap(resp => of(resp.organizations))
-    )
-  }
-
  activeOrg(): Observable<Organization | undefined> {
    return this.callerOrganizations$.pipe(
-      switchMap(resp => of(resp.organizations.at(-1)))
+      switchMap(orgs => of(orgs.at(0)))
    )
  }

--- a/internal/frontend/holos/src/app/services/platform.service.ts
+++ b/internal/frontend/holos/src/app/services/platform.service.ts
@@ -1,10 +1,11 @@
 import { Inject, Injectable } from '@angular/core';
-import { JsonValue, Struct, } from '@bufbuild/protobuf';
 import { Observable, of, switchMap } from 'rxjs';
 import { ObservableClient } from '../../connect/observable-client';
-import { Organization } from '../gen/holos/v1alpha1/organization_pb';
-import { PlatformService as ConnectPlatformService } from '../gen/holos/v1alpha1/platform_connect';
-import { GetFormResponse, ListPlatformsRequest, Platform, PutModelRequest, PutModelResponse } from '../gen/holos/v1alpha1/platform_pb';
+import { Organization } from '../gen/holos/organization/v1alpha1/organization_pb';
+import { PlatformService as ConnectPlatformService } from '../gen/holos/platform/v1alpha1/platform_service_connect';
+import { Platform, Spec } from '../gen/holos/platform/v1alpha1/platform_pb';
+import { GetPlatformRequest, ListPlatformsRequest, UpdatePlatformOperation, UpdatePlatformRequest } from '../gen/holos/platform/v1alpha1/platform_service_pb';
+import { FieldMask, JsonValue, Struct } from '@bufbuild/protobuf';

@Injectable({
  providedIn: 'root'
@@ -13,7 +14,10 @@ export class PlatformService {
  listPlatforms(org: Observable<Organization>): Observable<Platform[]> {
    return org.pipe(
      switchMap(org => {
-        const req = new ListPlatformsRequest({ orgId: org.id })
+        if (org.orgId == undefined) {
+          return of([])
+        }
+        const req = new ListPlatformsRequest({ orgId: org.orgId })
        return this.client.listPlatforms(req).pipe(
          switchMap(resp => { return of(resp.platforms) })
        )
@@ -21,20 +25,21 @@ export class PlatformService {
    )
  }

-  getForm(id: string): Observable<GetFormResponse> {
-    return this.client.getForm({ platformId: id })
+  updateModel(platformId: string, model: JsonValue): Observable<Platform | undefined> {
+    const update = new UpdatePlatformOperation({ platformId: platformId, model: Struct.fromJson(model) })
+    const updateMask = new FieldMask({ paths: ["model"] })
+    const req = new UpdatePlatformRequest({ update: update, updateMask: updateMask })
+    return this.client.updatePlatform(req).pipe(
+      switchMap(resp => { return of(resp.platform) })
+    )
  }

-  putModel(id: string, model: JsonValue): Observable<PutModelResponse> {
-    const req = new PutModelRequest({
-      platformId: id,
-      // "We recommend to use fromJson() to construct Struct literals" refer to
-      // https://github.com/bufbuild/protobuf-es/blob/main/docs/runtime_api.md#struct
-      model: Struct.fromJson(model),
-    })
-    return this.client.putModel(req)
+  getPlatform(platformId: string): Observable<Platform | undefined> {
+    const req = new GetPlatformRequest({ platformId: platformId })
+    return this.client.getPlatform(req).pipe(
+      switchMap(resp => { return of(resp.platform) })
+    )
  }

-
  constructor(@Inject(ConnectPlatformService) private client: ObservableClient<typeof ConnectPlatformService>) { }
 }
--- a/internal/frontend/holos/src/app/services/user.service.ts
+++ b/internal/frontend/holos/src/app/services/user.service.ts
@@ -1,21 +1,21 @@
 import { Inject, Injectable } from '@angular/core';
 import { Observable, switchMap, of, shareReplay } from 'rxjs';
 import { ObservableClient } from '../../connect/observable-client';
-import { Claims, User } from '../gen/holos/v1alpha1/user_pb';
-import { UserService as ConnectUserService } from '../gen/holos/v1alpha1/user_connect';
+import { User } from '../gen/holos/user/v1alpha1/user_pb';
+import { UserService as ConnectUserService } from '../gen/holos/user/v1alpha1/user_service_connect';

@Injectable({
  providedIn: 'root'
 })
 export class UserService {

-  getClaims(): Observable<Claims | null> {
-    return this.client.getCallerClaims({ request: {} }).pipe(
-      switchMap(getCallerClaimsResponse => {
-        if (getCallerClaimsResponse && getCallerClaimsResponse.claims) {
-          return of(getCallerClaimsResponse.claims)
+  getUser(): Observable<User | null> {
+    return this.client.getUser({}).pipe(
+      switchMap(resp => {
+        if (resp && resp.user) {
+          return of(resp.user)
        } else {
-          return of(null)
+          return this.createUser()
        }
      }),
      // Consolidate to one api call for all subscribers
@@ -24,7 +24,7 @@ export class UserService {
  }

  createUser(): Observable<User | null> {
-    return this.client.createCallerUser({ request: {} }).pipe(
+    return this.client.createUser({}).pipe(
      switchMap(resp => {
        if (resp && resp.user) {
          return of(resp.user)
--- a/internal/frontend/holos/src/app/views/platform-detail/platform-detail.component.html
+++ b/internal/frontend/holos/src/app/views/platform-detail/platform-detail.component.html
@@ -4,7 +4,7 @@
      <div class="grid-container">
        <form [formGroup]="form" (ngSubmit)="onSubmit(model)">
          <formly-form [model]="model" [fields]="fields" [options]="options" [form]="form"></formly-form>
-          <button type="submit" mat-flat-button color="primary" [disabled]="!form.valid">Submit</button>
+          <button type="submit" mat-flat-button color="primary" [disabled]="!form.valid || isLoading">Submit</button>
        </form>
      </div>
    </mat-tab>
--- a/internal/frontend/holos/src/app/views/platform-detail/platform-detail.component.ts
+++ b/internal/frontend/holos/src/app/views/platform-detail/platform-detail.component.ts
@@ -9,6 +9,8 @@ import { FormlyFieldConfig, FormlyFormOptions, FormlyModule } from '@ngx-formly/
 import { FormlyMaterialModule } from '@ngx-formly/material';
 import { Subject, takeUntil } from 'rxjs';
 import { PlatformService } from '../../services/platform.service';
+import { Platform } from '../../gen/holos/platform/v1alpha1/platform_pb';
+import { MatSnackBar, MatSnackBarModule } from '@angular/material/snack-bar';

@Component({
  selector: 'app-platform-detail',
@@ -29,7 +31,10 @@ import { PlatformService } from '../../services/platform.service';
 })
 export class PlatformDetailComponent implements OnDestroy {
  private platformService = inject(PlatformService);
+  private _snackBar: MatSnackBar = inject(MatSnackBar);
  private platformId: string = "";
+  private platform: Platform = new Platform();
+  isLoading = false;

  private destroy$: Subject<boolean> = new Subject<boolean>();
  form = new FormGroup({});
@@ -52,14 +57,16 @@ export class PlatformDetailComponent implements OnDestroy {

  onSubmit(model: JsonValue) {
    if (this.form.valid) {
-      console.log(model)
+      this.isLoading = true;
      this.platformService
-        .putModel(this.platformId, model)
+        .updateModel(this.platform.id, model)
        .pipe(takeUntil(this.destroy$))
-        .subscribe(resp => {
-          if (resp.model !== undefined) {
-            this.setModel(resp.model.toJson())
-          }
+        .subscribe(platform => {
+          this._snackBar.open('Saved ' + platform?.displayName, 'OK', {
+            duration: 5000,
+          }).afterDismissed().subscribe(() => {
+            this.isLoading = false;
+          })
        })
    }
  }
@@ -68,17 +75,20 @@ export class PlatformDetailComponent implements OnDestroy {
  set id(platformId: string) {
    this.platformId = platformId;
    this.platformService
-      .getForm(platformId)
+      .getPlatform(platformId)
      .pipe(takeUntil(this.destroy$))
-      .subscribe(resp => {
-        if (resp.model !== undefined) {
-          this.setModel(resp.model.toJson())
+      .subscribe(platform => {
+        if (platform !== undefined) {
+          this.platform = platform
        }
-        if (resp.fields !== undefined) {
+        if (platform?.spec?.model !== undefined) {
+          this.setModel(platform.spec.model.toJson())
+        }
+        if (platform?.spec?.form !== undefined) {
          // NOTE: We could mix functions into the json data via mapped fields,
          // but consider carefully before doing so.  Refer to
          // https://formly.dev/docs/examples/other/json-powered
-          this.fields = resp.fields.map(field => field.toJson() as FormlyFieldConfig)
+          this.fields = platform.spec.form.fieldConfigs.map(fieldConfig => fieldConfig.toJson() as FormlyFieldConfig)
        }
      })
  }
--- a/internal/frontend/holos/src/app/views/platforms/platforms.component.ts
+++ b/internal/frontend/holos/src/app/views/platforms/platforms.component.ts
@@ -1,8 +1,8 @@
-import { Platform } from '../../gen/holos/v1alpha1/platform_pb';
+import { Platform } from '../../gen/holos/platform/v1alpha1/platform_pb';
 import { Component, OnInit, inject } from '@angular/core';
 import { MatListItem, MatNavList } from '@angular/material/list';
 import { Observable, filter } from 'rxjs';
-import { Organization } from '../../gen/holos/v1alpha1/organization_pb';
+import { Organization } from '../../gen/holos/organization/v1alpha1/organization_pb';
 import { OrganizationService } from '../../services/organization.service';
 import { PlatformService } from '../../services/platform.service';
 import { AsyncPipe, CommonModule } from '@angular/common';
--- a/internal/holos/config.go
+++ b/internal/holos/config.go
@@ -120,6 +120,7 @@ type Config struct {
 	txtarIndex           *int
 	txtarFlagSet         *flag.FlagSet
 	provisionerClientset kubernetes.Interface
+	ClientConfig         *ClientConfig
 	ServerConfig         *ServerConfig
 }

@@ -280,6 +281,33 @@ func getenv(key, defaultValue string) string {
 	return defaultValue
 }

+func NewClientConfig() *ClientConfig {
+	f := flag.NewFlagSet("", flag.ContinueOnError)
+	c := &ClientConfig{flagSet: f}
+	f.StringVar(&c.server, "server", getenv("HOLOS_SERVER", "https://app.holos.run:443"), "server to connect to")
+	return c
+}
+
+// ClientConfig configures the holos rpc client.
+type ClientConfig struct {
+	flagSet *flag.FlagSet
+	server  string
+}
+
+func (c *ClientConfig) Server() string {
+	if c == nil {
+		return ""
+	}
+	return c.server
+}
+
+func (c *ClientConfig) FlagSet() *flag.FlagSet {
+	if c == nil {
+		return nil
+	}
+	return c.flagSet
+}
+
 type ServerConfig struct {
 	oidcIssuer     string      // --oidc-issuer
 	oidcAudiences  stringSlice // --oidc-audience
--- a/internal/server/handler/organization.go
+++ b/internal/server/handler/organization.go
@@ -13,7 +13,8 @@ import (
 	"github.com/holos-run/holos/internal/errors"
 	"github.com/holos-run/holos/internal/logger"
 	"github.com/holos-run/holos/internal/server/middleware/authn"
-	holos "github.com/holos-run/holos/service/gen/holos/v1alpha1"
+	object "github.com/holos-run/holos/service/gen/holos/object/v1alpha1"
+	holos "github.com/holos-run/holos/service/gen/holos/organization/v1alpha1"
 	"google.golang.org/protobuf/types/known/timestamppb"
 )

@@ -27,10 +28,7 @@ type OrganizationHandler struct {
 	db *ent.Client
 }

-func (h *OrganizationHandler) ListCallerOrganizations(
-	ctx context.Context,
-	req *connect.Request[holos.ListCallerOrganizationsRequest],
-) (*connect.Response[holos.ListCallerOrganizationsResponse], error) {
+func (h *OrganizationHandler) ListOrganizations(ctx context.Context, req *connect.Request[holos.ListOrganizationsRequest]) (*connect.Response[holos.ListOrganizationsResponse], error) {
 	authnID, err := authn.FromContext(ctx)
 	if err != nil {
 		return nil, connect.NewError(connect.CodePermissionDenied, errors.Wrap(err))
@@ -56,23 +54,28 @@ func (h *OrganizationHandler) ListCallerOrganizations(
 		rpcOrgs = append(rpcOrgs, OrganizationToRPC(dbOrg))
 	}

-	res := connect.NewResponse(&holos.ListCallerOrganizationsResponse{
-		User:          UserToRPC(dbUser),
+	// JEFFTODO: FieldMask
+	res := connect.NewResponse(&holos.ListOrganizationsResponse{
+		User: &object.UserRef{
+			User: &object.UserRef_UserId{
+				UserId: dbUser.ID.String(),
+			},
+		},
 		Organizations: rpcOrgs,
 	})
 	return res, nil
 }

-func (h *OrganizationHandler) CreateCallerOrganization(
+func (h *OrganizationHandler) CreateOrganization(
 	ctx context.Context,
-	req *connect.Request[holos.CreateCallerOrganizationRequest],
-) (*connect.Response[holos.CreateCallerOrganizationResponse], error) {
+	req *connect.Request[holos.CreateOrganizationRequest],
+) (*connect.Response[holos.CreateOrganizationResponse], error) {
 	log := logger.FromContext(ctx)
 	authnID, err := authn.FromContext(ctx)
 	if err != nil {
 		return nil, connect.NewError(connect.CodePermissionDenied, errors.Wrap(err))
 	}
-	dbUser, err := getUser(ctx, h.db, authnID.Issuer(), authnID.Subject())
+	dbUser, err := getUser(ctx, h.db, authnID)
 	if err != nil {
 		if ent.MaskNotFound(err) == nil {
 			return nil, connect.NewError(connect.CodeNotFound, errors.Wrap(err))
@@ -81,38 +84,28 @@ func (h *OrganizationHandler) CreateCallerOrganization(
 		}
 	}

-	var org *ent.Organization
+	var dbOrg *ent.Organization
 	err = WithTx(ctx, h.db, func(tx *ent.Tx) (err error) {
-		org, err = tx.Organization.Create().
+		dbOrg, err = tx.Organization.Create().
 			SetName(cleanAndAppendRandom(authnID.Name())).
 			SetDisplayName(authnID.GivenName() + "'s Org").
 			SetCreatorID(dbUser.ID).
+			SetEditorID(dbUser.ID).
 			Save(ctx)
 		if err != nil {
 			return err
 		}
-		return tx.Organization.UpdateOne(org).AddUsers(dbUser).Exec(ctx)
+		return tx.Organization.UpdateOne(dbOrg).AddUsers(dbUser).Exec(ctx)
 	})
 	if err != nil {
 		return nil, connect.NewError(connect.CodeInternal, errors.Wrap(err))
 	}
-	log = log.With("organization", org)
+	log = log.With("organization", dbOrg)

 	log.InfoContext(ctx, "created organization")

-	// TODO: prefetch organizations
-	dbOrgs, err := dbUser.QueryOrganizations().All(ctx)
-	if err != nil {
-		return nil, connect.NewError(connect.CodeInternal, errors.Wrap(err))
-	}
-	rpcOrgs := make([]*holos.Organization, 0, len(dbOrgs))
-	for _, dbOrg := range dbOrgs {
-		rpcOrgs = append(rpcOrgs, OrganizationToRPC(dbOrg))
-	}
-
-	res := connect.NewResponse(&holos.CreateCallerOrganizationResponse{
-		User:          UserToRPC(dbUser),
-		Organizations: rpcOrgs,
+	res := connect.NewResponse(&holos.CreateOrganizationResponse{
+		Organization: OrganizationToRPC(dbOrg),
 	})
 	return res, nil
 }
@@ -131,17 +124,25 @@ func cleanAndAppendRandom(s string) string {

 // OrganizationToRPC returns an *holos.Organization adapted from *ent.Organization u.
 func OrganizationToRPC(org *ent.Organization) *holos.Organization {
+	orgID := org.ID.String()
 	rpcEntity := holos.Organization{
-		Id:          org.ID.String(),
+		OrgId:       &orgID,
 		Name:        org.Name,
-		DisplayName: org.DisplayName,
-		Timestamps: &holos.Timestamps{
+		DisplayName: &org.DisplayName,
+		Detail: &object.Detail{
+			CreatedBy: &object.ResourceEditor{
+				Editor: &object.ResourceEditor_UserId{
+					UserId: org.CreatedByID.String(),
+				},
+			},
 			CreatedAt: timestamppb.New(org.CreatedAt),
+			UpdatedBy: &object.ResourceEditor{
+				Editor: &object.ResourceEditor_UserId{
+					UserId: org.UpdatedByID.String(),
+				},
+			},
 			UpdatedAt: timestamppb.New(org.UpdatedAt),
 		},
-		Creator: &holos.Creator{
-			Id: org.CreatorID.String(),
-		},
 	}
 	return &rpcEntity
 }
--- a/internal/server/handler/platform.go
+++ b/internal/server/handler/platform.go
@@ -3,7 +3,7 @@ package handler
 import (
 	"context"
 	"fmt"
-	"log/slog"
+	"reflect"

 	"connectrpc.com/connect"
 	"github.com/gofrs/uuid"
@@ -13,7 +13,13 @@ import (
 	"github.com/holos-run/holos/internal/ent/user"
 	"github.com/holos-run/holos/internal/errors"
 	"github.com/holos-run/holos/internal/server/middleware/authn"
-	holos "github.com/holos-run/holos/service/gen/holos/v1alpha1"
+	"github.com/holos-run/holos/internal/server/middleware/logger"
+	"github.com/holos-run/holos/internal/strings"
+	object "github.com/holos-run/holos/service/gen/holos/object/v1alpha1"
+	platform "github.com/holos-run/holos/service/gen/holos/platform/v1alpha1"
+	storage "github.com/holos-run/holos/service/gen/holos/storage/v1alpha1"
+	fieldmask_utils "github.com/mennanov/fieldmask-utils"
+	"google.golang.org/protobuf/types/known/timestamppb"
 )

 // NewPlatformHandler returns a new PlatformService implementation.
@@ -26,44 +32,195 @@ type PlatformHandler struct {
 	db *ent.Client
 }

-func (h *PlatformHandler) ListPlatforms(
-	ctx context.Context,
-	req *connect.Request[holos.ListPlatformsRequest],
-) (*connect.Response[holos.ListPlatformsResponse], error) {
+// CreatePlatform implements the PlatformService CreatePlatform rpc method.
+func (h *PlatformHandler) CreatePlatform(ctx context.Context, req *connect.Request[platform.CreatePlatformRequest]) (*connect.Response[platform.CreatePlatformResponse], error) {
+	if req == nil || req.Msg == nil || req.Msg.Platform == nil || req.Msg.Platform.Owner == nil {
+		return nil, errors.Wrap(connect.NewError(connect.CodeInvalidArgument, fmt.Errorf("missing platform owner org")))
+	}
+	orgID := req.Msg.Platform.Owner.GetOrgId()
+	dbUser, dbOrg, err := getAuthnUsersOrg(ctx, orgID, h.db)
+	if err != nil {
+		return nil, errors.Wrap(err)
+	}
+
+	builder := h.db.Platform.Create().
+		SetOrgID(dbOrg.ID).
+		SetCreatorID(dbUser.ID).
+		SetName(req.Msg.Platform.Name).
+		SetDisplayName(req.Msg.Platform.GetDisplayName())
+	entPlatform, err := builder.Save(ctx)
+	if err != nil {
+		return nil, connect.NewError(connect.CodeFailedPrecondition, errors.Wrap(err))
+	}
+
+	resp := &platform.CreatePlatformResponse{
+		Platform: PlatformToRPC(entPlatform),
+	}
+
+	return connect.NewResponse(resp), nil
+}
+
+// GetPlatform implements the PlatformService GetPlatform rpc method.
+func (h *PlatformHandler) GetPlatform(ctx context.Context, req *connect.Request[platform.GetPlatformRequest]) (*connect.Response[platform.GetPlatformResponse], error) {
+	authnID, err := authn.FromContext(ctx)
+	if err != nil {
+		return nil, connect.NewError(connect.CodePermissionDenied, errors.Wrap(err))
+	}
+
+	dbPlatform, err := h.getPlatform(ctx, req.Msg.GetPlatformId(), authnID)
+	if err != nil {
+		return nil, errors.Wrap(err)
+	}
+	rpcPlatform := PlatformToRPC(dbPlatform)
+
+	mask, err := fieldmask_utils.MaskFromPaths(req.Msg.GetFieldMask().GetPaths(), strings.PascalCase)
+	if err != nil {
+		return nil, connect.NewError(connect.CodeInvalidArgument, errors.Wrap(err))
+	}
+	var rpcPlatformMasked platform.Platform
+	if err = fieldmask_utils.StructToStruct(mask, rpcPlatform, &rpcPlatformMasked); err != nil {
+		return nil, connect.NewError(connect.CodeInvalidArgument, errors.Wrap(err))
+	}
+
+	return connect.NewResponse(&platform.GetPlatformResponse{Platform: &rpcPlatformMasked}), nil
+}
+
+// ListPlatforms implements the PlatformService ListPlatforms rpc method.
+func (h *PlatformHandler) ListPlatforms(ctx context.Context, req *connect.Request[platform.ListPlatformsRequest]) (*connect.Response[platform.ListPlatformsResponse], error) {
+	if req == nil || req.Msg == nil {
+		return nil, errors.Wrap(connect.NewError(connect.CodeInvalidArgument, fmt.Errorf("no message in request")))
+	}
 	_, reqDBOrg, err := getAuthnUsersOrg(ctx, req.Msg.OrgId, h.db)
 	if err != nil {
 		return nil, errors.Wrap(err)
 	}

-	resp := &holos.ListPlatformsResponse{Platforms: rpcPlatforms(reqDBOrg)}
-	return connect.NewResponse(resp), nil
-}
+	mask, err := fieldmask_utils.MaskFromPaths(req.Msg.GetFieldMask().GetPaths(), strings.PascalCase)
+	if err != nil {
+		return nil, connect.NewError(connect.CodeInvalidArgument, errors.Wrap(err))
+	}

-func (h *PlatformHandler) AddPlatform(
-	ctx context.Context,
-	req *connect.Request[holos.AddPlatformRequest],
-) (*connect.Response[holos.AddPlatformResponse], error) {
-	dbUser, dbOrg, err := getAuthnUsersOrg(ctx, req.Msg.Platform.OrgId, h.db)
+	platforms, err := rpcPlatforms(reqDBOrg, mask)
 	if err != nil {
 		return nil, errors.Wrap(err)
 	}

-	platform, err := h.db.Platform.Create().
-		SetOrgID(dbOrg.ID).
-		SetCreatorID(dbUser.ID).
-		SetName(req.Msg.Platform.Name).
-		SetDisplayName(req.Msg.Platform.DisplayName).
-		Save(ctx)
+	resp := &platform.ListPlatformsResponse{Platforms: platforms}
+	return connect.NewResponse(resp), nil
+}
+
+// getEditor ensures the user identity stored in the context is a member of the
+// organization.  Useful to get the editor uuid for mutations.  orgID must be a
+// valid uuid string.
+func getEditor(ctx context.Context, db *ent.Client, authnID authn.Identity, orgID string) (*ent.User, error) {
+	orgUUID, err := uuid.FromString(orgID)
+	if err != nil {
+		return nil, connect.NewError(connect.CodeInvalidArgument, errors.Wrap(err))
+	}
+
+	editor, err := db.User.Query().
+		Where(
+			user.And(
+				user.Iss(authnID.Issuer()),
+				user.Sub(authnID.Subject()),
+				user.HasOrganizationsWith(organization.ID(orgUUID)),
+			),
+		).Only(ctx)
+	if err != nil {
+		if ent.MaskNotFound(err) == nil {
+			return nil, connect.NewError(connect.CodeNotFound, errors.Wrap(err))
+		} else {
+			return nil, connect.NewError(connect.CodeFailedPrecondition, errors.Wrap(err))
+		}
+	}
+	return editor, nil
+}
+
+func (h *PlatformHandler) UpdatePlatform(
+	ctx context.Context,
+	req *connect.Request[platform.UpdatePlatformRequest],
+) (*connect.Response[platform.UpdatePlatformResponse], error) {
+	authnID, err := authn.FromContext(ctx)
+	if err != nil {
+		return nil, connect.NewError(connect.CodePermissionDenied, errors.Wrap(err))
+	}
+
+	// Update mask is required to avoid an older client accidentally writing over
+	// fields added to the update operation.
+	if req.Msg.GetUpdateMask() == nil {
+		return nil, connect.NewError(connect.CodeInvalidArgument, errors.Wrap(errors.New("missing update mask")))
+	}
+
+	// Refer to https://github.com/mennanov/fieldmask-utils/blob/v1.1.2/README.md#naming-function
+	mask, err := fieldmask_utils.MaskFromProtoFieldMask(req.Msg.GetUpdateMask(), strings.PascalCase)
+	if err != nil {
+		return nil, errors.Wrap(err)
+	}
+
+	ops := make(map[string]interface{})
+	if err := fieldmask_utils.StructToMap(mask, req.Msg.GetUpdate(), ops, fieldmask_utils.WithMapVisitor(newVisitor(ctx))); err != nil {
+		return nil, errors.Wrap(err)
+	}
+
+	p, err := h.getPlatform(ctx, req.Msg.GetUpdate().GetPlatformId(), authnID)
+	if err != nil {
+		return nil, errors.Wrap(err)
+	}
+
+	log := logger.FromContext(ctx).With("platform_id", p.ID.String(), "org_id", p.OrgID.String())
+
+	if len(ops) == 0 {
+		err = errors.New("nothing to do: provide fields to update in the mask")
+		return nil, connect.NewError(connect.CodeInvalidArgument, errors.Wrap(err))
+	}
+
+	editor, err := getEditor(ctx, h.db, authnID, p.OrgID.String())
+	if err != nil {
+		return nil, errors.Wrap(err)
+	}
+
+	log = log.With("op", "update", "editor", editor.Email)
+
+	builder := p.Update()
+	builder.SetEditor(editor)
+	for field := range ops {
+		log := log.With("field", field)
+		switch field {
+		case "Name":
+			name := req.Msg.GetUpdate().GetName()
+			log.InfoContext(ctx, "update", field, name)
+			builder.SetName(name)
+		case "DisplayName":
+			name := req.Msg.GetUpdate().GetDisplayName()
+			log.InfoContext(ctx, "update", field, name)
+			builder.SetDisplayName(name)
+		case "Model":
+			log.InfoContext(ctx, "update")
+			builder.SetModel(&storage.Model{Model: req.Msg.GetUpdate().GetModel()})
+		case "Form":
+			log.InfoContext(ctx, "update")
+			builder.SetForm(&storage.Form{FieldConfigs: req.Msg.GetUpdate().GetForm().GetFieldConfigs()})
+		default:
+			err := errors.Wrap(errors.New("could not update: unknown field " + field))
+			log.ErrorContext(ctx, "could not update", "err", err)
+			return nil, connect.NewError(connect.CodeInvalidArgument, err)
+		}
+	}
+
+	dbPlatform, err := builder.Save(ctx)
 	if err != nil {
 		return nil, connect.NewError(connect.CodeFailedPrecondition, errors.Wrap(err))
 	}

-	resp := &holos.AddPlatformResponse{Platforms: rpcPlatforms(dbOrg)}
-	resp.Platforms = append(resp.Platforms, PlatformToRPC(platform))
+	resp := platform.UpdatePlatformResponse{
+		Platform: PlatformToRPC(dbPlatform),
+	}

-	return connect.NewResponse(resp), nil
+	return connect.NewResponse(&resp), nil
 }

+// getPlatform returns a platform by id ensuring the request comes from an
+// identity that is a member of the organization owning the platform.
 func (h *PlatformHandler) getPlatform(ctx context.Context, id string, uid authn.Identity) (*ent.Platform, error) {
 	platformID, err := uuid.FromString(id)
 	if err != nil {
@@ -80,116 +237,52 @@ func (h *PlatformHandler) getPlatform(ctx context.Context, id string, uid authn.
 		Only(ctx)
 	if err != nil {
 		if ent.MaskNotFound(err) == nil {
-			return nil, connect.NewError(connect.CodeNotFound, errors.Wrap(err))
+			return nil, connect.NewError(connect.CodeNotFound, err)
 		} else {
-			return nil, connect.NewError(connect.CodeFailedPrecondition, errors.Wrap(err))
+			return nil, connect.NewError(connect.CodeFailedPrecondition, err)
 		}
 	}

 	return p, nil
 }

-func (h *PlatformHandler) GetPlatform(ctx context.Context, req *connect.Request[holos.GetPlatformRequest]) (*connect.Response[holos.GetPlatformResponse], error) {
-	authnID, err := authn.FromContext(ctx)
-	if err != nil {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.Wrap(err))
-	}
-
-	p, err := h.getPlatform(ctx, req.Msg.PlatformId, authnID)
-	if err != nil {
-		return nil, errors.Wrap(err)
-	}
-
-	return connect.NewResponse(&holos.GetPlatformResponse{Platform: PlatformToRPC(p)}), nil
-}
-
-func (h *PlatformHandler) PutModel(ctx context.Context, req *connect.Request[holos.PutModelRequest]) (*connect.Response[holos.PutModelResponse], error) {
-	authnID, err := authn.FromContext(ctx)
-	if err != nil {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.Wrap(err))
-	}
-
-	p, err := h.getPlatform(ctx, req.Msg.GetPlatformId(), authnID)
-	if err != nil {
-		return nil, errors.Wrap(err)
-	}
-
-	slog.WarnContext(ctx, "todo: validate the platform config against cue definitions", "action", "todo", "cue", len(p.Cue))
-
-	_, err = p.Update().
-		SetModel(&holos.Model{Model: req.Msg.GetModel()}).
-		Save(ctx)
-	if err != nil {
-		return nil, connect.NewError(connect.CodeFailedPrecondition, errors.Wrap(err))
-	}
-
-	return connect.NewResponse(&holos.PutModelResponse{Model: req.Msg.Model}), nil
-}
-
-func (h *PlatformHandler) GetModel(ctx context.Context, req *connect.Request[holos.GetModelRequest]) (*connect.Response[holos.GetModelResponse], error) {
-	authnID, err := authn.FromContext(ctx)
-	if err != nil {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.Wrap(err))
-	}
-
-	p, err := h.getPlatform(ctx, req.Msg.PlatformId, authnID)
-	if err != nil {
-		return nil, errors.Wrap(err)
-	}
-
-	return connect.NewResponse(&holos.GetModelResponse{Model: p.Model.Model}), nil
-}
-
-func (h *PlatformHandler) GetForm(ctx context.Context, req *connect.Request[holos.GetFormRequest]) (*connect.Response[holos.GetFormResponse], error) {
-	authnID, err := authn.FromContext(ctx)
-	if err != nil {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.Wrap(err))
-	}
-
-	p, err := h.getPlatform(ctx, req.Msg.GetPlatformId(), authnID)
-	if err != nil {
-		return nil, errors.Wrap(err)
-	}
-
-	return connect.NewResponse(&holos.GetFormResponse{Fields: p.Form.GetFields(), Model: p.Model.GetModel()}), nil
-}
-
-func (h *PlatformHandler) PutForm(ctx context.Context, req *connect.Request[holos.PutFormRequest]) (*connect.Response[holos.PutFormResponse], error) {
-	authnID, err := authn.FromContext(ctx)
-	if err != nil {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.Wrap(err))
-	}
-
-	p, err := h.getPlatform(ctx, req.Msg.GetPlatformId(), authnID)
-	if err != nil {
-		return nil, errors.Wrap(err)
-	}
-
-	_, err = p.Update().
-		SetForm(&holos.Form{Fields: req.Msg.GetFields()}).
-		Save(ctx)
-	if err != nil {
-		return nil, connect.NewError(connect.CodeFailedPrecondition, errors.Wrap(err))
-	}
-
-	resp := &holos.PutFormResponse{Fields: req.Msg.GetFields()}
-	return connect.NewResponse(resp), nil
-}
-
-func PlatformToRPC(platform *ent.Platform) *holos.Platform {
-	return &holos.Platform{
-		Id:          platform.ID.String(),
-		Name:        platform.Name,
-		DisplayName: platform.DisplayName,
-		OrgId:       platform.OrgID.String(),
-		Spec:        &holos.PlatformSpec{Model: platform.Model.GetModel()},
+func PlatformToRPC(entity *ent.Platform) *platform.Platform {
+	return &platform.Platform{
+		Id: entity.ID.String(),
+		Owner: &platform.Owner{
+			Owner: &platform.Owner_OrgId{
+				OrgId: entity.OrgID.String(),
+			},
+		},
+		Name:        entity.Name,
+		DisplayName: &entity.DisplayName,
+		Spec: &platform.Spec{
+			Model: entity.Model.GetModel(),
+			Form: &platform.Form{
+				FieldConfigs: entity.Form.GetFieldConfigs(),
+			},
+		},
+		Detail: &object.Detail{
+			CreatedBy: &object.ResourceEditor{
+				Editor: &object.ResourceEditor_UserId{
+					UserId: entity.CreatedByID.String(),
+				},
+			},
+			CreatedAt: timestamppb.New(entity.CreatedAt),
+			UpdatedBy: &object.ResourceEditor{
+				Editor: &object.ResourceEditor_UserId{
+					UserId: entity.UpdatedByID.String(),
+				},
+			},
+			UpdatedAt: timestamppb.New(entity.UpdatedAt),
+		},
 	}
 }

 func getAuthnUsersOrg(ctx context.Context, orgID string, db *ent.Client) (*ent.User, *ent.Organization, error) {
 	reqOrgID, err := uuid.FromString(orgID)
 	if err != nil {
-		err = errors.Wrap(fmt.Errorf("%w:\n\thave (%+v)\n\twant (uuid string)", err, orgID))
+		err = errors.Wrap(fmt.Errorf("invalid org id: %w:\n\thave (%+v)\n\twant (uuid string)", err, orgID))
 		return nil, nil, connect.NewError(connect.CodeInvalidArgument, err)
 	}

@@ -234,14 +327,30 @@ func getAuthnUsersOrg(ctx context.Context, orgID string, db *ent.Client) (*ent.U
 	return dbUser, reqDBOrg, nil
 }

-func rpcPlatforms(reqDBOrg *ent.Organization) []*holos.Platform {
+func rpcPlatforms(reqDBOrg *ent.Organization, mask fieldmask_utils.Mask) ([]*platform.Platform, error) {
 	if reqDBOrg == nil {
-		return nil
+		return nil, nil
 	}
+
 	// one extra in case a new platform is appended.
-	platforms := make([]*holos.Platform, 0, 1+len(reqDBOrg.Edges.Platforms))
-	for _, platform := range reqDBOrg.Edges.Platforms {
-		platforms = append(platforms, PlatformToRPC(platform))
+	platforms := make([]*platform.Platform, 0, 1+len(reqDBOrg.Edges.Platforms))
+	for _, dbPlatform := range reqDBOrg.Edges.Platforms {
+		var platformMasked platform.Platform
+		if err := fieldmask_utils.StructToStruct(mask, PlatformToRPC(dbPlatform), &platformMasked); err != nil {
+			return nil, connect.NewError(connect.CodeInvalidArgument, errors.Wrap(err))
+		}
+		platforms = append(platforms, &platformMasked)
+	}
+	return platforms, nil
+}
+
+// newVisitor returns a new fieldmask visitor function for use with
+// fieldmask_utils.StructToMap.  This is here largely as an placeholder to
+// remember we can mutate the value if we want.
+func newVisitor(ctx context.Context) func(filter fieldmask_utils.FieldFilter, src, dst reflect.Value, srcFieldName, dstFieldName string, srcFieldValue reflect.Value) fieldmask_utils.MapVisitorResult {
+	return func(filter fieldmask_utils.FieldFilter, src, dst reflect.Value, srcFieldName, dstFieldName string, srcFieldValue reflect.Value) fieldmask_utils.MapVisitorResult {
+		return fieldmask_utils.MapVisitorResult{
+			UpdatedDst: &dst,
+		}
 	}
-	return platforms
 }
--- a/internal/server/handler/system.go
+++ b/internal/server/handler/system.go
@@ -1,6 +1,7 @@
 package handler

 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"fmt"
@@ -12,7 +13,8 @@ import (
 	"github.com/holos-run/holos/internal/errors"
 	"github.com/holos-run/holos/internal/server/middleware/authn"
 	"github.com/holos-run/holos/internal/server/middleware/logger"
-	holos "github.com/holos-run/holos/service/gen/holos/v1alpha1"
+	storage "github.com/holos-run/holos/service/gen/holos/storage/v1alpha1"
+	system "github.com/holos-run/holos/service/gen/holos/system/v1alpha1"
 )

 const AdminEmail = "jeff@openinfrastructure.co"
@@ -39,7 +41,7 @@ func (h *SystemHandler) checkAdmin(ctx context.Context) error {
 	return nil
 }

-func (h *SystemHandler) DropTables(ctx context.Context, req *connect.Request[holos.DropTablesRequest]) (*connect.Response[holos.DropTablesResponse], error) {
+func (h *SystemHandler) DropTables(ctx context.Context, req *connect.Request[system.DropTablesRequest]) (*connect.Response[system.DropTablesResponse], error) {
 	if err := h.checkAdmin(ctx); err != nil {
 		return nil, err
 	}
@@ -64,10 +66,10 @@ func (h *SystemHandler) DropTables(ctx context.Context, req *connect.Request[hol
 		return nil, connect.NewError(connect.CodeFailedPrecondition, errors.Wrap(err))
 	}

-	return connect.NewResponse(&holos.DropTablesResponse{}), nil
+	return connect.NewResponse(&system.DropTablesResponse{}), nil
 }

-func (h *SystemHandler) SeedDatabase(ctx context.Context, req *connect.Request[holos.SeedDatabaseRequest]) (*connect.Response[holos.SeedDatabaseResponse], error) {
+func (h *SystemHandler) SeedDatabase(ctx context.Context, req *connect.Request[system.SeedDatabaseRequest]) (*connect.Response[system.SeedDatabaseResponse], error) {
 	if err := h.checkAdmin(ctx); err != nil {
 		return nil, err
 	}
@@ -108,6 +110,7 @@ func (h *SystemHandler) SeedDatabase(ctx context.Context, req *connect.Request[h
 			SetName("ois").
 			SetDisplayName("Open Infrastructure Services").
 			SetCreator(jeff).
+			SetEditor(jeff).
 			Save(ctx)
 		if err != nil {
 			return errors.Wrap(err)
@@ -119,13 +122,17 @@ func (h *SystemHandler) SeedDatabase(ctx context.Context, req *connect.Request[h
 			return errors.Wrap(err)
 		}

-		var form holos.Form
-		if err := json.Unmarshal([]byte(BareForm), &form); err != nil {
+		decoder := json.NewDecoder(bytes.NewReader([]byte(BareForm)))
+		decoder.DisallowUnknownFields()
+		var form storage.Form
+		if err := decoder.Decode(&form); err != nil {
 			return errors.Wrap(err)
 		}

-		var model holos.Model
-		if err := json.Unmarshal([]byte(Model), &model); err != nil {
+		decoder = json.NewDecoder(bytes.NewReader([]byte(Model)))
+		decoder.DisallowUnknownFields()
+		var model storage.Model
+		if err := decoder.Decode(&model); err != nil {
 			return errors.Wrap(err)
 		}

@@ -137,6 +144,7 @@ func (h *SystemHandler) SeedDatabase(ctx context.Context, req *connect.Request[h
 			SetForm(&form).
 			SetModel(&model).
 			SetCreator(jeff).
+			SetEditor(jeff).
 			SetOrgID(org.ID).
 			Exec(ctx)
 		if err != nil {
@@ -151,6 +159,7 @@ func (h *SystemHandler) SeedDatabase(ctx context.Context, req *connect.Request[h
 				SetForm(&form).
 				SetModel(&model).
 				SetCreator(jeff).
+				SetEditor(jeff).
 				SetOrgID(org.ID).
 				Exec(ctx)
 			if err != nil {
@@ -163,14 +172,14 @@ func (h *SystemHandler) SeedDatabase(ctx context.Context, req *connect.Request[h
 		return nil, connect.NewError(connect.CodeFailedPrecondition, errors.Wrap(err))
 	}

-	return connect.NewResponse(&holos.SeedDatabaseResponse{}), nil
+	return connect.NewResponse(&system.SeedDatabaseResponse{}), nil
 }

 const Model = `{"model":{}}`

 const BareForm = `
 {
-  "fields": [
+  "field_configs": [
    {
      "key": "org",
      "wrappers": [
--- a/internal/server/handler/user.go
+++ b/internal/server/handler/user.go
@@ -2,15 +2,17 @@ package handler

 import (
 	"context"
+	"fmt"
 	"log/slog"

 	"connectrpc.com/connect"
 	"github.com/holos-run/holos/internal/ent"
 	"github.com/holos-run/holos/internal/ent/user"
 	"github.com/holos-run/holos/internal/errors"
+	"github.com/holos-run/holos/internal/logger"
 	"github.com/holos-run/holos/internal/server/middleware/authn"
-	"github.com/holos-run/holos/internal/server/middleware/logger"
-	holos "github.com/holos-run/holos/service/gen/holos/v1alpha1"
+	object "github.com/holos-run/holos/service/gen/holos/object/v1alpha1"
+	holos "github.com/holos-run/holos/service/gen/holos/user/v1alpha1"
 	"google.golang.org/protobuf/types/known/timestamppb"
 )

@@ -24,48 +26,108 @@ type UserHandler struct {
 	db *ent.Client
 }

-func (h *UserHandler) GetCallerClaims(
-	ctx context.Context,
-	req *connect.Request[holos.GetCallerClaimsRequest],
-) (*connect.Response[holos.GetCallerClaimsResponse], error) {
+func (h *UserHandler) GetUser(ctx context.Context, req *connect.Request[holos.GetUserRequest]) (*connect.Response[holos.GetUserResponse], error) {
 	authnID, err := authn.FromContext(ctx)
 	if err != nil {
 		return nil, connect.NewError(connect.CodePermissionDenied, errors.Wrap(err))
 	}
-	res := connect.NewResponse(&holos.GetCallerClaimsResponse{
-		Claims: &holos.Claims{
-			Iss:           authnID.Issuer(),
-			Sub:           authnID.Subject(),
-			Email:         authnID.Email(),
-			EmailVerified: authnID.Verified(),
-			Name:          authnID.Name(),
-			Groups:        authnID.Groups(),
-			GivenName:     authnID.GivenName(),
-			FamilyName:    authnID.FamilyName(),
-			Picture:       authnID.Picture(),
-		},
+
+	if req.Msg.GetUser() != nil || req.Msg.GetFieldMask() != nil {
+		return nil, connect.NewError(connect.CodeUnimplemented, errors.Wrap(fmt.Errorf("not implemented: make an empty request instead")))
+	}
+
+	dbUser, err := getUser(ctx, h.db, authnID)
+	if err != nil {
+		return nil, errors.Wrap(err)
+	}
+
+	rpcUser := UserToRPC(dbUser)
+	if pic := authnID.Picture(); pic != "" {
+		rpcUser.Picture = &pic
+	}
+
+	return connect.NewResponse(&holos.GetUserResponse{User: rpcUser}), nil
+}
+
+func (h *UserHandler) CreateUser(ctx context.Context, req *connect.Request[holos.CreateUserRequest]) (*connect.Response[holos.CreateUserResponse], error) {
+	var createdUser *ent.User
+	var err error
+	if rpcUser := req.Msg.GetUser(); rpcUser != nil {
+		createdUser, err = h.createUser(ctx, h.db, rpcUser)
+	} else {
+		createdUser, err = h.createCallerUser(ctx)
+	}
+	if err != nil {
+		return nil, errors.Wrap(err)
+	}
+
+	res := connect.NewResponse(&holos.CreateUserResponse{
+		User: UserToRPC(createdUser),
 	})
 	return res, nil
 }

-func (h *UserHandler) GetCallerUser(
-	ctx context.Context,
-	req *connect.Request[holos.GetCallerUserRequest],
-) (*connect.Response[holos.GetCallerUserResponse], error) {
-	authnID, err := authn.FromContext(ctx)
-	if err != nil {
-		return nil, connect.NewError(connect.CodePermissionDenied, errors.Wrap(err))
+// UserToRPC returns an *holos.User adapted from *ent.User u.
+func UserToRPC(entity *ent.User) *holos.User {
+	uid := entity.ID.String()
+	iamUser := holos.User{
+		Id:    &uid,
+		Email: entity.Email,
+		Name:  &entity.Name,
+		Subject: &object.Subject{
+			Iss: entity.Iss,
+			Sub: entity.Sub,
+		},
+		Detail: &object.Detail{
+			CreatedBy: &object.ResourceEditor{
+				Editor: &object.ResourceEditor_UserId{
+					UserId: uid,
+				},
+			},
+			CreatedAt: timestamppb.New(entity.CreatedAt),
+			UpdatedBy: &object.ResourceEditor{
+				Editor: &object.ResourceEditor_UserId{
+					UserId: uid,
+				},
+			},
+			UpdatedAt: timestamppb.New(entity.UpdatedAt),
+		},
 	}
-	dbUser, err := getUser(ctx, h.db, authnID.Issuer(), authnID.Subject())
+	return &iamUser
+}
+
+func getUser(ctx context.Context, client *ent.Client, authnID authn.Identity) (*ent.User, error) {
+	user, err := client.User.Query().
+		Where(
+			user.Iss(authnID.Issuer()),
+			user.Sub(authnID.Subject()),
+		).
+		Only(ctx)
 	if err != nil {
 		if ent.MaskNotFound(err) == nil {
 			return nil, connect.NewError(connect.CodeNotFound, errors.Wrap(err))
-		} else {
-			return nil, connect.NewError(connect.CodeFailedPrecondition, errors.Wrap(err))
 		}
+		return nil, connect.NewError(connect.CodeFailedPrecondition, errors.Wrap(err))
 	}
-	res := connect.NewResponse(&holos.GetCallerUserResponse{User: UserToRPC(dbUser)})
-	return res, nil
+
+	return user, nil
+}
+
+func (h *UserHandler) createUser(ctx context.Context, client *ent.Client, rpcUser *holos.User) (*ent.User, error) {
+	log := logger.FromContext(ctx)
+	var dbUser *ent.User
+	dbUser, err := client.User.Create().
+		SetName(rpcUser.GetName()).
+		SetIss(rpcUser.GetSubject().GetIss()).
+		SetSub(rpcUser.GetSubject().GetSub()).
+		SetEmail(rpcUser.GetEmail()).
+		Save(ctx)
+	if err != nil {
+		return nil, connect.NewError(connect.CodeInternal, errors.Wrap(err))
+	}
+	log = log.With("user", dbUser)
+	log.InfoContext(ctx, "created user")
+	return dbUser, nil
 }

 func (h *UserHandler) createCallerUser(ctx context.Context) (*ent.User, error) {
@@ -74,9 +136,29 @@ func (h *UserHandler) createCallerUser(ctx context.Context) (*ent.User, error) {
 		return nil, connect.NewError(connect.CodePermissionDenied, errors.Wrap(err))
 	}

+	emailVerified := authnID.Verified()
+	name := authnID.Name()
+	givenName := authnID.GivenName()
+	familyName := authnID.FamilyName()
+	picture := authnID.Picture()
+
+	rpcUser := holos.User{
+		Subject: &object.Subject{
+			Iss: authnID.Issuer(),
+			Sub: authnID.Subject(),
+		},
+		Email:         authnID.Email(),
+		EmailVerified: &emailVerified,
+		Name:          &name,
+		GivenName:     &givenName,
+		FamilyName:    &familyName,
+		Groups:        authnID.Groups(),
+		Picture:       &picture,
+	}
+
 	var createdUser *ent.User
 	err = WithTx(ctx, h.db, func(tx *ent.Tx) error {
-		createdUser, err = createUser(ctx, tx.Client(), authnID.Name(), authnID)
+		createdUser, err = h.createUser(ctx, tx.Client(), &rpcUser)
 		return err
 	})
 	if err != nil {
@@ -84,71 +166,5 @@ func (h *UserHandler) createCallerUser(ctx context.Context) (*ent.User, error) {
 		return nil, err
 	}

-	return createdUser, nil
-}
-
-func (h *UserHandler) CreateCallerUser(
-	ctx context.Context,
-	req *connect.Request[holos.CreateCallerUserRequest],
-) (*connect.Response[holos.CreateCallerUserResponse], error) {
-	createdUser, err := h.createCallerUser(ctx)
-	if err != nil {
-		return nil, err
-	}
-
-	res := connect.NewResponse(&holos.CreateCallerUserResponse{
-		User: UserToRPC(createdUser),
-	})
-	return res, nil
-}
-
-// UserToRPC returns an *holos.User adapted from *ent.User u.
-func UserToRPC(u *ent.User) *holos.User {
-	iamUser := holos.User{
-		Id:    u.ID.String(),
-		Email: u.Email,
-		Name:  u.Name,
-		Timestamps: &holos.Timestamps{
-			CreatedAt: timestamppb.New(u.CreatedAt),
-			UpdatedAt: timestamppb.New(u.UpdatedAt),
-		},
-	}
-	return &iamUser
-}
-
-func getUser(ctx context.Context, client *ent.Client, iss string, sub string) (*ent.User, error) {
-	log := logger.FromContext(ctx)
-	user, err := client.User.Query().
-		Where(
-			user.Iss(iss),
-			user.Sub(sub),
-		).
-		Only(ctx)
-	if err != nil {
-		log.DebugContext(ctx, "could not get user", "err", err, "iss", iss, "sub", sub)
-		return nil, errors.Wrap(err)
-	}
-	return user, nil
-}
-
-func createUser(ctx context.Context, client *ent.Client, name string, claims authn.Identity) (*ent.User, error) {
-	log := logger.FromContext(ctx)
-	// Create the user, error if it already exists
-	user, err := client.User.
-		Create().
-		SetEmail(claims.Email()).
-		SetIss(claims.Issuer()).
-		SetSub(claims.Subject()).
-		SetName(name).
-		Save(ctx)
-	if err != nil {
-		err = connect.NewError(connect.CodeFailedPrecondition, errors.Wrap(err))
-		log.ErrorContext(ctx, "could not create user", "err", err)
-		return user, err
-	}
-
-	log = log.With("user", user)
-	log.InfoContext(ctx, "created user")
-
-	return user, nil
+	return createdUser.Unwrap(), nil
 }
--- a/internal/server/server/server.go
+++ b/internal/server/server/server.go
@@ -17,7 +17,10 @@ import (
 	"github.com/holos-run/holos/internal/server/handler"
 	"github.com/holos-run/holos/internal/server/middleware/authn"
 	"github.com/holos-run/holos/internal/server/middleware/logger"
-	"github.com/holos-run/holos/service/gen/holos/v1alpha1/holosconnect"
+	"github.com/holos-run/holos/service/gen/holos/organization/v1alpha1/organizationconnect"
+	"github.com/holos-run/holos/service/gen/holos/platform/v1alpha1/platformconnect"
+	"github.com/holos-run/holos/service/gen/holos/system/v1alpha1/systemconnect"
+	"github.com/holos-run/holos/service/gen/holos/user/v1alpha1/userconnect"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"golang.org/x/net/http2"
 	"golang.org/x/net/http2/h2c"
@@ -112,16 +115,16 @@ func (s *Server) registerConnectRpc() error {

 	opts := connect.WithInterceptors(validator)

-	s.handle(holosconnect.NewUserServiceHandler(handler.NewUserHandler(s.db), opts))
-	s.handle(holosconnect.NewOrganizationServiceHandler(handler.NewOrganizationHandler(s.db), opts))
-	s.handle(holosconnect.NewPlatformServiceHandler(handler.NewPlatformHandler(s.db), opts))
-	s.handle(holosconnect.NewSystemServiceHandler(handler.NewSystemHandler(s.db), opts))
+	s.handle(userconnect.NewUserServiceHandler(handler.NewUserHandler(s.db), opts))
+	s.handle(organizationconnect.NewOrganizationServiceHandler(handler.NewOrganizationHandler(s.db), opts))
+	s.handle(platformconnect.NewPlatformServiceHandler(handler.NewPlatformHandler(s.db), opts))
+	s.handle(systemconnect.NewSystemServiceHandler(handler.NewSystemHandler(s.db), opts))

 	reflector := grpcreflect.NewStaticReflector(
-		holosconnect.UserServiceName,
-		holosconnect.OrganizationServiceName,
-		holosconnect.PlatformServiceName,
-		holosconnect.SystemServiceName,
+		userconnect.UserServiceName,
+		organizationconnect.OrganizationServiceName,
+		platformconnect.PlatformServiceName,
+		systemconnect.SystemServiceName,
 	)

 	s.mux.Handle(grpcreflect.NewHandlerV1(reflector))
--- a/internal/strings/ascii.go
+++ b/internal/strings/ascii.go
@@ -0,0 +1,43 @@
+// Copyright 2010 The Go Authors.  All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// - Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//
+// - Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//
+// - Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// Original license: https://github.com/golang/protobuf/blob/master/LICENSE
+// Original CamelCase func: https://github.com/golang/protobuf/blob/master/protoc-gen-go/generator/generator.go#L2648
+
+package strings
+
+// Is c an ASCII lower-case letter?
+func isASCIILower(c byte) bool {
+	return 'a' <= c && c <= 'z'
+}
+
+// Is c an ASCII digit?
+func isASCIIDigit(c byte) bool {
+	return '0' <= c && c <= '9'
+}
+
+// appendLowercaseSequence appends the lowercase sequence from s that begins at i into t
+// returns the new t that contains all the chain of characters that should be lowercase
+// and the new index where to start counting from.
+func appendLowercaseSequence(s string, i int, t []byte) ([]byte, int) {
+	for i+1 < len(s) && isASCIILower(s[i+1]) {
+		i++
+		t = append(t, s[i])
+	}
+	return t, i
+}
--- a/internal/strings/ascii_test.go
+++ b/internal/strings/ascii_test.go
@@ -0,0 +1,22 @@
+package strings
+
+import (
+	"github.com/stretchr/testify/assert"
+	"testing"
+)
+
+func TestIsASCIILower(t *testing.T) {
+	assert.True(t, isASCIILower('a'))
+	assert.True(t, isASCIILower('z'))
+	assert.False(t, isASCIILower('1'))
+	assert.False(t, isASCIILower('#'))
+	assert.False(t, isASCIILower('$'))
+}
+
+func TestIsASCIIDigit(t *testing.T) {
+	assert.True(t, isASCIIDigit('1'))
+	assert.True(t, isASCIIDigit('9'))
+	assert.False(t, isASCIIDigit('a'))
+	assert.False(t, isASCIIDigit('z'))
+	assert.False(t, isASCIIDigit('$'))
+}
--- a/internal/strings/camel_case.go
+++ b/internal/strings/camel_case.go
@@ -0,0 +1,45 @@
+// Copyright 2010 The Go Authors.  All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// - Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//
+// - Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//
+// - Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// Original license: https://github.com/golang/protobuf/blob/master/LICENSE
+// Original CamelCase func: https://github.com/golang/protobuf/blob/master/protoc-gen-go/generator/generator.go#L2648
+
+package strings
+
+// CamelCase is a special case of PascalCase with the difference that
+// CamelCase will return the first value in the string as a lowercase character.
+// In short, _my_field_name_2 becomes xMyFieldName_2.
+func CamelCase(s string) string {
+	if s == "" {
+		return ""
+	}
+	t := make([]byte, 0, 32)
+	i := 0
+	if s[0] == '_' {
+		// Need a capital letter; drop the '_'.
+		t = append(t, 'x')
+		i++
+	}
+	// If the first letter is a lowercase, we keep it as is.
+	if len(t) == 0 && isASCIILower(s[i]) {
+		t = append(t, s[i])
+		t, i = appendLowercaseSequence(s, i, t)
+		i++
+	}
+	return string(append(t, lookupAndReplacePascalCaseWords(s, i)...))
+}
--- a/internal/strings/camel_case_test.go
+++ b/internal/strings/camel_case_test.go
@@ -0,0 +1,16 @@
+package strings
+
+import (
+	"github.com/stretchr/testify/assert"
+	"testing"
+)
+
+func TestCamelCase(t *testing.T) {
+	assert.Empty(t, CamelCase(""))
+
+	assert.Equal(t, "x", CamelCase("_"))
+
+	assert.Equal(t, "xMyFieldName_2", CamelCase("_my_field_name_2"))
+
+	assert.Equal(t, "testSnake", CamelCase("test_snake"))
+}
--- a/internal/strings/doc.go
+++ b/internal/strings/doc.go
@@ -0,0 +1,3 @@
+// Package strings implements simple functions to manipulate UTF-8 encoded strings that are not included in the
+// standard library package.
+package strings
--- a/internal/strings/pascal_case.go
+++ b/internal/strings/pascal_case.go
@@ -0,0 +1,73 @@
+// Copyright 2010 The Go Authors.  All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// - Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//
+// - Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//
+// - Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// Original license: https://github.com/golang/protobuf/blob/master/LICENSE
+// Original CamelCase func: https://github.com/golang/protobuf/blob/master/protoc-gen-go/generator/generator.go#L2648
+
+package strings
+
+// PascalCase returns the PascalCased name.
+// If there is an interior underscore followed by a lower case letter,
+// drop the underscore and convert the letter to upper case.
+// There is a remote possibility of this rewrite causing a name collision,
+// but it's so remote we're prepared to pretend it's nonexistent - since the
+// C++ generator lowercases names, it's extremely unlikely to have two fields
+// with different capitalizations.
+// In short, _my_field_name_2 becomes XMyFieldName_2.
+func PascalCase(s string) string {
+	if s == "" {
+		return ""
+	}
+	t := make([]byte, 0, 32)
+	i := 0
+	if s[0] == '_' {
+		// Need a capital letter; drop the '_'.
+		t = append(t, 'X')
+		i++
+	}
+	return string(append(t, lookupAndReplacePascalCaseWords(s, i)...))
+}
+
+// lookupAndReplacePascalCaseWords lookups for words in the string starting in position i
+// and replaces the snake case format to PascalCase.
+// Invariant: if the next letter is lower case, it must be converted
+// to upper case.
+// That is, we process a word at a time, where words are marked by _ or
+// upper case letter. Digits are treated as words.
+func lookupAndReplacePascalCaseWords(s string, i int) []byte {
+	t := make([]byte, 0, 32)
+	for ; i < len(s); i++ {
+		c := s[i]
+		if c == '_' && i+1 < len(s) && isASCIILower(s[i+1]) {
+			continue // Skip the underscore in s.
+		}
+		if isASCIIDigit(c) {
+			t = append(t, c)
+			continue
+		}
+		// Assume we have a letter now - if not, it's a bogus identifier.
+		// The next word is a sequence of characters that must start upper case.
+		if isASCIILower(c) {
+			c ^= ' ' // Make it a capital letter.
+		}
+		t = append(t, c) // Guaranteed not lower case.
+		// Accept lower case sequence that follows.
+		t, i = appendLowercaseSequence(s, i, t)
+	}
+	return t
+}
--- a/internal/strings/pascal_case_test.go
+++ b/internal/strings/pascal_case_test.go
@@ -0,0 +1,16 @@
+package strings
+
+import (
+	"github.com/stretchr/testify/assert"
+	"testing"
+)
+
+func TestPascalCase(t *testing.T) {
+	assert.Empty(t, PascalCase(""))
+
+	assert.Equal(t, "X", PascalCase("_"))
+
+	assert.Equal(t, "XMyFieldName_2", PascalCase("_my_field_name_2"))
+
+	assert.Equal(t, "TestSnake", PascalCase("test_snake"))
+}
--- a/internal/token/token.go
+++ b/internal/token/token.go
@@ -7,11 +7,14 @@ import (
 	"flag"
 	"fmt"
 	"log/slog"
+	"net/http"
 	"path/filepath"
 	"strings"
 	"time"

 	"github.com/holos-run/holos/internal/errors"
+	hlogger "github.com/holos-run/holos/internal/logger"
+	"github.com/holos-run/holos/internal/server/middleware/authn"
 	"github.com/int128/kubelogin/pkg/infrastructure/browser"
 	"github.com/int128/kubelogin/pkg/infrastructure/clock"
 	"github.com/int128/kubelogin/pkg/infrastructure/logger"
@@ -60,8 +63,8 @@ type Claims struct {
 }

 // NewConfig returns a Config with default values.
-func NewConfig() Config {
-	return Config{
+func NewConfig() *Config {
+	return &Config{
 		Issuer:      "https://login.ois.run",
 		ClientID:    "262479925313799528@holos_platform",
 		Scopes:      []string{"openid", "email", "profile", "groups", "offline_access"},
@@ -92,8 +95,35 @@ func (c *Config) FlagSet() *flag.FlagSet {
 	return flags
 }

+// Client returns a http.Client which adds the authorization bearer token to
+// each request.
+func NewClient(cfg *Config) *http.Client {
+	return &http.Client{
+		Transport: &customTransport{
+			Transport: http.DefaultTransport,
+			config:    cfg,
+		},
+	}
+}
+
+type customTransport struct {
+	Transport http.RoundTripper
+	config    *Config
+}
+
+func (t *customTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	ctx := req.Context()
+	log := hlogger.FromContext(ctx)
+	token, err := Get(ctx, log, t.config)
+	if err != nil {
+		return nil, errors.Wrap(fmt.Errorf("could not get token: %w", err))
+	}
+	req.Header.Set(authn.Header, token.Bearer)
+	return t.Transport.RoundTrip(req)
+}
+
 // Get returns an oidc token for use as an authorization bearer http header.
-func Get(ctx context.Context, log *slog.Logger, cfg Config) (*Token, error) {
+func Get(ctx context.Context, log *slog.Logger, cfg *Config) (*Token, error) {
 	var scopes []string
 	scopes = append(scopes, cfg.Scopes...)
 	scopes = append(scopes, cfg.ExtraScopes...)
--- a/service/.gitignore
+++ b/service/.gitignore
@@ -1 +0,0 @@
-/gen/
--- a/service/buf.lock
+++ b/service/buf.lock
@@ -4,5 +4,5 @@ deps:
  - remote: buf.build
    owner: bufbuild
    repository: protovalidate
-    commit: b983156c5e994cc9892e0ce3e64e17e0
-    digest: shake256:fb47a62989d38c2529bcc5cd86ded43d800eb84cee82b42b9e8a9e815d4ee8134a0fb9d0ce8299b27c2d2bbb7d6ade0c4ad5a8a4d467e1e2c7ca619ae9f634e2
+    commit: 46a4cf4ba1094a34bcd89a6c67163b4b
+    digest: shake256:436ce453801917c11bc7b21d66bcfae87da2aceb804a041487be1e51dc9fbc219e61ea6a552db7a7aa6d63bb5efd0f3ed5fe3d4c42d4f750d0eb35f14144e3b6
--- a/service/gen/holos/object/v1alpha1/object.pb.go
+++ b/service/gen/holos/object/v1alpha1/object.pb.go
@@ -0,0 +1,721 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.33.0-devel
+// 	protoc        (unknown)
+// source: holos/object/v1alpha1/object.proto
+
+package object
+
+import (
+	_ "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type Detail struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Created by entity
+	CreatedBy *ResourceEditor `protobuf:"bytes,1,opt,name=created_by,json=createdBy,proto3,oneof" json:"created_by,omitempty"`
+	// Created at timestamp
+	CreatedAt *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	// Updated by entity
+	UpdatedBy *ResourceEditor `protobuf:"bytes,3,opt,name=updated_by,json=updatedBy,proto3,oneof" json:"updated_by,omitempty"`
+	// Updated at timestamp
+	UpdatedAt *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=updated_at,json=updatedAt,proto3" json:"updated_at,omitempty"`
+}
+
+func (x *Detail) Reset() {
+	*x = Detail{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_object_v1alpha1_object_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Detail) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Detail) ProtoMessage() {}
+
+func (x *Detail) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_object_v1alpha1_object_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Detail.ProtoReflect.Descriptor instead.
+func (*Detail) Descriptor() ([]byte, []int) {
+	return file_holos_object_v1alpha1_object_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Detail) GetCreatedBy() *ResourceEditor {
+	if x != nil {
+		return x.CreatedBy
+	}
+	return nil
+}
+
+func (x *Detail) GetCreatedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.CreatedAt
+	}
+	return nil
+}
+
+func (x *Detail) GetUpdatedBy() *ResourceEditor {
+	if x != nil {
+		return x.UpdatedBy
+	}
+	return nil
+}
+
+func (x *Detail) GetUpdatedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.UpdatedAt
+	}
+	return nil
+}
+
+// Subject represents the oidc iss and sub claims which uniquely identify a subject.
+type Subject struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// iss represents the oidc id token iss claim.  Limits defined at
+	// https://openid.net/specs/openid-authentication-1_1.html#limits
+	Iss string `protobuf:"bytes,1,opt,name=iss,proto3" json:"iss,omitempty"`
+	// sub represents the oidc id token sub claim.
+	Sub string `protobuf:"bytes,2,opt,name=sub,proto3" json:"sub,omitempty"`
+}
+
+func (x *Subject) Reset() {
+	*x = Subject{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_object_v1alpha1_object_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Subject) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Subject) ProtoMessage() {}
+
+func (x *Subject) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_object_v1alpha1_object_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Subject.ProtoReflect.Descriptor instead.
+func (*Subject) Descriptor() ([]byte, []int) {
+	return file_holos_object_v1alpha1_object_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *Subject) GetIss() string {
+	if x != nil {
+		return x.Iss
+	}
+	return ""
+}
+
+func (x *Subject) GetSub() string {
+	if x != nil {
+		return x.Sub
+	}
+	return ""
+}
+
+// UserRef refers to a User by uuid, email, or by the oidc iss and sub claims.
+type UserRef struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Types that are assignable to User:
+	//
+	//	*UserRef_UserId
+	//	*UserRef_Email
+	//	*UserRef_Subject
+	User isUserRef_User `protobuf_oneof:"user"`
+}
+
+func (x *UserRef) Reset() {
+	*x = UserRef{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_object_v1alpha1_object_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UserRef) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UserRef) ProtoMessage() {}
+
+func (x *UserRef) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_object_v1alpha1_object_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UserRef.ProtoReflect.Descriptor instead.
+func (*UserRef) Descriptor() ([]byte, []int) {
+	return file_holos_object_v1alpha1_object_proto_rawDescGZIP(), []int{2}
+}
+
+func (m *UserRef) GetUser() isUserRef_User {
+	if m != nil {
+		return m.User
+	}
+	return nil
+}
+
+func (x *UserRef) GetUserId() string {
+	if x, ok := x.GetUser().(*UserRef_UserId); ok {
+		return x.UserId
+	}
+	return ""
+}
+
+func (x *UserRef) GetEmail() string {
+	if x, ok := x.GetUser().(*UserRef_Email); ok {
+		return x.Email
+	}
+	return ""
+}
+
+func (x *UserRef) GetSubject() *Subject {
+	if x, ok := x.GetUser().(*UserRef_Subject); ok {
+		return x.Subject
+	}
+	return nil
+}
+
+type isUserRef_User interface {
+	isUserRef_User()
+}
+
+type UserRef_UserId struct {
+	UserId string `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3,oneof"`
+}
+
+type UserRef_Email struct {
+	Email string `protobuf:"bytes,2,opt,name=email,proto3,oneof"`
+}
+
+type UserRef_Subject struct {
+	Subject *Subject `protobuf:"bytes,3,opt,name=subject,proto3,oneof"`
+}
+
+func (*UserRef_UserId) isUserRef_User() {}
+
+func (*UserRef_Email) isUserRef_User() {}
+
+func (*UserRef_Subject) isUserRef_User() {}
+
+// Organization represents the ways in which a organization may be uniquely identified in the system.
+type OrganizationRef struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Types that are assignable to Org:
+	//
+	//	*OrganizationRef_OrgId
+	//	*OrganizationRef_OrgName
+	Org isOrganizationRef_Org `protobuf_oneof:"org"`
+}
+
+func (x *OrganizationRef) Reset() {
+	*x = OrganizationRef{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_object_v1alpha1_object_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *OrganizationRef) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*OrganizationRef) ProtoMessage() {}
+
+func (x *OrganizationRef) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_object_v1alpha1_object_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use OrganizationRef.ProtoReflect.Descriptor instead.
+func (*OrganizationRef) Descriptor() ([]byte, []int) {
+	return file_holos_object_v1alpha1_object_proto_rawDescGZIP(), []int{3}
+}
+
+func (m *OrganizationRef) GetOrg() isOrganizationRef_Org {
+	if m != nil {
+		return m.Org
+	}
+	return nil
+}
+
+func (x *OrganizationRef) GetOrgId() string {
+	if x, ok := x.GetOrg().(*OrganizationRef_OrgId); ok {
+		return x.OrgId
+	}
+	return ""
+}
+
+func (x *OrganizationRef) GetOrgName() string {
+	if x, ok := x.GetOrg().(*OrganizationRef_OrgName); ok {
+		return x.OrgName
+	}
+	return ""
+}
+
+type isOrganizationRef_Org interface {
+	isOrganizationRef_Org()
+}
+
+type OrganizationRef_OrgId struct {
+	OrgId string `protobuf:"bytes,1,opt,name=org_id,json=orgId,proto3,oneof"`
+}
+
+type OrganizationRef_OrgName struct {
+	OrgName string `protobuf:"bytes,2,opt,name=org_name,json=orgName,proto3,oneof"`
+}
+
+func (*OrganizationRef_OrgId) isOrganizationRef_Org() {}
+
+func (*OrganizationRef_OrgName) isOrganizationRef_Org() {}
+
+// ResourceEditor represents the entity that most recently created or edited a resource.
+type ResourceEditor struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Types that are assignable to Editor:
+	//
+	//	*ResourceEditor_UserId
+	Editor isResourceEditor_Editor `protobuf_oneof:"editor"`
+}
+
+func (x *ResourceEditor) Reset() {
+	*x = ResourceEditor{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_object_v1alpha1_object_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ResourceEditor) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ResourceEditor) ProtoMessage() {}
+
+func (x *ResourceEditor) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_object_v1alpha1_object_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ResourceEditor.ProtoReflect.Descriptor instead.
+func (*ResourceEditor) Descriptor() ([]byte, []int) {
+	return file_holos_object_v1alpha1_object_proto_rawDescGZIP(), []int{4}
+}
+
+func (m *ResourceEditor) GetEditor() isResourceEditor_Editor {
+	if m != nil {
+		return m.Editor
+	}
+	return nil
+}
+
+func (x *ResourceEditor) GetUserId() string {
+	if x, ok := x.GetEditor().(*ResourceEditor_UserId); ok {
+		return x.UserId
+	}
+	return ""
+}
+
+type isResourceEditor_Editor interface {
+	isResourceEditor_Editor()
+}
+
+type ResourceEditor_UserId struct {
+	UserId string `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3,oneof"`
+}
+
+func (*ResourceEditor_UserId) isResourceEditor_Editor() {}
+
+type ResourceOwner struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Types that are assignable to ResourceOwner:
+	//
+	//	*ResourceOwner_OrgId
+	//	*ResourceOwner_UserId
+	ResourceOwner isResourceOwner_ResourceOwner `protobuf_oneof:"resource_owner"`
+}
+
+func (x *ResourceOwner) Reset() {
+	*x = ResourceOwner{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_object_v1alpha1_object_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ResourceOwner) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ResourceOwner) ProtoMessage() {}
+
+func (x *ResourceOwner) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_object_v1alpha1_object_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ResourceOwner.ProtoReflect.Descriptor instead.
+func (*ResourceOwner) Descriptor() ([]byte, []int) {
+	return file_holos_object_v1alpha1_object_proto_rawDescGZIP(), []int{5}
+}
+
+func (m *ResourceOwner) GetResourceOwner() isResourceOwner_ResourceOwner {
+	if m != nil {
+		return m.ResourceOwner
+	}
+	return nil
+}
+
+func (x *ResourceOwner) GetOrgId() string {
+	if x, ok := x.GetResourceOwner().(*ResourceOwner_OrgId); ok {
+		return x.OrgId
+	}
+	return ""
+}
+
+func (x *ResourceOwner) GetUserId() string {
+	if x, ok := x.GetResourceOwner().(*ResourceOwner_UserId); ok {
+		return x.UserId
+	}
+	return ""
+}
+
+type isResourceOwner_ResourceOwner interface {
+	isResourceOwner_ResourceOwner()
+}
+
+type ResourceOwner_OrgId struct {
+	OrgId string `protobuf:"bytes,1,opt,name=org_id,json=orgId,proto3,oneof"`
+}
+
+type ResourceOwner_UserId struct {
+	UserId string `protobuf:"bytes,2,opt,name=user_id,json=userId,proto3,oneof"`
+}
+
+func (*ResourceOwner_OrgId) isResourceOwner_ResourceOwner() {}
+
+func (*ResourceOwner_UserId) isResourceOwner_ResourceOwner() {}
+
+var File_holos_object_v1alpha1_object_proto protoreflect.FileDescriptor
+
+var file_holos_object_v1alpha1_object_proto_rawDesc = []byte{
+	0x0a, 0x22, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x2f, 0x76,
+	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x12, 0x15, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x6f, 0x62, 0x6a, 0x65,
+	0x63, 0x74, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x1a, 0x1f, 0x67, 0x6f, 0x6f,
+	0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d,
+	0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1b, 0x62, 0x75,
+	0x66, 0x2f, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2f, 0x76, 0x61, 0x6c, 0x69, 0x64,
+	0x61, 0x74, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xc6, 0x02, 0x0a, 0x06, 0x44, 0x65,
+	0x74, 0x61, 0x69, 0x6c, 0x12, 0x49, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f,
+	0x62, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73,
+	0x2e, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
+	0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x45, 0x64, 0x69, 0x74, 0x6f, 0x72, 0x48,
+	0x00, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x42, 0x79, 0x88, 0x01, 0x01, 0x12,
+	0x43, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x42,
+	0x08, 0xba, 0x48, 0x05, 0xb2, 0x01, 0x02, 0x38, 0x01, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x64, 0x41, 0x74, 0x12, 0x49, 0x0a, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x5f,
+	0x62, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73,
+	0x2e, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
+	0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x45, 0x64, 0x69, 0x74, 0x6f, 0x72, 0x48,
+	0x01, 0x52, 0x09, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x42, 0x79, 0x88, 0x01, 0x01, 0x12,
+	0x43, 0x0a, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x42,
+	0x08, 0xba, 0x48, 0x05, 0xb2, 0x01, 0x02, 0x38, 0x01, 0x52, 0x09, 0x75, 0x70, 0x64, 0x61, 0x74,
+	0x65, 0x64, 0x41, 0x74, 0x42, 0x0d, 0x0a, 0x0b, 0x5f, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64,
+	0x5f, 0x62, 0x79, 0x42, 0x0d, 0x0a, 0x0b, 0x5f, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x5f,
+	0x62, 0x79, 0x22, 0x52, 0x0a, 0x07, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x12, 0x29, 0x0a,
+	0x03, 0x69, 0x73, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x17, 0xba, 0x48, 0x14, 0x72,
+	0x12, 0x10, 0x01, 0x18, 0xff, 0x01, 0x3a, 0x08, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f,
+	0x88, 0x01, 0x01, 0x52, 0x03, 0x69, 0x73, 0x73, 0x12, 0x1c, 0x0a, 0x03, 0x73, 0x75, 0x62, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xba, 0x48, 0x07, 0x72, 0x05, 0x10, 0x01, 0x18, 0xff,
+	0x01, 0x52, 0x03, 0x73, 0x75, 0x62, 0x22, 0x9a, 0x01, 0x0a, 0x07, 0x55, 0x73, 0x65, 0x72, 0x52,
+	0x65, 0x66, 0x12, 0x23, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x48, 0x00, 0x52,
+	0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x1f, 0x0a, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x07, 0xba, 0x48, 0x04, 0x72, 0x02, 0x60, 0x01, 0x48,
+	0x00, 0x52, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x3a, 0x0a, 0x07, 0x73, 0x75, 0x62, 0x6a,
+	0x65, 0x63, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x68, 0x6f, 0x6c, 0x6f,
+	0x73, 0x2e, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x48, 0x00, 0x52, 0x07, 0x73, 0x75, 0x62,
+	0x6a, 0x65, 0x63, 0x74, 0x42, 0x0d, 0x0a, 0x04, 0x75, 0x73, 0x65, 0x72, 0x12, 0x05, 0xba, 0x48,
+	0x02, 0x08, 0x01, 0x22, 0xd1, 0x02, 0x0a, 0x0f, 0x4f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x66, 0x12, 0x21, 0x0a, 0x06, 0x6f, 0x72, 0x67, 0x5f, 0x69,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01,
+	0x01, 0x48, 0x00, 0x52, 0x05, 0x6f, 0x72, 0x67, 0x49, 0x64, 0x12, 0x8c, 0x02, 0x0a, 0x08, 0x6f,
+	0x72, 0x67, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0xee, 0x01,
+	0xba, 0x48, 0xea, 0x01, 0xba, 0x01, 0xe6, 0x01, 0x0a, 0x08, 0x6f, 0x72, 0x67, 0x2e, 0x6e, 0x61,
+	0x6d, 0x65, 0x12, 0xa4, 0x01, 0x41, 0x6c, 0x6c, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74,
+	0x65, 0x72, 0x73, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x65, 0x69, 0x74, 0x68,
+	0x65, 0x72, 0x20, 0x61, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x20, 0x6f, 0x72, 0x20, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x2e, 0x20, 0x20, 0x43, 0x61,
+	0x6e, 0x6e, 0x6f, 0x74, 0x20, 0x73, 0x74, 0x61, 0x72, 0x74, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20,
+	0x61, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x2e, 0x20, 0x20, 0x43, 0x61, 0x6e, 0x6e, 0x6f,
+	0x74, 0x20, 0x69, 0x6e, 0x63, 0x6c, 0x75, 0x64, 0x65, 0x20, 0x63, 0x6f, 0x6e, 0x73, 0x65, 0x63,
+	0x75, 0x74, 0x69, 0x76, 0x65, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x2e, 0x20, 0x20,
+	0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x61,
+	0x74, 0x20, 0x6c, 0x65, 0x61, 0x73, 0x74, 0x20, 0x33, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x61, 0x74,
+	0x20, 0x6d, 0x6f, 0x73, 0x74, 0x20, 0x33, 0x39, 0x2e, 0x1a, 0x33, 0x74, 0x68, 0x69, 0x73, 0x2e,
+	0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x28, 0x3f, 0x21, 0x2d, 0x29, 0x28,
+	0x3f, 0x21, 0x2e, 0x2a, 0x2d, 0x2d, 0x29, 0x28, 0x5b, 0x61, 0x2d, 0x7a, 0x41, 0x2d, 0x5a, 0x30,
+	0x2d, 0x39, 0x2d, 0x5d, 0x29, 0x7b, 0x33, 0x2c, 0x33, 0x39, 0x7d, 0x24, 0x27, 0x29, 0x48, 0x00,
+	0x52, 0x07, 0x6f, 0x72, 0x67, 0x4e, 0x61, 0x6d, 0x65, 0x42, 0x0c, 0x0a, 0x03, 0x6f, 0x72, 0x67,
+	0x12, 0x05, 0xba, 0x48, 0x02, 0x08, 0x01, 0x22, 0x46, 0x0a, 0x0e, 0x52, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x45, 0x64, 0x69, 0x74, 0x6f, 0x72, 0x12, 0x23, 0x0a, 0x07, 0x75, 0x73, 0x65,
+	0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72,
+	0x03, 0xb0, 0x01, 0x01, 0x48, 0x00, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x42, 0x0f,
+	0x0a, 0x06, 0x65, 0x64, 0x69, 0x74, 0x6f, 0x72, 0x12, 0x05, 0xba, 0x48, 0x02, 0x08, 0x01, 0x22,
+	0x70, 0x0a, 0x0d, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4f, 0x77, 0x6e, 0x65, 0x72,
+	0x12, 0x21, 0x0a, 0x06, 0x6f, 0x72, 0x67, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x48, 0x00, 0x52, 0x05, 0x6f, 0x72,
+	0x67, 0x49, 0x64, 0x12, 0x23, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x48, 0x00,
+	0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x42, 0x17, 0x0a, 0x0e, 0x72, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x5f, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x12, 0x05, 0xba, 0x48, 0x02, 0x08,
+	0x01, 0x42, 0x45, 0x5a, 0x43, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f,
+	0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2d, 0x72, 0x75, 0x6e, 0x2f, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2f,
+	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x68, 0x6f, 0x6c, 0x6f,
+	0x73, 0x2f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x3b, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_holos_object_v1alpha1_object_proto_rawDescOnce sync.Once
+	file_holos_object_v1alpha1_object_proto_rawDescData = file_holos_object_v1alpha1_object_proto_rawDesc
+)
+
+func file_holos_object_v1alpha1_object_proto_rawDescGZIP() []byte {
+	file_holos_object_v1alpha1_object_proto_rawDescOnce.Do(func() {
+		file_holos_object_v1alpha1_object_proto_rawDescData = protoimpl.X.CompressGZIP(file_holos_object_v1alpha1_object_proto_rawDescData)
+	})
+	return file_holos_object_v1alpha1_object_proto_rawDescData
+}
+
+var file_holos_object_v1alpha1_object_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
+var file_holos_object_v1alpha1_object_proto_goTypes = []interface{}{
+	(*Detail)(nil),                // 0: holos.object.v1alpha1.Detail
+	(*Subject)(nil),               // 1: holos.object.v1alpha1.Subject
+	(*UserRef)(nil),               // 2: holos.object.v1alpha1.UserRef
+	(*OrganizationRef)(nil),       // 3: holos.object.v1alpha1.OrganizationRef
+	(*ResourceEditor)(nil),        // 4: holos.object.v1alpha1.ResourceEditor
+	(*ResourceOwner)(nil),         // 5: holos.object.v1alpha1.ResourceOwner
+	(*timestamppb.Timestamp)(nil), // 6: google.protobuf.Timestamp
+}
+var file_holos_object_v1alpha1_object_proto_depIdxs = []int32{
+	4, // 0: holos.object.v1alpha1.Detail.created_by:type_name -> holos.object.v1alpha1.ResourceEditor
+	6, // 1: holos.object.v1alpha1.Detail.created_at:type_name -> google.protobuf.Timestamp
+	4, // 2: holos.object.v1alpha1.Detail.updated_by:type_name -> holos.object.v1alpha1.ResourceEditor
+	6, // 3: holos.object.v1alpha1.Detail.updated_at:type_name -> google.protobuf.Timestamp
+	1, // 4: holos.object.v1alpha1.UserRef.subject:type_name -> holos.object.v1alpha1.Subject
+	5, // [5:5] is the sub-list for method output_type
+	5, // [5:5] is the sub-list for method input_type
+	5, // [5:5] is the sub-list for extension type_name
+	5, // [5:5] is the sub-list for extension extendee
+	0, // [0:5] is the sub-list for field type_name
+}
+
+func init() { file_holos_object_v1alpha1_object_proto_init() }
+func file_holos_object_v1alpha1_object_proto_init() {
+	if File_holos_object_v1alpha1_object_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_holos_object_v1alpha1_object_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Detail); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_holos_object_v1alpha1_object_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Subject); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_holos_object_v1alpha1_object_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UserRef); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_holos_object_v1alpha1_object_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*OrganizationRef); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_holos_object_v1alpha1_object_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ResourceEditor); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_holos_object_v1alpha1_object_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ResourceOwner); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_holos_object_v1alpha1_object_proto_msgTypes[0].OneofWrappers = []interface{}{}
+	file_holos_object_v1alpha1_object_proto_msgTypes[2].OneofWrappers = []interface{}{
+		(*UserRef_UserId)(nil),
+		(*UserRef_Email)(nil),
+		(*UserRef_Subject)(nil),
+	}
+	file_holos_object_v1alpha1_object_proto_msgTypes[3].OneofWrappers = []interface{}{
+		(*OrganizationRef_OrgId)(nil),
+		(*OrganizationRef_OrgName)(nil),
+	}
+	file_holos_object_v1alpha1_object_proto_msgTypes[4].OneofWrappers = []interface{}{
+		(*ResourceEditor_UserId)(nil),
+	}
+	file_holos_object_v1alpha1_object_proto_msgTypes[5].OneofWrappers = []interface{}{
+		(*ResourceOwner_OrgId)(nil),
+		(*ResourceOwner_UserId)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_holos_object_v1alpha1_object_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   6,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_holos_object_v1alpha1_object_proto_goTypes,
+		DependencyIndexes: file_holos_object_v1alpha1_object_proto_depIdxs,
+		MessageInfos:      file_holos_object_v1alpha1_object_proto_msgTypes,
+	}.Build()
+	File_holos_object_v1alpha1_object_proto = out.File
+	file_holos_object_v1alpha1_object_proto_rawDesc = nil
+	file_holos_object_v1alpha1_object_proto_goTypes = nil
+	file_holos_object_v1alpha1_object_proto_depIdxs = nil
+}
--- a/service/gen/holos/organization/v1alpha1/organization.pb.go
+++ b/service/gen/holos/organization/v1alpha1/organization.pb.go
@@ -0,0 +1,240 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.33.0-devel
+// 	protoc        (unknown)
+// source: holos/organization/v1alpha1/organization.proto
+
+package organization
+
+import (
+	_ "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate"
+	v1alpha1 "github.com/holos-run/holos/service/gen/holos/object/v1alpha1"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type Organization struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Unique id assigned by the server.
+	OrgId *string `protobuf:"bytes,1,opt,name=org_id,json=orgId,proto3,oneof" json:"org_id,omitempty"`
+	// Name is the organization name as a dns label.
+	Name        string           `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+	DisplayName *string          `protobuf:"bytes,3,opt,name=display_name,json=displayName,proto3,oneof" json:"display_name,omitempty"`
+	Detail      *v1alpha1.Detail `protobuf:"bytes,4,opt,name=detail,proto3,oneof" json:"detail,omitempty"`
+}
+
+func (x *Organization) Reset() {
+	*x = Organization{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_organization_v1alpha1_organization_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Organization) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Organization) ProtoMessage() {}
+
+func (x *Organization) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_organization_v1alpha1_organization_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Organization.ProtoReflect.Descriptor instead.
+func (*Organization) Descriptor() ([]byte, []int) {
+	return file_holos_organization_v1alpha1_organization_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Organization) GetOrgId() string {
+	if x != nil && x.OrgId != nil {
+		return *x.OrgId
+	}
+	return ""
+}
+
+func (x *Organization) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *Organization) GetDisplayName() string {
+	if x != nil && x.DisplayName != nil {
+		return *x.DisplayName
+	}
+	return ""
+}
+
+func (x *Organization) GetDetail() *v1alpha1.Detail {
+	if x != nil {
+		return x.Detail
+	}
+	return nil
+}
+
+var File_holos_organization_v1alpha1_organization_proto protoreflect.FileDescriptor
+
+var file_holos_organization_v1alpha1_organization_proto_rawDesc = []byte{
+	0x0a, 0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2f, 0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x6f, 0x72,
+	0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x12, 0x1b, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x1a, 0x1b, 0x62,
+	0x75, 0x66, 0x2f, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2f, 0x76, 0x61, 0x6c, 0x69,
+	0x64, 0x61, 0x74, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x22, 0x68, 0x6f, 0x6c, 0x6f,
+	0x73, 0x2f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x2f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x95,
+	0x07, 0x0a, 0x0c, 0x4f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12,
+	0x24, 0x0a, 0x06, 0x6f, 0x72, 0x67, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42,
+	0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x48, 0x00, 0x52, 0x05, 0x6f, 0x72, 0x67,
+	0x49, 0x64, 0x88, 0x01, 0x01, 0x12, 0xf0, 0x02, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x42, 0xdb, 0x02, 0xba, 0x48, 0xd7, 0x02, 0xba, 0x01, 0x4a, 0x0a, 0x14,
+	0x6e, 0x61, 0x6d, 0x65, 0x2e, 0x6e, 0x6f, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x5f, 0x68, 0x79,
+	0x70, 0x68, 0x65, 0x6e, 0x12, 0x1b, 0x43, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x20, 0x73, 0x74, 0x61,
+	0x72, 0x74, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x61, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e,
+	0x2e, 0x1a, 0x15, 0x21, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x73, 0x74, 0x61, 0x72, 0x74, 0x73, 0x57,
+	0x69, 0x74, 0x68, 0x28, 0x27, 0x2d, 0x27, 0x29, 0xba, 0x01, 0x44, 0x0a, 0x12, 0x6e, 0x61, 0x6d,
+	0x65, 0x2e, 0x6e, 0x6f, 0x5f, 0x65, 0x6e, 0x64, 0x5f, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x12,
+	0x19, 0x43, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x20, 0x65, 0x6e, 0x64, 0x20, 0x77, 0x69, 0x74, 0x68,
+	0x20, 0x61, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x2e, 0x1a, 0x13, 0x21, 0x74, 0x68, 0x69,
+	0x73, 0x2e, 0x65, 0x6e, 0x64, 0x73, 0x57, 0x69, 0x74, 0x68, 0x28, 0x27, 0x2d, 0x27, 0x29, 0xba,
+	0x01, 0x58, 0x0a, 0x1b, 0x6e, 0x61, 0x6d, 0x65, 0x2e, 0x6e, 0x6f, 0x5f, 0x63, 0x6f, 0x6e, 0x73,
+	0x65, 0x63, 0x75, 0x74, 0x69, 0x76, 0x65, 0x5f, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x12,
+	0x23, 0x43, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x20, 0x69, 0x6e, 0x63, 0x6c, 0x75, 0x64, 0x65, 0x20,
+	0x63, 0x6f, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x74, 0x69, 0x76, 0x65, 0x20, 0x68, 0x79, 0x70, 0x68,
+	0x65, 0x6e, 0x73, 0x2e, 0x1a, 0x14, 0x21, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x63, 0x6f, 0x6e, 0x74,
+	0x61, 0x69, 0x6e, 0x73, 0x28, 0x27, 0x2d, 0x2d, 0x27, 0x29, 0xba, 0x01, 0x5f, 0x0a, 0x04, 0x6e,
+	0x61, 0x6d, 0x65, 0x12, 0x37, 0x41, 0x6c, 0x6c, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74,
+	0x65, 0x72, 0x73, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x65, 0x69, 0x74, 0x68,
+	0x65, 0x72, 0x20, 0x61, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x20, 0x6f, 0x72, 0x20, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x2e, 0x1a, 0x1e, 0x74, 0x68,
+	0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x41, 0x2d,
+	0x5a, 0x61, 0x2d, 0x7a, 0x30, 0x2d, 0x39, 0x2d, 0x5d, 0x24, 0x27, 0x29, 0x72, 0x04, 0x10, 0x03,
+	0x18, 0x27, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x88, 0x03, 0x0a, 0x0c, 0x64, 0x69, 0x73,
+	0x70, 0x6c, 0x61, 0x79, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x42,
+	0xdf, 0x02, 0xba, 0x48, 0xdb, 0x02, 0xba, 0x01, 0x48, 0x0a, 0x13, 0x6e, 0x61, 0x6d, 0x65, 0x2e,
+	0x6e, 0x6f, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x5f, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x1a,
+	0x43, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x20, 0x73, 0x74, 0x61, 0x72, 0x74, 0x20, 0x77, 0x69, 0x74,
+	0x68, 0x20, 0x61, 0x20, 0x73, 0x70, 0x61, 0x63, 0x65, 0x2e, 0x1a, 0x15, 0x21, 0x74, 0x68, 0x69,
+	0x73, 0x2e, 0x73, 0x74, 0x61, 0x72, 0x74, 0x73, 0x57, 0x69, 0x74, 0x68, 0x28, 0x27, 0x20, 0x27,
+	0x29, 0xba, 0x01, 0x42, 0x0a, 0x11, 0x6e, 0x61, 0x6d, 0x65, 0x2e, 0x6e, 0x6f, 0x5f, 0x65, 0x6e,
+	0x64, 0x5f, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x18, 0x43, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x20,
+	0x65, 0x6e, 0x64, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x61, 0x20, 0x73, 0x70, 0x61, 0x63, 0x65,
+	0x2e, 0x1a, 0x13, 0x21, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x65, 0x6e, 0x64, 0x73, 0x57, 0x69, 0x74,
+	0x68, 0x28, 0x27, 0x20, 0x27, 0x29, 0xba, 0x01, 0x56, 0x0a, 0x1a, 0x6e, 0x61, 0x6d, 0x65, 0x2e,
+	0x6e, 0x6f, 0x5f, 0x63, 0x6f, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x74, 0x69, 0x76, 0x65, 0x5f, 0x73,
+	0x70, 0x61, 0x63, 0x65, 0x73, 0x12, 0x22, 0x43, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x20, 0x69, 0x6e,
+	0x63, 0x6c, 0x75, 0x64, 0x65, 0x20, 0x63, 0x6f, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x74, 0x69, 0x76,
+	0x65, 0x20, 0x73, 0x70, 0x61, 0x63, 0x65, 0x73, 0x2e, 0x1a, 0x14, 0x21, 0x74, 0x68, 0x69, 0x73,
+	0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x73, 0x28, 0x27, 0x20, 0x20, 0x27, 0x29, 0xba,
+	0x01, 0x69, 0x0a, 0x0f, 0x6e, 0x61, 0x6d, 0x65, 0x2e, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74,
+	0x65, 0x72, 0x73, 0x12, 0x36, 0x41, 0x6c, 0x6c, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74,
+	0x65, 0x72, 0x73, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x65, 0x69, 0x74, 0x68,
+	0x65, 0x72, 0x20, 0x61, 0x20, 0x73, 0x70, 0x61, 0x63, 0x65, 0x20, 0x6f, 0x72, 0x20, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x2e, 0x1a, 0x1e, 0x74, 0x68, 0x69,
+	0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x41, 0x2d, 0x5a,
+	0x61, 0x2d, 0x7a, 0x30, 0x2d, 0x39, 0x20, 0x5d, 0x24, 0x27, 0x29, 0x72, 0x04, 0x10, 0x01, 0x18,
+	0x64, 0x48, 0x01, 0x52, 0x0b, 0x64, 0x69, 0x73, 0x70, 0x6c, 0x61, 0x79, 0x4e, 0x61, 0x6d, 0x65,
+	0x88, 0x01, 0x01, 0x12, 0x3a, 0x0a, 0x06, 0x64, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x6f, 0x62, 0x6a, 0x65,
+	0x63, 0x74, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x44, 0x65, 0x74, 0x61,
+	0x69, 0x6c, 0x48, 0x02, 0x52, 0x06, 0x64, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x88, 0x01, 0x01, 0x42,
+	0x09, 0x0a, 0x07, 0x5f, 0x6f, 0x72, 0x67, 0x5f, 0x69, 0x64, 0x42, 0x0f, 0x0a, 0x0d, 0x5f, 0x64,
+	0x69, 0x73, 0x70, 0x6c, 0x61, 0x79, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x42, 0x09, 0x0a, 0x07, 0x5f,
+	0x64, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x42, 0x51, 0x5a, 0x4f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
+	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2d, 0x72, 0x75, 0x6e, 0x2f, 0x68,
+	0x6f, 0x6c, 0x6f, 0x73, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2f, 0x67, 0x65, 0x6e,
+	0x2f, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2f, 0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x3b, 0x6f, 0x72, 0x67,
+	0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x33,
+}
+
+var (
+	file_holos_organization_v1alpha1_organization_proto_rawDescOnce sync.Once
+	file_holos_organization_v1alpha1_organization_proto_rawDescData = file_holos_organization_v1alpha1_organization_proto_rawDesc
+)
+
+func file_holos_organization_v1alpha1_organization_proto_rawDescGZIP() []byte {
+	file_holos_organization_v1alpha1_organization_proto_rawDescOnce.Do(func() {
+		file_holos_organization_v1alpha1_organization_proto_rawDescData = protoimpl.X.CompressGZIP(file_holos_organization_v1alpha1_organization_proto_rawDescData)
+	})
+	return file_holos_organization_v1alpha1_organization_proto_rawDescData
+}
+
+var file_holos_organization_v1alpha1_organization_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_holos_organization_v1alpha1_organization_proto_goTypes = []interface{}{
+	(*Organization)(nil),    // 0: holos.organization.v1alpha1.Organization
+	(*v1alpha1.Detail)(nil), // 1: holos.object.v1alpha1.Detail
+}
+var file_holos_organization_v1alpha1_organization_proto_depIdxs = []int32{
+	1, // 0: holos.organization.v1alpha1.Organization.detail:type_name -> holos.object.v1alpha1.Detail
+	1, // [1:1] is the sub-list for method output_type
+	1, // [1:1] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_holos_organization_v1alpha1_organization_proto_init() }
+func file_holos_organization_v1alpha1_organization_proto_init() {
+	if File_holos_organization_v1alpha1_organization_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_holos_organization_v1alpha1_organization_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Organization); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_holos_organization_v1alpha1_organization_proto_msgTypes[0].OneofWrappers = []interface{}{}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_holos_organization_v1alpha1_organization_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_holos_organization_v1alpha1_organization_proto_goTypes,
+		DependencyIndexes: file_holos_organization_v1alpha1_organization_proto_depIdxs,
+		MessageInfos:      file_holos_organization_v1alpha1_organization_proto_msgTypes,
+	}.Build()
+	File_holos_organization_v1alpha1_organization_proto = out.File
+	file_holos_organization_v1alpha1_organization_proto_rawDesc = nil
+	file_holos_organization_v1alpha1_organization_proto_goTypes = nil
+	file_holos_organization_v1alpha1_organization_proto_depIdxs = nil
+}
--- a/service/gen/holos/organization/v1alpha1/organization_service.pb.go
+++ b/service/gen/holos/organization/v1alpha1/organization_service.pb.go
@@ -0,0 +1,407 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.33.0-devel
+// 	protoc        (unknown)
+// source: holos/organization/v1alpha1/organization_service.proto
+
+package organization
+
+import (
+	v1alpha1 "github.com/holos-run/holos/service/gen/holos/object/v1alpha1"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	fieldmaskpb "google.golang.org/protobuf/types/known/fieldmaskpb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type CreateOrganizationRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Organization *Organization `protobuf:"bytes,1,opt,name=organization,proto3" json:"organization,omitempty"`
+}
+
+func (x *CreateOrganizationRequest) Reset() {
+	*x = CreateOrganizationRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_organization_v1alpha1_organization_service_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CreateOrganizationRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateOrganizationRequest) ProtoMessage() {}
+
+func (x *CreateOrganizationRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_organization_v1alpha1_organization_service_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateOrganizationRequest.ProtoReflect.Descriptor instead.
+func (*CreateOrganizationRequest) Descriptor() ([]byte, []int) {
+	return file_holos_organization_v1alpha1_organization_service_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *CreateOrganizationRequest) GetOrganization() *Organization {
+	if x != nil {
+		return x.Organization
+	}
+	return nil
+}
+
+type CreateOrganizationResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Organization *Organization `protobuf:"bytes,1,opt,name=organization,proto3" json:"organization,omitempty"`
+}
+
+func (x *CreateOrganizationResponse) Reset() {
+	*x = CreateOrganizationResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_organization_v1alpha1_organization_service_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CreateOrganizationResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateOrganizationResponse) ProtoMessage() {}
+
+func (x *CreateOrganizationResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_organization_v1alpha1_organization_service_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateOrganizationResponse.ProtoReflect.Descriptor instead.
+func (*CreateOrganizationResponse) Descriptor() ([]byte, []int) {
+	return file_holos_organization_v1alpha1_organization_service_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *CreateOrganizationResponse) GetOrganization() *Organization {
+	if x != nil {
+		return x.Organization
+	}
+	return nil
+}
+
+type ListOrganizationsRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	FieldMask *fieldmaskpb.FieldMask `protobuf:"bytes,1,opt,name=field_mask,json=fieldMask,proto3" json:"field_mask,omitempty"`
+}
+
+func (x *ListOrganizationsRequest) Reset() {
+	*x = ListOrganizationsRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_organization_v1alpha1_organization_service_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListOrganizationsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListOrganizationsRequest) ProtoMessage() {}
+
+func (x *ListOrganizationsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_organization_v1alpha1_organization_service_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListOrganizationsRequest.ProtoReflect.Descriptor instead.
+func (*ListOrganizationsRequest) Descriptor() ([]byte, []int) {
+	return file_holos_organization_v1alpha1_organization_service_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *ListOrganizationsRequest) GetFieldMask() *fieldmaskpb.FieldMask {
+	if x != nil {
+		return x.FieldMask
+	}
+	return nil
+}
+
+type ListOrganizationsResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	User          *v1alpha1.UserRef `protobuf:"bytes,1,opt,name=user,proto3,oneof" json:"user,omitempty"`
+	Organizations []*Organization   `protobuf:"bytes,2,rep,name=organizations,proto3" json:"organizations,omitempty"`
+}
+
+func (x *ListOrganizationsResponse) Reset() {
+	*x = ListOrganizationsResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_organization_v1alpha1_organization_service_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListOrganizationsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListOrganizationsResponse) ProtoMessage() {}
+
+func (x *ListOrganizationsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_organization_v1alpha1_organization_service_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListOrganizationsResponse.ProtoReflect.Descriptor instead.
+func (*ListOrganizationsResponse) Descriptor() ([]byte, []int) {
+	return file_holos_organization_v1alpha1_organization_service_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *ListOrganizationsResponse) GetUser() *v1alpha1.UserRef {
+	if x != nil {
+		return x.User
+	}
+	return nil
+}
+
+func (x *ListOrganizationsResponse) GetOrganizations() []*Organization {
+	if x != nil {
+		return x.Organizations
+	}
+	return nil
+}
+
+var File_holos_organization_v1alpha1_organization_service_proto protoreflect.FileDescriptor
+
+var file_holos_organization_v1alpha1_organization_service_proto_rawDesc = []byte{
+	0x0a, 0x36, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2f, 0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x6f, 0x72,
+	0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x1b, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e,
+	0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x1a, 0x20, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x5f, 0x6d, 0x61, 0x73,
+	0x6b, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x22, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2f, 0x6f,
+	0x62, 0x6a, 0x65, 0x63, 0x74, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x6f,
+	0x62, 0x6a, 0x65, 0x63, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x2e, 0x68, 0x6f, 0x6c,
+	0x6f, 0x73, 0x2f, 0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f,
+	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x6a, 0x0a, 0x19, 0x43,
+	0x72, 0x65, 0x61, 0x74, 0x65, 0x4f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x4d, 0x0a, 0x0c, 0x6f, 0x72, 0x67, 0x61,
+	0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29,
+	0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x4f, 0x72, 0x67,
+	0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0c, 0x6f, 0x72, 0x67, 0x61, 0x6e,
+	0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x6b, 0x0a, 0x1a, 0x43, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x4f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4d, 0x0a, 0x0c, 0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x68, 0x6f,
+	0x6c, 0x6f, 0x73, 0x2e, 0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x4f, 0x72, 0x67, 0x61, 0x6e, 0x69,
+	0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0c, 0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x22, 0x55, 0x0a, 0x18, 0x4c, 0x69, 0x73, 0x74, 0x4f, 0x72, 0x67, 0x61,
+	0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x39, 0x0a, 0x0a, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x5f, 0x6d, 0x61, 0x73, 0x6b, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4d, 0x61, 0x73, 0x6b,
+	0x52, 0x09, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x4d, 0x61, 0x73, 0x6b, 0x22, 0xae, 0x01, 0x0a, 0x19,
+	0x4c, 0x69, 0x73, 0x74, 0x4f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x37, 0x0a, 0x04, 0x75, 0x73, 0x65,
+	0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e,
+	0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e,
+	0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x66, 0x48, 0x00, 0x52, 0x04, 0x75, 0x73, 0x65, 0x72, 0x88,
+	0x01, 0x01, 0x12, 0x4f, 0x0a, 0x0d, 0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x68, 0x6f, 0x6c, 0x6f,
+	0x73, 0x2e, 0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76,
+	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x4f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0d, 0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x42, 0x07, 0x0a, 0x05, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x32, 0xa6, 0x02, 0x0a,
+	0x13, 0x4f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x12, 0x87, 0x01, 0x0a, 0x12, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4f,
+	0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x36, 0x2e, 0x68, 0x6f,
+	0x6c, 0x6f, 0x73, 0x2e, 0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x4f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x37, 0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x6f, 0x72, 0x67, 0x61,
+	0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x84,
+	0x01, 0x0a, 0x11, 0x4c, 0x69, 0x73, 0x74, 0x4f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x12, 0x35, 0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x6f, 0x72, 0x67,
+	0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x36, 0x2e, 0x68, 0x6f,
+	0x6c, 0x6f, 0x73, 0x2e, 0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4f, 0x72,
+	0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0x51, 0x5a, 0x4f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e,
+	0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2d, 0x72, 0x75, 0x6e, 0x2f, 0x68, 0x6f,
+	0x6c, 0x6f, 0x73, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2f, 0x67, 0x65, 0x6e, 0x2f,
+	0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2f, 0x6f, 0x72, 0x67, 0x61, 0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x3b, 0x6f, 0x72, 0x67, 0x61,
+	0x6e, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_holos_organization_v1alpha1_organization_service_proto_rawDescOnce sync.Once
+	file_holos_organization_v1alpha1_organization_service_proto_rawDescData = file_holos_organization_v1alpha1_organization_service_proto_rawDesc
+)
+
+func file_holos_organization_v1alpha1_organization_service_proto_rawDescGZIP() []byte {
+	file_holos_organization_v1alpha1_organization_service_proto_rawDescOnce.Do(func() {
+		file_holos_organization_v1alpha1_organization_service_proto_rawDescData = protoimpl.X.CompressGZIP(file_holos_organization_v1alpha1_organization_service_proto_rawDescData)
+	})
+	return file_holos_organization_v1alpha1_organization_service_proto_rawDescData
+}
+
+var file_holos_organization_v1alpha1_organization_service_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_holos_organization_v1alpha1_organization_service_proto_goTypes = []interface{}{
+	(*CreateOrganizationRequest)(nil),  // 0: holos.organization.v1alpha1.CreateOrganizationRequest
+	(*CreateOrganizationResponse)(nil), // 1: holos.organization.v1alpha1.CreateOrganizationResponse
+	(*ListOrganizationsRequest)(nil),   // 2: holos.organization.v1alpha1.ListOrganizationsRequest
+	(*ListOrganizationsResponse)(nil),  // 3: holos.organization.v1alpha1.ListOrganizationsResponse
+	(*Organization)(nil),               // 4: holos.organization.v1alpha1.Organization
+	(*fieldmaskpb.FieldMask)(nil),      // 5: google.protobuf.FieldMask
+	(*v1alpha1.UserRef)(nil),           // 6: holos.object.v1alpha1.UserRef
+}
+var file_holos_organization_v1alpha1_organization_service_proto_depIdxs = []int32{
+	4, // 0: holos.organization.v1alpha1.CreateOrganizationRequest.organization:type_name -> holos.organization.v1alpha1.Organization
+	4, // 1: holos.organization.v1alpha1.CreateOrganizationResponse.organization:type_name -> holos.organization.v1alpha1.Organization
+	5, // 2: holos.organization.v1alpha1.ListOrganizationsRequest.field_mask:type_name -> google.protobuf.FieldMask
+	6, // 3: holos.organization.v1alpha1.ListOrganizationsResponse.user:type_name -> holos.object.v1alpha1.UserRef
+	4, // 4: holos.organization.v1alpha1.ListOrganizationsResponse.organizations:type_name -> holos.organization.v1alpha1.Organization
+	0, // 5: holos.organization.v1alpha1.OrganizationService.CreateOrganization:input_type -> holos.organization.v1alpha1.CreateOrganizationRequest
+	2, // 6: holos.organization.v1alpha1.OrganizationService.ListOrganizations:input_type -> holos.organization.v1alpha1.ListOrganizationsRequest
+	1, // 7: holos.organization.v1alpha1.OrganizationService.CreateOrganization:output_type -> holos.organization.v1alpha1.CreateOrganizationResponse
+	3, // 8: holos.organization.v1alpha1.OrganizationService.ListOrganizations:output_type -> holos.organization.v1alpha1.ListOrganizationsResponse
+	7, // [7:9] is the sub-list for method output_type
+	5, // [5:7] is the sub-list for method input_type
+	5, // [5:5] is the sub-list for extension type_name
+	5, // [5:5] is the sub-list for extension extendee
+	0, // [0:5] is the sub-list for field type_name
+}
+
+func init() { file_holos_organization_v1alpha1_organization_service_proto_init() }
+func file_holos_organization_v1alpha1_organization_service_proto_init() {
+	if File_holos_organization_v1alpha1_organization_service_proto != nil {
+		return
+	}
+	file_holos_organization_v1alpha1_organization_proto_init()
+	if !protoimpl.UnsafeEnabled {
+		file_holos_organization_v1alpha1_organization_service_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CreateOrganizationRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_holos_organization_v1alpha1_organization_service_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CreateOrganizationResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_holos_organization_v1alpha1_organization_service_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ListOrganizationsRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_holos_organization_v1alpha1_organization_service_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ListOrganizationsResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_holos_organization_v1alpha1_organization_service_proto_msgTypes[3].OneofWrappers = []interface{}{}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_holos_organization_v1alpha1_organization_service_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   4,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_holos_organization_v1alpha1_organization_service_proto_goTypes,
+		DependencyIndexes: file_holos_organization_v1alpha1_organization_service_proto_depIdxs,
+		MessageInfos:      file_holos_organization_v1alpha1_organization_service_proto_msgTypes,
+	}.Build()
+	File_holos_organization_v1alpha1_organization_service_proto = out.File
+	file_holos_organization_v1alpha1_organization_service_proto_rawDesc = nil
+	file_holos_organization_v1alpha1_organization_service_proto_goTypes = nil
+	file_holos_organization_v1alpha1_organization_service_proto_depIdxs = nil
+}
--- a/service/gen/holos/organization/v1alpha1/organizationconnect/organization_service.connect.go
+++ b/service/gen/holos/organization/v1alpha1/organizationconnect/organization_service.connect.go
@@ -0,0 +1,146 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: holos/organization/v1alpha1/organization_service.proto
+
+package organizationconnect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1alpha1 "github.com/holos-run/holos/service/gen/holos/organization/v1alpha1"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// OrganizationServiceName is the fully-qualified name of the OrganizationService service.
+	OrganizationServiceName = "holos.organization.v1alpha1.OrganizationService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// OrganizationServiceCreateOrganizationProcedure is the fully-qualified name of the
+	// OrganizationService's CreateOrganization RPC.
+	OrganizationServiceCreateOrganizationProcedure = "/holos.organization.v1alpha1.OrganizationService/CreateOrganization"
+	// OrganizationServiceListOrganizationsProcedure is the fully-qualified name of the
+	// OrganizationService's ListOrganizations RPC.
+	OrganizationServiceListOrganizationsProcedure = "/holos.organization.v1alpha1.OrganizationService/ListOrganizations"
+)
+
+// These variables are the protoreflect.Descriptor objects for the RPCs defined in this package.
+var (
+	organizationServiceServiceDescriptor                  = v1alpha1.File_holos_organization_v1alpha1_organization_service_proto.Services().ByName("OrganizationService")
+	organizationServiceCreateOrganizationMethodDescriptor = organizationServiceServiceDescriptor.Methods().ByName("CreateOrganization")
+	organizationServiceListOrganizationsMethodDescriptor  = organizationServiceServiceDescriptor.Methods().ByName("ListOrganizations")
+)
+
+// OrganizationServiceClient is a client for the holos.organization.v1alpha1.OrganizationService
+// service.
+type OrganizationServiceClient interface {
+	CreateOrganization(context.Context, *connect.Request[v1alpha1.CreateOrganizationRequest]) (*connect.Response[v1alpha1.CreateOrganizationResponse], error)
+	ListOrganizations(context.Context, *connect.Request[v1alpha1.ListOrganizationsRequest]) (*connect.Response[v1alpha1.ListOrganizationsResponse], error)
+}
+
+// NewOrganizationServiceClient constructs a client for the
+// holos.organization.v1alpha1.OrganizationService service. By default, it uses the Connect protocol
+// with the binary Protobuf Codec, asks for gzipped responses, and sends uncompressed requests. To
+// use the gRPC or gRPC-Web protocols, supply the connect.WithGRPC() or connect.WithGRPCWeb()
+// options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewOrganizationServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) OrganizationServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	return &organizationServiceClient{
+		createOrganization: connect.NewClient[v1alpha1.CreateOrganizationRequest, v1alpha1.CreateOrganizationResponse](
+			httpClient,
+			baseURL+OrganizationServiceCreateOrganizationProcedure,
+			connect.WithSchema(organizationServiceCreateOrganizationMethodDescriptor),
+			connect.WithClientOptions(opts...),
+		),
+		listOrganizations: connect.NewClient[v1alpha1.ListOrganizationsRequest, v1alpha1.ListOrganizationsResponse](
+			httpClient,
+			baseURL+OrganizationServiceListOrganizationsProcedure,
+			connect.WithSchema(organizationServiceListOrganizationsMethodDescriptor),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// organizationServiceClient implements OrganizationServiceClient.
+type organizationServiceClient struct {
+	createOrganization *connect.Client[v1alpha1.CreateOrganizationRequest, v1alpha1.CreateOrganizationResponse]
+	listOrganizations  *connect.Client[v1alpha1.ListOrganizationsRequest, v1alpha1.ListOrganizationsResponse]
+}
+
+// CreateOrganization calls holos.organization.v1alpha1.OrganizationService.CreateOrganization.
+func (c *organizationServiceClient) CreateOrganization(ctx context.Context, req *connect.Request[v1alpha1.CreateOrganizationRequest]) (*connect.Response[v1alpha1.CreateOrganizationResponse], error) {
+	return c.createOrganization.CallUnary(ctx, req)
+}
+
+// ListOrganizations calls holos.organization.v1alpha1.OrganizationService.ListOrganizations.
+func (c *organizationServiceClient) ListOrganizations(ctx context.Context, req *connect.Request[v1alpha1.ListOrganizationsRequest]) (*connect.Response[v1alpha1.ListOrganizationsResponse], error) {
+	return c.listOrganizations.CallUnary(ctx, req)
+}
+
+// OrganizationServiceHandler is an implementation of the
+// holos.organization.v1alpha1.OrganizationService service.
+type OrganizationServiceHandler interface {
+	CreateOrganization(context.Context, *connect.Request[v1alpha1.CreateOrganizationRequest]) (*connect.Response[v1alpha1.CreateOrganizationResponse], error)
+	ListOrganizations(context.Context, *connect.Request[v1alpha1.ListOrganizationsRequest]) (*connect.Response[v1alpha1.ListOrganizationsResponse], error)
+}
+
+// NewOrganizationServiceHandler builds an HTTP handler from the service implementation. It returns
+// the path on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewOrganizationServiceHandler(svc OrganizationServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	organizationServiceCreateOrganizationHandler := connect.NewUnaryHandler(
+		OrganizationServiceCreateOrganizationProcedure,
+		svc.CreateOrganization,
+		connect.WithSchema(organizationServiceCreateOrganizationMethodDescriptor),
+		connect.WithHandlerOptions(opts...),
+	)
+	organizationServiceListOrganizationsHandler := connect.NewUnaryHandler(
+		OrganizationServiceListOrganizationsProcedure,
+		svc.ListOrganizations,
+		connect.WithSchema(organizationServiceListOrganizationsMethodDescriptor),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/holos.organization.v1alpha1.OrganizationService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case OrganizationServiceCreateOrganizationProcedure:
+			organizationServiceCreateOrganizationHandler.ServeHTTP(w, r)
+		case OrganizationServiceListOrganizationsProcedure:
+			organizationServiceListOrganizationsHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedOrganizationServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedOrganizationServiceHandler struct{}
+
+func (UnimplementedOrganizationServiceHandler) CreateOrganization(context.Context, *connect.Request[v1alpha1.CreateOrganizationRequest]) (*connect.Response[v1alpha1.CreateOrganizationResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("holos.organization.v1alpha1.OrganizationService.CreateOrganization is not implemented"))
+}
+
+func (UnimplementedOrganizationServiceHandler) ListOrganizations(context.Context, *connect.Request[v1alpha1.ListOrganizationsRequest]) (*connect.Response[v1alpha1.ListOrganizationsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("holos.organization.v1alpha1.OrganizationService.ListOrganizations is not implemented"))
+}
--- a/service/gen/holos/platform/v1alpha1/platform.pb.go
+++ b/service/gen/holos/platform/v1alpha1/platform.pb.go
@@ -0,0 +1,513 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.33.0-devel
+// 	protoc        (unknown)
+// source: holos/platform/v1alpha1/platform.proto
+
+package platform
+
+import (
+	_ "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate"
+	v1alpha1 "github.com/holos-run/holos/service/gen/holos/object/v1alpha1"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	structpb "google.golang.org/protobuf/types/known/structpb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type Platform struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Unique id assigned by the server.
+	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	// Owner of the platform.
+	Owner *Owner `protobuf:"bytes,2,opt,name=owner,proto3" json:"owner,omitempty"`
+	// name is the platform short name as a dns label.
+	Name        string           `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
+	DisplayName *string          `protobuf:"bytes,4,opt,name=display_name,json=displayName,proto3,oneof" json:"display_name,omitempty"`
+	Description *string          `protobuf:"bytes,5,opt,name=description,proto3,oneof" json:"description,omitempty"`
+	Spec        *Spec            `protobuf:"bytes,6,opt,name=spec,proto3,oneof" json:"spec,omitempty"`
+	Detail      *v1alpha1.Detail `protobuf:"bytes,8,opt,name=detail,proto3,oneof" json:"detail,omitempty"`
+}
+
+func (x *Platform) Reset() {
+	*x = Platform{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_platform_v1alpha1_platform_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Platform) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Platform) ProtoMessage() {}
+
+func (x *Platform) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_platform_v1alpha1_platform_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Platform.ProtoReflect.Descriptor instead.
+func (*Platform) Descriptor() ([]byte, []int) {
+	return file_holos_platform_v1alpha1_platform_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Platform) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *Platform) GetOwner() *Owner {
+	if x != nil {
+		return x.Owner
+	}
+	return nil
+}
+
+func (x *Platform) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *Platform) GetDisplayName() string {
+	if x != nil && x.DisplayName != nil {
+		return *x.DisplayName
+	}
+	return ""
+}
+
+func (x *Platform) GetDescription() string {
+	if x != nil && x.Description != nil {
+		return *x.Description
+	}
+	return ""
+}
+
+func (x *Platform) GetSpec() *Spec {
+	if x != nil {
+		return x.Spec
+	}
+	return nil
+}
+
+func (x *Platform) GetDetail() *v1alpha1.Detail {
+	if x != nil {
+		return x.Detail
+	}
+	return nil
+}
+
+// Owner of a platform.
+type Owner struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Types that are assignable to Owner:
+	//
+	//	*Owner_OrgId
+	Owner isOwner_Owner `protobuf_oneof:"owner"`
+}
+
+func (x *Owner) Reset() {
+	*x = Owner{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_platform_v1alpha1_platform_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Owner) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Owner) ProtoMessage() {}
+
+func (x *Owner) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_platform_v1alpha1_platform_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Owner.ProtoReflect.Descriptor instead.
+func (*Owner) Descriptor() ([]byte, []int) {
+	return file_holos_platform_v1alpha1_platform_proto_rawDescGZIP(), []int{1}
+}
+
+func (m *Owner) GetOwner() isOwner_Owner {
+	if m != nil {
+		return m.Owner
+	}
+	return nil
+}
+
+func (x *Owner) GetOrgId() string {
+	if x, ok := x.GetOwner().(*Owner_OrgId); ok {
+		return x.OrgId
+	}
+	return ""
+}
+
+type isOwner_Owner interface {
+	isOwner_Owner()
+}
+
+type Owner_OrgId struct {
+	OrgId string `protobuf:"bytes,1,opt,name=org_id,json=orgId,proto3,oneof"`
+}
+
+func (*Owner_OrgId) isOwner_Owner() {}
+
+// Spec represents the top level specification of a Platform.
+type Spec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// model represents the user-defined and user-supplied form field values.
+	// The model is a Struct to ensure any valid JSON object defined by the user
+	// via the form can be represented and stored.
+	Model *structpb.Struct `protobuf:"bytes,1,opt,name=model,proto3" json:"model,omitempty"`
+	Form  *Form            `protobuf:"bytes,2,opt,name=form,proto3,oneof" json:"form,omitempty"`
+}
+
+func (x *Spec) Reset() {
+	*x = Spec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_platform_v1alpha1_platform_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Spec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Spec) ProtoMessage() {}
+
+func (x *Spec) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_platform_v1alpha1_platform_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Spec.ProtoReflect.Descriptor instead.
+func (*Spec) Descriptor() ([]byte, []int) {
+	return file_holos_platform_v1alpha1_platform_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *Spec) GetModel() *structpb.Struct {
+	if x != nil {
+		return x.Model
+	}
+	return nil
+}
+
+func (x *Spec) GetForm() *Form {
+	if x != nil {
+		return x.Form
+	}
+	return nil
+}
+
+// Form represents the Formly input form.
+type Form struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// fields represents FormlyFieldConfig[] encoded as an array of JSON objects
+	// organized by section.
+	FieldConfigs []*structpb.Struct `protobuf:"bytes,1,rep,name=field_configs,json=fieldConfigs,proto3" json:"field_configs,omitempty"`
+}
+
+func (x *Form) Reset() {
+	*x = Form{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_platform_v1alpha1_platform_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Form) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Form) ProtoMessage() {}
+
+func (x *Form) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_platform_v1alpha1_platform_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Form.ProtoReflect.Descriptor instead.
+func (*Form) Descriptor() ([]byte, []int) {
+	return file_holos_platform_v1alpha1_platform_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *Form) GetFieldConfigs() []*structpb.Struct {
+	if x != nil {
+		return x.FieldConfigs
+	}
+	return nil
+}
+
+var File_holos_platform_v1alpha1_platform_proto protoreflect.FileDescriptor
+
+var file_holos_platform_v1alpha1_platform_proto_rawDesc = []byte{
+	0x0a, 0x26, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d,
+	0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f,
+	0x72, 0x6d, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x17, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e,
+	0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x1a, 0x1b, 0x62, 0x75, 0x66, 0x2f, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2f,
+	0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1c,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f,
+	0x73, 0x74, 0x72, 0x75, 0x63, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x22, 0x68, 0x6f,
+	0x6c, 0x6f, 0x73, 0x2f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0x2f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x22, 0xe7, 0x07, 0x0a, 0x08, 0x50, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x12, 0x18, 0x0a,
+	0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03,
+	0xb0, 0x01, 0x01, 0x52, 0x02, 0x69, 0x64, 0x12, 0x34, 0x0a, 0x05, 0x6f, 0x77, 0x6e, 0x65, 0x72,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x70,
+	0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
+	0x2e, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x52, 0x05, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x12, 0xf9, 0x02,
+	0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x42, 0xe4, 0x02, 0xba,
+	0x48, 0xe0, 0x02, 0xba, 0x01, 0x4a, 0x0a, 0x14, 0x6e, 0x61, 0x6d, 0x65, 0x2e, 0x6e, 0x6f, 0x5f,
+	0x73, 0x74, 0x61, 0x72, 0x74, 0x5f, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x12, 0x1b, 0x43, 0x61,
+	0x6e, 0x6e, 0x6f, 0x74, 0x20, 0x73, 0x74, 0x61, 0x72, 0x74, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20,
+	0x61, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x2e, 0x1a, 0x15, 0x21, 0x74, 0x68, 0x69, 0x73,
+	0x2e, 0x73, 0x74, 0x61, 0x72, 0x74, 0x73, 0x57, 0x69, 0x74, 0x68, 0x28, 0x27, 0x2d, 0x27, 0x29,
+	0xba, 0x01, 0x44, 0x0a, 0x12, 0x6e, 0x61, 0x6d, 0x65, 0x2e, 0x6e, 0x6f, 0x5f, 0x65, 0x6e, 0x64,
+	0x5f, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x12, 0x19, 0x43, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x20,
+	0x65, 0x6e, 0x64, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x61, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65,
+	0x6e, 0x2e, 0x1a, 0x13, 0x21, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x65, 0x6e, 0x64, 0x73, 0x57, 0x69,
+	0x74, 0x68, 0x28, 0x27, 0x2d, 0x27, 0x29, 0xba, 0x01, 0x58, 0x0a, 0x1b, 0x6e, 0x61, 0x6d, 0x65,
+	0x2e, 0x6e, 0x6f, 0x5f, 0x63, 0x6f, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x74, 0x69, 0x76, 0x65, 0x5f,
+	0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x12, 0x23, 0x43, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x20,
+	0x69, 0x6e, 0x63, 0x6c, 0x75, 0x64, 0x65, 0x20, 0x63, 0x6f, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x74,
+	0x69, 0x76, 0x65, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x2e, 0x1a, 0x14, 0x21, 0x74,
+	0x68, 0x69, 0x73, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x73, 0x28, 0x27, 0x2d, 0x2d,
+	0x27, 0x29, 0xba, 0x01, 0x68, 0x0a, 0x0c, 0x6e, 0x61, 0x6d, 0x65, 0x2e, 0x70, 0x61, 0x74, 0x74,
+	0x65, 0x72, 0x6e, 0x12, 0x37, 0x41, 0x6c, 0x6c, 0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74,
+	0x65, 0x72, 0x73, 0x20, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x62, 0x65, 0x20, 0x65, 0x69, 0x74, 0x68,
+	0x65, 0x72, 0x20, 0x61, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x20, 0x6f, 0x72, 0x20, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65, 0x72, 0x69, 0x63, 0x2e, 0x1a, 0x1f, 0x74, 0x68,
+	0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x41, 0x2d,
+	0x5a, 0x61, 0x2d, 0x7a, 0x30, 0x2d, 0x39, 0x2d, 0x5d, 0x2b, 0x24, 0x27, 0x29, 0x72, 0x04, 0x10,
+	0x01, 0x18, 0x27, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0xb4, 0x02, 0x0a, 0x0c, 0x64, 0x69,
+	0x73, 0x70, 0x6c, 0x61, 0x79, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09,
+	0x42, 0x8b, 0x02, 0xba, 0x48, 0x87, 0x02, 0xba, 0x01, 0x50, 0x0a, 0x1b, 0x64, 0x69, 0x73, 0x70,
+	0x6c, 0x61, 0x79, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x2e, 0x6e, 0x6f, 0x5f, 0x73, 0x74, 0x61, 0x72,
+	0x74, 0x5f, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x1a, 0x43, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x20,
+	0x73, 0x74, 0x61, 0x72, 0x74, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x61, 0x20, 0x73, 0x70, 0x61,
+	0x63, 0x65, 0x2e, 0x1a, 0x15, 0x21, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x73, 0x74, 0x61, 0x72, 0x74,
+	0x73, 0x57, 0x69, 0x74, 0x68, 0x28, 0x27, 0x20, 0x27, 0x29, 0xba, 0x01, 0x4a, 0x0a, 0x19, 0x64,
+	0x69, 0x73, 0x70, 0x6c, 0x61, 0x79, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x2e, 0x6e, 0x6f, 0x5f, 0x65,
+	0x6e, 0x64, 0x5f, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x18, 0x43, 0x61, 0x6e, 0x6e, 0x6f, 0x74,
+	0x20, 0x65, 0x6e, 0x64, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x61, 0x20, 0x73, 0x70, 0x61, 0x63,
+	0x65, 0x2e, 0x1a, 0x13, 0x21, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x65, 0x6e, 0x64, 0x73, 0x57, 0x69,
+	0x74, 0x68, 0x28, 0x27, 0x20, 0x27, 0x29, 0xba, 0x01, 0x5e, 0x0a, 0x22, 0x64, 0x69, 0x73, 0x70,
+	0x6c, 0x61, 0x79, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x2e, 0x6e, 0x6f, 0x5f, 0x63, 0x6f, 0x6e, 0x73,
+	0x65, 0x63, 0x75, 0x74, 0x69, 0x76, 0x65, 0x5f, 0x73, 0x70, 0x61, 0x63, 0x65, 0x73, 0x12, 0x22,
+	0x43, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x20, 0x69, 0x6e, 0x63, 0x6c, 0x75, 0x64, 0x65, 0x20, 0x63,
+	0x6f, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x74, 0x69, 0x76, 0x65, 0x20, 0x73, 0x70, 0x61, 0x63, 0x65,
+	0x73, 0x2e, 0x1a, 0x14, 0x21, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69,
+	0x6e, 0x73, 0x28, 0x27, 0x20, 0x20, 0x27, 0x29, 0x72, 0x04, 0x10, 0x01, 0x18, 0x64, 0x48, 0x00,
+	0x52, 0x0b, 0x64, 0x69, 0x73, 0x70, 0x6c, 0x61, 0x79, 0x4e, 0x61, 0x6d, 0x65, 0x88, 0x01, 0x01,
+	0x12, 0x2f, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18,
+	0x05, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0x18, 0xff, 0x0f, 0x48,
+	0x01, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x88, 0x01,
+	0x01, 0x12, 0x36, 0x0a, 0x04, 0x73, 0x70, 0x65, 0x63, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1d, 0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d,
+	0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x53, 0x70, 0x65, 0x63, 0x48, 0x02,
+	0x52, 0x04, 0x73, 0x70, 0x65, 0x63, 0x88, 0x01, 0x01, 0x12, 0x3a, 0x0a, 0x06, 0x64, 0x65, 0x74,
+	0x61, 0x69, 0x6c, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x68, 0x6f, 0x6c, 0x6f,
+	0x73, 0x2e, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
+	0x31, 0x2e, 0x44, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x48, 0x03, 0x52, 0x06, 0x64, 0x65, 0x74, 0x61,
+	0x69, 0x6c, 0x88, 0x01, 0x01, 0x42, 0x0f, 0x0a, 0x0d, 0x5f, 0x64, 0x69, 0x73, 0x70, 0x6c, 0x61,
+	0x79, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x42, 0x0e, 0x0a, 0x0c, 0x5f, 0x64, 0x65, 0x73, 0x63, 0x72,
+	0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x07, 0x0a, 0x05, 0x5f, 0x73, 0x70, 0x65, 0x63, 0x42,
+	0x09, 0x0a, 0x07, 0x5f, 0x64, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x22, 0x3a, 0x0a, 0x05, 0x4f, 0x77,
+	0x6e, 0x65, 0x72, 0x12, 0x21, 0x0a, 0x06, 0x6f, 0x72, 0x67, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x48, 0x00, 0x52,
+	0x05, 0x6f, 0x72, 0x67, 0x49, 0x64, 0x42, 0x0e, 0x0a, 0x05, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x12,
+	0x05, 0xba, 0x48, 0x02, 0x08, 0x01, 0x22, 0x76, 0x0a, 0x04, 0x53, 0x70, 0x65, 0x63, 0x12, 0x2d,
+	0x0a, 0x05, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
+	0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x52, 0x05, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x12, 0x36, 0x0a,
+	0x04, 0x66, 0x6f, 0x72, 0x6d, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x68, 0x6f,
+	0x6c, 0x6f, 0x73, 0x2e, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x46, 0x6f, 0x72, 0x6d, 0x48, 0x00, 0x52, 0x04, 0x66, 0x6f,
+	0x72, 0x6d, 0x88, 0x01, 0x01, 0x42, 0x07, 0x0a, 0x05, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x22, 0x44,
+	0x0a, 0x04, 0x46, 0x6f, 0x72, 0x6d, 0x12, 0x3c, 0x0a, 0x0d, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x5f,
+	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x17, 0x2e,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
+	0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x52, 0x0c, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x73, 0x42, 0x49, 0x5a, 0x47, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
+	0x6f, 0x6d, 0x2f, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2d, 0x72, 0x75, 0x6e, 0x2f, 0x68, 0x6f, 0x6c,
+	0x6f, 0x73, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x68,
+	0x6f, 0x6c, 0x6f, 0x73, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x76, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x3b, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x62,
+	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_holos_platform_v1alpha1_platform_proto_rawDescOnce sync.Once
+	file_holos_platform_v1alpha1_platform_proto_rawDescData = file_holos_platform_v1alpha1_platform_proto_rawDesc
+)
+
+func file_holos_platform_v1alpha1_platform_proto_rawDescGZIP() []byte {
+	file_holos_platform_v1alpha1_platform_proto_rawDescOnce.Do(func() {
+		file_holos_platform_v1alpha1_platform_proto_rawDescData = protoimpl.X.CompressGZIP(file_holos_platform_v1alpha1_platform_proto_rawDescData)
+	})
+	return file_holos_platform_v1alpha1_platform_proto_rawDescData
+}
+
+var file_holos_platform_v1alpha1_platform_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_holos_platform_v1alpha1_platform_proto_goTypes = []interface{}{
+	(*Platform)(nil),        // 0: holos.platform.v1alpha1.Platform
+	(*Owner)(nil),           // 1: holos.platform.v1alpha1.Owner
+	(*Spec)(nil),            // 2: holos.platform.v1alpha1.Spec
+	(*Form)(nil),            // 3: holos.platform.v1alpha1.Form
+	(*v1alpha1.Detail)(nil), // 4: holos.object.v1alpha1.Detail
+	(*structpb.Struct)(nil), // 5: google.protobuf.Struct
+}
+var file_holos_platform_v1alpha1_platform_proto_depIdxs = []int32{
+	1, // 0: holos.platform.v1alpha1.Platform.owner:type_name -> holos.platform.v1alpha1.Owner
+	2, // 1: holos.platform.v1alpha1.Platform.spec:type_name -> holos.platform.v1alpha1.Spec
+	4, // 2: holos.platform.v1alpha1.Platform.detail:type_name -> holos.object.v1alpha1.Detail
+	5, // 3: holos.platform.v1alpha1.Spec.model:type_name -> google.protobuf.Struct
+	3, // 4: holos.platform.v1alpha1.Spec.form:type_name -> holos.platform.v1alpha1.Form
+	5, // 5: holos.platform.v1alpha1.Form.field_configs:type_name -> google.protobuf.Struct
+	6, // [6:6] is the sub-list for method output_type
+	6, // [6:6] is the sub-list for method input_type
+	6, // [6:6] is the sub-list for extension type_name
+	6, // [6:6] is the sub-list for extension extendee
+	0, // [0:6] is the sub-list for field type_name
+}
+
+func init() { file_holos_platform_v1alpha1_platform_proto_init() }
+func file_holos_platform_v1alpha1_platform_proto_init() {
+	if File_holos_platform_v1alpha1_platform_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_holos_platform_v1alpha1_platform_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Platform); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_holos_platform_v1alpha1_platform_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Owner); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_holos_platform_v1alpha1_platform_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Spec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_holos_platform_v1alpha1_platform_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Form); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_holos_platform_v1alpha1_platform_proto_msgTypes[0].OneofWrappers = []interface{}{}
+	file_holos_platform_v1alpha1_platform_proto_msgTypes[1].OneofWrappers = []interface{}{
+		(*Owner_OrgId)(nil),
+	}
+	file_holos_platform_v1alpha1_platform_proto_msgTypes[2].OneofWrappers = []interface{}{}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_holos_platform_v1alpha1_platform_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   4,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_holos_platform_v1alpha1_platform_proto_goTypes,
+		DependencyIndexes: file_holos_platform_v1alpha1_platform_proto_depIdxs,
+		MessageInfos:      file_holos_platform_v1alpha1_platform_proto_msgTypes,
+	}.Build()
+	File_holos_platform_v1alpha1_platform_proto = out.File
+	file_holos_platform_v1alpha1_platform_proto_rawDesc = nil
+	file_holos_platform_v1alpha1_platform_proto_goTypes = nil
+	file_holos_platform_v1alpha1_platform_proto_depIdxs = nil
+}
--- a/service/gen/holos/platform/v1alpha1/platform_service.pb.go
+++ b/service/gen/holos/platform/v1alpha1/platform_service.pb.go
@@ -0,0 +1,873 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.33.0-devel
+// 	protoc        (unknown)
+// source: holos/platform/v1alpha1/platform_service.proto
+
+package platform
+
+import (
+	_ "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	fieldmaskpb "google.golang.org/protobuf/types/known/fieldmaskpb"
+	structpb "google.golang.org/protobuf/types/known/structpb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type CreatePlatformRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Platform *Platform `protobuf:"bytes,1,opt,name=platform,proto3" json:"platform,omitempty"`
+}
+
+func (x *CreatePlatformRequest) Reset() {
+	*x = CreatePlatformRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_platform_v1alpha1_platform_service_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CreatePlatformRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreatePlatformRequest) ProtoMessage() {}
+
+func (x *CreatePlatformRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_platform_v1alpha1_platform_service_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreatePlatformRequest.ProtoReflect.Descriptor instead.
+func (*CreatePlatformRequest) Descriptor() ([]byte, []int) {
+	return file_holos_platform_v1alpha1_platform_service_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *CreatePlatformRequest) GetPlatform() *Platform {
+	if x != nil {
+		return x.Platform
+	}
+	return nil
+}
+
+type CreatePlatformResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Platform *Platform `protobuf:"bytes,1,opt,name=platform,proto3" json:"platform,omitempty"`
+}
+
+func (x *CreatePlatformResponse) Reset() {
+	*x = CreatePlatformResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_platform_v1alpha1_platform_service_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CreatePlatformResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreatePlatformResponse) ProtoMessage() {}
+
+func (x *CreatePlatformResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_platform_v1alpha1_platform_service_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreatePlatformResponse.ProtoReflect.Descriptor instead.
+func (*CreatePlatformResponse) Descriptor() ([]byte, []int) {
+	return file_holos_platform_v1alpha1_platform_service_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *CreatePlatformResponse) GetPlatform() *Platform {
+	if x != nil {
+		return x.Platform
+	}
+	return nil
+}
+
+type GetPlatformRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	PlatformId string `protobuf:"bytes,1,opt,name=platform_id,json=platformId,proto3" json:"platform_id,omitempty"`
+	// FieldMask represents the response Platform fields to include.
+	FieldMask *fieldmaskpb.FieldMask `protobuf:"bytes,2,opt,name=field_mask,json=fieldMask,proto3" json:"field_mask,omitempty"`
+}
+
+func (x *GetPlatformRequest) Reset() {
+	*x = GetPlatformRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_platform_v1alpha1_platform_service_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetPlatformRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetPlatformRequest) ProtoMessage() {}
+
+func (x *GetPlatformRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_platform_v1alpha1_platform_service_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetPlatformRequest.ProtoReflect.Descriptor instead.
+func (*GetPlatformRequest) Descriptor() ([]byte, []int) {
+	return file_holos_platform_v1alpha1_platform_service_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *GetPlatformRequest) GetPlatformId() string {
+	if x != nil {
+		return x.PlatformId
+	}
+	return ""
+}
+
+func (x *GetPlatformRequest) GetFieldMask() *fieldmaskpb.FieldMask {
+	if x != nil {
+		return x.FieldMask
+	}
+	return nil
+}
+
+type GetPlatformResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Platform *Platform `protobuf:"bytes,1,opt,name=platform,proto3" json:"platform,omitempty"`
+}
+
+func (x *GetPlatformResponse) Reset() {
+	*x = GetPlatformResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_platform_v1alpha1_platform_service_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetPlatformResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetPlatformResponse) ProtoMessage() {}
+
+func (x *GetPlatformResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_platform_v1alpha1_platform_service_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetPlatformResponse.ProtoReflect.Descriptor instead.
+func (*GetPlatformResponse) Descriptor() ([]byte, []int) {
+	return file_holos_platform_v1alpha1_platform_service_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *GetPlatformResponse) GetPlatform() *Platform {
+	if x != nil {
+		return x.Platform
+	}
+	return nil
+}
+
+type UpdatePlatformRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Update operations to perform.  Fields are set to the provided value if
+	// selected by the mask.  Absent fields are cleared if they are selected by
+	// the mask.
+	Update *UpdatePlatformOperation `protobuf:"bytes,1,opt,name=update,proto3" json:"update,omitempty"`
+	// FieldMask represents the mutation operations to perform.  Marked optional
+	// for the nil guard check.  Required.
+	UpdateMask *fieldmaskpb.FieldMask `protobuf:"bytes,2,opt,name=update_mask,json=updateMask,proto3,oneof" json:"update_mask,omitempty"`
+}
+
+func (x *UpdatePlatformRequest) Reset() {
+	*x = UpdatePlatformRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_platform_v1alpha1_platform_service_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UpdatePlatformRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdatePlatformRequest) ProtoMessage() {}
+
+func (x *UpdatePlatformRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_platform_v1alpha1_platform_service_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdatePlatformRequest.ProtoReflect.Descriptor instead.
+func (*UpdatePlatformRequest) Descriptor() ([]byte, []int) {
+	return file_holos_platform_v1alpha1_platform_service_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *UpdatePlatformRequest) GetUpdate() *UpdatePlatformOperation {
+	if x != nil {
+		return x.Update
+	}
+	return nil
+}
+
+func (x *UpdatePlatformRequest) GetUpdateMask() *fieldmaskpb.FieldMask {
+	if x != nil {
+		return x.UpdateMask
+	}
+	return nil
+}
+
+type UpdatePlatformResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Platform *Platform `protobuf:"bytes,1,opt,name=platform,proto3" json:"platform,omitempty"`
+}
+
+func (x *UpdatePlatformResponse) Reset() {
+	*x = UpdatePlatformResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_platform_v1alpha1_platform_service_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UpdatePlatformResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdatePlatformResponse) ProtoMessage() {}
+
+func (x *UpdatePlatformResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_platform_v1alpha1_platform_service_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdatePlatformResponse.ProtoReflect.Descriptor instead.
+func (*UpdatePlatformResponse) Descriptor() ([]byte, []int) {
+	return file_holos_platform_v1alpha1_platform_service_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *UpdatePlatformResponse) GetPlatform() *Platform {
+	if x != nil {
+		return x.Platform
+	}
+	return nil
+}
+
+type ListPlatformsRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	OrgId string `protobuf:"bytes,1,opt,name=org_id,json=orgId,proto3" json:"org_id,omitempty"`
+	// FieldMask represents the response Platform fields to include.
+	FieldMask *fieldmaskpb.FieldMask `protobuf:"bytes,2,opt,name=field_mask,json=fieldMask,proto3" json:"field_mask,omitempty"`
+}
+
+func (x *ListPlatformsRequest) Reset() {
+	*x = ListPlatformsRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_platform_v1alpha1_platform_service_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListPlatformsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListPlatformsRequest) ProtoMessage() {}
+
+func (x *ListPlatformsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_platform_v1alpha1_platform_service_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListPlatformsRequest.ProtoReflect.Descriptor instead.
+func (*ListPlatformsRequest) Descriptor() ([]byte, []int) {
+	return file_holos_platform_v1alpha1_platform_service_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *ListPlatformsRequest) GetOrgId() string {
+	if x != nil {
+		return x.OrgId
+	}
+	return ""
+}
+
+func (x *ListPlatformsRequest) GetFieldMask() *fieldmaskpb.FieldMask {
+	if x != nil {
+		return x.FieldMask
+	}
+	return nil
+}
+
+type ListPlatformsResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Platforms []*Platform `protobuf:"bytes,1,rep,name=platforms,proto3" json:"platforms,omitempty"`
+}
+
+func (x *ListPlatformsResponse) Reset() {
+	*x = ListPlatformsResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_platform_v1alpha1_platform_service_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListPlatformsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListPlatformsResponse) ProtoMessage() {}
+
+func (x *ListPlatformsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_platform_v1alpha1_platform_service_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListPlatformsResponse.ProtoReflect.Descriptor instead.
+func (*ListPlatformsResponse) Descriptor() ([]byte, []int) {
+	return file_holos_platform_v1alpha1_platform_service_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *ListPlatformsResponse) GetPlatforms() []*Platform {
+	if x != nil {
+		return x.Platforms
+	}
+	return nil
+}
+
+type UpdatePlatformOperation struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Platform UUID to update.
+	PlatformId string `protobuf:"bytes,1,opt,name=platform_id,json=platformId,proto3" json:"platform_id,omitempty"`
+	// Update the platform name.
+	Name *string `protobuf:"bytes,2,opt,name=name,proto3,oneof" json:"name,omitempty"`
+	// Update the platform display name.
+	DisplayName *string `protobuf:"bytes,3,opt,name=display_name,json=displayName,proto3,oneof" json:"display_name,omitempty"`
+	// Replace the form model.
+	Model *structpb.Struct `protobuf:"bytes,4,opt,name=model,proto3,oneof" json:"model,omitempty"`
+	// Replace the form.
+	Form *Form `protobuf:"bytes,5,opt,name=form,proto3,oneof" json:"form,omitempty"`
+}
+
+func (x *UpdatePlatformOperation) Reset() {
+	*x = UpdatePlatformOperation{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_platform_v1alpha1_platform_service_proto_msgTypes[8]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UpdatePlatformOperation) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdatePlatformOperation) ProtoMessage() {}
+
+func (x *UpdatePlatformOperation) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_platform_v1alpha1_platform_service_proto_msgTypes[8]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdatePlatformOperation.ProtoReflect.Descriptor instead.
+func (*UpdatePlatformOperation) Descriptor() ([]byte, []int) {
+	return file_holos_platform_v1alpha1_platform_service_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *UpdatePlatformOperation) GetPlatformId() string {
+	if x != nil {
+		return x.PlatformId
+	}
+	return ""
+}
+
+func (x *UpdatePlatformOperation) GetName() string {
+	if x != nil && x.Name != nil {
+		return *x.Name
+	}
+	return ""
+}
+
+func (x *UpdatePlatformOperation) GetDisplayName() string {
+	if x != nil && x.DisplayName != nil {
+		return *x.DisplayName
+	}
+	return ""
+}
+
+func (x *UpdatePlatformOperation) GetModel() *structpb.Struct {
+	if x != nil {
+		return x.Model
+	}
+	return nil
+}
+
+func (x *UpdatePlatformOperation) GetForm() *Form {
+	if x != nil {
+		return x.Form
+	}
+	return nil
+}
+
+var File_holos_platform_v1alpha1_platform_service_proto protoreflect.FileDescriptor
+
+var file_holos_platform_v1alpha1_platform_service_proto_rawDesc = []byte{
+	0x0a, 0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d,
+	0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f,
+	0x72, 0x6d, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x12, 0x17, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d,
+	0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x1a, 0x1b, 0x62, 0x75, 0x66, 0x2f, 0x76,
+	0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2f, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x20, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x5f, 0x6d, 0x61,
+	0x73, 0x6b, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1c, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
+	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x73, 0x74, 0x72, 0x75, 0x63, 0x74,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x26, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2f, 0x70, 0x6c,
+	0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f,
+	0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x56,
+	0x0a, 0x15, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x3d, 0x0a, 0x08, 0x70, 0x6c, 0x61, 0x74, 0x66,
+	0x6f, 0x72, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x68, 0x6f, 0x6c, 0x6f,
+	0x73, 0x2e, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0x2e, 0x50, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x52, 0x08, 0x70, 0x6c,
+	0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x22, 0x57, 0x0a, 0x16, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x50, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x3d, 0x0a, 0x08, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x21, 0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x70, 0x6c, 0x61, 0x74, 0x66,
+	0x6f, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x50, 0x6c, 0x61,
+	0x74, 0x66, 0x6f, 0x72, 0x6d, 0x52, 0x08, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x22,
+	0x7a, 0x0a, 0x12, 0x47, 0x65, 0x74, 0x50, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x29, 0x0a, 0x0b, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72,
+	0x6d, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72,
+	0x03, 0xb0, 0x01, 0x01, 0x52, 0x0a, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x49, 0x64,
+	0x12, 0x39, 0x0a, 0x0a, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x5f, 0x6d, 0x61, 0x73, 0x6b, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4d, 0x61, 0x73, 0x6b,
+	0x52, 0x09, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x4d, 0x61, 0x73, 0x6b, 0x22, 0x54, 0x0a, 0x13, 0x47,
+	0x65, 0x74, 0x50, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x12, 0x3d, 0x0a, 0x08, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x70, 0x6c, 0x61,
+	0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x50,
+	0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x52, 0x08, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72,
+	0x6d, 0x22, 0xb3, 0x01, 0x0a, 0x15, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x50, 0x6c, 0x61, 0x74,
+	0x66, 0x6f, 0x72, 0x6d, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x48, 0x0a, 0x06, 0x75,
+	0x70, 0x64, 0x61, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x68, 0x6f,
+	0x6c, 0x6f, 0x73, 0x2e, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x50, 0x6c, 0x61, 0x74,
+	0x66, 0x6f, 0x72, 0x6d, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x06, 0x75,
+	0x70, 0x64, 0x61, 0x74, 0x65, 0x12, 0x40, 0x0a, 0x0b, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f,
+	0x6d, 0x61, 0x73, 0x6b, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f,
+	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65,
+	0x6c, 0x64, 0x4d, 0x61, 0x73, 0x6b, 0x48, 0x00, 0x52, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65,
+	0x4d, 0x61, 0x73, 0x6b, 0x88, 0x01, 0x01, 0x42, 0x0e, 0x0a, 0x0c, 0x5f, 0x75, 0x70, 0x64, 0x61,
+	0x74, 0x65, 0x5f, 0x6d, 0x61, 0x73, 0x6b, 0x22, 0x57, 0x0a, 0x16, 0x55, 0x70, 0x64, 0x61, 0x74,
+	0x65, 0x50, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x3d, 0x0a, 0x08, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x70, 0x6c, 0x61, 0x74,
+	0x66, 0x6f, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x50, 0x6c,
+	0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x52, 0x08, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d,
+	0x22, 0x72, 0x0a, 0x14, 0x4c, 0x69, 0x73, 0x74, 0x50, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d,
+	0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1f, 0x0a, 0x06, 0x6f, 0x72, 0x67, 0x5f,
+	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0,
+	0x01, 0x01, 0x52, 0x05, 0x6f, 0x72, 0x67, 0x49, 0x64, 0x12, 0x39, 0x0a, 0x0a, 0x66, 0x69, 0x65,
+	0x6c, 0x64, 0x5f, 0x6d, 0x61, 0x73, 0x6b, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
+	0x46, 0x69, 0x65, 0x6c, 0x64, 0x4d, 0x61, 0x73, 0x6b, 0x52, 0x09, 0x66, 0x69, 0x65, 0x6c, 0x64,
+	0x4d, 0x61, 0x73, 0x6b, 0x22, 0x58, 0x0a, 0x15, 0x4c, 0x69, 0x73, 0x74, 0x50, 0x6c, 0x61, 0x74,
+	0x66, 0x6f, 0x72, 0x6d, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3f, 0x0a,
+	0x09, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x21, 0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72,
+	0x6d, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x50, 0x6c, 0x61, 0x74, 0x66,
+	0x6f, 0x72, 0x6d, 0x52, 0x09, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x73, 0x22, 0x95,
+	0x07, 0x0a, 0x17, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x50, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72,
+	0x6d, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x29, 0x0a, 0x0b, 0x70, 0x6c,
+	0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42,
+	0x08, 0xba, 0x48, 0x05, 0x72, 0x03, 0xb0, 0x01, 0x01, 0x52, 0x0a, 0x70, 0x6c, 0x61, 0x74, 0x66,
+	0x6f, 0x72, 0x6d, 0x49, 0x64, 0x12, 0xfe, 0x02, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x42, 0xe4, 0x02, 0xba, 0x48, 0xe0, 0x02, 0xba, 0x01, 0x4a, 0x0a, 0x14,
+	0x6e, 0x61, 0x6d, 0x65, 0x2e, 0x6e, 0x6f, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x5f, 0x68, 0x79,
+	0x70, 0x68, 0x65, 0x6e, 0x12, 0x1b, 0x43, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x20, 0x73, 0x74, 0x61,
+	0x72, 0x74, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x61, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e,
+	0x2e, 0x1a, 0x15, 0x21, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x73, 0x74, 0x61, 0x72, 0x74, 0x73, 0x57,
+	0x69, 0x74, 0x68, 0x28, 0x27, 0x2d, 0x27, 0x29, 0xba, 0x01, 0x44, 0x0a, 0x12, 0x6e, 0x61, 0x6d,
+	0x65, 0x2e, 0x6e, 0x6f, 0x5f, 0x65, 0x6e, 0x64, 0x5f, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x12,
+	0x19, 0x43, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x20, 0x65, 0x6e, 0x64, 0x20, 0x77, 0x69, 0x74, 0x68,
+	0x20, 0x61, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x2e, 0x1a, 0x13, 0x21, 0x74, 0x68, 0x69,
+	0x73, 0x2e, 0x65, 0x6e, 0x64, 0x73, 0x57, 0x69, 0x74, 0x68, 0x28, 0x27, 0x2d, 0x27, 0x29, 0xba,
+	0x01, 0x58, 0x0a, 0x1b, 0x6e, 0x61, 0x6d, 0x65, 0x2e, 0x6e, 0x6f, 0x5f, 0x63, 0x6f, 0x6e, 0x73,
+	0x65, 0x63, 0x75, 0x74, 0x69, 0x76, 0x65, 0x5f, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x12,
+	0x23, 0x43, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x20, 0x69, 0x6e, 0x63, 0x6c, 0x75, 0x64, 0x65, 0x20,
+	0x63, 0x6f, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x74, 0x69, 0x76, 0x65, 0x20, 0x68, 0x79, 0x70, 0x68,
+	0x65, 0x6e, 0x73, 0x2e, 0x1a, 0x14, 0x21, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x63, 0x6f, 0x6e, 0x74,
+	0x61, 0x69, 0x6e, 0x73, 0x28, 0x27, 0x2d, 0x2d, 0x27, 0x29, 0xba, 0x01, 0x68, 0x0a, 0x0c, 0x6e,
+	0x61, 0x6d, 0x65, 0x2e, 0x70, 0x61, 0x74, 0x74, 0x65, 0x72, 0x6e, 0x12, 0x37, 0x41, 0x6c, 0x6c,
+	0x20, 0x63, 0x68, 0x61, 0x72, 0x61, 0x63, 0x74, 0x65, 0x72, 0x73, 0x20, 0x6d, 0x75, 0x73, 0x74,
+	0x20, 0x62, 0x65, 0x20, 0x65, 0x69, 0x74, 0x68, 0x65, 0x72, 0x20, 0x61, 0x20, 0x68, 0x79, 0x70,
+	0x68, 0x65, 0x6e, 0x20, 0x6f, 0x72, 0x20, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x6e, 0x75, 0x6d, 0x65,
+	0x72, 0x69, 0x63, 0x2e, 0x1a, 0x1f, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68,
+	0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x41, 0x2d, 0x5a, 0x61, 0x2d, 0x7a, 0x30, 0x2d, 0x39, 0x2d,
+	0x5d, 0x2b, 0x24, 0x27, 0x29, 0x72, 0x04, 0x10, 0x01, 0x18, 0x27, 0x48, 0x00, 0x52, 0x04, 0x6e,
+	0x61, 0x6d, 0x65, 0x88, 0x01, 0x01, 0x12, 0xb4, 0x02, 0x0a, 0x0c, 0x64, 0x69, 0x73, 0x70, 0x6c,
+	0x61, 0x79, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x42, 0x8b, 0x02,
+	0xba, 0x48, 0x87, 0x02, 0xba, 0x01, 0x50, 0x0a, 0x1b, 0x64, 0x69, 0x73, 0x70, 0x6c, 0x61, 0x79,
+	0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x2e, 0x6e, 0x6f, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x5f, 0x73,
+	0x70, 0x61, 0x63, 0x65, 0x12, 0x1a, 0x43, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x20, 0x73, 0x74, 0x61,
+	0x72, 0x74, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x61, 0x20, 0x73, 0x70, 0x61, 0x63, 0x65, 0x2e,
+	0x1a, 0x15, 0x21, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x73, 0x74, 0x61, 0x72, 0x74, 0x73, 0x57, 0x69,
+	0x74, 0x68, 0x28, 0x27, 0x20, 0x27, 0x29, 0xba, 0x01, 0x4a, 0x0a, 0x19, 0x64, 0x69, 0x73, 0x70,
+	0x6c, 0x61, 0x79, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x2e, 0x6e, 0x6f, 0x5f, 0x65, 0x6e, 0x64, 0x5f,
+	0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x18, 0x43, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x20, 0x65, 0x6e,
+	0x64, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x61, 0x20, 0x73, 0x70, 0x61, 0x63, 0x65, 0x2e, 0x1a,
+	0x13, 0x21, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x65, 0x6e, 0x64, 0x73, 0x57, 0x69, 0x74, 0x68, 0x28,
+	0x27, 0x20, 0x27, 0x29, 0xba, 0x01, 0x5e, 0x0a, 0x22, 0x64, 0x69, 0x73, 0x70, 0x6c, 0x61, 0x79,
+	0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x2e, 0x6e, 0x6f, 0x5f, 0x63, 0x6f, 0x6e, 0x73, 0x65, 0x63, 0x75,
+	0x74, 0x69, 0x76, 0x65, 0x5f, 0x73, 0x70, 0x61, 0x63, 0x65, 0x73, 0x12, 0x22, 0x43, 0x61, 0x6e,
+	0x6e, 0x6f, 0x74, 0x20, 0x69, 0x6e, 0x63, 0x6c, 0x75, 0x64, 0x65, 0x20, 0x63, 0x6f, 0x6e, 0x73,
+	0x65, 0x63, 0x75, 0x74, 0x69, 0x76, 0x65, 0x20, 0x73, 0x70, 0x61, 0x63, 0x65, 0x73, 0x2e, 0x1a,
+	0x14, 0x21, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x73, 0x28,
+	0x27, 0x20, 0x20, 0x27, 0x29, 0x72, 0x04, 0x10, 0x01, 0x18, 0x64, 0x48, 0x01, 0x52, 0x0b, 0x64,
+	0x69, 0x73, 0x70, 0x6c, 0x61, 0x79, 0x4e, 0x61, 0x6d, 0x65, 0x88, 0x01, 0x01, 0x12, 0x32, 0x0a,
+	0x05, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53,
+	0x74, 0x72, 0x75, 0x63, 0x74, 0x48, 0x02, 0x52, 0x05, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x88, 0x01,
+	0x01, 0x12, 0x36, 0x0a, 0x04, 0x66, 0x6f, 0x72, 0x6d, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1d, 0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d,
+	0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x46, 0x6f, 0x72, 0x6d, 0x48, 0x03,
+	0x52, 0x04, 0x66, 0x6f, 0x72, 0x6d, 0x88, 0x01, 0x01, 0x42, 0x07, 0x0a, 0x05, 0x5f, 0x6e, 0x61,
+	0x6d, 0x65, 0x42, 0x0f, 0x0a, 0x0d, 0x5f, 0x64, 0x69, 0x73, 0x70, 0x6c, 0x61, 0x79, 0x5f, 0x6e,
+	0x61, 0x6d, 0x65, 0x42, 0x08, 0x0a, 0x06, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x42, 0x07, 0x0a,
+	0x05, 0x5f, 0x66, 0x6f, 0x72, 0x6d, 0x32, 0xd9, 0x03, 0x0a, 0x0f, 0x50, 0x6c, 0x61, 0x74, 0x66,
+	0x6f, 0x72, 0x6d, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x73, 0x0a, 0x0e, 0x43, 0x72,
+	0x65, 0x61, 0x74, 0x65, 0x50, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x12, 0x2e, 0x2e, 0x68,
+	0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2e, 0x76, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x6c, 0x61,
+	0x74, 0x66, 0x6f, 0x72, 0x6d, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2f, 0x2e, 0x68,
+	0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2e, 0x76, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x6c, 0x61,
+	0x74, 0x66, 0x6f, 0x72, 0x6d, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12,
+	0x6a, 0x0a, 0x0b, 0x47, 0x65, 0x74, 0x50, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x12, 0x2b,
+	0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2e,
+	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x50, 0x6c, 0x61, 0x74,
+	0x66, 0x6f, 0x72, 0x6d, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c, 0x2e, 0x68, 0x6f,
+	0x6c, 0x6f, 0x73, 0x2e, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2e, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x50, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72,
+	0x6d, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x73, 0x0a, 0x0e, 0x55,
+	0x70, 0x64, 0x61, 0x74, 0x65, 0x50, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x12, 0x2e, 0x2e,
+	0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2e, 0x76,
+	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x50, 0x6c,
+	0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2f, 0x2e,
+	0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2e, 0x76,
+	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x50, 0x6c,
+	0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00,
+	0x12, 0x70, 0x0a, 0x0d, 0x4c, 0x69, 0x73, 0x74, 0x50, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d,
+	0x73, 0x12, 0x2d, 0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f,
+	0x72, 0x6d, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74,
+	0x50, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x2e, 0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72,
+	0x6d, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x50,
+	0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x22, 0x00, 0x42, 0x49, 0x5a, 0x47, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d,
+	0x2f, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2d, 0x72, 0x75, 0x6e, 0x2f, 0x68, 0x6f, 0x6c, 0x6f, 0x73,
+	0x2f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x68, 0x6f, 0x6c,
+	0x6f, 0x73, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x2f, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0x3b, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x62, 0x06, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_holos_platform_v1alpha1_platform_service_proto_rawDescOnce sync.Once
+	file_holos_platform_v1alpha1_platform_service_proto_rawDescData = file_holos_platform_v1alpha1_platform_service_proto_rawDesc
+)
+
+func file_holos_platform_v1alpha1_platform_service_proto_rawDescGZIP() []byte {
+	file_holos_platform_v1alpha1_platform_service_proto_rawDescOnce.Do(func() {
+		file_holos_platform_v1alpha1_platform_service_proto_rawDescData = protoimpl.X.CompressGZIP(file_holos_platform_v1alpha1_platform_service_proto_rawDescData)
+	})
+	return file_holos_platform_v1alpha1_platform_service_proto_rawDescData
+}
+
+var file_holos_platform_v1alpha1_platform_service_proto_msgTypes = make([]protoimpl.MessageInfo, 9)
+var file_holos_platform_v1alpha1_platform_service_proto_goTypes = []interface{}{
+	(*CreatePlatformRequest)(nil),   // 0: holos.platform.v1alpha1.CreatePlatformRequest
+	(*CreatePlatformResponse)(nil),  // 1: holos.platform.v1alpha1.CreatePlatformResponse
+	(*GetPlatformRequest)(nil),      // 2: holos.platform.v1alpha1.GetPlatformRequest
+	(*GetPlatformResponse)(nil),     // 3: holos.platform.v1alpha1.GetPlatformResponse
+	(*UpdatePlatformRequest)(nil),   // 4: holos.platform.v1alpha1.UpdatePlatformRequest
+	(*UpdatePlatformResponse)(nil),  // 5: holos.platform.v1alpha1.UpdatePlatformResponse
+	(*ListPlatformsRequest)(nil),    // 6: holos.platform.v1alpha1.ListPlatformsRequest
+	(*ListPlatformsResponse)(nil),   // 7: holos.platform.v1alpha1.ListPlatformsResponse
+	(*UpdatePlatformOperation)(nil), // 8: holos.platform.v1alpha1.UpdatePlatformOperation
+	(*Platform)(nil),                // 9: holos.platform.v1alpha1.Platform
+	(*fieldmaskpb.FieldMask)(nil),   // 10: google.protobuf.FieldMask
+	(*structpb.Struct)(nil),         // 11: google.protobuf.Struct
+	(*Form)(nil),                    // 12: holos.platform.v1alpha1.Form
+}
+var file_holos_platform_v1alpha1_platform_service_proto_depIdxs = []int32{
+	9,  // 0: holos.platform.v1alpha1.CreatePlatformRequest.platform:type_name -> holos.platform.v1alpha1.Platform
+	9,  // 1: holos.platform.v1alpha1.CreatePlatformResponse.platform:type_name -> holos.platform.v1alpha1.Platform
+	10, // 2: holos.platform.v1alpha1.GetPlatformRequest.field_mask:type_name -> google.protobuf.FieldMask
+	9,  // 3: holos.platform.v1alpha1.GetPlatformResponse.platform:type_name -> holos.platform.v1alpha1.Platform
+	8,  // 4: holos.platform.v1alpha1.UpdatePlatformRequest.update:type_name -> holos.platform.v1alpha1.UpdatePlatformOperation
+	10, // 5: holos.platform.v1alpha1.UpdatePlatformRequest.update_mask:type_name -> google.protobuf.FieldMask
+	9,  // 6: holos.platform.v1alpha1.UpdatePlatformResponse.platform:type_name -> holos.platform.v1alpha1.Platform
+	10, // 7: holos.platform.v1alpha1.ListPlatformsRequest.field_mask:type_name -> google.protobuf.FieldMask
+	9,  // 8: holos.platform.v1alpha1.ListPlatformsResponse.platforms:type_name -> holos.platform.v1alpha1.Platform
+	11, // 9: holos.platform.v1alpha1.UpdatePlatformOperation.model:type_name -> google.protobuf.Struct
+	12, // 10: holos.platform.v1alpha1.UpdatePlatformOperation.form:type_name -> holos.platform.v1alpha1.Form
+	0,  // 11: holos.platform.v1alpha1.PlatformService.CreatePlatform:input_type -> holos.platform.v1alpha1.CreatePlatformRequest
+	2,  // 12: holos.platform.v1alpha1.PlatformService.GetPlatform:input_type -> holos.platform.v1alpha1.GetPlatformRequest
+	4,  // 13: holos.platform.v1alpha1.PlatformService.UpdatePlatform:input_type -> holos.platform.v1alpha1.UpdatePlatformRequest
+	6,  // 14: holos.platform.v1alpha1.PlatformService.ListPlatforms:input_type -> holos.platform.v1alpha1.ListPlatformsRequest
+	1,  // 15: holos.platform.v1alpha1.PlatformService.CreatePlatform:output_type -> holos.platform.v1alpha1.CreatePlatformResponse
+	3,  // 16: holos.platform.v1alpha1.PlatformService.GetPlatform:output_type -> holos.platform.v1alpha1.GetPlatformResponse
+	5,  // 17: holos.platform.v1alpha1.PlatformService.UpdatePlatform:output_type -> holos.platform.v1alpha1.UpdatePlatformResponse
+	7,  // 18: holos.platform.v1alpha1.PlatformService.ListPlatforms:output_type -> holos.platform.v1alpha1.ListPlatformsResponse
+	15, // [15:19] is the sub-list for method output_type
+	11, // [11:15] is the sub-list for method input_type
+	11, // [11:11] is the sub-list for extension type_name
+	11, // [11:11] is the sub-list for extension extendee
+	0,  // [0:11] is the sub-list for field type_name
+}
+
+func init() { file_holos_platform_v1alpha1_platform_service_proto_init() }
+func file_holos_platform_v1alpha1_platform_service_proto_init() {
+	if File_holos_platform_v1alpha1_platform_service_proto != nil {
+		return
+	}
+	file_holos_platform_v1alpha1_platform_proto_init()
+	if !protoimpl.UnsafeEnabled {
+		file_holos_platform_v1alpha1_platform_service_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CreatePlatformRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_holos_platform_v1alpha1_platform_service_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CreatePlatformResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_holos_platform_v1alpha1_platform_service_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetPlatformRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_holos_platform_v1alpha1_platform_service_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetPlatformResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_holos_platform_v1alpha1_platform_service_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UpdatePlatformRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_holos_platform_v1alpha1_platform_service_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UpdatePlatformResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_holos_platform_v1alpha1_platform_service_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ListPlatformsRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_holos_platform_v1alpha1_platform_service_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ListPlatformsResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_holos_platform_v1alpha1_platform_service_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UpdatePlatformOperation); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_holos_platform_v1alpha1_platform_service_proto_msgTypes[4].OneofWrappers = []interface{}{}
+	file_holos_platform_v1alpha1_platform_service_proto_msgTypes[8].OneofWrappers = []interface{}{}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_holos_platform_v1alpha1_platform_service_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   9,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_holos_platform_v1alpha1_platform_service_proto_goTypes,
+		DependencyIndexes: file_holos_platform_v1alpha1_platform_service_proto_depIdxs,
+		MessageInfos:      file_holos_platform_v1alpha1_platform_service_proto_msgTypes,
+	}.Build()
+	File_holos_platform_v1alpha1_platform_service_proto = out.File
+	file_holos_platform_v1alpha1_platform_service_proto_rawDesc = nil
+	file_holos_platform_v1alpha1_platform_service_proto_goTypes = nil
+	file_holos_platform_v1alpha1_platform_service_proto_depIdxs = nil
+}
--- a/service/gen/holos/platform/v1alpha1/platformconnect/platform_service.connect.go
+++ b/service/gen/holos/platform/v1alpha1/platformconnect/platform_service.connect.go
@@ -0,0 +1,204 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: holos/platform/v1alpha1/platform_service.proto
+
+package platformconnect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1alpha1 "github.com/holos-run/holos/service/gen/holos/platform/v1alpha1"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// PlatformServiceName is the fully-qualified name of the PlatformService service.
+	PlatformServiceName = "holos.platform.v1alpha1.PlatformService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// PlatformServiceCreatePlatformProcedure is the fully-qualified name of the PlatformService's
+	// CreatePlatform RPC.
+	PlatformServiceCreatePlatformProcedure = "/holos.platform.v1alpha1.PlatformService/CreatePlatform"
+	// PlatformServiceGetPlatformProcedure is the fully-qualified name of the PlatformService's
+	// GetPlatform RPC.
+	PlatformServiceGetPlatformProcedure = "/holos.platform.v1alpha1.PlatformService/GetPlatform"
+	// PlatformServiceUpdatePlatformProcedure is the fully-qualified name of the PlatformService's
+	// UpdatePlatform RPC.
+	PlatformServiceUpdatePlatformProcedure = "/holos.platform.v1alpha1.PlatformService/UpdatePlatform"
+	// PlatformServiceListPlatformsProcedure is the fully-qualified name of the PlatformService's
+	// ListPlatforms RPC.
+	PlatformServiceListPlatformsProcedure = "/holos.platform.v1alpha1.PlatformService/ListPlatforms"
+)
+
+// These variables are the protoreflect.Descriptor objects for the RPCs defined in this package.
+var (
+	platformServiceServiceDescriptor              = v1alpha1.File_holos_platform_v1alpha1_platform_service_proto.Services().ByName("PlatformService")
+	platformServiceCreatePlatformMethodDescriptor = platformServiceServiceDescriptor.Methods().ByName("CreatePlatform")
+	platformServiceGetPlatformMethodDescriptor    = platformServiceServiceDescriptor.Methods().ByName("GetPlatform")
+	platformServiceUpdatePlatformMethodDescriptor = platformServiceServiceDescriptor.Methods().ByName("UpdatePlatform")
+	platformServiceListPlatformsMethodDescriptor  = platformServiceServiceDescriptor.Methods().ByName("ListPlatforms")
+)
+
+// PlatformServiceClient is a client for the holos.platform.v1alpha1.PlatformService service.
+type PlatformServiceClient interface {
+	CreatePlatform(context.Context, *connect.Request[v1alpha1.CreatePlatformRequest]) (*connect.Response[v1alpha1.CreatePlatformResponse], error)
+	GetPlatform(context.Context, *connect.Request[v1alpha1.GetPlatformRequest]) (*connect.Response[v1alpha1.GetPlatformResponse], error)
+	UpdatePlatform(context.Context, *connect.Request[v1alpha1.UpdatePlatformRequest]) (*connect.Response[v1alpha1.UpdatePlatformResponse], error)
+	ListPlatforms(context.Context, *connect.Request[v1alpha1.ListPlatformsRequest]) (*connect.Response[v1alpha1.ListPlatformsResponse], error)
+}
+
+// NewPlatformServiceClient constructs a client for the holos.platform.v1alpha1.PlatformService
+// service. By default, it uses the Connect protocol with the binary Protobuf Codec, asks for
+// gzipped responses, and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply
+// the connect.WithGRPC() or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewPlatformServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) PlatformServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	return &platformServiceClient{
+		createPlatform: connect.NewClient[v1alpha1.CreatePlatformRequest, v1alpha1.CreatePlatformResponse](
+			httpClient,
+			baseURL+PlatformServiceCreatePlatformProcedure,
+			connect.WithSchema(platformServiceCreatePlatformMethodDescriptor),
+			connect.WithClientOptions(opts...),
+		),
+		getPlatform: connect.NewClient[v1alpha1.GetPlatformRequest, v1alpha1.GetPlatformResponse](
+			httpClient,
+			baseURL+PlatformServiceGetPlatformProcedure,
+			connect.WithSchema(platformServiceGetPlatformMethodDescriptor),
+			connect.WithClientOptions(opts...),
+		),
+		updatePlatform: connect.NewClient[v1alpha1.UpdatePlatformRequest, v1alpha1.UpdatePlatformResponse](
+			httpClient,
+			baseURL+PlatformServiceUpdatePlatformProcedure,
+			connect.WithSchema(platformServiceUpdatePlatformMethodDescriptor),
+			connect.WithClientOptions(opts...),
+		),
+		listPlatforms: connect.NewClient[v1alpha1.ListPlatformsRequest, v1alpha1.ListPlatformsResponse](
+			httpClient,
+			baseURL+PlatformServiceListPlatformsProcedure,
+			connect.WithSchema(platformServiceListPlatformsMethodDescriptor),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// platformServiceClient implements PlatformServiceClient.
+type platformServiceClient struct {
+	createPlatform *connect.Client[v1alpha1.CreatePlatformRequest, v1alpha1.CreatePlatformResponse]
+	getPlatform    *connect.Client[v1alpha1.GetPlatformRequest, v1alpha1.GetPlatformResponse]
+	updatePlatform *connect.Client[v1alpha1.UpdatePlatformRequest, v1alpha1.UpdatePlatformResponse]
+	listPlatforms  *connect.Client[v1alpha1.ListPlatformsRequest, v1alpha1.ListPlatformsResponse]
+}
+
+// CreatePlatform calls holos.platform.v1alpha1.PlatformService.CreatePlatform.
+func (c *platformServiceClient) CreatePlatform(ctx context.Context, req *connect.Request[v1alpha1.CreatePlatformRequest]) (*connect.Response[v1alpha1.CreatePlatformResponse], error) {
+	return c.createPlatform.CallUnary(ctx, req)
+}
+
+// GetPlatform calls holos.platform.v1alpha1.PlatformService.GetPlatform.
+func (c *platformServiceClient) GetPlatform(ctx context.Context, req *connect.Request[v1alpha1.GetPlatformRequest]) (*connect.Response[v1alpha1.GetPlatformResponse], error) {
+	return c.getPlatform.CallUnary(ctx, req)
+}
+
+// UpdatePlatform calls holos.platform.v1alpha1.PlatformService.UpdatePlatform.
+func (c *platformServiceClient) UpdatePlatform(ctx context.Context, req *connect.Request[v1alpha1.UpdatePlatformRequest]) (*connect.Response[v1alpha1.UpdatePlatformResponse], error) {
+	return c.updatePlatform.CallUnary(ctx, req)
+}
+
+// ListPlatforms calls holos.platform.v1alpha1.PlatformService.ListPlatforms.
+func (c *platformServiceClient) ListPlatforms(ctx context.Context, req *connect.Request[v1alpha1.ListPlatformsRequest]) (*connect.Response[v1alpha1.ListPlatformsResponse], error) {
+	return c.listPlatforms.CallUnary(ctx, req)
+}
+
+// PlatformServiceHandler is an implementation of the holos.platform.v1alpha1.PlatformService
+// service.
+type PlatformServiceHandler interface {
+	CreatePlatform(context.Context, *connect.Request[v1alpha1.CreatePlatformRequest]) (*connect.Response[v1alpha1.CreatePlatformResponse], error)
+	GetPlatform(context.Context, *connect.Request[v1alpha1.GetPlatformRequest]) (*connect.Response[v1alpha1.GetPlatformResponse], error)
+	UpdatePlatform(context.Context, *connect.Request[v1alpha1.UpdatePlatformRequest]) (*connect.Response[v1alpha1.UpdatePlatformResponse], error)
+	ListPlatforms(context.Context, *connect.Request[v1alpha1.ListPlatformsRequest]) (*connect.Response[v1alpha1.ListPlatformsResponse], error)
+}
+
+// NewPlatformServiceHandler builds an HTTP handler from the service implementation. It returns the
+// path on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewPlatformServiceHandler(svc PlatformServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	platformServiceCreatePlatformHandler := connect.NewUnaryHandler(
+		PlatformServiceCreatePlatformProcedure,
+		svc.CreatePlatform,
+		connect.WithSchema(platformServiceCreatePlatformMethodDescriptor),
+		connect.WithHandlerOptions(opts...),
+	)
+	platformServiceGetPlatformHandler := connect.NewUnaryHandler(
+		PlatformServiceGetPlatformProcedure,
+		svc.GetPlatform,
+		connect.WithSchema(platformServiceGetPlatformMethodDescriptor),
+		connect.WithHandlerOptions(opts...),
+	)
+	platformServiceUpdatePlatformHandler := connect.NewUnaryHandler(
+		PlatformServiceUpdatePlatformProcedure,
+		svc.UpdatePlatform,
+		connect.WithSchema(platformServiceUpdatePlatformMethodDescriptor),
+		connect.WithHandlerOptions(opts...),
+	)
+	platformServiceListPlatformsHandler := connect.NewUnaryHandler(
+		PlatformServiceListPlatformsProcedure,
+		svc.ListPlatforms,
+		connect.WithSchema(platformServiceListPlatformsMethodDescriptor),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/holos.platform.v1alpha1.PlatformService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case PlatformServiceCreatePlatformProcedure:
+			platformServiceCreatePlatformHandler.ServeHTTP(w, r)
+		case PlatformServiceGetPlatformProcedure:
+			platformServiceGetPlatformHandler.ServeHTTP(w, r)
+		case PlatformServiceUpdatePlatformProcedure:
+			platformServiceUpdatePlatformHandler.ServeHTTP(w, r)
+		case PlatformServiceListPlatformsProcedure:
+			platformServiceListPlatformsHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedPlatformServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedPlatformServiceHandler struct{}
+
+func (UnimplementedPlatformServiceHandler) CreatePlatform(context.Context, *connect.Request[v1alpha1.CreatePlatformRequest]) (*connect.Response[v1alpha1.CreatePlatformResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("holos.platform.v1alpha1.PlatformService.CreatePlatform is not implemented"))
+}
+
+func (UnimplementedPlatformServiceHandler) GetPlatform(context.Context, *connect.Request[v1alpha1.GetPlatformRequest]) (*connect.Response[v1alpha1.GetPlatformResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("holos.platform.v1alpha1.PlatformService.GetPlatform is not implemented"))
+}
+
+func (UnimplementedPlatformServiceHandler) UpdatePlatform(context.Context, *connect.Request[v1alpha1.UpdatePlatformRequest]) (*connect.Response[v1alpha1.UpdatePlatformResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("holos.platform.v1alpha1.PlatformService.UpdatePlatform is not implemented"))
+}
+
+func (UnimplementedPlatformServiceHandler) ListPlatforms(context.Context, *connect.Request[v1alpha1.ListPlatformsRequest]) (*connect.Response[v1alpha1.ListPlatformsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("holos.platform.v1alpha1.PlatformService.ListPlatforms is not implemented"))
+}
--- a/service/gen/holos/storage/v1alpha1/storage.pb.go
+++ b/service/gen/holos/storage/v1alpha1/storage.pb.go
@@ -0,0 +1,225 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.33.0-devel
+// 	protoc        (unknown)
+// source: holos/storage/v1alpha1/storage.proto
+
+package storage
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	structpb "google.golang.org/protobuf/types/known/structpb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Model represents user-defined and user-supplied form field values stored as a
+// marshaled JSON object.  The model is a Struct to ensure any valid JSON object
+// defined by the user via the form can be represented and stored.
+type Model struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Model *structpb.Struct `protobuf:"bytes,1,opt,name=model,proto3" json:"model,omitempty"`
+}
+
+func (x *Model) Reset() {
+	*x = Model{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_storage_v1alpha1_storage_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Model) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Model) ProtoMessage() {}
+
+func (x *Model) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_storage_v1alpha1_storage_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Model.ProtoReflect.Descriptor instead.
+func (*Model) Descriptor() ([]byte, []int) {
+	return file_holos_storage_v1alpha1_storage_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Model) GetModel() *structpb.Struct {
+	if x != nil {
+		return x.Model
+	}
+	return nil
+}
+
+// Form represents the Formly input form stored as a marshaled JSON object.
+type Form struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// fields represents FormlyFieldConfig[] encoded as an array of JSON objects
+	// organized by section.
+	FieldConfigs []*structpb.Struct `protobuf:"bytes,1,rep,name=field_configs,json=fieldConfigs,proto3" json:"field_configs,omitempty"`
+}
+
+func (x *Form) Reset() {
+	*x = Form{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_storage_v1alpha1_storage_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Form) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Form) ProtoMessage() {}
+
+func (x *Form) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_storage_v1alpha1_storage_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Form.ProtoReflect.Descriptor instead.
+func (*Form) Descriptor() ([]byte, []int) {
+	return file_holos_storage_v1alpha1_storage_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *Form) GetFieldConfigs() []*structpb.Struct {
+	if x != nil {
+		return x.FieldConfigs
+	}
+	return nil
+}
+
+var File_holos_storage_v1alpha1_storage_proto protoreflect.FileDescriptor
+
+var file_holos_storage_v1alpha1_storage_proto_rawDesc = []byte{
+	0x0a, 0x24, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2f,
+	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x16, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x73, 0x74,
+	0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x1a, 0x1c,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f,
+	0x73, 0x74, 0x72, 0x75, 0x63, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x36, 0x0a, 0x05,
+	0x4d, 0x6f, 0x64, 0x65, 0x6c, 0x12, 0x2d, 0x0a, 0x05, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x52, 0x05, 0x6d,
+	0x6f, 0x64, 0x65, 0x6c, 0x22, 0x44, 0x0a, 0x04, 0x46, 0x6f, 0x72, 0x6d, 0x12, 0x3c, 0x0a, 0x0d,
+	0x66, 0x69, 0x65, 0x6c, 0x64, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x18, 0x01, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x52, 0x0c, 0x66, 0x69,
+	0x65, 0x6c, 0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x42, 0x41, 0x5a, 0x3f, 0x67, 0x69,
+	0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2d, 0x72,
+	0x75, 0x6e, 0x2f, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2f, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x3b, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x62, 0x06, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_holos_storage_v1alpha1_storage_proto_rawDescOnce sync.Once
+	file_holos_storage_v1alpha1_storage_proto_rawDescData = file_holos_storage_v1alpha1_storage_proto_rawDesc
+)
+
+func file_holos_storage_v1alpha1_storage_proto_rawDescGZIP() []byte {
+	file_holos_storage_v1alpha1_storage_proto_rawDescOnce.Do(func() {
+		file_holos_storage_v1alpha1_storage_proto_rawDescData = protoimpl.X.CompressGZIP(file_holos_storage_v1alpha1_storage_proto_rawDescData)
+	})
+	return file_holos_storage_v1alpha1_storage_proto_rawDescData
+}
+
+var file_holos_storage_v1alpha1_storage_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_holos_storage_v1alpha1_storage_proto_goTypes = []interface{}{
+	(*Model)(nil),           // 0: holos.storage.v1alpha1.Model
+	(*Form)(nil),            // 1: holos.storage.v1alpha1.Form
+	(*structpb.Struct)(nil), // 2: google.protobuf.Struct
+}
+var file_holos_storage_v1alpha1_storage_proto_depIdxs = []int32{
+	2, // 0: holos.storage.v1alpha1.Model.model:type_name -> google.protobuf.Struct
+	2, // 1: holos.storage.v1alpha1.Form.field_configs:type_name -> google.protobuf.Struct
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_holos_storage_v1alpha1_storage_proto_init() }
+func file_holos_storage_v1alpha1_storage_proto_init() {
+	if File_holos_storage_v1alpha1_storage_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_holos_storage_v1alpha1_storage_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Model); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_holos_storage_v1alpha1_storage_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Form); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_holos_storage_v1alpha1_storage_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_holos_storage_v1alpha1_storage_proto_goTypes,
+		DependencyIndexes: file_holos_storage_v1alpha1_storage_proto_depIdxs,
+		MessageInfos:      file_holos_storage_v1alpha1_storage_proto_msgTypes,
+	}.Build()
+	File_holos_storage_v1alpha1_storage_proto = out.File
+	file_holos_storage_v1alpha1_storage_proto_rawDesc = nil
+	file_holos_storage_v1alpha1_storage_proto_goTypes = nil
+	file_holos_storage_v1alpha1_storage_proto_depIdxs = nil
+}
--- a/service/gen/holos/system/v1alpha1/system_service.pb.go
+++ b/service/gen/holos/system/v1alpha1/system_service.pb.go
@@ -0,0 +1,313 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.33.0-devel
+// 	protoc        (unknown)
+// source: holos/system/v1alpha1/system_service.proto
+
+package system
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type SeedDatabaseRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *SeedDatabaseRequest) Reset() {
+	*x = SeedDatabaseRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_system_v1alpha1_system_service_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SeedDatabaseRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SeedDatabaseRequest) ProtoMessage() {}
+
+func (x *SeedDatabaseRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_system_v1alpha1_system_service_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SeedDatabaseRequest.ProtoReflect.Descriptor instead.
+func (*SeedDatabaseRequest) Descriptor() ([]byte, []int) {
+	return file_holos_system_v1alpha1_system_service_proto_rawDescGZIP(), []int{0}
+}
+
+type SeedDatabaseResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *SeedDatabaseResponse) Reset() {
+	*x = SeedDatabaseResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_system_v1alpha1_system_service_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SeedDatabaseResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SeedDatabaseResponse) ProtoMessage() {}
+
+func (x *SeedDatabaseResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_system_v1alpha1_system_service_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SeedDatabaseResponse.ProtoReflect.Descriptor instead.
+func (*SeedDatabaseResponse) Descriptor() ([]byte, []int) {
+	return file_holos_system_v1alpha1_system_service_proto_rawDescGZIP(), []int{1}
+}
+
+type DropTablesRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *DropTablesRequest) Reset() {
+	*x = DropTablesRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_system_v1alpha1_system_service_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DropTablesRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DropTablesRequest) ProtoMessage() {}
+
+func (x *DropTablesRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_system_v1alpha1_system_service_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DropTablesRequest.ProtoReflect.Descriptor instead.
+func (*DropTablesRequest) Descriptor() ([]byte, []int) {
+	return file_holos_system_v1alpha1_system_service_proto_rawDescGZIP(), []int{2}
+}
+
+type DropTablesResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *DropTablesResponse) Reset() {
+	*x = DropTablesResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_system_v1alpha1_system_service_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DropTablesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DropTablesResponse) ProtoMessage() {}
+
+func (x *DropTablesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_system_v1alpha1_system_service_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DropTablesResponse.ProtoReflect.Descriptor instead.
+func (*DropTablesResponse) Descriptor() ([]byte, []int) {
+	return file_holos_system_v1alpha1_system_service_proto_rawDescGZIP(), []int{3}
+}
+
+var File_holos_system_v1alpha1_system_service_proto protoreflect.FileDescriptor
+
+var file_holos_system_v1alpha1_system_service_proto_rawDesc = []byte{
+	0x0a, 0x2a, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2f, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x2f, 0x76,
+	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x5f, 0x73,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x15, 0x68, 0x6f,
+	0x6c, 0x6f, 0x73, 0x2e, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0x22, 0x15, 0x0a, 0x13, 0x53, 0x65, 0x65, 0x64, 0x44, 0x61, 0x74, 0x61, 0x62,
+	0x61, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x16, 0x0a, 0x14, 0x53, 0x65,
+	0x65, 0x64, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x22, 0x13, 0x0a, 0x11, 0x44, 0x72, 0x6f, 0x70, 0x54, 0x61, 0x62, 0x6c, 0x65, 0x73,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x14, 0x0a, 0x12, 0x44, 0x72, 0x6f, 0x70, 0x54,
+	0x61, 0x62, 0x6c, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x32, 0xdf, 0x01,
+	0x0a, 0x0d, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12,
+	0x69, 0x0a, 0x0c, 0x53, 0x65, 0x65, 0x64, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x12,
+	0x2a, 0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x2e, 0x76,
+	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x53, 0x65, 0x65, 0x64, 0x44, 0x61, 0x74, 0x61,
+	0x62, 0x61, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2b, 0x2e, 0x68, 0x6f,
+	0x6c, 0x6f, 0x73, 0x2e, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0x2e, 0x53, 0x65, 0x65, 0x64, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x63, 0x0a, 0x0a, 0x44, 0x72,
+	0x6f, 0x70, 0x54, 0x61, 0x62, 0x6c, 0x65, 0x73, 0x12, 0x28, 0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73,
+	0x2e, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
+	0x2e, 0x44, 0x72, 0x6f, 0x70, 0x54, 0x61, 0x62, 0x6c, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x29, 0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x73, 0x79, 0x73, 0x74, 0x65,
+	0x6d, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x44, 0x72, 0x6f, 0x70, 0x54,
+	0x61, 0x62, 0x6c, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42,
+	0x45, 0x5a, 0x43, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x6f,
+	0x6c, 0x6f, 0x73, 0x2d, 0x72, 0x75, 0x6e, 0x2f, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2f, 0x73, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2f,
+	0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x3b,
+	0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_holos_system_v1alpha1_system_service_proto_rawDescOnce sync.Once
+	file_holos_system_v1alpha1_system_service_proto_rawDescData = file_holos_system_v1alpha1_system_service_proto_rawDesc
+)
+
+func file_holos_system_v1alpha1_system_service_proto_rawDescGZIP() []byte {
+	file_holos_system_v1alpha1_system_service_proto_rawDescOnce.Do(func() {
+		file_holos_system_v1alpha1_system_service_proto_rawDescData = protoimpl.X.CompressGZIP(file_holos_system_v1alpha1_system_service_proto_rawDescData)
+	})
+	return file_holos_system_v1alpha1_system_service_proto_rawDescData
+}
+
+var file_holos_system_v1alpha1_system_service_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_holos_system_v1alpha1_system_service_proto_goTypes = []interface{}{
+	(*SeedDatabaseRequest)(nil),  // 0: holos.system.v1alpha1.SeedDatabaseRequest
+	(*SeedDatabaseResponse)(nil), // 1: holos.system.v1alpha1.SeedDatabaseResponse
+	(*DropTablesRequest)(nil),    // 2: holos.system.v1alpha1.DropTablesRequest
+	(*DropTablesResponse)(nil),   // 3: holos.system.v1alpha1.DropTablesResponse
+}
+var file_holos_system_v1alpha1_system_service_proto_depIdxs = []int32{
+	0, // 0: holos.system.v1alpha1.SystemService.SeedDatabase:input_type -> holos.system.v1alpha1.SeedDatabaseRequest
+	2, // 1: holos.system.v1alpha1.SystemService.DropTables:input_type -> holos.system.v1alpha1.DropTablesRequest
+	1, // 2: holos.system.v1alpha1.SystemService.SeedDatabase:output_type -> holos.system.v1alpha1.SeedDatabaseResponse
+	3, // 3: holos.system.v1alpha1.SystemService.DropTables:output_type -> holos.system.v1alpha1.DropTablesResponse
+	2, // [2:4] is the sub-list for method output_type
+	0, // [0:2] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_holos_system_v1alpha1_system_service_proto_init() }
+func file_holos_system_v1alpha1_system_service_proto_init() {
+	if File_holos_system_v1alpha1_system_service_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_holos_system_v1alpha1_system_service_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SeedDatabaseRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_holos_system_v1alpha1_system_service_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SeedDatabaseResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_holos_system_v1alpha1_system_service_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DropTablesRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_holos_system_v1alpha1_system_service_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DropTablesResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_holos_system_v1alpha1_system_service_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   4,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_holos_system_v1alpha1_system_service_proto_goTypes,
+		DependencyIndexes: file_holos_system_v1alpha1_system_service_proto_depIdxs,
+		MessageInfos:      file_holos_system_v1alpha1_system_service_proto_msgTypes,
+	}.Build()
+	File_holos_system_v1alpha1_system_service_proto = out.File
+	file_holos_system_v1alpha1_system_service_proto_rawDesc = nil
+	file_holos_system_v1alpha1_system_service_proto_goTypes = nil
+	file_holos_system_v1alpha1_system_service_proto_depIdxs = nil
+}
--- a/service/gen/holos/system/v1alpha1/systemconnect/system_service.connect.go
+++ b/service/gen/holos/system/v1alpha1/systemconnect/system_service.connect.go
@@ -0,0 +1,143 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: holos/system/v1alpha1/system_service.proto
+
+package systemconnect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1alpha1 "github.com/holos-run/holos/service/gen/holos/system/v1alpha1"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// SystemServiceName is the fully-qualified name of the SystemService service.
+	SystemServiceName = "holos.system.v1alpha1.SystemService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// SystemServiceSeedDatabaseProcedure is the fully-qualified name of the SystemService's
+	// SeedDatabase RPC.
+	SystemServiceSeedDatabaseProcedure = "/holos.system.v1alpha1.SystemService/SeedDatabase"
+	// SystemServiceDropTablesProcedure is the fully-qualified name of the SystemService's DropTables
+	// RPC.
+	SystemServiceDropTablesProcedure = "/holos.system.v1alpha1.SystemService/DropTables"
+)
+
+// These variables are the protoreflect.Descriptor objects for the RPCs defined in this package.
+var (
+	systemServiceServiceDescriptor            = v1alpha1.File_holos_system_v1alpha1_system_service_proto.Services().ByName("SystemService")
+	systemServiceSeedDatabaseMethodDescriptor = systemServiceServiceDescriptor.Methods().ByName("SeedDatabase")
+	systemServiceDropTablesMethodDescriptor   = systemServiceServiceDescriptor.Methods().ByName("DropTables")
+)
+
+// SystemServiceClient is a client for the holos.system.v1alpha1.SystemService service.
+type SystemServiceClient interface {
+	SeedDatabase(context.Context, *connect.Request[v1alpha1.SeedDatabaseRequest]) (*connect.Response[v1alpha1.SeedDatabaseResponse], error)
+	DropTables(context.Context, *connect.Request[v1alpha1.DropTablesRequest]) (*connect.Response[v1alpha1.DropTablesResponse], error)
+}
+
+// NewSystemServiceClient constructs a client for the holos.system.v1alpha1.SystemService service.
+// By default, it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped
+// responses, and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the
+// connect.WithGRPC() or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewSystemServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) SystemServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	return &systemServiceClient{
+		seedDatabase: connect.NewClient[v1alpha1.SeedDatabaseRequest, v1alpha1.SeedDatabaseResponse](
+			httpClient,
+			baseURL+SystemServiceSeedDatabaseProcedure,
+			connect.WithSchema(systemServiceSeedDatabaseMethodDescriptor),
+			connect.WithClientOptions(opts...),
+		),
+		dropTables: connect.NewClient[v1alpha1.DropTablesRequest, v1alpha1.DropTablesResponse](
+			httpClient,
+			baseURL+SystemServiceDropTablesProcedure,
+			connect.WithSchema(systemServiceDropTablesMethodDescriptor),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// systemServiceClient implements SystemServiceClient.
+type systemServiceClient struct {
+	seedDatabase *connect.Client[v1alpha1.SeedDatabaseRequest, v1alpha1.SeedDatabaseResponse]
+	dropTables   *connect.Client[v1alpha1.DropTablesRequest, v1alpha1.DropTablesResponse]
+}
+
+// SeedDatabase calls holos.system.v1alpha1.SystemService.SeedDatabase.
+func (c *systemServiceClient) SeedDatabase(ctx context.Context, req *connect.Request[v1alpha1.SeedDatabaseRequest]) (*connect.Response[v1alpha1.SeedDatabaseResponse], error) {
+	return c.seedDatabase.CallUnary(ctx, req)
+}
+
+// DropTables calls holos.system.v1alpha1.SystemService.DropTables.
+func (c *systemServiceClient) DropTables(ctx context.Context, req *connect.Request[v1alpha1.DropTablesRequest]) (*connect.Response[v1alpha1.DropTablesResponse], error) {
+	return c.dropTables.CallUnary(ctx, req)
+}
+
+// SystemServiceHandler is an implementation of the holos.system.v1alpha1.SystemService service.
+type SystemServiceHandler interface {
+	SeedDatabase(context.Context, *connect.Request[v1alpha1.SeedDatabaseRequest]) (*connect.Response[v1alpha1.SeedDatabaseResponse], error)
+	DropTables(context.Context, *connect.Request[v1alpha1.DropTablesRequest]) (*connect.Response[v1alpha1.DropTablesResponse], error)
+}
+
+// NewSystemServiceHandler builds an HTTP handler from the service implementation. It returns the
+// path on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewSystemServiceHandler(svc SystemServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	systemServiceSeedDatabaseHandler := connect.NewUnaryHandler(
+		SystemServiceSeedDatabaseProcedure,
+		svc.SeedDatabase,
+		connect.WithSchema(systemServiceSeedDatabaseMethodDescriptor),
+		connect.WithHandlerOptions(opts...),
+	)
+	systemServiceDropTablesHandler := connect.NewUnaryHandler(
+		SystemServiceDropTablesProcedure,
+		svc.DropTables,
+		connect.WithSchema(systemServiceDropTablesMethodDescriptor),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/holos.system.v1alpha1.SystemService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case SystemServiceSeedDatabaseProcedure:
+			systemServiceSeedDatabaseHandler.ServeHTTP(w, r)
+		case SystemServiceDropTablesProcedure:
+			systemServiceDropTablesHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedSystemServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedSystemServiceHandler struct{}
+
+func (UnimplementedSystemServiceHandler) SeedDatabase(context.Context, *connect.Request[v1alpha1.SeedDatabaseRequest]) (*connect.Response[v1alpha1.SeedDatabaseResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("holos.system.v1alpha1.SystemService.SeedDatabase is not implemented"))
+}
+
+func (UnimplementedSystemServiceHandler) DropTables(context.Context, *connect.Request[v1alpha1.DropTablesRequest]) (*connect.Response[v1alpha1.DropTablesResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("holos.system.v1alpha1.SystemService.DropTables is not implemented"))
+}
--- a/service/gen/holos/user/v1alpha1/user.pb.go
+++ b/service/gen/holos/user/v1alpha1/user.pb.go
@@ -0,0 +1,310 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.33.0-devel
+// 	protoc        (unknown)
+// source: holos/user/v1alpha1/user.proto
+
+package user
+
+import (
+	_ "buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go/buf/validate"
+	v1alpha1 "github.com/holos-run/holos/service/gen/holos/object/v1alpha1"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// User represents a human user of the system.
+type User struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Unique uuid assigned by the server.
+	Id *string `protobuf:"bytes,1,opt,name=id,proto3,oneof" json:"id,omitempty"`
+	// Subject represents the oidc iss and sub claims of the user.
+	Subject *v1alpha1.Subject `protobuf:"bytes,2,opt,name=subject,proto3,oneof" json:"subject,omitempty"`
+	// Email address of the user.
+	Email string `protobuf:"bytes,3,opt,name=email,proto3" json:"email,omitempty"`
+	// True if the user email has been verified.
+	EmailVerified *bool `protobuf:"varint,4,opt,name=email_verified,json=emailVerified,proto3,oneof" json:"email_verified,omitempty"`
+	// Full name provided by the user.
+	Name *string `protobuf:"bytes,5,opt,name=name,proto3,oneof" json:"name,omitempty"`
+	// Given or first name of the user.
+	GivenName *string `protobuf:"bytes,6,opt,name=given_name,json=givenName,proto3,oneof" json:"given_name,omitempty"`
+	// Family or last name of the user.
+	FamilyName *string `protobuf:"bytes,7,opt,name=family_name,json=familyName,proto3,oneof" json:"family_name,omitempty"`
+	// Groups the user is a member of.  This field represents the oidc groups
+	// claim.
+	Groups []string `protobuf:"bytes,8,rep,name=groups,proto3" json:"groups,omitempty"`
+	// https url to an user avatar profile picture.  Should be at least a 200x200 px square image.
+	Picture *string `protobuf:"bytes,9,opt,name=picture,proto3,oneof" json:"picture,omitempty"`
+	// Detail applicable to all resource objects in the system such as created and
+	// updated metadata.
+	Detail *v1alpha1.Detail `protobuf:"bytes,10,opt,name=detail,proto3,oneof" json:"detail,omitempty"`
+}
+
+func (x *User) Reset() {
+	*x = User{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_user_v1alpha1_user_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *User) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*User) ProtoMessage() {}
+
+func (x *User) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_user_v1alpha1_user_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use User.ProtoReflect.Descriptor instead.
+func (*User) Descriptor() ([]byte, []int) {
+	return file_holos_user_v1alpha1_user_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *User) GetId() string {
+	if x != nil && x.Id != nil {
+		return *x.Id
+	}
+	return ""
+}
+
+func (x *User) GetSubject() *v1alpha1.Subject {
+	if x != nil {
+		return x.Subject
+	}
+	return nil
+}
+
+func (x *User) GetEmail() string {
+	if x != nil {
+		return x.Email
+	}
+	return ""
+}
+
+func (x *User) GetEmailVerified() bool {
+	if x != nil && x.EmailVerified != nil {
+		return *x.EmailVerified
+	}
+	return false
+}
+
+func (x *User) GetName() string {
+	if x != nil && x.Name != nil {
+		return *x.Name
+	}
+	return ""
+}
+
+func (x *User) GetGivenName() string {
+	if x != nil && x.GivenName != nil {
+		return *x.GivenName
+	}
+	return ""
+}
+
+func (x *User) GetFamilyName() string {
+	if x != nil && x.FamilyName != nil {
+		return *x.FamilyName
+	}
+	return ""
+}
+
+func (x *User) GetGroups() []string {
+	if x != nil {
+		return x.Groups
+	}
+	return nil
+}
+
+func (x *User) GetPicture() string {
+	if x != nil && x.Picture != nil {
+		return *x.Picture
+	}
+	return ""
+}
+
+func (x *User) GetDetail() *v1alpha1.Detail {
+	if x != nil {
+		return x.Detail
+	}
+	return nil
+}
+
+var File_holos_user_v1alpha1_user_proto protoreflect.FileDescriptor
+
+var file_holos_user_v1alpha1_user_proto_rawDesc = []byte{
+	0x0a, 0x1e, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x2f, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x12, 0x13, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x2e, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x1a, 0x1b, 0x62, 0x75, 0x66, 0x2f, 0x76, 0x61, 0x6c, 0x69, 0x64,
+	0x61, 0x74, 0x65, 0x2f, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x1a, 0x22, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74,
+	0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xdb, 0x08, 0x0a, 0x04, 0x55, 0x73, 0x65, 0x72, 0x12,
+	0x1d, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x08, 0xba, 0x48, 0x05,
+	0x72, 0x03, 0xb0, 0x01, 0x01, 0x48, 0x00, 0x52, 0x02, 0x69, 0x64, 0x88, 0x01, 0x01, 0x12, 0x3d,
+	0x0a, 0x07, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1e, 0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x2e, 0x76,
+	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x53, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x48,
+	0x01, 0x52, 0x07, 0x73, 0x75, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x88, 0x01, 0x01, 0x12, 0x1d, 0x0a,
+	0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x42, 0x07, 0xba, 0x48,
+	0x04, 0x72, 0x02, 0x60, 0x01, 0x52, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x2a, 0x0a, 0x0e,
+	0x65, 0x6d, 0x61, 0x69, 0x6c, 0x5f, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x65, 0x64, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x08, 0x48, 0x02, 0x52, 0x0d, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x56, 0x65, 0x72,
+	0x69, 0x66, 0x69, 0x65, 0x64, 0x88, 0x01, 0x01, 0x12, 0xde, 0x01, 0x0a, 0x04, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x42, 0xc4, 0x01, 0xba, 0x48, 0xc0, 0x01, 0xba, 0x01,
+	0x5a, 0x0a, 0x1a, 0x6e, 0x61, 0x6d, 0x65, 0x2e, 0x6e, 0x6f, 0x5f, 0x6c, 0x65, 0x61, 0x64, 0x69,
+	0x6e, 0x67, 0x5f, 0x77, 0x68, 0x69, 0x74, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x1d, 0x43,
+	0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x20, 0x73, 0x74, 0x61, 0x72, 0x74, 0x20, 0x77, 0x69, 0x74, 0x68,
+	0x20, 0x77, 0x68, 0x69, 0x74, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x2e, 0x1a, 0x1d, 0x21, 0x74,
+	0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x5b,
+	0x3a, 0x73, 0x70, 0x61, 0x63, 0x65, 0x3a, 0x5d, 0x5d, 0x27, 0x29, 0xba, 0x01, 0x59, 0x0a, 0x1b,
+	0x6e, 0x61, 0x6d, 0x65, 0x2e, 0x6e, 0x6f, 0x5f, 0x74, 0x72, 0x61, 0x69, 0x6c, 0x69, 0x6e, 0x67,
+	0x5f, 0x77, 0x68, 0x69, 0x74, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x1b, 0x43, 0x61, 0x6e,
+	0x6e, 0x6f, 0x74, 0x20, 0x65, 0x6e, 0x64, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x77, 0x68, 0x69,
+	0x74, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x2e, 0x1a, 0x1d, 0x21, 0x74, 0x68, 0x69, 0x73, 0x2e,
+	0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5b, 0x5b, 0x3a, 0x73, 0x70, 0x61, 0x63,
+	0x65, 0x3a, 0x5d, 0x5d, 0x24, 0x27, 0x29, 0x72, 0x05, 0x10, 0x01, 0x18, 0xff, 0x01, 0x48, 0x03,
+	0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x88, 0x01, 0x01, 0x12, 0xe9, 0x01, 0x0a, 0x0a, 0x67, 0x69,
+	0x76, 0x65, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x42, 0xc4,
+	0x01, 0xba, 0x48, 0xc0, 0x01, 0xba, 0x01, 0x5a, 0x0a, 0x1a, 0x6e, 0x61, 0x6d, 0x65, 0x2e, 0x6e,
+	0x6f, 0x5f, 0x6c, 0x65, 0x61, 0x64, 0x69, 0x6e, 0x67, 0x5f, 0x77, 0x68, 0x69, 0x74, 0x65, 0x73,
+	0x70, 0x61, 0x63, 0x65, 0x12, 0x1d, 0x43, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x20, 0x73, 0x74, 0x61,
+	0x72, 0x74, 0x20, 0x77, 0x69, 0x74, 0x68, 0x20, 0x77, 0x68, 0x69, 0x74, 0x65, 0x73, 0x70, 0x61,
+	0x63, 0x65, 0x2e, 0x1a, 0x1d, 0x21, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68,
+	0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x5b, 0x3a, 0x73, 0x70, 0x61, 0x63, 0x65, 0x3a, 0x5d, 0x5d,
+	0x27, 0x29, 0xba, 0x01, 0x59, 0x0a, 0x1b, 0x6e, 0x61, 0x6d, 0x65, 0x2e, 0x6e, 0x6f, 0x5f, 0x74,
+	0x72, 0x61, 0x69, 0x6c, 0x69, 0x6e, 0x67, 0x5f, 0x77, 0x68, 0x69, 0x74, 0x65, 0x73, 0x70, 0x61,
+	0x63, 0x65, 0x12, 0x1b, 0x43, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x20, 0x65, 0x6e, 0x64, 0x20, 0x77,
+	0x69, 0x74, 0x68, 0x20, 0x77, 0x68, 0x69, 0x74, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x2e, 0x1a,
+	0x1d, 0x21, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27,
+	0x5b, 0x5b, 0x3a, 0x73, 0x70, 0x61, 0x63, 0x65, 0x3a, 0x5d, 0x5d, 0x24, 0x27, 0x29, 0x72, 0x05,
+	0x10, 0x01, 0x18, 0xff, 0x01, 0x48, 0x04, 0x52, 0x09, 0x67, 0x69, 0x76, 0x65, 0x6e, 0x4e, 0x61,
+	0x6d, 0x65, 0x88, 0x01, 0x01, 0x12, 0xeb, 0x01, 0x0a, 0x0b, 0x66, 0x61, 0x6d, 0x69, 0x6c, 0x79,
+	0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x42, 0xc4, 0x01, 0xba, 0x48,
+	0xc0, 0x01, 0xba, 0x01, 0x5a, 0x0a, 0x1a, 0x6e, 0x61, 0x6d, 0x65, 0x2e, 0x6e, 0x6f, 0x5f, 0x6c,
+	0x65, 0x61, 0x64, 0x69, 0x6e, 0x67, 0x5f, 0x77, 0x68, 0x69, 0x74, 0x65, 0x73, 0x70, 0x61, 0x63,
+	0x65, 0x12, 0x1d, 0x43, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x20, 0x73, 0x74, 0x61, 0x72, 0x74, 0x20,
+	0x77, 0x69, 0x74, 0x68, 0x20, 0x77, 0x68, 0x69, 0x74, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x2e,
+	0x1a, 0x1d, 0x21, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28,
+	0x27, 0x5e, 0x5b, 0x5b, 0x3a, 0x73, 0x70, 0x61, 0x63, 0x65, 0x3a, 0x5d, 0x5d, 0x27, 0x29, 0xba,
+	0x01, 0x59, 0x0a, 0x1b, 0x6e, 0x61, 0x6d, 0x65, 0x2e, 0x6e, 0x6f, 0x5f, 0x74, 0x72, 0x61, 0x69,
+	0x6c, 0x69, 0x6e, 0x67, 0x5f, 0x77, 0x68, 0x69, 0x74, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12,
+	0x1b, 0x43, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x20, 0x65, 0x6e, 0x64, 0x20, 0x77, 0x69, 0x74, 0x68,
+	0x20, 0x77, 0x68, 0x69, 0x74, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x2e, 0x1a, 0x1d, 0x21, 0x74,
+	0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5b, 0x5b, 0x3a,
+	0x73, 0x70, 0x61, 0x63, 0x65, 0x3a, 0x5d, 0x5d, 0x24, 0x27, 0x29, 0x72, 0x05, 0x10, 0x01, 0x18,
+	0xff, 0x01, 0x48, 0x05, 0x52, 0x0a, 0x66, 0x61, 0x6d, 0x69, 0x6c, 0x79, 0x4e, 0x61, 0x6d, 0x65,
+	0x88, 0x01, 0x01, 0x12, 0x16, 0x0a, 0x06, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x08, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x06, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x36, 0x0a, 0x07, 0x70,
+	0x69, 0x63, 0x74, 0x75, 0x72, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x42, 0x17, 0xba, 0x48,
+	0x14, 0x72, 0x12, 0x10, 0x01, 0x18, 0xff, 0x0f, 0x3a, 0x08, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a,
+	0x2f, 0x2f, 0x88, 0x01, 0x01, 0x48, 0x06, 0x52, 0x07, 0x70, 0x69, 0x63, 0x74, 0x75, 0x72, 0x65,
+	0x88, 0x01, 0x01, 0x12, 0x3a, 0x0a, 0x06, 0x64, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x18, 0x0a, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x6f, 0x62, 0x6a, 0x65,
+	0x63, 0x74, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x44, 0x65, 0x74, 0x61,
+	0x69, 0x6c, 0x48, 0x07, 0x52, 0x06, 0x64, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x88, 0x01, 0x01, 0x42,
+	0x05, 0x0a, 0x03, 0x5f, 0x69, 0x64, 0x42, 0x0a, 0x0a, 0x08, 0x5f, 0x73, 0x75, 0x62, 0x6a, 0x65,
+	0x63, 0x74, 0x42, 0x11, 0x0a, 0x0f, 0x5f, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x5f, 0x76, 0x65, 0x72,
+	0x69, 0x66, 0x69, 0x65, 0x64, 0x42, 0x07, 0x0a, 0x05, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x42, 0x0d,
+	0x0a, 0x0b, 0x5f, 0x67, 0x69, 0x76, 0x65, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x42, 0x0e, 0x0a,
+	0x0c, 0x5f, 0x66, 0x61, 0x6d, 0x69, 0x6c, 0x79, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x42, 0x0a, 0x0a,
+	0x08, 0x5f, 0x70, 0x69, 0x63, 0x74, 0x75, 0x72, 0x65, 0x42, 0x09, 0x0a, 0x07, 0x5f, 0x64, 0x65,
+	0x74, 0x61, 0x69, 0x6c, 0x42, 0x41, 0x5a, 0x3f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
+	0x6f, 0x6d, 0x2f, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2d, 0x72, 0x75, 0x6e, 0x2f, 0x68, 0x6f, 0x6c,
+	0x6f, 0x73, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x68,
+	0x6f, 0x6c, 0x6f, 0x73, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0x3b, 0x75, 0x73, 0x65, 0x72, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_holos_user_v1alpha1_user_proto_rawDescOnce sync.Once
+	file_holos_user_v1alpha1_user_proto_rawDescData = file_holos_user_v1alpha1_user_proto_rawDesc
+)
+
+func file_holos_user_v1alpha1_user_proto_rawDescGZIP() []byte {
+	file_holos_user_v1alpha1_user_proto_rawDescOnce.Do(func() {
+		file_holos_user_v1alpha1_user_proto_rawDescData = protoimpl.X.CompressGZIP(file_holos_user_v1alpha1_user_proto_rawDescData)
+	})
+	return file_holos_user_v1alpha1_user_proto_rawDescData
+}
+
+var file_holos_user_v1alpha1_user_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_holos_user_v1alpha1_user_proto_goTypes = []interface{}{
+	(*User)(nil),             // 0: holos.user.v1alpha1.User
+	(*v1alpha1.Subject)(nil), // 1: holos.object.v1alpha1.Subject
+	(*v1alpha1.Detail)(nil),  // 2: holos.object.v1alpha1.Detail
+}
+var file_holos_user_v1alpha1_user_proto_depIdxs = []int32{
+	1, // 0: holos.user.v1alpha1.User.subject:type_name -> holos.object.v1alpha1.Subject
+	2, // 1: holos.user.v1alpha1.User.detail:type_name -> holos.object.v1alpha1.Detail
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_holos_user_v1alpha1_user_proto_init() }
+func file_holos_user_v1alpha1_user_proto_init() {
+	if File_holos_user_v1alpha1_user_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_holos_user_v1alpha1_user_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*User); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_holos_user_v1alpha1_user_proto_msgTypes[0].OneofWrappers = []interface{}{}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_holos_user_v1alpha1_user_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_holos_user_v1alpha1_user_proto_goTypes,
+		DependencyIndexes: file_holos_user_v1alpha1_user_proto_depIdxs,
+		MessageInfos:      file_holos_user_v1alpha1_user_proto_msgTypes,
+	}.Build()
+	File_holos_user_v1alpha1_user_proto = out.File
+	file_holos_user_v1alpha1_user_proto_rawDesc = nil
+	file_holos_user_v1alpha1_user_proto_goTypes = nil
+	file_holos_user_v1alpha1_user_proto_depIdxs = nil
+}
--- a/service/gen/holos/user/v1alpha1/user_service.pb.go
+++ b/service/gen/holos/user/v1alpha1/user_service.pb.go
@@ -0,0 +1,398 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.33.0-devel
+// 	protoc        (unknown)
+// source: holos/user/v1alpha1/user_service.proto
+
+package user
+
+import (
+	v1alpha1 "github.com/holos-run/holos/service/gen/holos/object/v1alpha1"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	fieldmaskpb "google.golang.org/protobuf/types/known/fieldmaskpb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Create a User from the oidc id token claims or the provided user.  Each one
+// of subject, email, and user id must be globally unique.
+type CreateUserRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// User resource to create.  If absent, the server populates User fields with
+	// the oidc id token claims of the authenticated request.
+	User *User `protobuf:"bytes,1,opt,name=user,proto3,oneof" json:"user,omitempty"`
+}
+
+func (x *CreateUserRequest) Reset() {
+	*x = CreateUserRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_user_v1alpha1_user_service_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CreateUserRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateUserRequest) ProtoMessage() {}
+
+func (x *CreateUserRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_user_v1alpha1_user_service_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateUserRequest.ProtoReflect.Descriptor instead.
+func (*CreateUserRequest) Descriptor() ([]byte, []int) {
+	return file_holos_user_v1alpha1_user_service_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *CreateUserRequest) GetUser() *User {
+	if x != nil {
+		return x.User
+	}
+	return nil
+}
+
+type CreateUserResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	User *User `protobuf:"bytes,1,opt,name=user,proto3" json:"user,omitempty"`
+}
+
+func (x *CreateUserResponse) Reset() {
+	*x = CreateUserResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_user_v1alpha1_user_service_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CreateUserResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateUserResponse) ProtoMessage() {}
+
+func (x *CreateUserResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_user_v1alpha1_user_service_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateUserResponse.ProtoReflect.Descriptor instead.
+func (*CreateUserResponse) Descriptor() ([]byte, []int) {
+	return file_holos_user_v1alpha1_user_service_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *CreateUserResponse) GetUser() *User {
+	if x != nil {
+		return x.User
+	}
+	return nil
+}
+
+type GetUserRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// UserRef represents the user to return in the response.
+	User *v1alpha1.UserRef `protobuf:"bytes,1,opt,name=user,proto3" json:"user,omitempty"`
+	// FieldMask represents the response User fields to include.
+	FieldMask *fieldmaskpb.FieldMask `protobuf:"bytes,2,opt,name=field_mask,json=fieldMask,proto3,oneof" json:"field_mask,omitempty"`
+}
+
+func (x *GetUserRequest) Reset() {
+	*x = GetUserRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_user_v1alpha1_user_service_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetUserRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetUserRequest) ProtoMessage() {}
+
+func (x *GetUserRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_user_v1alpha1_user_service_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetUserRequest.ProtoReflect.Descriptor instead.
+func (*GetUserRequest) Descriptor() ([]byte, []int) {
+	return file_holos_user_v1alpha1_user_service_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *GetUserRequest) GetUser() *v1alpha1.UserRef {
+	if x != nil {
+		return x.User
+	}
+	return nil
+}
+
+func (x *GetUserRequest) GetFieldMask() *fieldmaskpb.FieldMask {
+	if x != nil {
+		return x.FieldMask
+	}
+	return nil
+}
+
+type GetUserResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	User *User `protobuf:"bytes,1,opt,name=user,proto3" json:"user,omitempty"`
+}
+
+func (x *GetUserResponse) Reset() {
+	*x = GetUserResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_holos_user_v1alpha1_user_service_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetUserResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetUserResponse) ProtoMessage() {}
+
+func (x *GetUserResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_holos_user_v1alpha1_user_service_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetUserResponse.ProtoReflect.Descriptor instead.
+func (*GetUserResponse) Descriptor() ([]byte, []int) {
+	return file_holos_user_v1alpha1_user_service_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *GetUserResponse) GetUser() *User {
+	if x != nil {
+		return x.User
+	}
+	return nil
+}
+
+var File_holos_user_v1alpha1_user_service_proto protoreflect.FileDescriptor
+
+var file_holos_user_v1alpha1_user_service_proto_rawDesc = []byte{
+	0x0a, 0x26, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x2f, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x13, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e,
+	0x75, 0x73, 0x65, 0x72, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x1a, 0x1e, 0x68,
+	0x6f, 0x6c, 0x6f, 0x73, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x20, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x66,
+	0x69, 0x65, 0x6c, 0x64, 0x5f, 0x6d, 0x61, 0x73, 0x6b, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a,
+	0x22, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x2f, 0x76, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x22, 0x50, 0x0a, 0x11, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x55, 0x73, 0x65,
+	0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x32, 0x0a, 0x04, 0x75, 0x73, 0x65, 0x72,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x75,
+	0x73, 0x65, 0x72, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x55, 0x73, 0x65,
+	0x72, 0x48, 0x00, 0x52, 0x04, 0x75, 0x73, 0x65, 0x72, 0x88, 0x01, 0x01, 0x42, 0x07, 0x0a, 0x05,
+	0x5f, 0x75, 0x73, 0x65, 0x72, 0x22, 0x43, 0x0a, 0x12, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x55,
+	0x73, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2d, 0x0a, 0x04, 0x75,
+	0x73, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x68, 0x6f, 0x6c, 0x6f,
+	0x73, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e,
+	0x55, 0x73, 0x65, 0x72, 0x52, 0x04, 0x75, 0x73, 0x65, 0x72, 0x22, 0x93, 0x01, 0x0a, 0x0e, 0x47,
+	0x65, 0x74, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x32, 0x0a,
+	0x04, 0x75, 0x73, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x68, 0x6f,
+	0x6c, 0x6f, 0x73, 0x2e, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x66, 0x52, 0x04, 0x75, 0x73, 0x65,
+	0x72, 0x12, 0x3e, 0x0a, 0x0a, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x5f, 0x6d, 0x61, 0x73, 0x6b, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4d, 0x61, 0x73,
+	0x6b, 0x48, 0x00, 0x52, 0x09, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x4d, 0x61, 0x73, 0x6b, 0x88, 0x01,
+	0x01, 0x42, 0x0d, 0x0a, 0x0b, 0x5f, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x5f, 0x6d, 0x61, 0x73, 0x6b,
+	0x22, 0x40, 0x0a, 0x0f, 0x47, 0x65, 0x74, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x2d, 0x0a, 0x04, 0x75, 0x73, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x19, 0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x2e, 0x76,
+	0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x52, 0x04, 0x75, 0x73,
+	0x65, 0x72, 0x32, 0xc6, 0x01, 0x0a, 0x0b, 0x55, 0x73, 0x65, 0x72, 0x53, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x12, 0x5f, 0x0a, 0x0a, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72,
+	0x12, 0x26, 0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x2e, 0x76, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x55, 0x73, 0x65,
+	0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x27, 0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73,
+	0x2e, 0x75, 0x73, 0x65, 0x72, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x43,
+	0x72, 0x65, 0x61, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x22, 0x00, 0x12, 0x56, 0x0a, 0x07, 0x47, 0x65, 0x74, 0x55, 0x73, 0x65, 0x72, 0x12, 0x23,
+	0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x2e, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2e, 0x75, 0x73, 0x65, 0x72,
+	0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x55, 0x73, 0x65,
+	0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0x41, 0x5a, 0x3f, 0x67,
+	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2d,
+	0x72, 0x75, 0x6e, 0x2f, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x68, 0x6f, 0x6c, 0x6f, 0x73, 0x2f, 0x75, 0x73, 0x65, 0x72,
+	0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x3b, 0x75, 0x73, 0x65, 0x72, 0x62, 0x06,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_holos_user_v1alpha1_user_service_proto_rawDescOnce sync.Once
+	file_holos_user_v1alpha1_user_service_proto_rawDescData = file_holos_user_v1alpha1_user_service_proto_rawDesc
+)
+
+func file_holos_user_v1alpha1_user_service_proto_rawDescGZIP() []byte {
+	file_holos_user_v1alpha1_user_service_proto_rawDescOnce.Do(func() {
+		file_holos_user_v1alpha1_user_service_proto_rawDescData = protoimpl.X.CompressGZIP(file_holos_user_v1alpha1_user_service_proto_rawDescData)
+	})
+	return file_holos_user_v1alpha1_user_service_proto_rawDescData
+}
+
+var file_holos_user_v1alpha1_user_service_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_holos_user_v1alpha1_user_service_proto_goTypes = []interface{}{
+	(*CreateUserRequest)(nil),     // 0: holos.user.v1alpha1.CreateUserRequest
+	(*CreateUserResponse)(nil),    // 1: holos.user.v1alpha1.CreateUserResponse
+	(*GetUserRequest)(nil),        // 2: holos.user.v1alpha1.GetUserRequest
+	(*GetUserResponse)(nil),       // 3: holos.user.v1alpha1.GetUserResponse
+	(*User)(nil),                  // 4: holos.user.v1alpha1.User
+	(*v1alpha1.UserRef)(nil),      // 5: holos.object.v1alpha1.UserRef
+	(*fieldmaskpb.FieldMask)(nil), // 6: google.protobuf.FieldMask
+}
+var file_holos_user_v1alpha1_user_service_proto_depIdxs = []int32{
+	4, // 0: holos.user.v1alpha1.CreateUserRequest.user:type_name -> holos.user.v1alpha1.User
+	4, // 1: holos.user.v1alpha1.CreateUserResponse.user:type_name -> holos.user.v1alpha1.User
+	5, // 2: holos.user.v1alpha1.GetUserRequest.user:type_name -> holos.object.v1alpha1.UserRef
+	6, // 3: holos.user.v1alpha1.GetUserRequest.field_mask:type_name -> google.protobuf.FieldMask
+	4, // 4: holos.user.v1alpha1.GetUserResponse.user:type_name -> holos.user.v1alpha1.User
+	0, // 5: holos.user.v1alpha1.UserService.CreateUser:input_type -> holos.user.v1alpha1.CreateUserRequest
+	2, // 6: holos.user.v1alpha1.UserService.GetUser:input_type -> holos.user.v1alpha1.GetUserRequest
+	1, // 7: holos.user.v1alpha1.UserService.CreateUser:output_type -> holos.user.v1alpha1.CreateUserResponse
+	3, // 8: holos.user.v1alpha1.UserService.GetUser:output_type -> holos.user.v1alpha1.GetUserResponse
+	7, // [7:9] is the sub-list for method output_type
+	5, // [5:7] is the sub-list for method input_type
+	5, // [5:5] is the sub-list for extension type_name
+	5, // [5:5] is the sub-list for extension extendee
+	0, // [0:5] is the sub-list for field type_name
+}
+
+func init() { file_holos_user_v1alpha1_user_service_proto_init() }
+func file_holos_user_v1alpha1_user_service_proto_init() {
+	if File_holos_user_v1alpha1_user_service_proto != nil {
+		return
+	}
+	file_holos_user_v1alpha1_user_proto_init()
+	if !protoimpl.UnsafeEnabled {
+		file_holos_user_v1alpha1_user_service_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CreateUserRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_holos_user_v1alpha1_user_service_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CreateUserResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_holos_user_v1alpha1_user_service_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetUserRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_holos_user_v1alpha1_user_service_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetUserResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_holos_user_v1alpha1_user_service_proto_msgTypes[0].OneofWrappers = []interface{}{}
+	file_holos_user_v1alpha1_user_service_proto_msgTypes[2].OneofWrappers = []interface{}{}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_holos_user_v1alpha1_user_service_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   4,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_holos_user_v1alpha1_user_service_proto_goTypes,
+		DependencyIndexes: file_holos_user_v1alpha1_user_service_proto_depIdxs,
+		MessageInfos:      file_holos_user_v1alpha1_user_service_proto_msgTypes,
+	}.Build()
+	File_holos_user_v1alpha1_user_service_proto = out.File
+	file_holos_user_v1alpha1_user_service_proto_rawDesc = nil
+	file_holos_user_v1alpha1_user_service_proto_goTypes = nil
+	file_holos_user_v1alpha1_user_service_proto_depIdxs = nil
+}
--- a/service/gen/holos/user/v1alpha1/userconnect/user_service.connect.go
+++ b/service/gen/holos/user/v1alpha1/userconnect/user_service.connect.go
@@ -0,0 +1,145 @@
+// Code generated by protoc-gen-connect-go. DO NOT EDIT.
+//
+// Source: holos/user/v1alpha1/user_service.proto
+
+package userconnect
+
+import (
+	connect "connectrpc.com/connect"
+	context "context"
+	errors "errors"
+	v1alpha1 "github.com/holos-run/holos/service/gen/holos/user/v1alpha1"
+	http "net/http"
+	strings "strings"
+)
+
+// This is a compile-time assertion to ensure that this generated file and the connect package are
+// compatible. If you get a compiler error that this constant is not defined, this code was
+// generated with a version of connect newer than the one compiled into your binary. You can fix the
+// problem by either regenerating this code with an older version of connect or updating the connect
+// version compiled into your binary.
+const _ = connect.IsAtLeastVersion1_13_0
+
+const (
+	// UserServiceName is the fully-qualified name of the UserService service.
+	UserServiceName = "holos.user.v1alpha1.UserService"
+)
+
+// These constants are the fully-qualified names of the RPCs defined in this package. They're
+// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
+//
+// Note that these are different from the fully-qualified method names used by
+// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
+// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
+// period.
+const (
+	// UserServiceCreateUserProcedure is the fully-qualified name of the UserService's CreateUser RPC.
+	UserServiceCreateUserProcedure = "/holos.user.v1alpha1.UserService/CreateUser"
+	// UserServiceGetUserProcedure is the fully-qualified name of the UserService's GetUser RPC.
+	UserServiceGetUserProcedure = "/holos.user.v1alpha1.UserService/GetUser"
+)
+
+// These variables are the protoreflect.Descriptor objects for the RPCs defined in this package.
+var (
+	userServiceServiceDescriptor          = v1alpha1.File_holos_user_v1alpha1_user_service_proto.Services().ByName("UserService")
+	userServiceCreateUserMethodDescriptor = userServiceServiceDescriptor.Methods().ByName("CreateUser")
+	userServiceGetUserMethodDescriptor    = userServiceServiceDescriptor.Methods().ByName("GetUser")
+)
+
+// UserServiceClient is a client for the holos.user.v1alpha1.UserService service.
+type UserServiceClient interface {
+	// Create a new user from authenticated claims or the provided User resource.
+	CreateUser(context.Context, *connect.Request[v1alpha1.CreateUserRequest]) (*connect.Response[v1alpha1.CreateUserResponse], error)
+	// Get an existing user by id, email, or subject.
+	GetUser(context.Context, *connect.Request[v1alpha1.GetUserRequest]) (*connect.Response[v1alpha1.GetUserResponse], error)
+}
+
+// NewUserServiceClient constructs a client for the holos.user.v1alpha1.UserService service. By
+// default, it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped responses,
+// and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the
+// connect.WithGRPC() or connect.WithGRPCWeb() options.
+//
+// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
+// http://api.acme.com or https://acme.com/grpc).
+func NewUserServiceClient(httpClient connect.HTTPClient, baseURL string, opts ...connect.ClientOption) UserServiceClient {
+	baseURL = strings.TrimRight(baseURL, "/")
+	return &userServiceClient{
+		createUser: connect.NewClient[v1alpha1.CreateUserRequest, v1alpha1.CreateUserResponse](
+			httpClient,
+			baseURL+UserServiceCreateUserProcedure,
+			connect.WithSchema(userServiceCreateUserMethodDescriptor),
+			connect.WithClientOptions(opts...),
+		),
+		getUser: connect.NewClient[v1alpha1.GetUserRequest, v1alpha1.GetUserResponse](
+			httpClient,
+			baseURL+UserServiceGetUserProcedure,
+			connect.WithSchema(userServiceGetUserMethodDescriptor),
+			connect.WithClientOptions(opts...),
+		),
+	}
+}
+
+// userServiceClient implements UserServiceClient.
+type userServiceClient struct {
+	createUser *connect.Client[v1alpha1.CreateUserRequest, v1alpha1.CreateUserResponse]
+	getUser    *connect.Client[v1alpha1.GetUserRequest, v1alpha1.GetUserResponse]
+}
+
+// CreateUser calls holos.user.v1alpha1.UserService.CreateUser.
+func (c *userServiceClient) CreateUser(ctx context.Context, req *connect.Request[v1alpha1.CreateUserRequest]) (*connect.Response[v1alpha1.CreateUserResponse], error) {
+	return c.createUser.CallUnary(ctx, req)
+}
+
+// GetUser calls holos.user.v1alpha1.UserService.GetUser.
+func (c *userServiceClient) GetUser(ctx context.Context, req *connect.Request[v1alpha1.GetUserRequest]) (*connect.Response[v1alpha1.GetUserResponse], error) {
+	return c.getUser.CallUnary(ctx, req)
+}
+
+// UserServiceHandler is an implementation of the holos.user.v1alpha1.UserService service.
+type UserServiceHandler interface {
+	// Create a new user from authenticated claims or the provided User resource.
+	CreateUser(context.Context, *connect.Request[v1alpha1.CreateUserRequest]) (*connect.Response[v1alpha1.CreateUserResponse], error)
+	// Get an existing user by id, email, or subject.
+	GetUser(context.Context, *connect.Request[v1alpha1.GetUserRequest]) (*connect.Response[v1alpha1.GetUserResponse], error)
+}
+
+// NewUserServiceHandler builds an HTTP handler from the service implementation. It returns the path
+// on which to mount the handler and the handler itself.
+//
+// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
+// and JSON codecs. They also support gzip compression.
+func NewUserServiceHandler(svc UserServiceHandler, opts ...connect.HandlerOption) (string, http.Handler) {
+	userServiceCreateUserHandler := connect.NewUnaryHandler(
+		UserServiceCreateUserProcedure,
+		svc.CreateUser,
+		connect.WithSchema(userServiceCreateUserMethodDescriptor),
+		connect.WithHandlerOptions(opts...),
+	)
+	userServiceGetUserHandler := connect.NewUnaryHandler(
+		UserServiceGetUserProcedure,
+		svc.GetUser,
+		connect.WithSchema(userServiceGetUserMethodDescriptor),
+		connect.WithHandlerOptions(opts...),
+	)
+	return "/holos.user.v1alpha1.UserService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case UserServiceCreateUserProcedure:
+			userServiceCreateUserHandler.ServeHTTP(w, r)
+		case UserServiceGetUserProcedure:
+			userServiceGetUserHandler.ServeHTTP(w, r)
+		default:
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// UnimplementedUserServiceHandler returns CodeUnimplemented from all methods.
+type UnimplementedUserServiceHandler struct{}
+
+func (UnimplementedUserServiceHandler) CreateUser(context.Context, *connect.Request[v1alpha1.CreateUserRequest]) (*connect.Response[v1alpha1.CreateUserResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("holos.user.v1alpha1.UserService.CreateUser is not implemented"))
+}
+
+func (UnimplementedUserServiceHandler) GetUser(context.Context, *connect.Request[v1alpha1.GetUserRequest]) (*connect.Response[v1alpha1.GetUserResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("holos.user.v1alpha1.UserService.GetUser is not implemented"))
+}
--- a/service/holos/object/v1alpha1/object.proto
+++ b/service/holos/object/v1alpha1/object.proto
@@ -0,0 +1,82 @@
+syntax = "proto3";
+
+package holos.object.v1alpha1;
+
+option go_package = "github.com/holos-run/holos/service/gen/holos/object/v1alpha1;object";
+
+import "google/protobuf/timestamp.proto";
+// git clone https://github.com/bufbuild/protovalidate then add <parent>/protovalidate/proto/protovalidate to your editor proto search path
+import "buf/validate/validate.proto";
+
+// For validation, see the [Standard constraints](https://github.com/bufbuild/protovalidate/blob/main/docs/standard-constraints.md)
+
+message Detail {
+  // Created by entity
+  optional ResourceEditor created_by = 1;
+  // Created at timestamp
+  google.protobuf.Timestamp created_at = 2 [(buf.validate.field).timestamp.lt_now = true];
+  // Updated by entity
+  optional ResourceEditor updated_by = 3;
+  // Updated at timestamp
+  google.protobuf.Timestamp updated_at = 4 [(buf.validate.field).timestamp.lt_now = true];
+}
+
+// Subject represents the oidc iss and sub claims which uniquely identify a subject.
+message Subject {
+  // iss represents the oidc id token iss claim.  Limits defined at
+  // https://openid.net/specs/openid-authentication-1_1.html#limits
+  string iss = 1 [
+    (buf.validate.field).string = {
+      min_len: 1,
+      max_len: 255,
+      uri: true,
+      prefix: "https://",
+    }];
+  // sub represents the oidc id token sub claim.
+  string sub = 2 [(buf.validate.field).string = {
+    min_len: 1,
+    max_len: 255,
+  }];
+}
+
+// UserRef refers to a User by uuid, email, or by the oidc iss and sub claims.
+message UserRef {
+  oneof user {
+    option (buf.validate.oneof).required = true;
+    string user_id = 1 [(buf.validate.field).string.uuid = true];
+    string email = 2 [(buf.validate.field).string.email = true];
+    Subject subject = 3;
+  }
+}
+
+// Organization represents the ways in which a organization may be uniquely identified in the system.
+message OrganizationRef {
+  oneof org {
+    option (buf.validate.oneof).required = true;
+    string org_id = 1 [(buf.validate.field).string.uuid = true];
+    string org_name = 2 [
+      (buf.validate.field).cel = {
+        id: "org.name"
+        message: "All characters must be either a hyphen or alphanumeric.  Cannot start with a hyphen.  Cannot include consecutive hyphens.  Length must be at least 3 and at most 39."
+        // https://github.com/google/cel-spec/blob/master/doc/langdef.md#regular-expressions
+        expression: "this.matches(\'^(?!-)(?!.*--)([a-zA-Z0-9-]){3,39}$\')"
+      }
+    ];
+  }
+}
+
+// ResourceEditor represents the entity that most recently created or edited a resource.
+message ResourceEditor {
+  oneof editor {
+    option (buf.validate.oneof).required = true;
+    string user_id = 1 [(buf.validate.field).string.uuid = true];
+  }
+}
+
+message ResourceOwner {
+  oneof resource_owner {
+    option (buf.validate.oneof).required = true;
+    string org_id = 1 [(buf.validate.field).string.uuid = true];
+    string user_id = 2 [(buf.validate.field).string.uuid = true];
+  }
+}
--- a/service/holos/organization/v1alpha1/organization.proto
+++ b/service/holos/organization/v1alpha1/organization.proto
@@ -0,0 +1,71 @@
+syntax = "proto3";
+
+package holos.organization.v1alpha1;
+
+option go_package = "github.com/holos-run/holos/service/gen/holos/organization/v1alpha1;organization";
+
+// git clone https://github.com/bufbuild/protovalidate then add <parent>/protovalidate/proto/protovalidate to your editor proto search path
+import "buf/validate/validate.proto";
+import "holos/object/v1alpha1/object.proto";
+
+// For validation, see the [Standard constraints](https://github.com/bufbuild/protovalidate/blob/main/docs/standard-constraints.md)
+
+message Organization {
+  // Unique id assigned by the server.
+  optional string org_id = 1 [(buf.validate.field).string.uuid = true];
+  // Name is the organization name as a dns label.
+  string name = 2 [
+    (buf.validate.field).string = {
+      min_len: 3,
+      max_len: 39,
+    },
+    (buf.validate.field).cel = {
+      id: "name.no_start_hyphen"
+      message: "Cannot start with a hyphen."
+      expression: "!this.startsWith('-')"
+    },
+    (buf.validate.field).cel = {
+      id: "name.no_end_hyphen"
+      message: "Cannot end with a hyphen."
+      expression: "!this.endsWith('-')"
+    },
+    (buf.validate.field).cel = {
+      id: "name.no_consecutive_hyphens"
+      message: "Cannot include consecutive hyphens."
+      expression: "!this.contains('--')"
+    },
+    (buf.validate.field).cel = {
+      id: "name"
+      message: "All characters must be either a hyphen or alphanumeric."
+      // https://github.com/google/cel-spec/blob/master/doc/langdef.md#regular-expressions
+      expression: "this.matches('^[A-Za-z0-9-]$')"
+    }
+   ];
+  optional string display_name = 3 [
+    (buf.validate.field).string = {
+      min_len: 1,
+      max_len: 100,
+    },
+    (buf.validate.field).cel = {
+      id: "name.no_start_space"
+      message: "Cannot start with a space."
+      expression: "!this.startsWith(' ')"
+    },
+    (buf.validate.field).cel = {
+      id: "name.no_end_space"
+      message: "Cannot end with a space."
+      expression: "!this.endsWith(' ')"
+    },
+    (buf.validate.field).cel = {
+      id: "name.no_consecutive_spaces"
+      message: "Cannot include consecutive spaces."
+      expression: "!this.contains('  ')"
+    },
+    (buf.validate.field).cel = {
+      id: "name.characters"
+      message: "All characters must be either a space or alphanumeric."
+      // https://github.com/google/cel-spec/blob/master/doc/langdef.md#regular-expressions
+      expression: "this.matches('^[A-Za-z0-9 ]$')"
+    }];
+  optional holos.object.v1alpha1.Detail detail = 4;
+}
--- a/service/holos/organization/v1alpha1/organization_service.proto
+++ b/service/holos/organization/v1alpha1/organization_service.proto
@@ -0,0 +1,34 @@
+syntax = "proto3";
+
+package holos.organization.v1alpha1;
+
+option go_package = "github.com/holos-run/holos/service/gen/holos/organization/v1alpha1;organization";
+
+// git clone https://github.com/bufbuild/protovalidate then add <parent>/protovalidate/proto/protovalidate to your editor proto search path
+import "google/protobuf/field_mask.proto";
+import "holos/object/v1alpha1/object.proto";
+import "holos/organization/v1alpha1/organization.proto";
+
+// For validation, see the [Standard constraints](https://github.com/bufbuild/protovalidate/blob/main/docs/standard-constraints.md)
+
+message CreateOrganizationRequest {
+  Organization organization = 1;
+}
+
+message CreateOrganizationResponse {
+  Organization organization = 1;
+}
+
+message ListOrganizationsRequest {
+  google.protobuf.FieldMask field_mask = 1;
+}
+
+message ListOrganizationsResponse {
+  optional holos.object.v1alpha1.UserRef user = 1;
+  repeated Organization organizations = 2;
+}
+
+service OrganizationService {
+  rpc CreateOrganization(CreateOrganizationRequest) returns (CreateOrganizationResponse) {}
+  rpc ListOrganizations(ListOrganizationsRequest) returns (ListOrganizationsResponse) {}
+}
--- a/service/holos/platform/v1alpha1/platform.proto
+++ b/service/holos/platform/v1alpha1/platform.proto
@@ -0,0 +1,93 @@
+syntax = "proto3";
+
+package holos.platform.v1alpha1;
+option go_package = "github.com/holos-run/holos/service/gen/holos/platform/v1alpha1;platform";
+
+// Managed by buf, refer to buf.yaml
+import "buf/validate/validate.proto";
+import "google/protobuf/struct.proto";
+import "holos/object/v1alpha1/object.proto";
+
+// For validation, see the [Standard constraints](https://github.com/bufbuild/protovalidate/blob/main/docs/standard-constraints.md)
+
+message Platform {
+  // Unique id assigned by the server.
+  string id = 1 [(buf.validate.field).string.uuid = true];
+  // Owner of the platform.
+  Owner owner = 2;
+  // name is the platform short name as a dns label.
+  string name = 3 [
+    (buf.validate.field).string = {
+      min_len: 1,
+      max_len: 39,
+    },
+    (buf.validate.field).cel = {
+      id: "name.no_start_hyphen"
+      message: "Cannot start with a hyphen."
+      expression: "!this.startsWith('-')"
+    },
+    (buf.validate.field).cel = {
+      id: "name.no_end_hyphen"
+      message: "Cannot end with a hyphen."
+      expression: "!this.endsWith('-')"
+    },
+    (buf.validate.field).cel = {
+      id: "name.no_consecutive_hyphens"
+      message: "Cannot include consecutive hyphens."
+      expression: "!this.contains('--')"
+    },
+    (buf.validate.field).cel = {
+      id: "name.pattern"
+      message: "All characters must be either a hyphen or alphanumeric."
+      // https://github.com/google/cel-spec/blob/master/doc/langdef.md#regular-expressions
+      expression: "this.matches('^[A-Za-z0-9-]+$')"
+    }
+   ];
+  optional string display_name = 4 [
+    (buf.validate.field).string = {
+      min_len: 1,
+      max_len: 100,
+    },
+    (buf.validate.field).cel = {
+      id: "display_name.no_start_space"
+      message: "Cannot start with a space."
+      expression: "!this.startsWith(' ')"
+    },
+    (buf.validate.field).cel = {
+      id: "display_name.no_end_space"
+      message: "Cannot end with a space."
+      expression: "!this.endsWith(' ')"
+    },
+    (buf.validate.field).cel = {
+      id: "display_name.no_consecutive_spaces"
+      message: "Cannot include consecutive spaces."
+      expression: "!this.contains('  ')"
+    }];
+  optional string description = 5 [(buf.validate.field).string.max_len = 2047];
+  optional Spec spec = 6;
+  optional holos.object.v1alpha1.Detail detail = 8;
+}
+
+// Owner of a platform.
+message Owner {
+  oneof owner {
+    option (buf.validate.oneof).required = true;
+    string org_id = 1 [(buf.validate.field).string.uuid = true];
+  }
+}
+
+// Spec represents the top level specification of a Platform.
+message Spec {
+  // model represents the user-defined and user-supplied form field values.
+  // The model is a Struct to ensure any valid JSON object defined by the user
+  // via the form can be represented and stored.
+  google.protobuf.Struct model = 1;
+  optional Form form = 2;
+}
+
+// Form represents the Formly input form.
+message Form {
+  // fields represents FormlyFieldConfig[] encoded as an array of JSON objects
+  // organized by section.
+  repeated google.protobuf.Struct field_configs = 1;
+}
--- a/service/holos/platform/v1alpha1/platform_service.proto
+++ b/service/holos/platform/v1alpha1/platform_service.proto
@@ -0,0 +1,115 @@
+syntax = "proto3";
+
+package holos.platform.v1alpha1;
+option go_package = "github.com/holos-run/holos/service/gen/holos/platform/v1alpha1;platform";
+
+import "buf/validate/validate.proto";
+import "google/protobuf/field_mask.proto";
+import "google/protobuf/struct.proto";
+import "holos/platform/v1alpha1/platform.proto";
+
+message CreatePlatformRequest {
+  Platform platform = 1;
+}
+
+message CreatePlatformResponse {
+  Platform platform = 1;
+}
+
+message GetPlatformRequest {
+  string platform_id = 1 [(buf.validate.field).string.uuid = true];
+  // FieldMask represents the response Platform fields to include.
+  google.protobuf.FieldMask field_mask = 2;
+}
+
+message GetPlatformResponse {
+  Platform platform = 1;
+}
+
+message UpdatePlatformRequest {
+  // Update operations to perform.  Fields are set to the provided value if
+  // selected by the mask.  Absent fields are cleared if they are selected by
+  // the mask.
+  UpdatePlatformOperation update = 1;
+  // FieldMask represents the mutation operations to perform.  Marked optional
+  // for the nil guard check.  Required.
+  optional google.protobuf.FieldMask update_mask = 2;
+}
+
+message UpdatePlatformResponse {
+  Platform platform = 1;
+}
+
+message ListPlatformsRequest {
+  string org_id = 1 [(buf.validate.field).string.uuid = true];
+  // FieldMask represents the response Platform fields to include.
+  google.protobuf.FieldMask field_mask = 2;
+}
+
+message ListPlatformsResponse {
+  repeated Platform platforms = 1;
+}
+
+message UpdatePlatformOperation {
+  // Platform UUID to update.
+  string platform_id = 1 [(buf.validate.field).string.uuid = true];
+  // Update the platform name.
+  optional string name = 2 [ 
+    (buf.validate.field).string = {
+      min_len: 1,
+      max_len: 39,
+    },
+    (buf.validate.field).cel = {
+      id: "name.no_start_hyphen"
+      message: "Cannot start with a hyphen."
+      expression: "!this.startsWith('-')"
+    },
+    (buf.validate.field).cel = {
+      id: "name.no_end_hyphen"
+      message: "Cannot end with a hyphen."
+      expression: "!this.endsWith('-')"
+    },
+    (buf.validate.field).cel = {
+      id: "name.no_consecutive_hyphens"
+      message: "Cannot include consecutive hyphens."
+      expression: "!this.contains('--')"
+    },
+    (buf.validate.field).cel = {
+      id: "name.pattern"
+      message: "All characters must be either a hyphen or alphanumeric."
+      // https://github.com/google/cel-spec/blob/master/doc/langdef.md#regular-expressions
+      expression: "this.matches('^[A-Za-z0-9-]+$')"
+    }];
+  // Update the platform display name.
+  optional string display_name = 3 [
+    (buf.validate.field).string = {
+      min_len: 1,
+      max_len: 100,
+    },
+    (buf.validate.field).cel = {
+      id: "display_name.no_start_space"
+      message: "Cannot start with a space."
+      expression: "!this.startsWith(' ')"
+    },
+    (buf.validate.field).cel = {
+      id: "display_name.no_end_space"
+      message: "Cannot end with a space."
+      expression: "!this.endsWith(' ')"
+    },
+    (buf.validate.field).cel = {
+      id: "display_name.no_consecutive_spaces"
+      message: "Cannot include consecutive spaces."
+      expression: "!this.contains('  ')"
+    }];
+  // Replace the form model.
+  optional google.protobuf.Struct model = 4;
+  // Replace the form.
+  optional Form form = 5;
+}
+
+service PlatformService {
+  rpc CreatePlatform(CreatePlatformRequest) returns (CreatePlatformResponse) {}
+  rpc GetPlatform(GetPlatformRequest) returns (GetPlatformResponse) {}
+  rpc UpdatePlatform(UpdatePlatformRequest) returns (UpdatePlatformResponse) {}
+  rpc ListPlatforms(ListPlatformsRequest) returns (ListPlatformsResponse) {}
+}
--- a/service/holos/storage/v1alpha1/storage.proto
+++ b/service/holos/storage/v1alpha1/storage.proto
@@ -0,0 +1,21 @@
+syntax = "proto3";
+
+package holos.storage.v1alpha1;
+option go_package = "github.com/holos-run/holos/service/gen/storage/v1alpha1;storage";
+
+// Managed by buf, refer to buf.yaml
+import "google/protobuf/struct.proto";
+
+// Model represents user-defined and user-supplied form field values stored as a
+// marshaled JSON object.  The model is a Struct to ensure any valid JSON object
+// defined by the user via the form can be represented and stored.
+message Model {
+  google.protobuf.Struct model = 1;
+}
+
+// Form represents the Formly input form stored as a marshaled JSON object.
+message Form {
+  // fields represents FormlyFieldConfig[] encoded as an array of JSON objects
+  // organized by section.
+  repeated google.protobuf.Struct field_configs = 1;
+}
--- a/service/holos/system/v1alpha1/system_service.proto
+++ b/service/holos/system/v1alpha1/system_service.proto
@@ -1,8 +1,8 @@
 syntax = "proto3";

-package holos.v1alpha1;
+package holos.system.v1alpha1;

-option go_package = "github.com/holos-run/holos/service/gen/holos/v1alpha1;holos";
+option go_package = "github.com/holos-run/holos/service/gen/holos/system/v1alpha1;system";

 // git clone https://github.com/bufbuild/protovalidate then add <parent>/protovalidate/proto/protovalidate to your editor proto search path

--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Jeff McCune	9a2773c618	(#171 ) Refactor API to use FieldMasks This patch refactors the API following the [API Best Practices][api] documentation. The UpdatePlatform method is modeled after a mutating operation described [by Netflix][nflx] instead of using a REST resource representation. This makes it much easier to iterate over the fields that need to be updated as the PlatformUpdateOperation is a flat data structure while a Platform resource may have nested fields. Nested fields are more complicated and less clear to handle with a FieldMask. This patch also adds a snapckbar message on save. Previously, the save button didn't give any indication of success or failure. This patch fixes the problem by adding a snackbar message that pop up at the bottom of the screen nicely. When the snackbar message is dismissed or times out the save button is re-enabled. [api]: https://protobuf.dev/programming-guides/api/ [nflx]: https://netflixtechblog.com/practical-api-design-at-netflix-part-2-protobuf-fieldmask-for-mutation-operations-2e75e1d230e4 Examples: FieldMask for ListPlatforms ``` grpcurl -H "x-oidc-id-token: $(holos token)" -d @ ${HOLOS_SERVER##*/} holos.platform.v1alpha1.PlatformService.ListPlatforms <<EOF { "org_id": "018f36fb-e3f7-7f7f-a1c5-c85fb735d215", "field_mask": { "paths": ["id","name"] } } EOF ``` ```json { "platforms": [ { "id": "018f36fb-e3ff-7f7f-a5d1-7ca2bf499e94", "name": "bare" }, { "id": "018f6b06-9e57-7223-91a9-784e145d998c", "name": "gary" }, { "id": "018f6b06-9e53-7223-8ae1-1ad53d46b158", "name": "jeff" }, { "id": "018f6b06-9e5b-7223-8b8b-ea62618e8200", "name": "nate" } ] } ``` Closes: #171	2024-05-13 16:20:20 -07:00
Jeff McCune	51b6575d9f	(#171 ) Refactor to API Best Practices This patch refactors the API to be resource-oriented around one service per resource type. PlatformService, OrganizationService, UserService, etc... Validation is improved to use CEL rules provided by [protovalidate][1]. Place holders for FieldMask and other best practices are added, but are unimplemented as per [API Best Practices][2]. The intent is to set us up well for copying and pasting solid existing examples as we add features. With this patch the server and web app client are both updated to use the refactored API, however the following are not working: 1. Update the model. 2. Field Masks. [1]: https://buf.build/bufbuild/protovalidate [2]: https://protobuf.dev/programming-guides/api/	2024-05-10 15:55:41 -07:00
Jeff McCune	68a43f0682	(#167 ) Add holos rpc platform-model command This command is just a prototype of how to fetch the platform model so we can make it available to CUE. The idea is we take the data from the holos server and write it into a CUE `_Platform` struct. This will probably involve converting the data to CUE format and nesting it under the platform struct spec field.	2024-05-08 16:34:00 -07:00
Jeff McCune	9da88c4d1b	(#169 ) ZITADEL ServerError - PGBouncer DNS Add runbook notes. Root cause and permanent solution have not been identified yet.	2024-05-08 12:04:50 -07:00
Jeff McCune	19df2ec0fb	(#167 ) Bump dev deployment to 0.74.0	2024-05-07 16:58:03 -07:00