diff --git a/README.md b/README.md
index 83a1be5c..467e2c91 100644
--- a/README.md
+++ b/README.md
@@ -23,6 +23,8 @@ The CLI is configured via the `tructl.yaml`. There is an example provided in `ex
 
 Run `cp example-tructl.yaml tructl.yaml` to copy the example config when running the CLI.
 
+Load up the platform (see its [README](https://github.com/opentdf/platform?tab=readme-ov-file#run) for instructions).
+
 ## Development
 
 ### CLI
diff --git a/cmd/auth-login.go b/cmd/auth-login.go
index 89700a25..06976f2d 100644
--- a/cmd/auth-login.go
+++ b/cmd/auth-login.go
@@ -10,12 +10,10 @@ import (
 	"github.com/zalando/go-keyring"
 )
 
-var (
-	auth_loginCommands = []string{
-		// auth_loginPassword.Use,
-		auth_loginClientCredentials.Use,
-	}
-)
+var auth_loginCommands = []string{
+	// auth_loginPassword.Use,
+	auth_loginClientCredentials.Use,
+}
 
 var auth_loginCmd = &cobra.Command{
 	Use:   "login",
@@ -53,7 +51,7 @@ var auth_loginClientCredentials = &cobra.Command{
 		if clientId == "" {
 			errMsg = fmt.Sprintf("Please provide required flag: (%s)", "clientId")
 			fmt.Println(cli.ErrorMessage(errMsg, nil))
-			cli.ExitWithError("Could not create attribute", nil)
+			cli.ExitWithError("Failed to create attribute", nil)
 			return
 		}
 
@@ -69,12 +67,12 @@ var auth_loginClientCredentials = &cobra.Command{
 		if clientSecret == "" {
 			errMsg = fmt.Sprintf("Please provide required flag: (%s)", "clientSecret")
 			fmt.Println(cli.ErrorMessage(errMsg, nil))
-			cli.ExitWithError("Could not create attribute", nil)
+			cli.ExitWithError("Failed to create attribute", nil)
 			return
 		}
 
 		// for now we're hardcoding the TOKEN_URL as a constant at the top
-		var _, err = h.GetTokenWithClientCredentials(clientId, clientSecret, handlers.TOKEN_URL, false)
+		_, err := h.GetTokenWithClientCredentials(clientId, clientSecret, handlers.TOKEN_URL, false)
 
 		if err != nil {
 			errMsg = cli.ErrorMessage("An error occurred during login. Please check your credentials and try again.", nil)
diff --git a/cmd/dev.go b/cmd/dev.go
index 490d79fa..2582f01e 100644
--- a/cmd/dev.go
+++ b/cmd/dev.go
@@ -71,7 +71,7 @@ func unMarshalMetadata(m string) *common.MetadataMutable {
 	if m != "" {
 		metadata := &common.MetadataMutable{}
 		if err := json.Unmarshal([]byte(m), metadata); err != nil {
-			cli.ExitWithError("Could not unmarshal metadata", err)
+			cli.ExitWithError("Failed to unmarshal metadata", err)
 		}
 		return metadata
 	}
diff --git a/cmd/kas-grants.go b/cmd/kas-grants.go
index 23118d10..3baab488 100644
--- a/cmd/kas-grants.go
+++ b/cmd/kas-grants.go
@@ -46,14 +46,14 @@ var (
 			if attr != "" {
 				res, err = h.UpdateKasGrantForAttribute(attr, kas)
 				if err != nil {
-					cli.ExitWithError("Could not update KAS grant for attribute", err)
+					cli.ExitWithError("Failed to update KAS grant for attribute", err)
 				}
 				id = attr
 				header = "Attribute ID"
 			} else {
 				res, err = h.UpdateKasGrantForValue(val, kas)
 				if err != nil {
-					cli.ExitWithError("Could not update KAS grant for attribute value", err)
+					cli.ExitWithError("Failed to update KAS grant for attribute value", err)
 				}
 				id = val
 				header = "Value ID"
@@ -90,19 +90,19 @@ var (
 				err    error
 			)
 
-			cli.ConfirmDelete("KAS ID: ", kas)
+			cli.ConfirmAction(cli.ActionDelete, "KAS ID: ", kas)
 
 			if attr != "" {
 				res, err = h.DeleteKasGrantFromAttribute(attr, kas)
 				if err != nil {
-					cli.ExitWithError("Could not update KAS grant for attribute", err)
+					cli.ExitWithError("Failed to update KAS grant for attribute", err)
 				}
 				id = attr
 				header = "Attribute ID"
 			} else {
 				_, err := h.DeleteKasGrantFromValue(val, kas)
 				if err != nil {
-					cli.ExitWithError("Could not update KAS grant for attribute value", err)
+					cli.ExitWithError("Failed to update KAS grant for attribute value", err)
 				}
 				id = val
 				header = "Value ID"
diff --git a/cmd/kas-registry.go b/cmd/kas-registry.go
index ba3a3231..a1b67023 100644
--- a/cmd/kas-registry.go
+++ b/cmd/kas-registry.go
@@ -44,8 +44,8 @@ var (
 
 			kas, err := h.GetKasRegistryEntry(id)
 			if err != nil {
-				errMsg := fmt.Sprintf("Could not find KAS registry entry (%s)", id)
-				cli.ExitWithNotFoundError(errMsg, err)
+				errMsg := fmt.Sprintf("Failed to get KAS registry entry (%s)", id)
+				cli.ExitWithError(errMsg, err)
 			}
 
 			keyType := "Local"
@@ -76,7 +76,7 @@ var (
 
 			list, err := h.ListKasRegistryEntries()
 			if err != nil {
-				cli.ExitWithError("Could not get KAS registry entries", err)
+				cli.ExitWithError("Failed to list KAS registry entries", err)
 			}
 
 			t := cli.NewTable()
@@ -138,7 +138,7 @@ var (
 				getMetadataMutable(metadataLabels),
 			)
 			if err != nil {
-				cli.ExitWithError("Could not create KAS registry entry", err)
+				cli.ExitWithError("Failed to create KAS registry entry", err)
 			}
 
 			t := cli.NewTabular().
@@ -193,7 +193,7 @@ var (
 				getMetadataUpdateBehavior(),
 			)
 			if err != nil {
-				cli.ExitWithError("Could not update KAS registry entry", err)
+				cli.ExitWithError(fmt.Sprintf("Failed to update KAS registry entry (%s)", id), err)
 			}
 			t := cli.NewTabular().
 				Rows([][]string{
@@ -217,14 +217,14 @@ var (
 
 			kas, err := h.GetKasRegistryEntry(id)
 			if err != nil {
-				errMsg := fmt.Sprintf("Could not find KAS registry entry (%s)", id)
-				cli.ExitWithNotFoundError(errMsg, err)
+				errMsg := fmt.Sprintf("Failed to get KAS registry entry (%s)", id)
+				cli.ExitWithError(errMsg, err)
 			}
 
-			cli.ConfirmDelete("KAS Registry Entry: ", id)
+			cli.ConfirmAction(cli.ActionDelete, "KAS Registry Entry: ", id)
 
-			if err := h.DeleteKasRegistryEntry(id); err != nil {
-				errMsg := fmt.Sprintf("Could not delete KAS registry entry (%s)", id)
+			if _, err := h.DeleteKasRegistryEntry(id); err != nil {
+				errMsg := fmt.Sprintf("Failed to delete KAS registry entry (%s)", id)
 				cli.ExitWithError(errMsg, err)
 			}
 
diff --git a/cmd/policy-attributeValues.go b/cmd/policy-attributeValues.go
new file mode 100644
index 00000000..1d85793b
--- /dev/null
+++ b/cmd/policy-attributeValues.go
@@ -0,0 +1,306 @@
+package cmd
+
+import (
+	"fmt"
+
+	"github.com/opentdf/platform/protocol/go/policy"
+	"github.com/opentdf/tructl/pkg/cli"
+	"github.com/spf13/cobra"
+)
+
+// TODO: add metadata to outputs once [https://github.com/opentdf/tructl/issues/73] is addressed
+
+var (
+	policy_attributeValuesCmd = &cobra.Command{
+		Use:   "values",
+		Short: "Manage attribute values",
+	}
+
+	policy_attributeValuesCreateCmd = &cobra.Command{
+		Use:   "create",
+		Short: "Create an attribute value",
+		Run: func(cmd *cobra.Command, args []string) {
+			flagHelper := cli.NewFlagHelper(cmd)
+			attrId := flagHelper.GetRequiredString("attribute-id")
+			value := flagHelper.GetRequiredString("value")
+			metadataLabels := flagHelper.GetStringSlice("label", metadataLabels, cli.FlagHelperStringSliceOptions{Min: 0})
+			// TODO: support create with members when update is unblocked to remove/alter them after creation [https://github.com/opentdf/platform/issues/476]
+
+			h := cli.NewHandler(cmd)
+			defer h.Close()
+
+			attr, err := h.GetAttribute(attrId)
+			if err != nil {
+				cli.ExitWithError(fmt.Sprintf("Failed to get parent attribute (%s)", attrId), err)
+			}
+
+			v, err := h.CreateAttributeValue(attr.Id, value, getMetadataMutable(metadataLabels))
+			if err != nil {
+				cli.ExitWithError("Failed to create attribute value", err)
+			}
+
+			handleValueSuccess(cmd, v)
+		},
+	}
+
+	policy_attributeValuesGetCmd = &cobra.Command{
+		Use:   "get",
+		Short: "Get an attribute value",
+		Run: func(cmd *cobra.Command, args []string) {
+			flagHelper := cli.NewFlagHelper(cmd)
+			id := flagHelper.GetRequiredString("id")
+
+			h := cli.NewHandler(cmd)
+			defer h.Close()
+
+			v, err := h.GetAttributeValue(id)
+			if err != nil {
+				cli.ExitWithError("Failed to find attribute value", err)
+			}
+
+			handleValueSuccess(cmd, v)
+		},
+	}
+
+	policy_attributeValuesUpdateCmd = &cobra.Command{
+		Use:   "update",
+		Short: "Update an attribute value",
+		Run: func(cmd *cobra.Command, args []string) {
+			flagHelper := cli.NewFlagHelper(cmd)
+			id := flagHelper.GetRequiredString("id")
+			metadataLabels := flagHelper.GetStringSlice("label", metadataLabels, cli.FlagHelperStringSliceOptions{Min: 0})
+
+			h := cli.NewHandler(cmd)
+			defer h.Close()
+
+			_, err := h.GetAttributeValue(id)
+			if err != nil {
+				cli.ExitWithError(fmt.Sprintf("Failed to get attribute value (%s)", id), err)
+			}
+
+			v, err := h.UpdateAttributeValue(id, nil, getMetadataMutable(metadataLabels), getMetadataUpdateBehavior())
+			if err != nil {
+				cli.ExitWithError("Failed to update attribute value", err)
+			}
+
+			handleValueSuccess(cmd, v)
+		},
+	}
+
+	policy_attributeValuesDeactivateCmd = &cobra.Command{
+		Use:   "deactivate",
+		Short: "Deactivate an attribute value",
+		Run: func(cmd *cobra.Command, args []string) {
+			flagHelper := cli.NewFlagHelper(cmd)
+			id := flagHelper.GetRequiredString("id")
+
+			h := cli.NewHandler(cmd)
+			defer h.Close()
+
+			value, err := h.GetAttributeValue(id)
+			if err != nil {
+				cli.ExitWithError(fmt.Sprintf("Failed to get attribute value (%s)", id), err)
+			}
+
+			cli.ConfirmAction(cli.ActionDeactivate, "attribute value", value.Value)
+
+			deactivated, err := h.DeactivateAttributeValue(id)
+			if err != nil {
+				cli.ExitWithError("Failed to deactivate attribute value", err)
+			}
+
+			handleValueSuccess(cmd, deactivated)
+		},
+	}
+
+	// TODO: uncomment when update with members is enabled in the platform [https://github.com/opentdf/platform/issues/476]
+	///
+	/// Attribute Value Members
+	///
+	// attrValueMembers = []string{}
+
+	// policy_attributeValueMembersCmd = &cobra.Command{
+	// 	Use:   "members",
+	// 	Short: "Manage attribute value members",
+	// 	Long:  "Manage attribute value members",
+	// }
+
+	// // Add member to attribute value
+	// policy_attributeValueMembersAddCmd = &cobra.Command{
+	// 	Use:   "add",
+	// 	Short: "Add members to an attribute value",
+	// 	Run: func(cmd *cobra.Command, args []string) {
+	// 		flagHelper := cli.NewFlagHelper(cmd)
+	// 		id := flagHelper.GetRequiredString("id")
+	// 		members := flagHelper.GetStringSlice("member", attrValueMembers, cli.FlagHelperStringSliceOptions{})
+
+	// 		h := cli.NewHandler(cmd)
+	// 		defer h.Close()
+
+	// 		prev, err := h.GetAttributeValue(id)
+	// 		if err != nil {
+	// 			cli.ExitWithError(fmt.Sprintf("Failed to get attribute value (%s)", id), err)
+	// 		}
+
+	// 		action := fmt.Sprintf("%s [%s] to", cli.ActionMemberAdd, strings.Join(members, ", "))
+	// 		cli.ConfirmAction(action, "attribute value", id)
+
+	// 		prevMemberIds := make([]string, len(prev.Members))
+	// 		for i, m := range prev.Members {
+	// 			prevMemberIds[i] = m.GetId()
+	// 		}
+	// 		updated := append(prevMemberIds, members...)
+
+	// 		v, err := h.UpdateAttributeValue(id, updated, nil, common.MetadataUpdateEnum_METADATA_UPDATE_ENUM_UNSPECIFIED)
+	// 		if err != nil {
+	// 			cli.ExitWithError(fmt.Sprintf("Failed to %s [%s] to attribute value (%s)", cli.ActionMemberAdd, strings.Join(members, ", "), id), err)
+	// 		}
+
+	// 		handleValueSuccess(cmd, v)
+	// 	},
+	// }
+
+	// // Remove member from attribute value
+	// policy_attributeValueMembersRemoveCmd = &cobra.Command{
+	// 	Use:   "remove",
+	// 	Short: "Remove members from an attribute value",
+	// 	Run: func(cmd *cobra.Command, args []string) {
+	// 		flagHelper := cli.NewFlagHelper(cmd)
+	// 		id := flagHelper.GetRequiredString("id")
+	// 		members := flagHelper.GetStringSlice("members", attrValueMembers, cli.FlagHelperStringSliceOptions{})
+
+	// 		h := cli.NewHandler(cmd)
+	// 		defer h.Close()
+
+	// 		prev, err := h.GetAttributeValue(id)
+	// 		if err != nil {
+	// 			cli.ExitWithError(fmt.Sprintf("Failed to get attribute value (%s)", id), err)
+	// 		}
+
+	// 		action := fmt.Sprintf("%s [%s] from", cli.ActionMemberRemove, strings.Join(members, ", "))
+	// 		cli.ConfirmAction(action, "attribute value", id)
+
+	// 		// collect the member ids off the members, then make the removals
+	// 		updatedMemberIds := make([]string, len(prev.Members))
+	// 		for i, m := range prev.Members {
+	// 			updatedMemberIds[i] = m.GetId()
+	// 		}
+	// 		for _, toBeRemoved := range members {
+	// 			for i, str := range updatedMemberIds {
+	// 				if toBeRemoved == str {
+	// 					updatedMemberIds = append(updatedMemberIds[:i], updatedMemberIds[i+1:]...)
+	// 					break
+	// 				}
+	// 			}
+	// 		}
+
+	// 		v, err := h.UpdateAttributeValue(id, updatedMemberIds, nil, common.MetadataUpdateEnum_METADATA_UPDATE_ENUM_UNSPECIFIED)
+	// 		if err != nil {
+	// 			cli.ExitWithError(fmt.Sprintf("Failed to %s [%s] from attribute value (%s)", cli.ActionMemberRemove, strings.Join(members, ", "), id), err)
+	// 		}
+
+	// 		handleValueSuccess(cmd, v)
+	// 	},
+	// }
+
+	// // Replace members of attribute value
+	// policy_attributeValueMembersReplaceCmd = &cobra.Command{
+	// 	Use:   "replace",
+	// 	Short: "Replace members from an attribute value",
+	// 	Long:  "This command will replace the members of an attribute value with the provided members. ",
+	// 	Run: func(cmd *cobra.Command, args []string) {
+	// 		flagHelper := cli.NewFlagHelper(cmd)
+	// 		id := flagHelper.GetRequiredString("id")
+	// 		members := flagHelper.GetStringSlice("members", attrValueMembers, cli.FlagHelperStringSliceOptions{})
+
+	// 		h := cli.NewHandler(cmd)
+	// 		defer h.Close()
+
+	// 		prev, err := h.GetAttributeValue(id)
+	// 		if err != nil {
+	// 			cli.ExitWithError(fmt.Sprintf("Failed to find attribute value (%s)", id), err)
+	// 		}
+
+	// 		existingMemberIds := make([]string, len(prev.Members))
+	// 		for i, m := range prev.Members {
+	// 			existingMemberIds[i] = m.GetId()
+	// 		}
+
+	// 		action := fmt.Sprintf("%s [%s] with [%s] under", cli.ActionMemberReplace, strings.Join(existingMemberIds, ", "), strings.Join(members, ", "))
+	// 		cli.ConfirmAction(action, "attribute value", id)
+
+	// 		v, err := h.UpdateAttributeValue(id, members, nil, common.MetadataUpdateEnum_METADATA_UPDATE_ENUM_UNSPECIFIED)
+	// 		if err != nil {
+	// 			cli.ExitWithError(fmt.Sprintf("Failed to %s of attribute value (%s)", cli.ActionMemberReplace, id), err)
+	// 		}
+
+	// 		handleValueSuccess(cmd, v)
+	// 	},
+	// }
+)
+
+func init() {
+	policy_attributesCmd.AddGroup(
+		&cobra.Group{
+			ID:    "subcommand",
+			Title: "Subcommands",
+		},
+	)
+	policy_attributesCmd.AddCommand(policy_attributeValuesCmd)
+	policy_attributeValuesCmd.GroupID = "subcommand"
+	policy_attributeValuesCmd.AddGroup(
+		&cobra.Group{
+			ID:    "subcommand",
+			Title: "Subcommands",
+		},
+	)
+
+	policy_attributeValuesCmd.AddCommand(policy_attributeValuesCreateCmd)
+	policy_attributeValuesCreateCmd.Flags().StringP("attribute-id", "a", "", "Attribute id")
+	policy_attributeValuesCreateCmd.Flags().StringP("value", "v", "", "Value")
+	injectLabelFlags(policy_attributeValuesCreateCmd, false)
+
+	policy_attributeValuesCmd.AddCommand(policy_attributeValuesGetCmd)
+	policy_attributeValuesGetCmd.Flags().StringP("id", "i", "", "Attribute value id")
+
+	policy_attributeValuesCmd.AddCommand(policy_attributeValuesUpdateCmd)
+	policy_attributeValuesUpdateCmd.Flags().StringP("id", "i", "", "Attribute value id")
+	injectLabelFlags(policy_attributeValuesUpdateCmd, true)
+
+	policy_attributeValuesCmd.AddCommand(policy_attributeValuesDeactivateCmd)
+	policy_attributeValuesDeactivateCmd.Flags().StringP("id", "i", "", "Attribute value id")
+
+	// Attribute value members
+	// policy_attributeValuesCmd.AddCommand(policy_attributeValueMembersCmd)
+	// policy_attributeValueMembersCmd.GroupID = "subcommand"
+
+	// policy_attributeValueMembersCmd.AddCommand(policy_attributeValueMembersAddCmd)
+	// policy_attributeValueMembersAddCmd.Flags().StringP("id", "i", "", "Attribute value id")
+	// policy_attributeValueMembersAddCmd.Flags().StringSliceVar(&attrValueMembers, "member", []string{}, "Each member id to add")
+
+	// policy_attributeValueMembersCmd.AddCommand(policy_attributeValueMembersRemoveCmd)
+	// policy_attributeValueMembersRemoveCmd.Flags().StringP("id", "i", "", "Attribute value id")
+	// policy_attributeValueMembersRemoveCmd.Flags().StringSliceVar(&attrValueMembers, "member", []string{}, "Each member id to remove")
+
+	// policy_attributeValueMembersCmd.AddCommand(policy_attributeValueMembersReplaceCmd)
+	// policy_attributeValueMembersReplaceCmd.Flags().StringP("id", "i", "", "Attribute value id")
+	// policy_attributeValueMembersReplaceCmd.Flags().StringSliceVar(&attrValueMembers, "member", []string{}, "Each member id that should exist after replacement")
+}
+
+func handleValueSuccess(cmd *cobra.Command, v *policy.Value) {
+	rows := [][]string{
+		{"Id", v.Id},
+		{"FQN", v.Fqn},
+		{"Value", v.Value},
+	}
+	members := v.GetMembers()
+	if len(members) > 0 {
+		memberIds := make([]string, len(members))
+		for i, m := range members {
+			memberIds[i] = m.Id
+		}
+		rows = append(rows, []string{"Members", cli.CommaSeparated(memberIds)})
+	}
+	t := cli.NewTabular().Rows(rows...)
+	HandleSuccess(cmd, v.Id, t, v)
+}
diff --git a/cmd/policy-attributes.go b/cmd/policy-attributes.go
index a790eb89..f64ce539 100644
--- a/cmd/policy-attributes.go
+++ b/cmd/policy-attributes.go
@@ -21,7 +21,7 @@ var (
 		policy_attributeGetCmd.Use,
 		policy_attributesListCmd.Use,
 		policy_attributeUpdateCmd.Use,
-		policy_attributesDeleteCmd.Use,
+		policy_attributesDeactivateCmd.Use,
 	}
 
 	policy_attributesCmd = &cobra.Command{
@@ -46,31 +46,20 @@ used to define the access controls based on subject encodings and entity entitle
 			flagHelper := cli.NewFlagHelper(cmd)
 			name := flagHelper.GetRequiredString("name")
 			rule := flagHelper.GetRequiredString("rule")
-			values := flagHelper.GetStringSlice("values", attrValues, cli.FlagHelperStringSliceOptions{})
+			values := flagHelper.GetStringSlice("value", attrValues, cli.FlagHelperStringSliceOptions{})
 			namespace := flagHelper.GetRequiredString("namespace")
 			metadataLabels := flagHelper.GetStringSlice("label", metadataLabels, cli.FlagHelperStringSliceOptions{Min: 0})
 
-			attr, err := h.CreateAttribute(name, rule, namespace, getMetadataMutable(metadataLabels))
+			attr, err := h.CreateAttribute(name, rule, namespace, values, getMetadataMutable(metadataLabels))
 			if err != nil {
-				cli.ExitWithError("Could not create attribute", err)
-			}
-
-			// create attribute values
-			attrValues := make([]*policy.Value, 0, len(values))
-			valueErrors := make(map[string]error)
-			for _, value := range values {
-				v, err := h.CreateAttributeValue(attr.Id, value)
-				if err != nil {
-					valueErrors[value] = err
-				}
-				attrValues = append(attrValues, v)
+				cli.ExitWithError("Failed to create attribute", err)
 			}
 
 			a := cli.GetSimpleAttribute(&policy.Attribute{
 				Id:        attr.Id,
 				Name:      attr.Name,
 				Rule:      attr.Rule,
-				Values:    attrValues,
+				Values:    attr.Values,
 				Namespace: attr.Namespace,
 			})
 
@@ -81,13 +70,7 @@ used to define the access controls based on subject encodings and entity entitle
 				{"Namespace", a.Namespace},
 			}...)
 
-			if len(valueErrors) > 0 {
-				fmt.Println(cli.ErrorMessage("Error creating attribute values", nil))
-				for value, err := range valueErrors {
-					cli.ErrorMessage(value, err)
-				}
-			}
-			HandleSuccess(cmd, a.Id, t, a)
+			HandleSuccess(cmd, a.Id, t, attr)
 		},
 	}
 
@@ -104,8 +87,8 @@ used to define the access controls based on subject encodings and entity entitle
 
 			attr, err := h.GetAttribute(id)
 			if err != nil {
-				errMsg := fmt.Sprintf("Could not find attribute (%s)", id)
-				cli.ExitWithNotFoundError(errMsg, err)
+				errMsg := fmt.Sprintf("Failed to get attribute (%s)", id)
+				cli.ExitWithError(errMsg, err)
 			}
 
 			a := cli.GetSimpleAttribute(attr)
@@ -131,7 +114,7 @@ used to define the access controls based on subject encodings and entity entitle
 
 			attrs, err := h.ListAttributes()
 			if err != nil {
-				cli.ExitWithError("Could not get attributes", err)
+				cli.ExitWithError("Failed to list attributes", err)
 			}
 
 			t := cli.NewTable()
@@ -150,9 +133,9 @@ used to define the access controls based on subject encodings and entity entitle
 		},
 	}
 
-	policy_attributesDeleteCmd = &cobra.Command{
+	policy_attributesDeactivateCmd = &cobra.Command{
 		Use:   "deactivate",
-		Short: "Delete an attribute",
+		Short: "Deactivate an attribute",
 		Run: func(cmd *cobra.Command, args []string) {
 			flagHelper := cli.NewFlagHelper(cmd)
 			id := flagHelper.GetRequiredString("id")
@@ -162,16 +145,16 @@ used to define the access controls based on subject encodings and entity entitle
 
 			attr, err := h.GetAttribute(id)
 			if err != nil {
-				errMsg := fmt.Sprintf("Could not find attribute (%s)", id)
-				cli.ExitWithNotFoundError(errMsg, err)
+				errMsg := fmt.Sprintf("Failed to get attribute (%s)", id)
+				cli.ExitWithError(errMsg, err)
 			}
 
-			cli.ConfirmDelete("attribute", attr.Name)
+			cli.ConfirmAction(cli.ActionDeactivate, "attribute", attr.Name)
 
 			attr, err = h.DeactivateAttribute(id)
 			if err != nil {
-				errMsg := fmt.Sprintf("Could not deactivate attribute (%s)", id)
-				cli.ExitWithNotFoundError(errMsg, err)
+				errMsg := fmt.Sprintf("Failed to deactivate attribute (%s)", id)
+				cli.ExitWithError(errMsg, err)
 			}
 
 			a := cli.GetSimpleAttribute(attr)
@@ -199,7 +182,7 @@ used to define the access controls based on subject encodings and entity entitle
 			labels := flagHelper.GetStringSlice("label", metadataLabels, cli.FlagHelperStringSliceOptions{Min: 0})
 
 			if a, err := h.UpdateAttribute(id, getMetadataMutable(labels), getMetadataUpdateBehavior()); err != nil {
-				cli.ExitWithError("Could not update attribute", err)
+				cli.ExitWithError(fmt.Sprintf("Failed to update attribute (%s)", id), err)
 			} else {
 				HandleSuccess(cmd, id, nil, a)
 			}
@@ -214,7 +197,7 @@ func init() {
 	policy_attributesCmd.AddCommand(policy_attributesCreateCmd)
 	policy_attributesCreateCmd.Flags().StringP("name", "n", "", "Name of the attribute")
 	policy_attributesCreateCmd.Flags().StringP("rule", "r", "", "Rule of the attribute")
-	policy_attributesCreateCmd.Flags().StringSliceVarP(&attrValues, "values", "v", []string{}, "Values of the attribute")
+	policy_attributesCreateCmd.Flags().StringSliceVarP(&attrValues, "value", "v", []string{}, "Values of the attribute")
 	policy_attributesCreateCmd.Flags().StringP("namespace", "s", "", "Namespace of the attribute")
 	injectLabelFlags(policy_attributesCreateCmd, false)
 
@@ -230,7 +213,7 @@ func init() {
 	policy_attributeUpdateCmd.Flags().StringP("id", "i", "", "Id of the attribute")
 	injectLabelFlags(policy_attributeUpdateCmd, true)
 
-	// Delete an attribute
-	policy_attributesCmd.AddCommand(policy_attributesDeleteCmd)
-	policy_attributesDeleteCmd.Flags().StringP("id", "i", "", "Id of the attribute")
+	// Deactivate an attribute
+	policy_attributesCmd.AddCommand(policy_attributesDeactivateCmd)
+	policy_attributesDeactivateCmd.Flags().StringP("id", "i", "", "Id of the attribute")
 }
diff --git a/cmd/policy-namespaces.go b/cmd/policy-namespaces.go
index a7d6e59a..de43629a 100644
--- a/cmd/policy-namespaces.go
+++ b/cmd/policy-namespaces.go
@@ -16,7 +16,7 @@ var (
 		policy_namespaceGetCmd.Use,
 		policy_namespacesListCmd.Use,
 		policy_namespaceUpdateCmd.Use,
-		policy_namespaceDeleteCmd.Use,
+		policy_namespaceDeactivateCmd.Use,
 	}
 
 	policy_namespacesCmd = &cobra.Command{
@@ -43,8 +43,8 @@ or different attributes tied to each.
 
 			ns, err := h.GetNamespace(id)
 			if err != nil {
-				errMsg := fmt.Sprintf("Could not find namespace (%s)", id)
-				cli.ExitWithNotFoundError(errMsg, err)
+				errMsg := fmt.Sprintf("Failed to get namespace (%s)", id)
+				cli.ExitWithError(errMsg, err)
 			}
 
 			t := cli.NewTabular().
@@ -65,7 +65,7 @@ or different attributes tied to each.
 
 			list, err := h.ListNamespaces()
 			if err != nil {
-				cli.ExitWithError("Could not get namespaces", err)
+				cli.ExitWithError("Failed to list namespaces", err)
 			}
 
 			t := cli.NewTable()
@@ -93,7 +93,7 @@ or different attributes tied to each.
 
 			created, err := h.CreateNamespace(name, getMetadataMutable(metadataLabels))
 			if err != nil {
-				cli.ExitWithError("Could not create namespace", err)
+				cli.ExitWithError("Failed to create namespace", err)
 			}
 
 			t := cli.NewTabular().Rows([][]string{
@@ -104,9 +104,9 @@ or different attributes tied to each.
 		},
 	}
 
-	policy_namespaceDeleteCmd = &cobra.Command{
+	policy_namespaceDeactivateCmd = &cobra.Command{
 		Use:   "deactivate",
-		Short: "Delete a namespace by id",
+		Short: "Deactivate a namespace by id",
 		Run: func(cmd *cobra.Command, args []string) {
 			h := cli.NewHandler(cmd)
 			defer h.Close()
@@ -116,15 +116,16 @@ or different attributes tied to each.
 
 			ns, err := h.GetNamespace(id)
 			if err != nil {
-				errMsg := fmt.Sprintf("Could not find namespace (%s)", id)
-				cli.ExitWithNotFoundError(errMsg, err)
+				errMsg := fmt.Sprintf("Failed to find namespace (%s)", id)
+				cli.ExitWithError(errMsg, err)
 			}
 
-			cli.ConfirmDelete("namespace", ns.Name)
+			cli.ConfirmAction(cli.ActionDeactivate, "namespace", ns.Name)
 
-			if err := h.DeactivateNamespace(id); err != nil {
-				errMsg := fmt.Sprintf("Could not deactivate namespace (%s)", id)
-				cli.ExitWithNotFoundError(errMsg, err)
+			d, err := h.DeactivateNamespace(id)
+			if err != nil {
+				errMsg := fmt.Sprintf("Failed to deactivate namespace (%s)", id)
+				cli.ExitWithError(errMsg, err)
 			}
 
 			t := cli.NewTabular().
@@ -132,7 +133,7 @@ or different attributes tied to each.
 					{"Id", ns.Id},
 					{"Name", ns.Name},
 				}...)
-			HandleSuccess(cmd, ns.Id, t, ns)
+			HandleSuccess(cmd, ns.Id, t, d)
 		},
 	}
 
@@ -154,7 +155,7 @@ or different attributes tied to each.
 				getMetadataUpdateBehavior(),
 			)
 			if err != nil {
-				cli.ExitWithError("Could not update namespace", err)
+				cli.ExitWithError(fmt.Sprintf("Failed to update namespace (%s)", id), err)
 			}
 
 			t := cli.NewTabular().Rows([][]string{
@@ -182,6 +183,6 @@ func init() {
 	policy_namespaceUpdateCmd.Flags().StringP("id", "i", "", "Id of the namespace")
 	injectLabelFlags(policy_namespaceUpdateCmd, true)
 
-	policy_namespacesCmd.AddCommand(policy_namespaceDeleteCmd)
-	policy_namespaceDeleteCmd.Flags().StringP("id", "i", "", "Id of the namespace")
+	policy_namespacesCmd.AddCommand(policy_namespaceDeactivateCmd)
+	policy_namespaceDeactivateCmd.Flags().StringP("id", "i", "", "Id of the namespace")
 }
diff --git a/cmd/policy-resource_mappings.go b/cmd/policy-resource_mappings.go
index 01ad5f34..7bc346a0 100644
--- a/cmd/policy-resource_mappings.go
+++ b/cmd/policy-resource_mappings.go
@@ -2,6 +2,7 @@ package cmd
 
 import (
 	_ "embed"
+	"fmt"
 	"strings"
 
 	"github.com/opentdf/tructl/docs/man"
@@ -68,7 +69,7 @@ var (
 
 			resourceMapping, err := h.GetResourceMapping(id)
 			if err != nil {
-				cli.ExitWithError("Failed to get resource mapping", err)
+				cli.ExitWithError(fmt.Sprintf("Failed to get resource mapping (%s)", id), err)
 			}
 
 			t := cli.NewTabular().Rows([][]string{
@@ -117,7 +118,7 @@ var (
 
 			resourceMapping, err := h.UpdateResourceMapping(id, attrValueId, terms, getMetadataMutable(labels), getMetadataUpdateBehavior())
 			if err != nil {
-				cli.ExitWithError("Failed to update resource mapping", err)
+				cli.ExitWithError(fmt.Sprintf("Failed to update resource mapping (%s)", id), err)
 			}
 
 			t := cli.NewTabular().Rows([][]string{
@@ -140,11 +141,11 @@ var (
 			flagHelper := cli.NewFlagHelper(cmd)
 			id := flagHelper.GetRequiredString("id")
 
-			cli.ConfirmDelete("resource-mapping", id)
+			cli.ConfirmAction(cli.ActionDelete, "resource-mapping", id)
 
 			resourceMapping, err := h.DeleteResourceMapping(id)
 			if err != nil {
-				cli.ExitWithError("Failed to delete resource mapping", err)
+				cli.ExitWithError(fmt.Sprintf("Failed to delete resource mapping (%s)", id), err)
 			}
 
 			t := cli.NewTabular().Rows([][]string{
diff --git a/cmd/policy-subject_condition_sets.go b/cmd/policy-subject_condition_sets.go
index e5c2428b..390ab0af 100644
--- a/cmd/policy-subject_condition_sets.go
+++ b/cmd/policy-subject_condition_sets.go
@@ -109,7 +109,7 @@ a Subject Mapping and, by said mapping, an Attribute Value.`,
 
 			scs, err := h.GetSubjectConditionSet(id)
 			if err != nil {
-				cli.ExitWithNotFoundError(fmt.Sprintf("Subject Condition Set with id %s not found", id), err)
+				cli.ExitWithError(fmt.Sprintf("Subject Condition Set with id %s not found", id), err)
 			}
 
 			var subjectSetsJSON []byte
@@ -218,13 +218,13 @@ a Subject Mapping and, by said mapping, an Attribute Value.`,
 
 			scs, err := h.GetSubjectConditionSet(id)
 			if err != nil {
-				cli.ExitWithNotFoundError(fmt.Sprintf("Subject Condition Set with id %s not found", id), err)
+				cli.ExitWithError(fmt.Sprintf("Subject Condition Set with id %s not found", id), err)
 			}
 
-			cli.ConfirmDelete("Subject Condition Set", id)
+			cli.ConfirmAction(cli.ActionDelete, "Subject Condition Set", id)
 
 			if err := h.DeleteSubjectConditionSet(id); err != nil {
-				cli.ExitWithNotFoundError(fmt.Sprintf("Subject Condition Set with id %s not found", id), err)
+				cli.ExitWithError(fmt.Sprintf("Subject Condition Set with id %s not found", id), err)
 			}
 
 			var subjectSetsJSON []byte
diff --git a/cmd/policy-subject_mappings.go b/cmd/policy-subject_mappings.go
index 8dc2f7eb..5c5b1c82 100644
--- a/cmd/policy-subject_mappings.go
+++ b/cmd/policy-subject_mappings.go
@@ -60,8 +60,8 @@ Note: SubjectConditionSets are reusable among SubjectMappings and are available
 
 			mapping, err := h.GetSubjectMapping(id)
 			if err != nil {
-				errMsg := fmt.Sprintf("Could not find subject mapping (%s)", id)
-				cli.ExitWithNotFoundError(errMsg, err)
+				errMsg := fmt.Sprintf("Failed to find subject mapping (%s)", id)
+				cli.ExitWithError(errMsg, err)
 			}
 
 			var actionsJSON []byte
@@ -101,7 +101,7 @@ Note: SubjectConditionSets are reusable among SubjectMappings and are available
 
 			list, err := h.ListSubjectMappings()
 			if err != nil {
-				cli.ExitWithError("Could not get subject mappings", err)
+				cli.ExitWithError("Failed to get subject mappings", err)
 			}
 
 			t := cli.NewTable().Width(180)
@@ -171,7 +171,7 @@ Note: SubjectConditionSets are reusable among SubjectMappings and are available
 
 			mapping, err := h.CreateNewSubjectMapping(attrValueId, actions, existingSCSId, scs, getMetadataMutable(metadataLabels))
 			if err != nil {
-				cli.ExitWithError("Could not create subject mapping", err)
+				cli.ExitWithError("Failed to create subject mapping", err)
 			}
 
 			var actionsJSON []byte
@@ -216,16 +216,16 @@ Note: SubjectConditionSets are reusable among SubjectMappings and are available
 
 			sm, err := h.GetSubjectMapping(id)
 			if err != nil {
-				errMsg := fmt.Sprintf("Could not find subject mapping (%s)", id)
-				cli.ExitWithNotFoundError(errMsg, err)
+				errMsg := fmt.Sprintf("Failed to find subject mapping (%s)", id)
+				cli.ExitWithError(errMsg, err)
 			}
 
-			cli.ConfirmDelete("subject mapping", sm.Id)
+			cli.ConfirmAction(cli.ActionDelete, "subject mapping", sm.Id)
 
 			deleted, err := h.DeleteSubjectMapping(id)
 			if err != nil {
-				errMsg := fmt.Sprintf("Could not delete subject mapping (%s)", id)
-				cli.ExitWithNotFoundError(errMsg, err)
+				errMsg := fmt.Sprintf("Failed to delete subject mapping (%s)", id)
+				cli.ExitWithError(errMsg, err)
 			}
 			HandleSuccess(cmd, id, nil, deleted)
 		},
@@ -267,7 +267,7 @@ full set of actions on update. `,
 				getMetadataUpdateBehavior(),
 			)
 			if err != nil {
-				cli.ExitWithError("Could not update subject mapping", err)
+				cli.ExitWithError("Failed to update subject mapping", err)
 			}
 
 			HandleSuccess(cmd, id, nil, updated)
diff --git a/go.mod b/go.mod
index e2c5c902..d55e20eb 100644
--- a/go.mod
+++ b/go.mod
@@ -11,8 +11,8 @@ require (
 	github.com/creasty/defaults v1.7.0
 	github.com/golang-jwt/jwt/v4 v4.5.0
 	github.com/muesli/reflow v0.3.0
-	github.com/opentdf/platform/protocol/go v0.0.0-20240314151303-79519c9c870f
-	github.com/opentdf/platform/sdk v0.0.0-20240314151303-79519c9c870f
+	github.com/opentdf/platform/protocol/go v0.0.0-20240328192545-ab689ebe9123
+	github.com/opentdf/platform/sdk v0.0.0-20240328192545-ab689ebe9123
 	github.com/spf13/cobra v1.8.0
 	github.com/spf13/viper v1.18.2
 	github.com/zalando/go-keyring v0.2.4
@@ -22,20 +22,15 @@ require (
 
 require (
 	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.33.0-20240221180331-f05a6f4403ce.1 // indirect
-	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
 	github.com/BurntSushi/toml v0.3.1 // indirect
 	github.com/alessio/shellescape v1.4.1 // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/catppuccin/go v0.2.0 // indirect
 	github.com/containerd/console v1.0.4 // indirect
-	github.com/coreos/go-oidc/v3 v3.9.0 // indirect
 	github.com/danieljoos/wincred v1.2.0 // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 // indirect
 	github.com/fsnotify/fsnotify v1.7.0 // indirect
-	github.com/go-jose/go-jose/v3 v3.0.3 // indirect
-	github.com/go-logr/logr v1.4.1 // indirect
-	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/goccy/go-json v0.10.2 // indirect
 	github.com/godbus/dbus/v5 v5.1.0 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
@@ -43,7 +38,6 @@ require (
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.1 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/klauspost/compress v1.17.2 // indirect
 	github.com/lestrrat-go/blackmagic v1.0.2 // indirect
 	github.com/lestrrat-go/httpcc v1.0.1 // indirect
 	github.com/lestrrat-go/httprc v1.0.5 // indirect
@@ -55,12 +49,10 @@ require (
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-localereader v0.0.1 // indirect
 	github.com/mattn/go-runewidth v0.0.15 // indirect
-	github.com/miekg/pkcs11 v1.1.1 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/muesli/termenv v0.15.2 // indirect
-	github.com/opentdf/backend-go v0.1.17 // indirect
 	github.com/pelletier/go-toml/v2 v2.1.0 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rogpeppe/go-internal v1.12.0 // indirect
@@ -73,12 +65,7 @@ require (
 	github.com/spf13/cast v1.6.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
-	github.com/virtru/access-pdp v1.11.0 // indirect
-	go.opentelemetry.io/otel v1.24.0 // indirect
-	go.opentelemetry.io/otel/metric v1.24.0 // indirect
-	go.opentelemetry.io/otel/trace v1.24.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	go.uber.org/zap v1.27.0 // indirect
 	golang.org/x/crypto v0.21.0 // indirect
 	golang.org/x/exp v0.0.0-20240222234643-814bf88cf225 // indirect
 	golang.org/x/net v0.22.0 // indirect
@@ -87,10 +74,9 @@ require (
 	golang.org/x/term v0.18.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
 	google.golang.org/appengine v1.6.8 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240311173647-c811ad7063a7 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240311173647-c811ad7063a7 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20240325203815-454cdb8f5daa // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240325203815-454cdb8f5daa // indirect
 	google.golang.org/protobuf v1.33.0 // indirect
-	gopkg.in/go-jose/go-jose.v2 v2.6.3 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
diff --git a/go.sum b/go.sum
index 1a446025..6161e995 100644
--- a/go.sum
+++ b/go.sum
@@ -8,8 +8,8 @@ github.com/BurntSushi/toml v0.3.1 h1:WXkYYl6Yr3qBf1K79EBnL4mak0OimBfB0XUf9Vl28OQ
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
 github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
-github.com/Microsoft/hcsshim v0.11.4 h1:68vKo2VN8DE9AdN4tnkWnmdhqdbpUFM8OF3Airm7fz8=
-github.com/Microsoft/hcsshim v0.11.4/go.mod h1:smjE4dvqPX9Zldna+t5FG3rnoHhaB7QYxPRqGcpAD9w=
+github.com/Microsoft/hcsshim v0.12.0 h1:rbICA+XZFwrBef2Odk++0LjFvClNCJGRK+fsrP254Ts=
+github.com/Microsoft/hcsshim v0.12.0/go.mod h1:RZV12pcHCXQ42XnlQ3pz6FZfmrC1C+R4gaOHhRNML1g=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d/go.mod h1:asat636LX7Bqt5lYEZ27JNDcqxfjdBQuJ/MM4CN/Lzo=
 github.com/adrg/frontmatter v0.2.0 h1:/DgnNe82o03riBd1S+ZDjd43wAmC6W35q67NHeLkPd4=
@@ -34,12 +34,10 @@ github.com/charmbracelet/lipgloss v0.10.0 h1:KWeXFSexGcfahHX+54URiZGkBFazf70JNMt
 github.com/charmbracelet/lipgloss v0.10.0/go.mod h1:Wig9DSfvANsxqkRsqj6x87irdy123SR4dOXlKa91ciE=
 github.com/containerd/console v1.0.4 h1:F2g4+oChYvBTsASRTz8NP6iIAi97J3TtSAsLbIFn4ro=
 github.com/containerd/console v1.0.4/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
-github.com/containerd/containerd v1.7.12 h1:+KQsnv4VnzyxWcfO9mlxxELaoztsDEjOuCMPAuPqgU0=
-github.com/containerd/containerd v1.7.12/go.mod h1:/5OMpE1p0ylxtEUGY8kuCYkDRzJm9NO1TFMWjUpdevk=
+github.com/containerd/containerd v1.7.14 h1:H/XLzbnGuenZEGK+v0RkwTdv2u1QFAruMe5N0GNPJwA=
+github.com/containerd/containerd v1.7.14/go.mod h1:YMC9Qt5yzNqXx/fO4j/5yYVIHXSRrlB3H7sxkUTvspg=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
-github.com/coreos/go-oidc/v3 v3.9.0 h1:0J/ogVOd4y8P0f0xUh8l9t07xRP/d8tccvjHl2dcsSo=
-github.com/coreos/go-oidc/v3 v3.9.0/go.mod h1:rTKz2PYwftcrtoCzV5g5kvfJoWcm0Mk8AF8y1iAQro4=
 github.com/cpuguy83/dockercfg v0.3.1 h1:/FpZ+JaygUR/lZP2NlFI2DVfrOEMAIKP5wWEJdoYe9E=
 github.com/cpuguy83/dockercfg v0.3.1/go.mod h1:sugsbF4//dDlL/i+S+rtpIWp+5h0BHJHfjj5/jFyUJc=
 github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
@@ -61,15 +59,12 @@ github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj
 github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-github.com/felixge/httpsnoop v1.0.3 h1:s/nj+GCswXYzN5v2DpNMuMQYe+0DDwt5WVCU6CWBdXk=
-github.com/felixge/httpsnoop v1.0.3/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
 github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
-github.com/go-jose/go-jose/v3 v3.0.3 h1:fFKWeig/irsp7XD2zBxvnmA/XaRWp5V3CBsZXJF7G7k=
-github.com/go-jose/go-jose/v3 v3.0.3/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
-github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
 github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
@@ -89,7 +84,6 @@ github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiu
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -100,10 +94,8 @@ github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/jarcoal/httpmock v1.3.1 h1:iUx3whfZWVf3jT01hQTO/Eo5sAYtB2/rqaUuOtpInww=
-github.com/jarcoal/httpmock v1.3.1/go.mod h1:3yb8rc4BI7TCBhFY8ng0gjuLKJNquuDNiPaZjnENuYg=
-github.com/klauspost/compress v1.17.2 h1:RlWWUY/Dr4fL8qk9YG7DTZ7PDgME2V4csBXA8L/ixi4=
-github.com/klauspost/compress v1.17.2/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
+github.com/klauspost/compress v1.17.7 h1:ehO88t2UGzQK66LMdE8tibEd1ErmzZjNEqWkjLAKQQg=
+github.com/klauspost/compress v1.17.7/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -135,8 +127,6 @@ github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+Ei
 github.com/mattn/go-runewidth v0.0.12/go.mod h1:RAqKPSqVFrSLVXbA8x7dzmKdmGzieGRCM46jaSJTDAk=
 github.com/mattn/go-runewidth v0.0.15 h1:UNAjwbU9l54TA3KzvqLGxwWjHmMgBUVhBiTjelZgg3U=
 github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
-github.com/miekg/pkcs11 v1.1.1 h1:Ugu9pdy6vAYku5DEpVWVFPYnzV+bxB+iRdbuFSu7TvU=
-github.com/miekg/pkcs11 v1.1.1/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
@@ -159,14 +149,12 @@ github.com/muesli/termenv v0.15.2 h1:GohcuySI0QmI3wN8Ok9PtKGkgkFIk7y6Vpb5PvrY+Wo
 github.com/muesli/termenv v0.15.2/go.mod h1:Epx+iuz8sNs7mNKhxzH4fWXGNpZwUaJKRS1noLXviQ8=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.1.0-rc5 h1:Ygwkfw9bpDvs+c9E34SdgGOj41dX/cbdlwvlWt0pnFI=
-github.com/opencontainers/image-spec v1.1.0-rc5/go.mod h1:X4pATf0uXsnn3g5aiGIsVnJBR4mxhKzfwmvK/B2NTm8=
-github.com/opentdf/backend-go v0.1.17 h1:RA/9Mj7OKycnvOrkIZTJCsSyROCcioXzzqMUlnCxP48=
-github.com/opentdf/backend-go v0.1.17/go.mod h1:4RAZ3K19YOJkpxSh4jl6vtjOUkK3H/zqA32LeBf3CDQ=
-github.com/opentdf/platform/protocol/go v0.0.0-20240314151303-79519c9c870f h1:+xE7MKFotF15VAEzvgx8LEK/ysx0RuZhoOc6vnKOr8Q=
-github.com/opentdf/platform/protocol/go v0.0.0-20240314151303-79519c9c870f/go.mod h1:qwJ2OQqNVtucVgkLlZhz6O1I1fxqHTXrl5HVRu9AO4Y=
-github.com/opentdf/platform/sdk v0.0.0-20240314151303-79519c9c870f h1:T7z84OKFYYX59KHAB3ifcu1EUUQT1kcCthADLihvSA4=
-github.com/opentdf/platform/sdk v0.0.0-20240314151303-79519c9c870f/go.mod h1:7HLs/qMMlM3aTf6alULPgXet/AYzc4EySv94GRoA50Q=
+github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
+github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
+github.com/opentdf/platform/protocol/go v0.0.0-20240328192545-ab689ebe9123 h1:otRtkhiBu075GliWAxX12QpiK4dlJdeOtSjomfJ25h0=
+github.com/opentdf/platform/protocol/go v0.0.0-20240328192545-ab689ebe9123/go.mod h1:QcLUArzpnfaLehOin8EBM77dCyyUwlRg/kH6uhy+HVE=
+github.com/opentdf/platform/sdk v0.0.0-20240328192545-ab689ebe9123 h1:flVFbXMjPRZ8t9GRxoGAva14qEMia1DOQbkJvb3ImXs=
+github.com/opentdf/platform/sdk v0.0.0-20240328192545-ab689ebe9123/go.mod h1:+HlyE1QyT7HsW5UlDGnBZVm0YdEfdv7g+K6pWDV8OAg=
 github.com/pelletier/go-toml/v2 v2.1.0 h1:FnwAJ4oYMvbT/34k9zzHuZNrhlz48GB3/s6at6/MHO4=
 github.com/pelletier/go-toml/v2 v2.1.0/go.mod h1:tJU2Z3ZkXwnxa4DPO899bsyIoywizdUvyaeZurnPPDc=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -214,7 +202,6 @@ github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSS
 github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
@@ -228,94 +215,73 @@ github.com/tklauser/go-sysconf v0.3.12 h1:0QaGUFOdQaIVdPgfITYzaTegZvdCjmYO52cSFA
 github.com/tklauser/go-sysconf v0.3.12/go.mod h1:Ho14jnntGE1fpdOqQEEaiKRpvIavV0hSfmBq8nJbHYI=
 github.com/tklauser/numcpus v0.6.1 h1:ng9scYS7az0Bk4OZLvrNXNSAO2Pxr1XXRAPyjhIx+Fk=
 github.com/tklauser/numcpus v0.6.1/go.mod h1:1XfjsgE2zo8GVw7POkMbHENHzVg3GzmoZ9fESEdAacY=
-github.com/virtru/access-pdp v1.11.0 h1:JmMUo5EExOg99TKNQ6AdwUDLdBwVvSpjxUVVJxJ0RR4=
-github.com/virtru/access-pdp v1.11.0/go.mod h1:7OkDvrJX9qtzZ8KYFv7uvbp3IuhJZBqjVaPcH+Irnc0=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yusufpapurcu/wmi v1.2.3 h1:E1ctvB7uKFMOJw3fdOW32DwGE9I7t++CRUEMKvFoFiw=
 github.com/yusufpapurcu/wmi v1.2.3/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
 github.com/zalando/go-keyring v0.2.4 h1:wi2xxTqdiwMKbM6TWwi+uJCG/Tum2UV0jqaQhCa9/68=
 github.com/zalando/go-keyring v0.2.4/go.mod h1:HL4k+OXQfJUWaMnqyuSOc0drfGPX2b51Du6K+MRgZMk=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.45.0 h1:x8Z78aZx8cOF0+Kkazoc7lwUNMGy0LrzEMxTm4BbTxg=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.45.0/go.mod h1:62CPTSry9QZtOaSsE3tOzhx6LzDhHnXJ6xHeMNNiM6Q=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 h1:jq9TW8u3so/bN+JPT166wjOI6/vQPF6Xe7nMNIltagk=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0/go.mod h1:p8pYQP+m5XfbZm9fxtSKAbM6oIllS7s2AfxrChvc7iw=
 go.opentelemetry.io/otel v1.24.0 h1:0LAOdjNmQeSTzGBzduGe/rU4tZhMwL5rWgtp9Ku5Jfo=
 go.opentelemetry.io/otel v1.24.0/go.mod h1:W7b9Ozg4nkF5tWI5zsXkaKKDjdVjpD4oAt9Qi/MArHo=
 go.opentelemetry.io/otel/metric v1.24.0 h1:6EhoGWWK28x1fbpA4tYTOWBkPefTDQnb8WSGXlc88kI=
 go.opentelemetry.io/otel/metric v1.24.0/go.mod h1:VYhLe1rFfxuTXLgj4CBiyz+9WYBA8pNGJgDcSFRKBco=
 go.opentelemetry.io/otel/trace v1.24.0 h1:CsKnnL4dUAr/0llH9FKuc698G04IrpWV0MQA/Y1YELI=
 go.opentelemetry.io/otel/trace v1.24.0/go.mod h1:HPc3Xr/cOApsBI154IU0OI0HJexz+aw5uPdbs3UCjNU=
-go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
-go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
-go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
-go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.21.0 h1:X31++rzVUdKhX5sWmSOFZxx8UW/ldWx55cbf08iNAMA=
 golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
 golang.org/x/exp v0.0.0-20240222234643-814bf88cf225 h1:LfspQV/FYTatPTr/3HzIcmiUFH7PGP+OQ6mgDYo3yuQ=
 golang.org/x/exp v0.0.0-20240222234643-814bf88cf225/go.mod h1:CxmFvTBINI24O/j8iY7H1xHzx2i4OsyguNBmN/uPtqc=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0 h1:SernR4v+D55NyBH2QiEQrlBAnj1ECL6AGrA5+dPaMY8=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.22.0 h1:9sGLhx7iRIHEiX0oAJ3MRZMUCElJgy7Br1nO+AMN3Tc=
 golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
 golang.org/x/oauth2 v0.16.0 h1:aDkGMBSYxElaoP81NpoUoz2oo2R2wHdZpGToUxfyQrQ=
 golang.org/x/oauth2 v0.16.0/go.mod h1:hqZ+0LWXsiVoZpeld6jVt06P3adbS2Uu911W1SsJv2o=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
 golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.18.0 h1:FcHjZXDMxI8mM3nwhX9HlKop4C0YQvCVCdwYl2wOtE8=
 golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.18.0 h1:k8NLag8AGHnn+PHbl7g43CtqZAwG60vZkLqgyZgIHgQ=
 golang.org/x/tools v0.18.0/go.mod h1:GL7B4CwcLLeo59yx/9UWWuNOW1n3VZ4f5axWfML7Lcg=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
 google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
-google.golang.org/genproto/googleapis/api v0.0.0-20240311173647-c811ad7063a7 h1:oqta3O3AnlWbmIE3bFnWbu4bRxZjfbWCp0cKSuZh01E=
-google.golang.org/genproto/googleapis/api v0.0.0-20240311173647-c811ad7063a7/go.mod h1:VQW3tUculP/D4B+xVCo+VgSq8As6wA9ZjHl//pmk+6s=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240311173647-c811ad7063a7 h1:8EeVk1VKMD+GD/neyEHGmz7pFblqPjHoi+PGQIlLx2s=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240311173647-c811ad7063a7/go.mod h1:WtryC6hu0hhx87FDGxWCDptyssuo68sk10vYjF+T9fY=
+google.golang.org/genproto/googleapis/api v0.0.0-20240325203815-454cdb8f5daa h1:Jt1XW5PaLXF1/ePZrznsh/aAUvI7Adfc3LY1dAKlzRs=
+google.golang.org/genproto/googleapis/api v0.0.0-20240325203815-454cdb8f5daa/go.mod h1:K4kfzHtI0kqWA79gecJarFtDn/Mls+GxQcg3Zox91Ac=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240325203815-454cdb8f5daa h1:RBgMaUMP+6soRkik4VoN8ojR2nex2TqZwjSSogic+eo=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240325203815-454cdb8f5daa/go.mod h1:WtryC6hu0hhx87FDGxWCDptyssuo68sk10vYjF+T9fY=
 google.golang.org/grpc v1.62.1 h1:B4n+nfKzOICUXMgyrNd19h/I9oH0L1pizfk1d4zSgTk=
 google.golang.org/grpc v1.62.1/go.mod h1:IWTG0VlJLCh1SkC58F7np9ka9mx/WNkjl4PGJaiq+QE=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
@@ -325,8 +291,6 @@ google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHh
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/go-jose/go-jose.v2 v2.6.3 h1:nt80fvSDlhKWQgSWyHyy5CfmlQr+asih51R8PTWNKKs=
-gopkg.in/go-jose/go-jose.v2 v2.6.3/go.mod h1:zzZDPkNNw/c9IE7Z9jr11mBZQhKQTMzoEEIoEdZlFBI=
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
 gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
diff --git a/pkg/cli/confirm.go b/pkg/cli/confirm.go
index b509d262..2b068da5 100644
--- a/pkg/cli/confirm.go
+++ b/pkg/cli/confirm.go
@@ -7,10 +7,25 @@ import (
 	"github.com/charmbracelet/huh"
 )
 
-func ConfirmDelete(resource string, id string) {
+const (
+	// top level actions
+	ActionGet        = "get"
+	ActionList       = "list"
+	ActionCreate     = "create"
+	ActionUpdate     = "update"
+	ActionDeactivate = "deactivate"
+	ActionDelete     = "delete"
+
+	// member actions
+	ActionMemberAdd     = "add members"
+	ActionMemberRemove  = "remove members"
+	ActionMemberReplace = "replace all existing members"
+)
+
+func ConfirmAction(action, resource, id string) {
 	var confirm bool
 	err := huh.NewConfirm().
-		Title(fmt.Sprintf("Are you sure you want to delete %s:\n\n\t%s", resource, id)).
+		Title(fmt.Sprintf("Are you sure you want to %s %s:\n\n\t%s", action, resource, id)).
 		Affirmative("yes").
 		Negative("no").
 		Value(&confirm).
diff --git a/pkg/cli/errors.go b/pkg/cli/errors.go
index c3b5be0a..a09de8d3 100644
--- a/pkg/cli/errors.go
+++ b/pkg/cli/errors.go
@@ -9,6 +9,7 @@ import (
 )
 
 func ExitWithError(errMsg string, err error) {
+	ExitWithNotFoundError(errMsg, err)
 	if err != nil {
 		fmt.Println(ErrorMessage(errMsg, err))
 		os.Exit(1)
@@ -17,7 +18,7 @@ func ExitWithError(errMsg string, err error) {
 
 func ExitWithNotFoundError(errMsg string, err error) {
 	if e, ok := status.FromError(err); ok && e.Code() == codes.NotFound {
-		fmt.Println(ErrorMessage(errMsg+" not found", nil))
+		fmt.Println(ErrorMessage(errMsg+": not found", nil))
 		os.Exit(1)
 	}
 }
diff --git a/pkg/cli/handlers.go b/pkg/cli/handlers.go
index fe2fd6fa..e251df69 100644
--- a/pkg/cli/handlers.go
+++ b/pkg/cli/handlers.go
@@ -8,7 +8,7 @@ import (
 func NewHandler(cmd *cobra.Command) handlers.Handler {
 	h, err := handlers.New(cmd.Flag("host").Value.String())
 	if err != nil {
-		ExitWithError("Could not connect to server", err)
+		ExitWithError("Failed to connect to server", err)
 	}
 	return h
 }
diff --git a/pkg/cli/messages.go b/pkg/cli/messages.go
index d35d3a66..deabe5a1 100644
--- a/pkg/cli/messages.go
+++ b/pkg/cli/messages.go
@@ -11,6 +11,9 @@ func SuccessMessage(msg string) string {
 }
 
 func FooterMessage(msg string) string {
+	if msg == "" {
+		return ""
+	}
 	w := lipgloss.Width
 	note := footerLabelStyle.Render("NOTE ")
 	footer := footerTextStyle.Copy().Width(defaultTableWidth - w(note)).Render(msg)
diff --git a/pkg/cli/sdkHelpers.go b/pkg/cli/sdkHelpers.go
index bfcae94a..b1fb8440 100644
--- a/pkg/cli/sdkHelpers.go
+++ b/pkg/cli/sdkHelpers.go
@@ -13,17 +13,35 @@ type SimpleAttribute struct {
 	Namespace string
 }
 
+type SimpleAttributeValue struct {
+	Id      string
+	FQN     string
+	Members []string
+}
+
 func GetSimpleAttribute(a *policy.Attribute) SimpleAttribute {
 	values := []string{}
-	for _, v := range a.Values {
-		values = append(values, v.Value)
+	for _, v := range a.GetValues() {
+		values = append(values, v.GetValue())
 	}
 
 	return SimpleAttribute{
-		Id:        a.Id,
-		Name:      a.Name,
-		Rule:      handlers.GetAttributeRuleFromAttributeType(a.Rule),
+		Id:        a.GetId(),
+		Name:      a.GetName(),
+		Rule:      handlers.GetAttributeRuleFromAttributeType(a.GetRule()),
 		Values:    values,
-		Namespace: a.Namespace.Name,
+		Namespace: a.GetNamespace().GetName(),
+	}
+}
+
+func GetSimpleAttributeValue(v *policy.Value) SimpleAttributeValue {
+	memberIds := []string{}
+	for _, m := range v.Members {
+		memberIds = append(memberIds, m.Id)
+	}
+	return SimpleAttributeValue{
+		Id:      v.Id,
+		FQN:     v.Fqn,
+		Members: memberIds,
 	}
 }
diff --git a/pkg/cli/tabular.go b/pkg/cli/tabular.go
index e4cad33b..04fcff40 100644
--- a/pkg/cli/tabular.go
+++ b/pkg/cli/tabular.go
@@ -26,22 +26,22 @@ func PrintSuccessTable(cmd *cobra.Command, id string, t *table.Table) {
 		helper string
 	}
 	switch cmd.Use {
-	case "get":
+	case ActionGet:
 		msg.verb = fmt.Sprintf("Found %s: %s", resource, id)
 		msg.helper = getJsonHelper(resource + " get --id=" + id)
-	case "create":
+	case ActionCreate:
 		msg.verb = fmt.Sprintf("Created %s: %s", resource, id)
 		msg.helper = getJsonHelper(resource + " get --id=" + id)
-	case "update":
+	case ActionUpdate:
 		msg.verb = fmt.Sprintf("Updated %s: %s", resource, id)
 		msg.helper = getJsonHelper(resource + " get --id=" + id)
-	case "delete":
+	case ActionDelete:
 		msg.verb = fmt.Sprintf("Deleted %s: %s", resource, id)
 		msg.helper = getJsonHelper(resource + " list")
-	case "deactivate":
+	case ActionDeactivate:
 		msg.verb = fmt.Sprintf("Deactivated %s: %s", resource, id)
 		msg.helper = getJsonHelper(resource + " list") // TODO: make sure the filters are provided here to get ACTIVE/INACTIVE/ANY
-	case "list":
+	case ActionList:
 		msg.verb = fmt.Sprintf("Found %s list", resource)
 		msg.helper = getJsonHelper(resource + " get --id=<id>")
 	default:
diff --git a/pkg/handlers/attribute.go b/pkg/handlers/attribute.go
index 9fefa7c7..2007f16e 100644
--- a/pkg/handlers/attribute.go
+++ b/pkg/handlers/attribute.go
@@ -49,7 +49,8 @@ func (h Handler) ListAttributes() ([]*policy.Attribute, error) {
 	return resp.Attributes, err
 }
 
-func (h Handler) CreateAttribute(name string, rule string, namespace string, metadata *common.MetadataMutable) (*policy.Attribute, error) {
+// Creates and returns the created attribute
+func (h Handler) CreateAttribute(name string, rule string, namespace string, values []string, metadata *common.MetadataMutable) (*policy.Attribute, error) {
 	r, err := GetAttributeRuleFromReadableString(rule)
 	if err != nil {
 		return nil, err
@@ -60,6 +61,7 @@ func (h Handler) CreateAttribute(name string, rule string, namespace string, met
 		Name:        name,
 		Rule:        r,
 		Metadata:    metadata,
+		Values:      values,
 	}
 
 	resp, err := h.sdk.Attributes.CreateAttribute(h.ctx, attrReq)
@@ -67,37 +69,35 @@ func (h Handler) CreateAttribute(name string, rule string, namespace string, met
 		return nil, err
 	}
 
-	attr := resp.Attribute
-
-	return &policy.Attribute{
-		Id:        attr.Id,
-		Name:      attr.Name,
-		Rule:      attr.Rule,
-		Namespace: attr.Namespace,
-	}, nil
+	return h.GetAttribute(resp.GetAttribute().GetId())
 }
 
-// TODO: verify updation behavior
+// Updates and returns updated attribute
 func (h *Handler) UpdateAttribute(
 	id string,
 	metadata *common.MetadataMutable,
 	behavior common.MetadataUpdateEnum,
-) (*attributes.UpdateAttributeResponse, error) {
-	return h.sdk.Attributes.UpdateAttribute(h.ctx, &attributes.UpdateAttributeRequest{
+) (*policy.Attribute, error) {
+	_, err := h.sdk.Attributes.UpdateAttribute(h.ctx, &attributes.UpdateAttributeRequest{
 		Id:                     id,
 		Metadata:               metadata,
 		MetadataUpdateBehavior: behavior,
 	})
+	if err != nil {
+		return nil, err
+	}
+	return h.GetAttribute(id)
 }
 
+// Deactivates and returns deactivated attribute
 func (h Handler) DeactivateAttribute(id string) (*policy.Attribute, error) {
-	resp, err := h.sdk.Attributes.DeactivateAttribute(h.ctx, &attributes.DeactivateAttributeRequest{
+	_, err := h.sdk.Attributes.DeactivateAttribute(h.ctx, &attributes.DeactivateAttributeRequest{
 		Id: id,
 	})
 	if err != nil {
 		return nil, err
 	}
-	return resp.Attribute, err
+	return h.GetAttribute(id)
 }
 
 func GetAttributeFqn(namespace string, name string) string {
diff --git a/pkg/handlers/attributeValues.go b/pkg/handlers/attributeValues.go
new file mode 100644
index 00000000..d36c592e
--- /dev/null
+++ b/pkg/handlers/attributeValues.go
@@ -0,0 +1,58 @@
+package handlers
+
+import (
+	"github.com/opentdf/platform/protocol/go/common"
+	"github.com/opentdf/platform/protocol/go/policy"
+	"github.com/opentdf/platform/protocol/go/policy/attributes"
+)
+
+// Creates and returns the created value
+func (h *Handler) CreateAttributeValue(attributeId string, value string, metadata *common.MetadataMutable) (*policy.Value, error) {
+	resp, err := h.sdk.Attributes.CreateAttributeValue(h.ctx, &attributes.CreateAttributeValueRequest{
+		AttributeId: attributeId,
+		Value:       value,
+		Metadata:    metadata,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return h.GetAttributeValue(resp.GetValue().GetId())
+}
+
+func (h *Handler) GetAttributeValue(id string) (*policy.Value, error) {
+	resp, err := h.sdk.Attributes.GetAttributeValue(h.ctx, &attributes.GetAttributeValueRequest{
+		Id: id,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return resp.GetValue(), nil
+}
+
+// Updates and returns updated value
+func (h *Handler) UpdateAttributeValue(id string, memberIds []string, metadata *common.MetadataMutable, behavior common.MetadataUpdateEnum) (*policy.Value, error) {
+	resp, err := h.sdk.Attributes.UpdateAttributeValue(h.ctx, &attributes.UpdateAttributeValueRequest{
+		Id:                     id,
+		Members:                memberIds,
+		Metadata:               metadata,
+		MetadataUpdateBehavior: behavior,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return h.GetAttributeValue(resp.GetValue().GetId())
+}
+
+// Deactivates and returns deactivated value
+func (h *Handler) DeactivateAttributeValue(id string) (*policy.Value, error) {
+	_, err := h.sdk.Attributes.DeactivateAttributeValue(h.ctx, &attributes.DeactivateAttributeValueRequest{
+		Id: id,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return h.GetAttributeValue(id)
+}
diff --git a/pkg/handlers/attribute_values.go b/pkg/handlers/attribute_values.go
deleted file mode 100644
index ea587355..00000000
--- a/pkg/handlers/attribute_values.go
+++ /dev/null
@@ -1,18 +0,0 @@
-package handlers
-
-import (
-	"github.com/opentdf/platform/protocol/go/policy"
-	"github.com/opentdf/platform/protocol/go/policy/attributes"
-)
-
-func (h *Handler) CreateAttributeValue(attributeId string, value string) (*policy.Value, error) {
-	resp, err := h.sdk.Attributes.CreateAttributeValue(h.ctx, &attributes.CreateAttributeValueRequest{
-		AttributeId: attributeId,
-		Value:       value,
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	return resp.Value, nil
-}
diff --git a/pkg/handlers/authLogin.go b/pkg/handlers/authLogin.go
index 763b1aa9..686d03a3 100644
--- a/pkg/handlers/authLogin.go
+++ b/pkg/handlers/authLogin.go
@@ -10,8 +10,10 @@ import (
 	"golang.org/x/oauth2/clientcredentials"
 )
 
-const TRUCTL_CLIENT_ID_CACHE_KEY = "TRUCTL_DEFAULT_CLIENT_ID"
-const TRUCTL_OIDC_TOKEN_KEY = "TRUCTL_OIDC_TOKEN"
+const (
+	TRUCTL_CLIENT_ID_CACHE_KEY = "TRUCTL_DEFAULT_CLIENT_ID"
+	TRUCTL_OIDC_TOKEN_KEY      = "TRUCTL_OIDC_TOKEN"
+)
 
 // we're hardcoding this for now, but eventually it will be retrieved from the backend config
 // TODO udpate to use the wellknown endpoint for the platform (https://github.com/opentdf/platform/pull/296)
@@ -77,7 +79,6 @@ func GetClientIdAndSecretFromCache() (string, string, error) {
 
 // DEBUG_PrintKeyRingSecrets prints all the secrets in the keyring.
 func (h *Handler) DEBUG_PrintKeyRingSecrets() {
-
 	clientId, err := keyring.Get(TOKEN_URL, TRUCTL_CLIENT_ID_CACHE_KEY)
 	if err != nil {
 		fmt.Println("Failed to retrieve secret from keyring:", err)
@@ -143,10 +144,3 @@ func (h *Handler) GetTokenWithClientCredentials(clientID, clientSecret, tokenURL
 	h.OIDC_TOKEN = token.AccessToken
 	return token, nil
 }
-
-// GetTokenWithPasswordFlow creates a custom request to obtain a token using the resource owner password credentials flow.
-func (h *Handler) GetTokenWithPasswordFlow(username, password, clientID, clientSecret, tokenURL string, noCache bool) (string, error) {
-	errMsg := "Method `GetTokenWithPasswordFlow` is not yet implemented. Please reach out to a Virtru Platform team member to inquire about the status of it."
-	fmt.Println(errMsg)
-	return "", nil
-}
diff --git a/pkg/handlers/kas-grants.go b/pkg/handlers/kas-grants.go
index 162fa31e..a2e5e329 100644
--- a/pkg/handlers/kas-grants.go
+++ b/pkg/handlers/kas-grants.go
@@ -16,7 +16,7 @@ func (h Handler) UpdateKasGrantForAttribute(attr_id string, kas_id string) (*att
 		return nil, err
 	}
 
-	return resp.AttributeKeyAccessServer, nil
+	return resp.GetAttributeKeyAccessServer(), nil
 }
 
 func (h Handler) DeleteKasGrantFromAttribute(attr_id string, kas_id string) (*attributes.AttributeKeyAccessServer, error) {
@@ -31,7 +31,7 @@ func (h Handler) DeleteKasGrantFromAttribute(attr_id string, kas_id string) (*at
 		return nil, err
 	}
 
-	return resp.AttributeKeyAccessServer, nil
+	return resp.GetAttributeKeyAccessServer(), nil
 }
 
 func (h Handler) UpdateKasGrantForValue(val_id string, kas_id string) (*attributes.ValueKeyAccessServer, error) {
@@ -46,7 +46,7 @@ func (h Handler) UpdateKasGrantForValue(val_id string, kas_id string) (*attribut
 		return nil, err
 	}
 
-	return resp.ValueKeyAccessServer, nil
+	return resp.GetValueKeyAccessServer(), nil
 }
 
 func (h Handler) DeleteKasGrantFromValue(val_id string, kas_id string) (*attributes.ValueKeyAccessServer, error) {
@@ -61,5 +61,5 @@ func (h Handler) DeleteKasGrantFromValue(val_id string, kas_id string) (*attribu
 		return nil, err
 	}
 
-	return resp.ValueKeyAccessServer, nil
+	return resp.GetValueKeyAccessServer(), nil
 }
diff --git a/pkg/handlers/kas-registry.go b/pkg/handlers/kas-registry.go
index 4bd02a7b..5d8d2167 100644
--- a/pkg/handlers/kas-registry.go
+++ b/pkg/handlers/kas-registry.go
@@ -13,7 +13,7 @@ func (h Handler) GetKasRegistryEntry(id string) (*kasregistry.KeyAccessServer, e
 		return nil, err
 	}
 
-	return resp.KeyAccessServer, nil
+	return resp.GetKeyAccessServer(), nil
 }
 
 func (h Handler) ListKasRegistryEntries() ([]*kasregistry.KeyAccessServer, error) {
@@ -22,9 +22,10 @@ func (h Handler) ListKasRegistryEntries() ([]*kasregistry.KeyAccessServer, error
 		return nil, err
 	}
 
-	return resp.KeyAccessServers, nil
+	return resp.GetKeyAccessServers(), nil
 }
 
+// Creates the KAS registry and then returns the KAS
 func (h Handler) CreateKasRegistryEntry(uri string, publicKey *kasregistry.PublicKey, metadata *common.MetadataMutable) (*kasregistry.KeyAccessServer, error) {
 	req := &kasregistry.CreateKeyAccessServerRequest{
 		Uri:       uri,
@@ -37,11 +38,12 @@ func (h Handler) CreateKasRegistryEntry(uri string, publicKey *kasregistry.Publi
 		return nil, err
 	}
 
-	return resp.KeyAccessServer, nil
+	return h.GetKasRegistryEntry(resp.GetKeyAccessServer().GetId())
 }
 
+// Updates the KAS registry and then returns the KAS
 func (h Handler) UpdateKasRegistryEntry(id string, uri string, publickey *kasregistry.PublicKey, metadata *common.MetadataMutable, behavior common.MetadataUpdateEnum) (*kasregistry.KeyAccessServer, error) {
-	resp, err := h.sdk.KeyAccessServerRegistry.UpdateKeyAccessServer(h.ctx, &kasregistry.UpdateKeyAccessServerRequest{
+	_, err := h.sdk.KeyAccessServerRegistry.UpdateKeyAccessServer(h.ctx, &kasregistry.UpdateKeyAccessServerRequest{
 		Id:                     id,
 		Uri:                    uri,
 		PublicKey:              publickey,
@@ -52,18 +54,19 @@ func (h Handler) UpdateKasRegistryEntry(id string, uri string, publickey *kasreg
 		return nil, err
 	}
 
-	return resp.KeyAccessServer, nil
+	return h.GetKasRegistryEntry(id)
 }
 
-func (h Handler) DeleteKasRegistryEntry(id string) error {
+// Deletes the KAS registry and returns the deleted KAS
+func (h Handler) DeleteKasRegistryEntry(id string) (*kasregistry.KeyAccessServer, error) {
 	req := &kasregistry.DeleteKeyAccessServerRequest{
 		Id: id,
 	}
 
-	_, err := h.sdk.KeyAccessServerRegistry.DeleteKeyAccessServer(h.ctx, req)
+	resp, err := h.sdk.KeyAccessServerRegistry.DeleteKeyAccessServer(h.ctx, req)
 	if err != nil {
-		return err
+		return nil, err
 	}
 
-	return nil
+	return resp.GetKeyAccessServer(), nil
 }
diff --git a/pkg/handlers/namespaces.go b/pkg/handlers/namespaces.go
index 58a9e69b..c8433278 100644
--- a/pkg/handlers/namespaces.go
+++ b/pkg/handlers/namespaces.go
@@ -14,7 +14,7 @@ func (h Handler) GetNamespace(id string) (*policy.Namespace, error) {
 		return nil, err
 	}
 
-	return resp.Namespace, nil
+	return resp.GetNamespace(), nil
 }
 
 func (h Handler) ListNamespaces() ([]*policy.Namespace, error) {
@@ -23,9 +23,10 @@ func (h Handler) ListNamespaces() ([]*policy.Namespace, error) {
 		return nil, err
 	}
 
-	return resp.Namespaces, nil
+	return resp.GetNamespaces(), nil
 }
 
+// Creates and returns the created n
 func (h Handler) CreateNamespace(name string, metadata *common.MetadataMutable) (*policy.Namespace, error) {
 	resp, err := h.sdk.Namespaces.CreateNamespace(h.ctx, &namespaces.CreateNamespaceRequest{
 		Name:     name,
@@ -35,11 +36,12 @@ func (h Handler) CreateNamespace(name string, metadata *common.MetadataMutable)
 		return nil, err
 	}
 
-	return resp.Namespace, nil
+	return h.GetNamespace(resp.GetNamespace().GetId())
 }
 
+// Updates and returns the updated namespace
 func (h Handler) UpdateNamespace(id string, metadata *common.MetadataMutable, behavior common.MetadataUpdateEnum) (*policy.Namespace, error) {
-	resp, err := h.sdk.Namespaces.UpdateNamespace(h.ctx, &namespaces.UpdateNamespaceRequest{
+	_, err := h.sdk.Namespaces.UpdateNamespace(h.ctx, &namespaces.UpdateNamespaceRequest{
 		Id:                     id,
 		Metadata:               metadata,
 		MetadataUpdateBehavior: behavior,
@@ -47,16 +49,17 @@ func (h Handler) UpdateNamespace(id string, metadata *common.MetadataMutable, be
 	if err != nil {
 		return nil, err
 	}
-	return resp.Namespace, nil
+	return h.GetNamespace(id)
 }
 
-func (h Handler) DeactivateNamespace(id string) error {
+// Deactivates and returns the deactivated namespace
+func (h Handler) DeactivateNamespace(id string) (*policy.Namespace, error) {
 	_, err := h.sdk.Namespaces.DeactivateNamespace(h.ctx, &namespaces.DeactivateNamespaceRequest{
 		Id: id,
 	})
 	if err != nil {
-		return err
+		return nil, err
 	}
 
-	return nil
+	return h.GetNamespace(id)
 }
diff --git a/pkg/handlers/resourceMappings.go b/pkg/handlers/resourceMappings.go
index df23eb66..2ea49fa7 100644
--- a/pkg/handlers/resourceMappings.go
+++ b/pkg/handlers/resourceMappings.go
@@ -14,6 +14,7 @@ type ResourceMapping struct {
 	Terms       []string
 }
 
+// Creates and returns the created resource mapping
 func (h *Handler) CreateResourceMapping(attributeId string, terms []string, metadata *common.MetadataMutable) (*policy.ResourceMapping, error) {
 	res, err := h.sdk.ResourceMapping.CreateResourceMapping(context.Background(), &resourcemapping.CreateResourceMappingRequest{
 		AttributeValueId: attributeId,
@@ -24,7 +25,7 @@ func (h *Handler) CreateResourceMapping(attributeId string, terms []string, meta
 		return nil, err
 	}
 
-	return res.ResourceMapping, nil
+	return h.GetResourceMapping(res.ResourceMapping.GetId())
 }
 
 func (h *Handler) GetResourceMapping(id string) (*policy.ResourceMapping, error) {
@@ -35,7 +36,7 @@ func (h *Handler) GetResourceMapping(id string) (*policy.ResourceMapping, error)
 		return nil, err
 	}
 
-	return res.ResourceMapping, nil
+	return res.GetResourceMapping(), nil
 }
 
 func (h *Handler) ListResourceMappings() ([]*policy.ResourceMapping, error) {
@@ -44,12 +45,13 @@ func (h *Handler) ListResourceMappings() ([]*policy.ResourceMapping, error) {
 		return nil, err
 	}
 
-	return res.ResourceMappings, nil
+	return res.GetResourceMappings(), nil
 }
 
 // TODO: verify updation behavior
+// Updates and returns the updated resource mapping
 func (h *Handler) UpdateResourceMapping(id string, attrValueId string, terms []string, metadata *common.MetadataMutable, behavior common.MetadataUpdateEnum) (*policy.ResourceMapping, error) {
-	res, err := h.sdk.ResourceMapping.UpdateResourceMapping(context.Background(), &resourcemapping.UpdateResourceMappingRequest{
+	_, err := h.sdk.ResourceMapping.UpdateResourceMapping(context.Background(), &resourcemapping.UpdateResourceMappingRequest{
 		Id:                     id,
 		AttributeValueId:       attrValueId,
 		Terms:                  terms,
@@ -60,7 +62,7 @@ func (h *Handler) UpdateResourceMapping(id string, attrValueId string, terms []s
 		return nil, err
 	}
 
-	return res.ResourceMapping, nil
+	return h.GetResourceMapping(id)
 }
 
 func (h *Handler) DeleteResourceMapping(id string) (*policy.ResourceMapping, error) {
diff --git a/pkg/handlers/subjectConditionSets.go b/pkg/handlers/subjectConditionSets.go
index 163f38a5..2f2d8366 100644
--- a/pkg/handlers/subjectConditionSets.go
+++ b/pkg/handlers/subjectConditionSets.go
@@ -14,7 +14,7 @@ func (h Handler) GetSubjectConditionSet(id string) (*policy.SubjectConditionSet,
 		return nil, err
 	}
 
-	return resp.SubjectConditionSet, nil
+	return resp.GetSubjectConditionSet(), nil
 }
 
 func (h Handler) ListSubjectConditionSets() ([]*policy.SubjectConditionSet, error) {
@@ -22,9 +22,10 @@ func (h Handler) ListSubjectConditionSets() ([]*policy.SubjectConditionSet, erro
 	if err != nil {
 		return nil, err
 	}
-	return resp.SubjectConditionSets, err
+	return resp.GetSubjectConditionSets(), err
 }
 
+// Creates and returns the created subject condition set
 func (h Handler) CreateSubjectConditionSet(ss []*policy.SubjectSet, metadata *common.MetadataMutable) (*policy.SubjectConditionSet, error) {
 	resp, err := h.sdk.SubjectMapping.CreateSubjectConditionSet(h.ctx, &subjectmapping.CreateSubjectConditionSetRequest{
 		SubjectConditionSet: &subjectmapping.SubjectConditionSetCreate{
@@ -35,11 +36,12 @@ func (h Handler) CreateSubjectConditionSet(ss []*policy.SubjectSet, metadata *co
 	if err != nil {
 		return nil, err
 	}
-	return resp.SubjectConditionSet, nil
+	return h.GetSubjectConditionSet(resp.GetSubjectConditionSet().GetId())
 }
 
+// Updates and returns the updated subject condition set
 func (h Handler) UpdateSubjectConditionSet(id string, ss []*policy.SubjectSet, metadata *common.MetadataMutable, behavior common.MetadataUpdateEnum) (*policy.SubjectConditionSet, error) {
-	resp, err := h.sdk.SubjectMapping.UpdateSubjectConditionSet(h.ctx, &subjectmapping.UpdateSubjectConditionSetRequest{
+	_, err := h.sdk.SubjectMapping.UpdateSubjectConditionSet(h.ctx, &subjectmapping.UpdateSubjectConditionSetRequest{
 		Id:                     id,
 		SubjectSets:            ss,
 		Metadata:               metadata,
@@ -48,7 +50,7 @@ func (h Handler) UpdateSubjectConditionSet(id string, ss []*policy.SubjectSet, m
 	if err != nil {
 		return nil, err
 	}
-	return resp.SubjectConditionSet, nil
+	return h.GetSubjectConditionSet(id)
 }
 
 func (h Handler) DeleteSubjectConditionSet(id string) error {
diff --git a/pkg/handlers/subjectmappings.go b/pkg/handlers/subjectmappings.go
index 6123883f..a3435b47 100644
--- a/pkg/handlers/subjectmappings.go
+++ b/pkg/handlers/subjectmappings.go
@@ -18,15 +18,16 @@ func (h Handler) GetSubjectMapping(id string) (*policy.SubjectMapping, error) {
 	resp, err := h.sdk.SubjectMapping.GetSubjectMapping(h.ctx, &subjectmapping.GetSubjectMappingRequest{
 		Id: id,
 	})
-	return resp.SubjectMapping, err
+	return resp.GetSubjectMapping(), err
 }
 
 func (h Handler) ListSubjectMappings() ([]*policy.SubjectMapping, error) {
 	resp, err := h.sdk.SubjectMapping.ListSubjectMappings(h.ctx, &subjectmapping.ListSubjectMappingsRequest{})
 
-	return resp.SubjectMappings, err
+	return resp.GetSubjectMappings(), err
 }
 
+// Creates and returns the created subject mapping
 func (h Handler) CreateNewSubjectMapping(attrValId string, actions []*policy.Action, existingSCSId string, newScs *subjectmapping.SubjectConditionSetCreate, m *common.MetadataMutable) (*policy.SubjectMapping, error) {
 	resp, err := h.sdk.SubjectMapping.CreateSubjectMapping(h.ctx, &subjectmapping.CreateSubjectMappingRequest{
 		AttributeValueId:              attrValId,
@@ -35,18 +36,25 @@ func (h Handler) CreateNewSubjectMapping(attrValId string, actions []*policy.Act
 		NewSubjectConditionSet:        newScs,
 		Metadata:                      m,
 	})
-	return resp.SubjectMapping, err
+	if err != nil {
+		return nil, err
+	}
+	return h.GetSubjectMapping(resp.GetSubjectMapping().GetId())
 }
 
+// Updates and returns the updated subject mapping
 func (h Handler) UpdateSubjectMapping(id string, updatedSCSId string, updatedActions []*policy.Action, metadata *common.MetadataMutable, metadataBehavior common.MetadataUpdateEnum) (*policy.SubjectMapping, error) {
-	resp, err := h.sdk.SubjectMapping.UpdateSubjectMapping(h.ctx, &subjectmapping.UpdateSubjectMappingRequest{
+	_, err := h.sdk.SubjectMapping.UpdateSubjectMapping(h.ctx, &subjectmapping.UpdateSubjectMappingRequest{
 		Id:                     id,
 		SubjectConditionSetId:  updatedSCSId,
 		Actions:                updatedActions,
 		MetadataUpdateBehavior: metadataBehavior,
 		Metadata:               metadata,
 	})
-	return resp.SubjectMapping, err
+	if err != nil {
+		return nil, err
+	}
+	return h.GetSubjectMapping(id)
 }
 
 func (h Handler) DeleteSubjectMapping(id string) (*policy.SubjectMapping, error) {