diff --git a/java-iam/proto-google-iam-v1/clirr-ignored-differences.xml b/java-iam/proto-google-iam-v1/clirr-ignored-differences.xml
index ca6f8c1981..f551ecf78f 100644
--- a/java-iam/proto-google-iam-v1/clirr-ignored-differences.xml
+++ b/java-iam/proto-google-iam-v1/clirr-ignored-differences.xml
@@ -1,6 +1,36 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!-- see http://www.mojohaus.org/clirr-maven-plugin/examples/ignored-differences.html -->
 <differences>
+  <difference>
+    <differenceType>7002</differenceType>
+    <className>com/google/iam/v1/*Builder</className>
+    <method>* addRepeatedField(*)</method>
+  </difference>
+  <difference>
+    <differenceType>7002</differenceType>
+    <className>com/google/iam/v1/*Builder</className>
+    <method>* clearField(*)</method>
+  </difference>
+  <difference>
+    <differenceType>7002</differenceType>
+    <className>com/google/iam/v1/*Builder</className>
+    <method>* clearOneof(*)</method>
+  </difference>
+  <difference>
+    <differenceType>7002</differenceType>
+    <className>com/google/iam/v1/*Builder</className>
+    <method>* clone()</method>
+  </difference>
+  <difference>
+    <differenceType>7002</differenceType>
+    <className>com/google/iam/v1/*Builder</className>
+    <method>* setField(*)</method>
+  </difference>
+  <difference>
+    <differenceType>7002</differenceType>
+    <className>com/google/iam/v1/*Builder</className>
+    <method>* setRepeatedField(*)</method>
+  </difference>
   <difference>
     <differenceType>7012</differenceType>
     <className>com/google/iam/v1/*OrBuilder</className>
diff --git a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/AuditConfig.java b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/AuditConfig.java
index 5414ae4c2c..3607c266a6 100644
--- a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/AuditConfig.java
+++ b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/AuditConfig.java
@@ -26,11 +26,14 @@
  * The configuration determines which permission types are logged, and what
  * identities, if any, are exempted from logging.
  * An AuditConfig must have one or more AuditLogConfigs.
+ *
  * If there are AuditConfigs for both `allServices` and a specific service,
  * the union of the two AuditConfigs is used for that service: the log_types
  * specified in each AuditConfig are enabled, and the exempted_members in each
  * AuditLogConfig are exempted.
+ *
  * Example Policy with multiple AuditConfigs:
+ *
  *     {
  *       "audit_configs": [
  *         {
@@ -66,6 +69,7 @@
  *         }
  *       ]
  *     }
+ *
  * For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ
  * logging. It also exempts jose&#64;example.com from DATA_READ logging, and
  * aliya&#64;example.com from DATA_WRITE logging.
@@ -94,11 +98,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new AuditConfig();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v1.PolicyProto.internal_static_google_iam_v1_AuditConfig_descriptor;
   }
@@ -414,11 +413,14 @@ protected Builder newBuilderForType(com.google.protobuf.GeneratedMessageV3.Build
    * The configuration determines which permission types are logged, and what
    * identities, if any, are exempted from logging.
    * An AuditConfig must have one or more AuditLogConfigs.
+   *
    * If there are AuditConfigs for both `allServices` and a specific service,
    * the union of the two AuditConfigs is used for that service: the log_types
    * specified in each AuditConfig are enabled, and the exempted_members in each
    * AuditLogConfig are exempted.
+   *
    * Example Policy with multiple AuditConfigs:
+   *
    *     {
    *       "audit_configs": [
    *         {
@@ -454,6 +456,7 @@ protected Builder newBuilderForType(com.google.protobuf.GeneratedMessageV3.Build
    *         }
    *       ]
    *     }
+   *
    * For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ
    * logging. It also exempts jose&#64;example.com from DATA_READ logging, and
    * aliya&#64;example.com from DATA_WRITE logging.
@@ -549,39 +552,6 @@ private void buildPartial0(com.google.iam.v1.AuditConfig result) {
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v1.AuditConfig) {
diff --git a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/AuditConfigDelta.java b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/AuditConfigDelta.java
index 9fc1f68b1d..b56b2552e6 100644
--- a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/AuditConfigDelta.java
+++ b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/AuditConfigDelta.java
@@ -51,11 +51,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new AuditConfigDelta();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v1.PolicyProto.internal_static_google_iam_v1_AuditConfigDelta_descriptor;
   }
@@ -708,39 +703,6 @@ private void buildPartial0(com.google.iam.v1.AuditConfigDelta result) {
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v1.AuditConfigDelta) {
diff --git a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/AuditLogConfig.java b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/AuditLogConfig.java
index dbdb7e2c76..05f9e30d65 100644
--- a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/AuditLogConfig.java
+++ b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/AuditLogConfig.java
@@ -24,6 +24,7 @@
  * <pre>
  * Provides the configuration for logging a type of permissions.
  * Example:
+ *
  *     {
  *       "audit_log_configs": [
  *         {
@@ -37,6 +38,7 @@
  *         }
  *       ]
  *     }
+ *
  * This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting
  * jose&#64;example.com from DATA_READ logging.
  * </pre>
@@ -55,7 +57,7 @@ private AuditLogConfig(com.google.protobuf.GeneratedMessageV3.Builder<?> builder
 
   private AuditLogConfig() {
     logType_ = 0;
-    exemptedMembers_ = com.google.protobuf.LazyStringArrayList.EMPTY;
+    exemptedMembers_ = com.google.protobuf.LazyStringArrayList.emptyList();
   }
 
   @java.lang.Override
@@ -64,11 +66,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new AuditLogConfig();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v1.PolicyProto.internal_static_google_iam_v1_AuditLogConfig_descriptor;
   }
@@ -300,7 +297,8 @@ public com.google.iam.v1.AuditLogConfig.LogType getLogType() {
   public static final int EXEMPTED_MEMBERS_FIELD_NUMBER = 2;
 
   @SuppressWarnings("serial")
-  private com.google.protobuf.LazyStringList exemptedMembers_;
+  private com.google.protobuf.LazyStringArrayList exemptedMembers_ =
+      com.google.protobuf.LazyStringArrayList.emptyList();
   /**
    *
    *
@@ -551,6 +549,7 @@ protected Builder newBuilderForType(com.google.protobuf.GeneratedMessageV3.Build
    * <pre>
    * Provides the configuration for logging a type of permissions.
    * Example:
+   *
    *     {
    *       "audit_log_configs": [
    *         {
@@ -564,6 +563,7 @@ protected Builder newBuilderForType(com.google.protobuf.GeneratedMessageV3.Build
    *         }
    *       ]
    *     }
+   *
    * This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting
    * jose&#64;example.com from DATA_READ logging.
    * </pre>
@@ -600,8 +600,7 @@ public Builder clear() {
       super.clear();
       bitField0_ = 0;
       logType_ = 0;
-      exemptedMembers_ = com.google.protobuf.LazyStringArrayList.EMPTY;
-      bitField0_ = (bitField0_ & ~0x00000002);
+      exemptedMembers_ = com.google.protobuf.LazyStringArrayList.emptyList();
       return this;
     }
 
@@ -627,7 +626,6 @@ public com.google.iam.v1.AuditLogConfig build() {
     @java.lang.Override
     public com.google.iam.v1.AuditLogConfig buildPartial() {
       com.google.iam.v1.AuditLogConfig result = new com.google.iam.v1.AuditLogConfig(this);
-      buildPartialRepeatedFields(result);
       if (bitField0_ != 0) {
         buildPartial0(result);
       }
@@ -635,52 +633,15 @@ public com.google.iam.v1.AuditLogConfig buildPartial() {
       return result;
     }
 
-    private void buildPartialRepeatedFields(com.google.iam.v1.AuditLogConfig result) {
-      if (((bitField0_ & 0x00000002) != 0)) {
-        exemptedMembers_ = exemptedMembers_.getUnmodifiableView();
-        bitField0_ = (bitField0_ & ~0x00000002);
-      }
-      result.exemptedMembers_ = exemptedMembers_;
-    }
-
     private void buildPartial0(com.google.iam.v1.AuditLogConfig result) {
       int from_bitField0_ = bitField0_;
       if (((from_bitField0_ & 0x00000001) != 0)) {
         result.logType_ = logType_;
       }
-    }
-
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
+      if (((from_bitField0_ & 0x00000002) != 0)) {
+        exemptedMembers_.makeImmutable();
+        result.exemptedMembers_ = exemptedMembers_;
+      }
     }
 
     @java.lang.Override
@@ -701,7 +662,7 @@ public Builder mergeFrom(com.google.iam.v1.AuditLogConfig other) {
       if (!other.exemptedMembers_.isEmpty()) {
         if (exemptedMembers_.isEmpty()) {
           exemptedMembers_ = other.exemptedMembers_;
-          bitField0_ = (bitField0_ & ~0x00000002);
+          bitField0_ |= 0x00000002;
         } else {
           ensureExemptedMembersIsMutable();
           exemptedMembers_.addAll(other.exemptedMembers_);
@@ -856,14 +817,14 @@ public Builder clearLogType() {
       return this;
     }
 
-    private com.google.protobuf.LazyStringList exemptedMembers_ =
-        com.google.protobuf.LazyStringArrayList.EMPTY;
+    private com.google.protobuf.LazyStringArrayList exemptedMembers_ =
+        com.google.protobuf.LazyStringArrayList.emptyList();
 
     private void ensureExemptedMembersIsMutable() {
-      if (!((bitField0_ & 0x00000002) != 0)) {
+      if (!exemptedMembers_.isModifiable()) {
         exemptedMembers_ = new com.google.protobuf.LazyStringArrayList(exemptedMembers_);
-        bitField0_ |= 0x00000002;
       }
+      bitField0_ |= 0x00000002;
     }
     /**
      *
@@ -880,7 +841,8 @@ private void ensureExemptedMembersIsMutable() {
      * @return A list containing the exemptedMembers.
      */
     public com.google.protobuf.ProtocolStringList getExemptedMembersList() {
-      return exemptedMembers_.getUnmodifiableView();
+      exemptedMembers_.makeImmutable();
+      return exemptedMembers_;
     }
     /**
      *
@@ -957,6 +919,7 @@ public Builder setExemptedMembers(int index, java.lang.String value) {
       }
       ensureExemptedMembersIsMutable();
       exemptedMembers_.set(index, value);
+      bitField0_ |= 0x00000002;
       onChanged();
       return this;
     }
@@ -981,6 +944,7 @@ public Builder addExemptedMembers(java.lang.String value) {
       }
       ensureExemptedMembersIsMutable();
       exemptedMembers_.add(value);
+      bitField0_ |= 0x00000002;
       onChanged();
       return this;
     }
@@ -1002,6 +966,7 @@ public Builder addExemptedMembers(java.lang.String value) {
     public Builder addAllExemptedMembers(java.lang.Iterable<java.lang.String> values) {
       ensureExemptedMembersIsMutable();
       com.google.protobuf.AbstractMessageLite.Builder.addAll(values, exemptedMembers_);
+      bitField0_ |= 0x00000002;
       onChanged();
       return this;
     }
@@ -1020,8 +985,9 @@ public Builder addAllExemptedMembers(java.lang.Iterable<java.lang.String> values
      * @return This builder for chaining.
      */
     public Builder clearExemptedMembers() {
-      exemptedMembers_ = com.google.protobuf.LazyStringArrayList.EMPTY;
+      exemptedMembers_ = com.google.protobuf.LazyStringArrayList.emptyList();
       bitField0_ = (bitField0_ & ~0x00000002);
+      ;
       onChanged();
       return this;
     }
@@ -1047,6 +1013,7 @@ public Builder addExemptedMembersBytes(com.google.protobuf.ByteString value) {
       checkByteStringIsUtf8(value);
       ensureExemptedMembersIsMutable();
       exemptedMembers_.add(value);
+      bitField0_ |= 0x00000002;
       onChanged();
       return this;
     }
diff --git a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/Binding.java b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/Binding.java
index b24aa460af..3784bda197 100644
--- a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/Binding.java
+++ b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/Binding.java
@@ -39,7 +39,7 @@ private Binding(com.google.protobuf.GeneratedMessageV3.Builder<?> builder) {
 
   private Binding() {
     role_ = "";
-    members_ = com.google.protobuf.LazyStringArrayList.EMPTY;
+    members_ = com.google.protobuf.LazyStringArrayList.emptyList();
   }
 
   @java.lang.Override
@@ -48,11 +48,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new Binding();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v1.PolicyProto.internal_static_google_iam_v1_Binding_descriptor;
   }
@@ -121,28 +116,37 @@ public com.google.protobuf.ByteString getRoleBytes() {
   public static final int MEMBERS_FIELD_NUMBER = 2;
 
   @SuppressWarnings("serial")
-  private com.google.protobuf.LazyStringList members_;
+  private com.google.protobuf.LazyStringArrayList members_ =
+      com.google.protobuf.LazyStringArrayList.emptyList();
   /**
    *
    *
    * <pre>
    * Specifies the principals requesting access for a Cloud Platform resource.
    * `members` can have the following values:
+   *
    * * `allUsers`: A special identifier that represents anyone who is
    *    on the internet; with or without a Google account.
+   *
    * * `allAuthenticatedUsers`: A special identifier that represents anyone
    *    who is authenticated with a Google account or a service account.
+   *
    * * `user:{emailid}`: An email address that represents a specific Google
    *    account. For example, `alice&#64;example.com` .
+   *
+   *
    * * `serviceAccount:{emailid}`: An email address that represents a service
    *    account. For example, `my-other-app&#64;appspot.gserviceaccount.com`.
+   *
    * * `group:{emailid}`: An email address that represents a Google group.
    *    For example, `admins&#64;example.com`.
+   *
    * * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
    *    identifier) representing a user that has been recently deleted. For
    *    example, `alice&#64;example.com?uid=123456789012345678901`. If the user is
    *    recovered, this value reverts to `user:{emailid}` and the recovered user
    *    retains the role in the binding.
+   *
    * * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
    *    unique identifier) representing a service account that has been recently
    *    deleted. For example,
@@ -150,11 +154,14 @@ public com.google.protobuf.ByteString getRoleBytes() {
    *    If the service account is undeleted, this value reverts to
    *    `serviceAccount:{emailid}` and the undeleted service account retains the
    *    role in the binding.
+   *
    * * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
    *    identifier) representing a Google group that has been recently
    *    deleted. For example, `admins&#64;example.com?uid=123456789012345678901`. If
    *    the group is recovered, this value reverts to `group:{emailid}` and the
    *    recovered group retains the role in the binding.
+   *
+   *
    * * `domain:{domain}`: The G Suite domain (primary) that represents all the
    *    users of that domain. For example, `google.com` or `example.com`.
    * </pre>
@@ -172,21 +179,29 @@ public com.google.protobuf.ProtocolStringList getMembersList() {
    * <pre>
    * Specifies the principals requesting access for a Cloud Platform resource.
    * `members` can have the following values:
+   *
    * * `allUsers`: A special identifier that represents anyone who is
    *    on the internet; with or without a Google account.
+   *
    * * `allAuthenticatedUsers`: A special identifier that represents anyone
    *    who is authenticated with a Google account or a service account.
+   *
    * * `user:{emailid}`: An email address that represents a specific Google
    *    account. For example, `alice&#64;example.com` .
+   *
+   *
    * * `serviceAccount:{emailid}`: An email address that represents a service
    *    account. For example, `my-other-app&#64;appspot.gserviceaccount.com`.
+   *
    * * `group:{emailid}`: An email address that represents a Google group.
    *    For example, `admins&#64;example.com`.
+   *
    * * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
    *    identifier) representing a user that has been recently deleted. For
    *    example, `alice&#64;example.com?uid=123456789012345678901`. If the user is
    *    recovered, this value reverts to `user:{emailid}` and the recovered user
    *    retains the role in the binding.
+   *
    * * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
    *    unique identifier) representing a service account that has been recently
    *    deleted. For example,
@@ -194,11 +209,14 @@ public com.google.protobuf.ProtocolStringList getMembersList() {
    *    If the service account is undeleted, this value reverts to
    *    `serviceAccount:{emailid}` and the undeleted service account retains the
    *    role in the binding.
+   *
    * * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
    *    identifier) representing a Google group that has been recently
    *    deleted. For example, `admins&#64;example.com?uid=123456789012345678901`. If
    *    the group is recovered, this value reverts to `group:{emailid}` and the
    *    recovered group retains the role in the binding.
+   *
+   *
    * * `domain:{domain}`: The G Suite domain (primary) that represents all the
    *    users of that domain. For example, `google.com` or `example.com`.
    * </pre>
@@ -216,21 +234,29 @@ public int getMembersCount() {
    * <pre>
    * Specifies the principals requesting access for a Cloud Platform resource.
    * `members` can have the following values:
+   *
    * * `allUsers`: A special identifier that represents anyone who is
    *    on the internet; with or without a Google account.
+   *
    * * `allAuthenticatedUsers`: A special identifier that represents anyone
    *    who is authenticated with a Google account or a service account.
+   *
    * * `user:{emailid}`: An email address that represents a specific Google
    *    account. For example, `alice&#64;example.com` .
+   *
+   *
    * * `serviceAccount:{emailid}`: An email address that represents a service
    *    account. For example, `my-other-app&#64;appspot.gserviceaccount.com`.
+   *
    * * `group:{emailid}`: An email address that represents a Google group.
    *    For example, `admins&#64;example.com`.
+   *
    * * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
    *    identifier) representing a user that has been recently deleted. For
    *    example, `alice&#64;example.com?uid=123456789012345678901`. If the user is
    *    recovered, this value reverts to `user:{emailid}` and the recovered user
    *    retains the role in the binding.
+   *
    * * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
    *    unique identifier) representing a service account that has been recently
    *    deleted. For example,
@@ -238,11 +264,14 @@ public int getMembersCount() {
    *    If the service account is undeleted, this value reverts to
    *    `serviceAccount:{emailid}` and the undeleted service account retains the
    *    role in the binding.
+   *
    * * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
    *    identifier) representing a Google group that has been recently
    *    deleted. For example, `admins&#64;example.com?uid=123456789012345678901`. If
    *    the group is recovered, this value reverts to `group:{emailid}` and the
    *    recovered group retains the role in the binding.
+   *
+   *
    * * `domain:{domain}`: The G Suite domain (primary) that represents all the
    *    users of that domain. For example, `google.com` or `example.com`.
    * </pre>
@@ -261,21 +290,29 @@ public java.lang.String getMembers(int index) {
    * <pre>
    * Specifies the principals requesting access for a Cloud Platform resource.
    * `members` can have the following values:
+   *
    * * `allUsers`: A special identifier that represents anyone who is
    *    on the internet; with or without a Google account.
+   *
    * * `allAuthenticatedUsers`: A special identifier that represents anyone
    *    who is authenticated with a Google account or a service account.
+   *
    * * `user:{emailid}`: An email address that represents a specific Google
    *    account. For example, `alice&#64;example.com` .
+   *
+   *
    * * `serviceAccount:{emailid}`: An email address that represents a service
    *    account. For example, `my-other-app&#64;appspot.gserviceaccount.com`.
+   *
    * * `group:{emailid}`: An email address that represents a Google group.
    *    For example, `admins&#64;example.com`.
+   *
    * * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
    *    identifier) representing a user that has been recently deleted. For
    *    example, `alice&#64;example.com?uid=123456789012345678901`. If the user is
    *    recovered, this value reverts to `user:{emailid}` and the recovered user
    *    retains the role in the binding.
+   *
    * * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
    *    unique identifier) representing a service account that has been recently
    *    deleted. For example,
@@ -283,11 +320,14 @@ public java.lang.String getMembers(int index) {
    *    If the service account is undeleted, this value reverts to
    *    `serviceAccount:{emailid}` and the undeleted service account retains the
    *    role in the binding.
+   *
    * * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
    *    identifier) representing a Google group that has been recently
    *    deleted. For example, `admins&#64;example.com?uid=123456789012345678901`. If
    *    the group is recovered, this value reverts to `group:{emailid}` and the
    *    recovered group retains the role in the binding.
+   *
+   *
    * * `domain:{domain}`: The G Suite domain (primary) that represents all the
    *    users of that domain. For example, `google.com` or `example.com`.
    * </pre>
@@ -308,11 +348,14 @@ public com.google.protobuf.ByteString getMembersBytes(int index) {
    *
    * <pre>
    * The condition that is associated with this binding.
+   *
    * If the condition evaluates to `true`, then this binding applies to the
    * current request.
+   *
    * If the condition evaluates to `false`, then this binding does not apply to
    * the current request. However, a different role binding might grant the same
    * role to one or more of the principals in this binding.
+   *
    * To learn which resources support conditions in their IAM policies, see the
    * [IAM
    * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -331,11 +374,14 @@ public boolean hasCondition() {
    *
    * <pre>
    * The condition that is associated with this binding.
+   *
    * If the condition evaluates to `true`, then this binding applies to the
    * current request.
+   *
    * If the condition evaluates to `false`, then this binding does not apply to
    * the current request. However, a different role binding might grant the same
    * role to one or more of the principals in this binding.
+   *
    * To learn which resources support conditions in their IAM policies, see the
    * [IAM
    * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -354,11 +400,14 @@ public com.google.type.Expr getCondition() {
    *
    * <pre>
    * The condition that is associated with this binding.
+   *
    * If the condition evaluates to `true`, then this binding applies to the
    * current request.
+   *
    * If the condition evaluates to `false`, then this binding does not apply to
    * the current request. However, a different role binding might grant the same
    * role to one or more of the principals in this binding.
+   *
    * To learn which resources support conditions in their IAM policies, see the
    * [IAM
    * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -595,8 +644,7 @@ public Builder clear() {
       super.clear();
       bitField0_ = 0;
       role_ = "";
-      members_ = com.google.protobuf.LazyStringArrayList.EMPTY;
-      bitField0_ = (bitField0_ & ~0x00000002);
+      members_ = com.google.protobuf.LazyStringArrayList.emptyList();
       condition_ = null;
       if (conditionBuilder_ != null) {
         conditionBuilder_.dispose();
@@ -627,7 +675,6 @@ public com.google.iam.v1.Binding build() {
     @java.lang.Override
     public com.google.iam.v1.Binding buildPartial() {
       com.google.iam.v1.Binding result = new com.google.iam.v1.Binding(this);
-      buildPartialRepeatedFields(result);
       if (bitField0_ != 0) {
         buildPartial0(result);
       }
@@ -635,57 +682,20 @@ public com.google.iam.v1.Binding buildPartial() {
       return result;
     }
 
-    private void buildPartialRepeatedFields(com.google.iam.v1.Binding result) {
-      if (((bitField0_ & 0x00000002) != 0)) {
-        members_ = members_.getUnmodifiableView();
-        bitField0_ = (bitField0_ & ~0x00000002);
-      }
-      result.members_ = members_;
-    }
-
     private void buildPartial0(com.google.iam.v1.Binding result) {
       int from_bitField0_ = bitField0_;
       if (((from_bitField0_ & 0x00000001) != 0)) {
         result.role_ = role_;
       }
+      if (((from_bitField0_ & 0x00000002) != 0)) {
+        members_.makeImmutable();
+        result.members_ = members_;
+      }
       if (((from_bitField0_ & 0x00000004) != 0)) {
         result.condition_ = conditionBuilder_ == null ? condition_ : conditionBuilder_.build();
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v1.Binding) {
@@ -706,7 +716,7 @@ public Builder mergeFrom(com.google.iam.v1.Binding other) {
       if (!other.members_.isEmpty()) {
         if (members_.isEmpty()) {
           members_ = other.members_;
-          bitField0_ = (bitField0_ & ~0x00000002);
+          bitField0_ |= 0x00000002;
         } else {
           ensureMembersIsMutable();
           members_.addAll(other.members_);
@@ -891,14 +901,14 @@ public Builder setRoleBytes(com.google.protobuf.ByteString value) {
       return this;
     }
 
-    private com.google.protobuf.LazyStringList members_ =
-        com.google.protobuf.LazyStringArrayList.EMPTY;
+    private com.google.protobuf.LazyStringArrayList members_ =
+        com.google.protobuf.LazyStringArrayList.emptyList();
 
     private void ensureMembersIsMutable() {
-      if (!((bitField0_ & 0x00000002) != 0)) {
+      if (!members_.isModifiable()) {
         members_ = new com.google.protobuf.LazyStringArrayList(members_);
-        bitField0_ |= 0x00000002;
       }
+      bitField0_ |= 0x00000002;
     }
     /**
      *
@@ -906,21 +916,29 @@ private void ensureMembersIsMutable() {
      * <pre>
      * Specifies the principals requesting access for a Cloud Platform resource.
      * `members` can have the following values:
+     *
      * * `allUsers`: A special identifier that represents anyone who is
      *    on the internet; with or without a Google account.
+     *
      * * `allAuthenticatedUsers`: A special identifier that represents anyone
      *    who is authenticated with a Google account or a service account.
+     *
      * * `user:{emailid}`: An email address that represents a specific Google
      *    account. For example, `alice&#64;example.com` .
+     *
+     *
      * * `serviceAccount:{emailid}`: An email address that represents a service
      *    account. For example, `my-other-app&#64;appspot.gserviceaccount.com`.
+     *
      * * `group:{emailid}`: An email address that represents a Google group.
      *    For example, `admins&#64;example.com`.
+     *
      * * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
      *    identifier) representing a user that has been recently deleted. For
      *    example, `alice&#64;example.com?uid=123456789012345678901`. If the user is
      *    recovered, this value reverts to `user:{emailid}` and the recovered user
      *    retains the role in the binding.
+     *
      * * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
      *    unique identifier) representing a service account that has been recently
      *    deleted. For example,
@@ -928,11 +946,14 @@ private void ensureMembersIsMutable() {
      *    If the service account is undeleted, this value reverts to
      *    `serviceAccount:{emailid}` and the undeleted service account retains the
      *    role in the binding.
+     *
      * * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
      *    identifier) representing a Google group that has been recently
      *    deleted. For example, `admins&#64;example.com?uid=123456789012345678901`. If
      *    the group is recovered, this value reverts to `group:{emailid}` and the
      *    recovered group retains the role in the binding.
+     *
+     *
      * * `domain:{domain}`: The G Suite domain (primary) that represents all the
      *    users of that domain. For example, `google.com` or `example.com`.
      * </pre>
@@ -942,7 +963,8 @@ private void ensureMembersIsMutable() {
      * @return A list containing the members.
      */
     public com.google.protobuf.ProtocolStringList getMembersList() {
-      return members_.getUnmodifiableView();
+      members_.makeImmutable();
+      return members_;
     }
     /**
      *
@@ -950,21 +972,29 @@ public com.google.protobuf.ProtocolStringList getMembersList() {
      * <pre>
      * Specifies the principals requesting access for a Cloud Platform resource.
      * `members` can have the following values:
+     *
      * * `allUsers`: A special identifier that represents anyone who is
      *    on the internet; with or without a Google account.
+     *
      * * `allAuthenticatedUsers`: A special identifier that represents anyone
      *    who is authenticated with a Google account or a service account.
+     *
      * * `user:{emailid}`: An email address that represents a specific Google
      *    account. For example, `alice&#64;example.com` .
+     *
+     *
      * * `serviceAccount:{emailid}`: An email address that represents a service
      *    account. For example, `my-other-app&#64;appspot.gserviceaccount.com`.
+     *
      * * `group:{emailid}`: An email address that represents a Google group.
      *    For example, `admins&#64;example.com`.
+     *
      * * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
      *    identifier) representing a user that has been recently deleted. For
      *    example, `alice&#64;example.com?uid=123456789012345678901`. If the user is
      *    recovered, this value reverts to `user:{emailid}` and the recovered user
      *    retains the role in the binding.
+     *
      * * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
      *    unique identifier) representing a service account that has been recently
      *    deleted. For example,
@@ -972,11 +1002,14 @@ public com.google.protobuf.ProtocolStringList getMembersList() {
      *    If the service account is undeleted, this value reverts to
      *    `serviceAccount:{emailid}` and the undeleted service account retains the
      *    role in the binding.
+     *
      * * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
      *    identifier) representing a Google group that has been recently
      *    deleted. For example, `admins&#64;example.com?uid=123456789012345678901`. If
      *    the group is recovered, this value reverts to `group:{emailid}` and the
      *    recovered group retains the role in the binding.
+     *
+     *
      * * `domain:{domain}`: The G Suite domain (primary) that represents all the
      *    users of that domain. For example, `google.com` or `example.com`.
      * </pre>
@@ -994,21 +1027,29 @@ public int getMembersCount() {
      * <pre>
      * Specifies the principals requesting access for a Cloud Platform resource.
      * `members` can have the following values:
+     *
      * * `allUsers`: A special identifier that represents anyone who is
      *    on the internet; with or without a Google account.
+     *
      * * `allAuthenticatedUsers`: A special identifier that represents anyone
      *    who is authenticated with a Google account or a service account.
+     *
      * * `user:{emailid}`: An email address that represents a specific Google
      *    account. For example, `alice&#64;example.com` .
+     *
+     *
      * * `serviceAccount:{emailid}`: An email address that represents a service
      *    account. For example, `my-other-app&#64;appspot.gserviceaccount.com`.
+     *
      * * `group:{emailid}`: An email address that represents a Google group.
      *    For example, `admins&#64;example.com`.
+     *
      * * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
      *    identifier) representing a user that has been recently deleted. For
      *    example, `alice&#64;example.com?uid=123456789012345678901`. If the user is
      *    recovered, this value reverts to `user:{emailid}` and the recovered user
      *    retains the role in the binding.
+     *
      * * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
      *    unique identifier) representing a service account that has been recently
      *    deleted. For example,
@@ -1016,11 +1057,14 @@ public int getMembersCount() {
      *    If the service account is undeleted, this value reverts to
      *    `serviceAccount:{emailid}` and the undeleted service account retains the
      *    role in the binding.
+     *
      * * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
      *    identifier) representing a Google group that has been recently
      *    deleted. For example, `admins&#64;example.com?uid=123456789012345678901`. If
      *    the group is recovered, this value reverts to `group:{emailid}` and the
      *    recovered group retains the role in the binding.
+     *
+     *
      * * `domain:{domain}`: The G Suite domain (primary) that represents all the
      *    users of that domain. For example, `google.com` or `example.com`.
      * </pre>
@@ -1039,21 +1083,29 @@ public java.lang.String getMembers(int index) {
      * <pre>
      * Specifies the principals requesting access for a Cloud Platform resource.
      * `members` can have the following values:
+     *
      * * `allUsers`: A special identifier that represents anyone who is
      *    on the internet; with or without a Google account.
+     *
      * * `allAuthenticatedUsers`: A special identifier that represents anyone
      *    who is authenticated with a Google account or a service account.
+     *
      * * `user:{emailid}`: An email address that represents a specific Google
      *    account. For example, `alice&#64;example.com` .
+     *
+     *
      * * `serviceAccount:{emailid}`: An email address that represents a service
      *    account. For example, `my-other-app&#64;appspot.gserviceaccount.com`.
+     *
      * * `group:{emailid}`: An email address that represents a Google group.
      *    For example, `admins&#64;example.com`.
+     *
      * * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
      *    identifier) representing a user that has been recently deleted. For
      *    example, `alice&#64;example.com?uid=123456789012345678901`. If the user is
      *    recovered, this value reverts to `user:{emailid}` and the recovered user
      *    retains the role in the binding.
+     *
      * * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
      *    unique identifier) representing a service account that has been recently
      *    deleted. For example,
@@ -1061,11 +1113,14 @@ public java.lang.String getMembers(int index) {
      *    If the service account is undeleted, this value reverts to
      *    `serviceAccount:{emailid}` and the undeleted service account retains the
      *    role in the binding.
+     *
      * * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
      *    identifier) representing a Google group that has been recently
      *    deleted. For example, `admins&#64;example.com?uid=123456789012345678901`. If
      *    the group is recovered, this value reverts to `group:{emailid}` and the
      *    recovered group retains the role in the binding.
+     *
+     *
      * * `domain:{domain}`: The G Suite domain (primary) that represents all the
      *    users of that domain. For example, `google.com` or `example.com`.
      * </pre>
@@ -1084,21 +1139,29 @@ public com.google.protobuf.ByteString getMembersBytes(int index) {
      * <pre>
      * Specifies the principals requesting access for a Cloud Platform resource.
      * `members` can have the following values:
+     *
      * * `allUsers`: A special identifier that represents anyone who is
      *    on the internet; with or without a Google account.
+     *
      * * `allAuthenticatedUsers`: A special identifier that represents anyone
      *    who is authenticated with a Google account or a service account.
+     *
      * * `user:{emailid}`: An email address that represents a specific Google
      *    account. For example, `alice&#64;example.com` .
+     *
+     *
      * * `serviceAccount:{emailid}`: An email address that represents a service
      *    account. For example, `my-other-app&#64;appspot.gserviceaccount.com`.
+     *
      * * `group:{emailid}`: An email address that represents a Google group.
      *    For example, `admins&#64;example.com`.
+     *
      * * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
      *    identifier) representing a user that has been recently deleted. For
      *    example, `alice&#64;example.com?uid=123456789012345678901`. If the user is
      *    recovered, this value reverts to `user:{emailid}` and the recovered user
      *    retains the role in the binding.
+     *
      * * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
      *    unique identifier) representing a service account that has been recently
      *    deleted. For example,
@@ -1106,11 +1169,14 @@ public com.google.protobuf.ByteString getMembersBytes(int index) {
      *    If the service account is undeleted, this value reverts to
      *    `serviceAccount:{emailid}` and the undeleted service account retains the
      *    role in the binding.
+     *
      * * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
      *    identifier) representing a Google group that has been recently
      *    deleted. For example, `admins&#64;example.com?uid=123456789012345678901`. If
      *    the group is recovered, this value reverts to `group:{emailid}` and the
      *    recovered group retains the role in the binding.
+     *
+     *
      * * `domain:{domain}`: The G Suite domain (primary) that represents all the
      *    users of that domain. For example, `google.com` or `example.com`.
      * </pre>
@@ -1127,6 +1193,7 @@ public Builder setMembers(int index, java.lang.String value) {
       }
       ensureMembersIsMutable();
       members_.set(index, value);
+      bitField0_ |= 0x00000002;
       onChanged();
       return this;
     }
@@ -1136,21 +1203,29 @@ public Builder setMembers(int index, java.lang.String value) {
      * <pre>
      * Specifies the principals requesting access for a Cloud Platform resource.
      * `members` can have the following values:
+     *
      * * `allUsers`: A special identifier that represents anyone who is
      *    on the internet; with or without a Google account.
+     *
      * * `allAuthenticatedUsers`: A special identifier that represents anyone
      *    who is authenticated with a Google account or a service account.
+     *
      * * `user:{emailid}`: An email address that represents a specific Google
      *    account. For example, `alice&#64;example.com` .
+     *
+     *
      * * `serviceAccount:{emailid}`: An email address that represents a service
      *    account. For example, `my-other-app&#64;appspot.gserviceaccount.com`.
+     *
      * * `group:{emailid}`: An email address that represents a Google group.
      *    For example, `admins&#64;example.com`.
+     *
      * * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
      *    identifier) representing a user that has been recently deleted. For
      *    example, `alice&#64;example.com?uid=123456789012345678901`. If the user is
      *    recovered, this value reverts to `user:{emailid}` and the recovered user
      *    retains the role in the binding.
+     *
      * * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
      *    unique identifier) representing a service account that has been recently
      *    deleted. For example,
@@ -1158,11 +1233,14 @@ public Builder setMembers(int index, java.lang.String value) {
      *    If the service account is undeleted, this value reverts to
      *    `serviceAccount:{emailid}` and the undeleted service account retains the
      *    role in the binding.
+     *
      * * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
      *    identifier) representing a Google group that has been recently
      *    deleted. For example, `admins&#64;example.com?uid=123456789012345678901`. If
      *    the group is recovered, this value reverts to `group:{emailid}` and the
      *    recovered group retains the role in the binding.
+     *
+     *
      * * `domain:{domain}`: The G Suite domain (primary) that represents all the
      *    users of that domain. For example, `google.com` or `example.com`.
      * </pre>
@@ -1178,6 +1256,7 @@ public Builder addMembers(java.lang.String value) {
       }
       ensureMembersIsMutable();
       members_.add(value);
+      bitField0_ |= 0x00000002;
       onChanged();
       return this;
     }
@@ -1187,21 +1266,29 @@ public Builder addMembers(java.lang.String value) {
      * <pre>
      * Specifies the principals requesting access for a Cloud Platform resource.
      * `members` can have the following values:
+     *
      * * `allUsers`: A special identifier that represents anyone who is
      *    on the internet; with or without a Google account.
+     *
      * * `allAuthenticatedUsers`: A special identifier that represents anyone
      *    who is authenticated with a Google account or a service account.
+     *
      * * `user:{emailid}`: An email address that represents a specific Google
      *    account. For example, `alice&#64;example.com` .
+     *
+     *
      * * `serviceAccount:{emailid}`: An email address that represents a service
      *    account. For example, `my-other-app&#64;appspot.gserviceaccount.com`.
+     *
      * * `group:{emailid}`: An email address that represents a Google group.
      *    For example, `admins&#64;example.com`.
+     *
      * * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
      *    identifier) representing a user that has been recently deleted. For
      *    example, `alice&#64;example.com?uid=123456789012345678901`. If the user is
      *    recovered, this value reverts to `user:{emailid}` and the recovered user
      *    retains the role in the binding.
+     *
      * * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
      *    unique identifier) representing a service account that has been recently
      *    deleted. For example,
@@ -1209,11 +1296,14 @@ public Builder addMembers(java.lang.String value) {
      *    If the service account is undeleted, this value reverts to
      *    `serviceAccount:{emailid}` and the undeleted service account retains the
      *    role in the binding.
+     *
      * * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
      *    identifier) representing a Google group that has been recently
      *    deleted. For example, `admins&#64;example.com?uid=123456789012345678901`. If
      *    the group is recovered, this value reverts to `group:{emailid}` and the
      *    recovered group retains the role in the binding.
+     *
+     *
      * * `domain:{domain}`: The G Suite domain (primary) that represents all the
      *    users of that domain. For example, `google.com` or `example.com`.
      * </pre>
@@ -1226,6 +1316,7 @@ public Builder addMembers(java.lang.String value) {
     public Builder addAllMembers(java.lang.Iterable<java.lang.String> values) {
       ensureMembersIsMutable();
       com.google.protobuf.AbstractMessageLite.Builder.addAll(values, members_);
+      bitField0_ |= 0x00000002;
       onChanged();
       return this;
     }
@@ -1235,21 +1326,29 @@ public Builder addAllMembers(java.lang.Iterable<java.lang.String> values) {
      * <pre>
      * Specifies the principals requesting access for a Cloud Platform resource.
      * `members` can have the following values:
+     *
      * * `allUsers`: A special identifier that represents anyone who is
      *    on the internet; with or without a Google account.
+     *
      * * `allAuthenticatedUsers`: A special identifier that represents anyone
      *    who is authenticated with a Google account or a service account.
+     *
      * * `user:{emailid}`: An email address that represents a specific Google
      *    account. For example, `alice&#64;example.com` .
+     *
+     *
      * * `serviceAccount:{emailid}`: An email address that represents a service
      *    account. For example, `my-other-app&#64;appspot.gserviceaccount.com`.
+     *
      * * `group:{emailid}`: An email address that represents a Google group.
      *    For example, `admins&#64;example.com`.
+     *
      * * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
      *    identifier) representing a user that has been recently deleted. For
      *    example, `alice&#64;example.com?uid=123456789012345678901`. If the user is
      *    recovered, this value reverts to `user:{emailid}` and the recovered user
      *    retains the role in the binding.
+     *
      * * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
      *    unique identifier) representing a service account that has been recently
      *    deleted. For example,
@@ -1257,11 +1356,14 @@ public Builder addAllMembers(java.lang.Iterable<java.lang.String> values) {
      *    If the service account is undeleted, this value reverts to
      *    `serviceAccount:{emailid}` and the undeleted service account retains the
      *    role in the binding.
+     *
      * * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
      *    identifier) representing a Google group that has been recently
      *    deleted. For example, `admins&#64;example.com?uid=123456789012345678901`. If
      *    the group is recovered, this value reverts to `group:{emailid}` and the
      *    recovered group retains the role in the binding.
+     *
+     *
      * * `domain:{domain}`: The G Suite domain (primary) that represents all the
      *    users of that domain. For example, `google.com` or `example.com`.
      * </pre>
@@ -1271,8 +1373,9 @@ public Builder addAllMembers(java.lang.Iterable<java.lang.String> values) {
      * @return This builder for chaining.
      */
     public Builder clearMembers() {
-      members_ = com.google.protobuf.LazyStringArrayList.EMPTY;
+      members_ = com.google.protobuf.LazyStringArrayList.emptyList();
       bitField0_ = (bitField0_ & ~0x00000002);
+      ;
       onChanged();
       return this;
     }
@@ -1282,21 +1385,29 @@ public Builder clearMembers() {
      * <pre>
      * Specifies the principals requesting access for a Cloud Platform resource.
      * `members` can have the following values:
+     *
      * * `allUsers`: A special identifier that represents anyone who is
      *    on the internet; with or without a Google account.
+     *
      * * `allAuthenticatedUsers`: A special identifier that represents anyone
      *    who is authenticated with a Google account or a service account.
+     *
      * * `user:{emailid}`: An email address that represents a specific Google
      *    account. For example, `alice&#64;example.com` .
+     *
+     *
      * * `serviceAccount:{emailid}`: An email address that represents a service
      *    account. For example, `my-other-app&#64;appspot.gserviceaccount.com`.
+     *
      * * `group:{emailid}`: An email address that represents a Google group.
      *    For example, `admins&#64;example.com`.
+     *
      * * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
      *    identifier) representing a user that has been recently deleted. For
      *    example, `alice&#64;example.com?uid=123456789012345678901`. If the user is
      *    recovered, this value reverts to `user:{emailid}` and the recovered user
      *    retains the role in the binding.
+     *
      * * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
      *    unique identifier) representing a service account that has been recently
      *    deleted. For example,
@@ -1304,11 +1415,14 @@ public Builder clearMembers() {
      *    If the service account is undeleted, this value reverts to
      *    `serviceAccount:{emailid}` and the undeleted service account retains the
      *    role in the binding.
+     *
      * * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
      *    identifier) representing a Google group that has been recently
      *    deleted. For example, `admins&#64;example.com?uid=123456789012345678901`. If
      *    the group is recovered, this value reverts to `group:{emailid}` and the
      *    recovered group retains the role in the binding.
+     *
+     *
      * * `domain:{domain}`: The G Suite domain (primary) that represents all the
      *    users of that domain. For example, `google.com` or `example.com`.
      * </pre>
@@ -1325,6 +1439,7 @@ public Builder addMembersBytes(com.google.protobuf.ByteString value) {
       checkByteStringIsUtf8(value);
       ensureMembersIsMutable();
       members_.add(value);
+      bitField0_ |= 0x00000002;
       onChanged();
       return this;
     }
@@ -1338,11 +1453,14 @@ public Builder addMembersBytes(com.google.protobuf.ByteString value) {
      *
      * <pre>
      * The condition that is associated with this binding.
+     *
      * If the condition evaluates to `true`, then this binding applies to the
      * current request.
+     *
      * If the condition evaluates to `false`, then this binding does not apply to
      * the current request. However, a different role binding might grant the same
      * role to one or more of the principals in this binding.
+     *
      * To learn which resources support conditions in their IAM policies, see the
      * [IAM
      * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -1360,11 +1478,14 @@ public boolean hasCondition() {
      *
      * <pre>
      * The condition that is associated with this binding.
+     *
      * If the condition evaluates to `true`, then this binding applies to the
      * current request.
+     *
      * If the condition evaluates to `false`, then this binding does not apply to
      * the current request. However, a different role binding might grant the same
      * role to one or more of the principals in this binding.
+     *
      * To learn which resources support conditions in their IAM policies, see the
      * [IAM
      * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -1386,11 +1507,14 @@ public com.google.type.Expr getCondition() {
      *
      * <pre>
      * The condition that is associated with this binding.
+     *
      * If the condition evaluates to `true`, then this binding applies to the
      * current request.
+     *
      * If the condition evaluates to `false`, then this binding does not apply to
      * the current request. However, a different role binding might grant the same
      * role to one or more of the principals in this binding.
+     *
      * To learn which resources support conditions in their IAM policies, see the
      * [IAM
      * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -1416,11 +1540,14 @@ public Builder setCondition(com.google.type.Expr value) {
      *
      * <pre>
      * The condition that is associated with this binding.
+     *
      * If the condition evaluates to `true`, then this binding applies to the
      * current request.
+     *
      * If the condition evaluates to `false`, then this binding does not apply to
      * the current request. However, a different role binding might grant the same
      * role to one or more of the principals in this binding.
+     *
      * To learn which resources support conditions in their IAM policies, see the
      * [IAM
      * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -1443,11 +1570,14 @@ public Builder setCondition(com.google.type.Expr.Builder builderForValue) {
      *
      * <pre>
      * The condition that is associated with this binding.
+     *
      * If the condition evaluates to `true`, then this binding applies to the
      * current request.
+     *
      * If the condition evaluates to `false`, then this binding does not apply to
      * the current request. However, a different role binding might grant the same
      * role to one or more of the principals in this binding.
+     *
      * To learn which resources support conditions in their IAM policies, see the
      * [IAM
      * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -1476,11 +1606,14 @@ public Builder mergeCondition(com.google.type.Expr value) {
      *
      * <pre>
      * The condition that is associated with this binding.
+     *
      * If the condition evaluates to `true`, then this binding applies to the
      * current request.
+     *
      * If the condition evaluates to `false`, then this binding does not apply to
      * the current request. However, a different role binding might grant the same
      * role to one or more of the principals in this binding.
+     *
      * To learn which resources support conditions in their IAM policies, see the
      * [IAM
      * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -1503,11 +1636,14 @@ public Builder clearCondition() {
      *
      * <pre>
      * The condition that is associated with this binding.
+     *
      * If the condition evaluates to `true`, then this binding applies to the
      * current request.
+     *
      * If the condition evaluates to `false`, then this binding does not apply to
      * the current request. However, a different role binding might grant the same
      * role to one or more of the principals in this binding.
+     *
      * To learn which resources support conditions in their IAM policies, see the
      * [IAM
      * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -1525,11 +1661,14 @@ public com.google.type.Expr.Builder getConditionBuilder() {
      *
      * <pre>
      * The condition that is associated with this binding.
+     *
      * If the condition evaluates to `true`, then this binding applies to the
      * current request.
+     *
      * If the condition evaluates to `false`, then this binding does not apply to
      * the current request. However, a different role binding might grant the same
      * role to one or more of the principals in this binding.
+     *
      * To learn which resources support conditions in their IAM policies, see the
      * [IAM
      * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -1549,11 +1688,14 @@ public com.google.type.ExprOrBuilder getConditionOrBuilder() {
      *
      * <pre>
      * The condition that is associated with this binding.
+     *
      * If the condition evaluates to `true`, then this binding applies to the
      * current request.
+     *
      * If the condition evaluates to `false`, then this binding does not apply to
      * the current request. However, a different role binding might grant the same
      * role to one or more of the principals in this binding.
+     *
      * To learn which resources support conditions in their IAM policies, see the
      * [IAM
      * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
diff --git a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/BindingDelta.java b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/BindingDelta.java
index 340980bdfc..49334ca531 100644
--- a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/BindingDelta.java
+++ b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/BindingDelta.java
@@ -50,11 +50,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new BindingDelta();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v1.PolicyProto.internal_static_google_iam_v1_BindingDelta_descriptor;
   }
@@ -701,39 +696,6 @@ private void buildPartial0(com.google.iam.v1.BindingDelta result) {
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v1.BindingDelta) {
diff --git a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/BindingOrBuilder.java b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/BindingOrBuilder.java
index b5e660fa3a..db97e10030 100644
--- a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/BindingOrBuilder.java
+++ b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/BindingOrBuilder.java
@@ -56,21 +56,29 @@ public interface BindingOrBuilder
    * <pre>
    * Specifies the principals requesting access for a Cloud Platform resource.
    * `members` can have the following values:
+   *
    * * `allUsers`: A special identifier that represents anyone who is
    *    on the internet; with or without a Google account.
+   *
    * * `allAuthenticatedUsers`: A special identifier that represents anyone
    *    who is authenticated with a Google account or a service account.
+   *
    * * `user:{emailid}`: An email address that represents a specific Google
    *    account. For example, `alice&#64;example.com` .
+   *
+   *
    * * `serviceAccount:{emailid}`: An email address that represents a service
    *    account. For example, `my-other-app&#64;appspot.gserviceaccount.com`.
+   *
    * * `group:{emailid}`: An email address that represents a Google group.
    *    For example, `admins&#64;example.com`.
+   *
    * * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
    *    identifier) representing a user that has been recently deleted. For
    *    example, `alice&#64;example.com?uid=123456789012345678901`. If the user is
    *    recovered, this value reverts to `user:{emailid}` and the recovered user
    *    retains the role in the binding.
+   *
    * * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
    *    unique identifier) representing a service account that has been recently
    *    deleted. For example,
@@ -78,11 +86,14 @@ public interface BindingOrBuilder
    *    If the service account is undeleted, this value reverts to
    *    `serviceAccount:{emailid}` and the undeleted service account retains the
    *    role in the binding.
+   *
    * * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
    *    identifier) representing a Google group that has been recently
    *    deleted. For example, `admins&#64;example.com?uid=123456789012345678901`. If
    *    the group is recovered, this value reverts to `group:{emailid}` and the
    *    recovered group retains the role in the binding.
+   *
+   *
    * * `domain:{domain}`: The G Suite domain (primary) that represents all the
    *    users of that domain. For example, `google.com` or `example.com`.
    * </pre>
@@ -98,21 +109,29 @@ public interface BindingOrBuilder
    * <pre>
    * Specifies the principals requesting access for a Cloud Platform resource.
    * `members` can have the following values:
+   *
    * * `allUsers`: A special identifier that represents anyone who is
    *    on the internet; with or without a Google account.
+   *
    * * `allAuthenticatedUsers`: A special identifier that represents anyone
    *    who is authenticated with a Google account or a service account.
+   *
    * * `user:{emailid}`: An email address that represents a specific Google
    *    account. For example, `alice&#64;example.com` .
+   *
+   *
    * * `serviceAccount:{emailid}`: An email address that represents a service
    *    account. For example, `my-other-app&#64;appspot.gserviceaccount.com`.
+   *
    * * `group:{emailid}`: An email address that represents a Google group.
    *    For example, `admins&#64;example.com`.
+   *
    * * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
    *    identifier) representing a user that has been recently deleted. For
    *    example, `alice&#64;example.com?uid=123456789012345678901`. If the user is
    *    recovered, this value reverts to `user:{emailid}` and the recovered user
    *    retains the role in the binding.
+   *
    * * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
    *    unique identifier) representing a service account that has been recently
    *    deleted. For example,
@@ -120,11 +139,14 @@ public interface BindingOrBuilder
    *    If the service account is undeleted, this value reverts to
    *    `serviceAccount:{emailid}` and the undeleted service account retains the
    *    role in the binding.
+   *
    * * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
    *    identifier) representing a Google group that has been recently
    *    deleted. For example, `admins&#64;example.com?uid=123456789012345678901`. If
    *    the group is recovered, this value reverts to `group:{emailid}` and the
    *    recovered group retains the role in the binding.
+   *
+   *
    * * `domain:{domain}`: The G Suite domain (primary) that represents all the
    *    users of that domain. For example, `google.com` or `example.com`.
    * </pre>
@@ -140,21 +162,29 @@ public interface BindingOrBuilder
    * <pre>
    * Specifies the principals requesting access for a Cloud Platform resource.
    * `members` can have the following values:
+   *
    * * `allUsers`: A special identifier that represents anyone who is
    *    on the internet; with or without a Google account.
+   *
    * * `allAuthenticatedUsers`: A special identifier that represents anyone
    *    who is authenticated with a Google account or a service account.
+   *
    * * `user:{emailid}`: An email address that represents a specific Google
    *    account. For example, `alice&#64;example.com` .
+   *
+   *
    * * `serviceAccount:{emailid}`: An email address that represents a service
    *    account. For example, `my-other-app&#64;appspot.gserviceaccount.com`.
+   *
    * * `group:{emailid}`: An email address that represents a Google group.
    *    For example, `admins&#64;example.com`.
+   *
    * * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
    *    identifier) representing a user that has been recently deleted. For
    *    example, `alice&#64;example.com?uid=123456789012345678901`. If the user is
    *    recovered, this value reverts to `user:{emailid}` and the recovered user
    *    retains the role in the binding.
+   *
    * * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
    *    unique identifier) representing a service account that has been recently
    *    deleted. For example,
@@ -162,11 +192,14 @@ public interface BindingOrBuilder
    *    If the service account is undeleted, this value reverts to
    *    `serviceAccount:{emailid}` and the undeleted service account retains the
    *    role in the binding.
+   *
    * * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
    *    identifier) representing a Google group that has been recently
    *    deleted. For example, `admins&#64;example.com?uid=123456789012345678901`. If
    *    the group is recovered, this value reverts to `group:{emailid}` and the
    *    recovered group retains the role in the binding.
+   *
+   *
    * * `domain:{domain}`: The G Suite domain (primary) that represents all the
    *    users of that domain. For example, `google.com` or `example.com`.
    * </pre>
@@ -183,21 +216,29 @@ public interface BindingOrBuilder
    * <pre>
    * Specifies the principals requesting access for a Cloud Platform resource.
    * `members` can have the following values:
+   *
    * * `allUsers`: A special identifier that represents anyone who is
    *    on the internet; with or without a Google account.
+   *
    * * `allAuthenticatedUsers`: A special identifier that represents anyone
    *    who is authenticated with a Google account or a service account.
+   *
    * * `user:{emailid}`: An email address that represents a specific Google
    *    account. For example, `alice&#64;example.com` .
+   *
+   *
    * * `serviceAccount:{emailid}`: An email address that represents a service
    *    account. For example, `my-other-app&#64;appspot.gserviceaccount.com`.
+   *
    * * `group:{emailid}`: An email address that represents a Google group.
    *    For example, `admins&#64;example.com`.
+   *
    * * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique
    *    identifier) representing a user that has been recently deleted. For
    *    example, `alice&#64;example.com?uid=123456789012345678901`. If the user is
    *    recovered, this value reverts to `user:{emailid}` and the recovered user
    *    retains the role in the binding.
+   *
    * * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus
    *    unique identifier) representing a service account that has been recently
    *    deleted. For example,
@@ -205,11 +246,14 @@ public interface BindingOrBuilder
    *    If the service account is undeleted, this value reverts to
    *    `serviceAccount:{emailid}` and the undeleted service account retains the
    *    role in the binding.
+   *
    * * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique
    *    identifier) representing a Google group that has been recently
    *    deleted. For example, `admins&#64;example.com?uid=123456789012345678901`. If
    *    the group is recovered, this value reverts to `group:{emailid}` and the
    *    recovered group retains the role in the binding.
+   *
+   *
    * * `domain:{domain}`: The G Suite domain (primary) that represents all the
    *    users of that domain. For example, `google.com` or `example.com`.
    * </pre>
@@ -226,11 +270,14 @@ public interface BindingOrBuilder
    *
    * <pre>
    * The condition that is associated with this binding.
+   *
    * If the condition evaluates to `true`, then this binding applies to the
    * current request.
+   *
    * If the condition evaluates to `false`, then this binding does not apply to
    * the current request. However, a different role binding might grant the same
    * role to one or more of the principals in this binding.
+   *
    * To learn which resources support conditions in their IAM policies, see the
    * [IAM
    * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -246,11 +293,14 @@ public interface BindingOrBuilder
    *
    * <pre>
    * The condition that is associated with this binding.
+   *
    * If the condition evaluates to `true`, then this binding applies to the
    * current request.
+   *
    * If the condition evaluates to `false`, then this binding does not apply to
    * the current request. However, a different role binding might grant the same
    * role to one or more of the principals in this binding.
+   *
    * To learn which resources support conditions in their IAM policies, see the
    * [IAM
    * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -266,11 +316,14 @@ public interface BindingOrBuilder
    *
    * <pre>
    * The condition that is associated with this binding.
+   *
    * If the condition evaluates to `true`, then this binding applies to the
    * current request.
+   *
    * If the condition evaluates to `false`, then this binding does not apply to
    * the current request. However, a different role binding might grant the same
    * role to one or more of the principals in this binding.
+   *
    * To learn which resources support conditions in their IAM policies, see the
    * [IAM
    * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
diff --git a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/GetIamPolicyRequest.java b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/GetIamPolicyRequest.java
index 532f56549c..7a3fb09423 100644
--- a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/GetIamPolicyRequest.java
+++ b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/GetIamPolicyRequest.java
@@ -47,11 +47,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new GetIamPolicyRequest();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v1.IamPolicyProto
         .internal_static_google_iam_v1_GetIamPolicyRequest_descriptor;
@@ -433,39 +428,6 @@ private void buildPartial0(com.google.iam.v1.GetIamPolicyRequest result) {
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v1.GetIamPolicyRequest) {
diff --git a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/GetPolicyOptions.java b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/GetPolicyOptions.java
index 9484d8801c..b4e03b62c7 100644
--- a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/GetPolicyOptions.java
+++ b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/GetPolicyOptions.java
@@ -45,11 +45,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new GetPolicyOptions();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v1.OptionsProto.internal_static_google_iam_v1_GetPolicyOptions_descriptor;
   }
@@ -72,15 +67,19 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
    * <pre>
    * Optional. The maximum policy version that will be used to format the
    * policy.
+   *
    * Valid values are 0, 1, and 3. Requests specifying an invalid value will be
    * rejected.
+   *
    * Requests for policies with any conditional role bindings must specify
    * version 3. Policies with no conditional role bindings may specify any valid
    * value or leave the field unset.
+   *
    * The policy in the response might use the policy version that you specified,
    * or it might use a lower policy version. For example, if you specify version
    * 3, but the policy has no conditional role bindings, the response uses
    * version 1.
+   *
    * To learn which resources support conditions in their IAM policies, see the
    * [IAM
    * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -332,39 +331,6 @@ private void buildPartial0(com.google.iam.v1.GetPolicyOptions result) {
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v1.GetPolicyOptions) {
@@ -438,15 +404,19 @@ public Builder mergeFrom(
      * <pre>
      * Optional. The maximum policy version that will be used to format the
      * policy.
+     *
      * Valid values are 0, 1, and 3. Requests specifying an invalid value will be
      * rejected.
+     *
      * Requests for policies with any conditional role bindings must specify
      * version 3. Policies with no conditional role bindings may specify any valid
      * value or leave the field unset.
+     *
      * The policy in the response might use the policy version that you specified,
      * or it might use a lower policy version. For example, if you specify version
      * 3, but the policy has no conditional role bindings, the response uses
      * version 1.
+     *
      * To learn which resources support conditions in their IAM policies, see the
      * [IAM
      * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -466,15 +436,19 @@ public int getRequestedPolicyVersion() {
      * <pre>
      * Optional. The maximum policy version that will be used to format the
      * policy.
+     *
      * Valid values are 0, 1, and 3. Requests specifying an invalid value will be
      * rejected.
+     *
      * Requests for policies with any conditional role bindings must specify
      * version 3. Policies with no conditional role bindings may specify any valid
      * value or leave the field unset.
+     *
      * The policy in the response might use the policy version that you specified,
      * or it might use a lower policy version. For example, if you specify version
      * 3, but the policy has no conditional role bindings, the response uses
      * version 1.
+     *
      * To learn which resources support conditions in their IAM policies, see the
      * [IAM
      * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -498,15 +472,19 @@ public Builder setRequestedPolicyVersion(int value) {
      * <pre>
      * Optional. The maximum policy version that will be used to format the
      * policy.
+     *
      * Valid values are 0, 1, and 3. Requests specifying an invalid value will be
      * rejected.
+     *
      * Requests for policies with any conditional role bindings must specify
      * version 3. Policies with no conditional role bindings may specify any valid
      * value or leave the field unset.
+     *
      * The policy in the response might use the policy version that you specified,
      * or it might use a lower policy version. For example, if you specify version
      * 3, but the policy has no conditional role bindings, the response uses
      * version 1.
+     *
      * To learn which resources support conditions in their IAM policies, see the
      * [IAM
      * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
diff --git a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/GetPolicyOptionsOrBuilder.java b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/GetPolicyOptionsOrBuilder.java
index 1cd51a9971..e93425ad57 100644
--- a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/GetPolicyOptionsOrBuilder.java
+++ b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/GetPolicyOptionsOrBuilder.java
@@ -29,15 +29,19 @@ public interface GetPolicyOptionsOrBuilder
    * <pre>
    * Optional. The maximum policy version that will be used to format the
    * policy.
+   *
    * Valid values are 0, 1, and 3. Requests specifying an invalid value will be
    * rejected.
+   *
    * Requests for policies with any conditional role bindings must specify
    * version 3. Policies with no conditional role bindings may specify any valid
    * value or leave the field unset.
+   *
    * The policy in the response might use the policy version that you specified,
    * or it might use a lower policy version. For example, if you specify version
    * 3, but the policy has no conditional role bindings, the response uses
    * version 1.
+   *
    * To learn which resources support conditions in their IAM policies, see the
    * [IAM
    * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
diff --git a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/IamPolicyProto.java b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/IamPolicyProto.java
index e1a3a44398..a61d0e275d 100644
--- a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/IamPolicyProto.java
+++ b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/IamPolicyProto.java
@@ -58,31 +58,31 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
           + "_behavior.proto\032\031google/api/resource.pro"
           + "to\032\033google/iam/v1/options.proto\032\032google/"
           + "iam/v1/policy.proto\032 google/protobuf/fie"
-          + "ld_mask.proto\"\217\001\n\023SetIamPolicyRequest\022\033\n"
-          + "\010resource\030\001 \001(\tB\t\340A\002\372A\003\n\001*\022*\n\006policy\030\002 \001"
-          + "(\0132\025.google.iam.v1.PolicyB\003\340A\002\022/\n\013update"
-          + "_mask\030\003 \001(\0132\032.google.protobuf.FieldMask\""
-          + "d\n\023GetIamPolicyRequest\022\033\n\010resource\030\001 \001(\t"
-          + "B\t\340A\002\372A\003\n\001*\0220\n\007options\030\002 \001(\0132\037.google.ia"
-          + "m.v1.GetPolicyOptions\"R\n\031TestIamPermissi"
-          + "onsRequest\022\033\n\010resource\030\001 \001(\tB\t\340A\002\372A\003\n\001*\022"
-          + "\030\n\013permissions\030\002 \003(\tB\003\340A\002\"1\n\032TestIamPerm"
-          + "issionsResponse\022\023\n\013permissions\030\001 \003(\t2\264\003\n"
-          + "\tIAMPolicy\022t\n\014SetIamPolicy\022\".google.iam."
-          + "v1.SetIamPolicyRequest\032\025.google.iam.v1.P"
-          + "olicy\")\202\323\344\223\002#\"\036/v1/{resource=**}:setIamP"
-          + "olicy:\001*\022t\n\014GetIamPolicy\022\".google.iam.v1"
-          + ".GetIamPolicyRequest\032\025.google.iam.v1.Pol"
-          + "icy\")\202\323\344\223\002#\"\036/v1/{resource=**}:getIamPol"
-          + "icy:\001*\022\232\001\n\022TestIamPermissions\022(.google.i"
-          + "am.v1.TestIamPermissionsRequest\032).google"
-          + ".iam.v1.TestIamPermissionsResponse\"/\202\323\344\223"
-          + "\002)\"$/v1/{resource=**}:testIamPermissions"
-          + ":\001*\032\036\312A\033iam-meta-api.googleapis.comB\177\n\021c"
-          + "om.google.iam.v1B\016IamPolicyProtoP\001Z)clou"
-          + "d.google.com/go/iam/apiv1/iampb;iampb\370\001\001"
-          + "\252\002\023Google.Cloud.Iam.V1\312\002\023Google\\Cloud\\Ia"
-          + "m\\V1b\006proto3"
+          + "ld_mask.proto\"\221\001\n\023SetIamPolicyRequest\022\034\n"
+          + "\010resource\030\001 \001(\tB\n\342A\001\002\372A\003\n\001*\022+\n\006policy\030\002 "
+          + "\001(\0132\025.google.iam.v1.PolicyB\004\342A\001\002\022/\n\013upda"
+          + "te_mask\030\003 \001(\0132\032.google.protobuf.FieldMas"
+          + "k\"e\n\023GetIamPolicyRequest\022\034\n\010resource\030\001 \001"
+          + "(\tB\n\342A\001\002\372A\003\n\001*\0220\n\007options\030\002 \001(\0132\037.google"
+          + ".iam.v1.GetPolicyOptions\"T\n\031TestIamPermi"
+          + "ssionsRequest\022\034\n\010resource\030\001 \001(\tB\n\342A\001\002\372A\003"
+          + "\n\001*\022\031\n\013permissions\030\002 \003(\tB\004\342A\001\002\"1\n\032TestIa"
+          + "mPermissionsResponse\022\023\n\013permissions\030\001 \003("
+          + "\t2\264\003\n\tIAMPolicy\022t\n\014SetIamPolicy\022\".google"
+          + ".iam.v1.SetIamPolicyRequest\032\025.google.iam"
+          + ".v1.Policy\")\202\323\344\223\002#\"\036/v1/{resource=**}:se"
+          + "tIamPolicy:\001*\022t\n\014GetIamPolicy\022\".google.i"
+          + "am.v1.GetIamPolicyRequest\032\025.google.iam.v"
+          + "1.Policy\")\202\323\344\223\002#\"\036/v1/{resource=**}:getI"
+          + "amPolicy:\001*\022\232\001\n\022TestIamPermissions\022(.goo"
+          + "gle.iam.v1.TestIamPermissionsRequest\032).g"
+          + "oogle.iam.v1.TestIamPermissionsResponse\""
+          + "/\202\323\344\223\002)\"$/v1/{resource=**}:testIamPermis"
+          + "sions:\001*\032\036\312A\033iam-meta-api.googleapis.com"
+          + "B\177\n\021com.google.iam.v1B\016IamPolicyProtoP\001Z"
+          + ")cloud.google.com/go/iam/apiv1/iampb;iam"
+          + "pb\370\001\001\252\002\023Google.Cloud.Iam.V1\312\002\023Google\\Clo"
+          + "ud\\Iam\\V1b\006proto3"
     };
     descriptor =
         com.google.protobuf.Descriptors.FileDescriptor.internalBuildGeneratedFileFrom(
diff --git a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/Policy.java b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/Policy.java
index 7f658f2af0..07c896a20e 100644
--- a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/Policy.java
+++ b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/Policy.java
@@ -24,11 +24,14 @@
  * <pre>
  * An Identity and Access Management (IAM) policy, which specifies access
  * controls for Google Cloud resources.
+ *
+ *
  * A `Policy` is a collection of `bindings`. A `binding` binds one or more
  * `members`, or principals, to a single `role`. Principals can be user
  * accounts, service accounts, Google groups, and domains (such as G Suite). A
  * `role` is a named list of permissions; each `role` can be an IAM predefined
  * role or a user-created custom role.
+ *
  * For some types of Google Cloud resources, a `binding` can also specify a
  * `condition`, which is a logical expression that allows access to a resource
  * only if the expression evaluates to `true`. A condition can add constraints
@@ -36,7 +39,9 @@
  * resources support conditions in their IAM policies, see the
  * [IAM
  * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+ *
  * **JSON example:**
+ *
  *     {
  *       "bindings": [
  *         {
@@ -64,7 +69,9 @@
  *       "etag": "BwWWja0YfJA=",
  *       "version": 3
  *     }
+ *
  * **YAML example:**
+ *
  *     bindings:
  *     - members:
  *       - user:mike&#64;example.com
@@ -81,6 +88,7 @@
  *         expression: request.time &lt; timestamp('2020-10-01T00:00:00.000Z')
  *     etag: BwWWja0YfJA=
  *     version: 3
+ *
  * For a description of IAM and its features, see the
  * [IAM documentation](https://cloud.google.com/iam/docs/).
  * </pre>
@@ -109,11 +117,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new Policy();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v1.PolicyProto.internal_static_google_iam_v1_Policy_descriptor;
   }
@@ -133,21 +136,27 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
    *
    * <pre>
    * Specifies the format of the policy.
+   *
    * Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
    * are rejected.
+   *
    * Any operation that affects conditional role bindings must specify version
    * `3`. This requirement applies to the following operations:
+   *
    * * Getting a policy that includes a conditional role binding
    * * Adding a conditional role binding to a policy
    * * Changing a conditional role binding in a policy
    * * Removing any role binding, with or without a condition, from a policy
    *   that includes conditions
+   *
    * **Important:** If you use IAM Conditions, you must include the `etag` field
    * whenever you call `setIamPolicy`. If you omit this field, then IAM allows
    * you to overwrite a version `3` policy with a version `1` policy, and all of
    * the conditions in the version `3` policy are lost.
+   *
    * If a policy does not include any conditions, operations on that policy may
    * specify any valid version or leave the field unset.
+   *
    * To learn which resources support conditions in their IAM policies, see the
    * [IAM
    * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -173,6 +182,7 @@ public int getVersion() {
    * Associates a list of `members`, or principals, with a `role`. Optionally,
    * may specify a `condition` that determines how and when the `bindings` are
    * applied. Each of the `bindings` must contain at least one principal.
+   *
    * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
    * of these principals can be Google groups. Each occurrence of a principal
    * counts towards these limits. For example, if the `bindings` grant 50
@@ -194,6 +204,7 @@ public java.util.List<com.google.iam.v1.Binding> getBindingsList() {
    * Associates a list of `members`, or principals, with a `role`. Optionally,
    * may specify a `condition` that determines how and when the `bindings` are
    * applied. Each of the `bindings` must contain at least one principal.
+   *
    * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
    * of these principals can be Google groups. Each occurrence of a principal
    * counts towards these limits. For example, if the `bindings` grant 50
@@ -215,6 +226,7 @@ public java.util.List<? extends com.google.iam.v1.BindingOrBuilder> getBindingsO
    * Associates a list of `members`, or principals, with a `role`. Optionally,
    * may specify a `condition` that determines how and when the `bindings` are
    * applied. Each of the `bindings` must contain at least one principal.
+   *
    * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
    * of these principals can be Google groups. Each occurrence of a principal
    * counts towards these limits. For example, if the `bindings` grant 50
@@ -236,6 +248,7 @@ public int getBindingsCount() {
    * Associates a list of `members`, or principals, with a `role`. Optionally,
    * may specify a `condition` that determines how and when the `bindings` are
    * applied. Each of the `bindings` must contain at least one principal.
+   *
    * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
    * of these principals can be Google groups. Each occurrence of a principal
    * counts towards these limits. For example, if the `bindings` grant 50
@@ -257,6 +270,7 @@ public com.google.iam.v1.Binding getBindings(int index) {
    * Associates a list of `members`, or principals, with a `role`. Optionally,
    * may specify a `condition` that determines how and when the `bindings` are
    * applied. Each of the `bindings` must contain at least one principal.
+   *
    * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
    * of these principals can be Google groups. Each occurrence of a principal
    * counts towards these limits. For example, if the `bindings` grant 50
@@ -356,6 +370,7 @@ public com.google.iam.v1.AuditConfigOrBuilder getAuditConfigsOrBuilder(int index
    * conditions: An `etag` is returned in the response to `getIamPolicy`, and
    * systems are expected to put that etag in the request to `setIamPolicy` to
    * ensure that their change will be applied to the same version of the policy.
+   *
    * **Important:** If you use IAM Conditions, you must include the `etag` field
    * whenever you call `setIamPolicy`. If you omit this field, then IAM allows
    * you to overwrite a version `3` policy with a version `1` policy, and all of
@@ -565,11 +580,14 @@ protected Builder newBuilderForType(com.google.protobuf.GeneratedMessageV3.Build
    * <pre>
    * An Identity and Access Management (IAM) policy, which specifies access
    * controls for Google Cloud resources.
+   *
+   *
    * A `Policy` is a collection of `bindings`. A `binding` binds one or more
    * `members`, or principals, to a single `role`. Principals can be user
    * accounts, service accounts, Google groups, and domains (such as G Suite). A
    * `role` is a named list of permissions; each `role` can be an IAM predefined
    * role or a user-created custom role.
+   *
    * For some types of Google Cloud resources, a `binding` can also specify a
    * `condition`, which is a logical expression that allows access to a resource
    * only if the expression evaluates to `true`. A condition can add constraints
@@ -577,7 +595,9 @@ protected Builder newBuilderForType(com.google.protobuf.GeneratedMessageV3.Build
    * resources support conditions in their IAM policies, see the
    * [IAM
    * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
+   *
    * **JSON example:**
+   *
    *     {
    *       "bindings": [
    *         {
@@ -605,7 +625,9 @@ protected Builder newBuilderForType(com.google.protobuf.GeneratedMessageV3.Build
    *       "etag": "BwWWja0YfJA=",
    *       "version": 3
    *     }
+   *
    * **YAML example:**
+   *
    *     bindings:
    *     - members:
    *       - user:mike&#64;example.com
@@ -622,6 +644,7 @@ protected Builder newBuilderForType(com.google.protobuf.GeneratedMessageV3.Build
    *         expression: request.time &lt; timestamp('2020-10-01T00:00:00.000Z')
    *     etag: BwWWja0YfJA=
    *     version: 3
+   *
    * For a description of IAM and its features, see the
    * [IAM documentation](https://cloud.google.com/iam/docs/).
    * </pre>
@@ -735,39 +758,6 @@ private void buildPartial0(com.google.iam.v1.Policy result) {
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v1.Policy) {
@@ -927,21 +917,27 @@ public Builder mergeFrom(
      *
      * <pre>
      * Specifies the format of the policy.
+     *
      * Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
      * are rejected.
+     *
      * Any operation that affects conditional role bindings must specify version
      * `3`. This requirement applies to the following operations:
+     *
      * * Getting a policy that includes a conditional role binding
      * * Adding a conditional role binding to a policy
      * * Changing a conditional role binding in a policy
      * * Removing any role binding, with or without a condition, from a policy
      *   that includes conditions
+     *
      * **Important:** If you use IAM Conditions, you must include the `etag` field
      * whenever you call `setIamPolicy`. If you omit this field, then IAM allows
      * you to overwrite a version `3` policy with a version `1` policy, and all of
      * the conditions in the version `3` policy are lost.
+     *
      * If a policy does not include any conditions, operations on that policy may
      * specify any valid version or leave the field unset.
+     *
      * To learn which resources support conditions in their IAM policies, see the
      * [IAM
      * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -960,21 +956,27 @@ public int getVersion() {
      *
      * <pre>
      * Specifies the format of the policy.
+     *
      * Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
      * are rejected.
+     *
      * Any operation that affects conditional role bindings must specify version
      * `3`. This requirement applies to the following operations:
+     *
      * * Getting a policy that includes a conditional role binding
      * * Adding a conditional role binding to a policy
      * * Changing a conditional role binding in a policy
      * * Removing any role binding, with or without a condition, from a policy
      *   that includes conditions
+     *
      * **Important:** If you use IAM Conditions, you must include the `etag` field
      * whenever you call `setIamPolicy`. If you omit this field, then IAM allows
      * you to overwrite a version `3` policy with a version `1` policy, and all of
      * the conditions in the version `3` policy are lost.
+     *
      * If a policy does not include any conditions, operations on that policy may
      * specify any valid version or leave the field unset.
+     *
      * To learn which resources support conditions in their IAM policies, see the
      * [IAM
      * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -997,21 +999,27 @@ public Builder setVersion(int value) {
      *
      * <pre>
      * Specifies the format of the policy.
+     *
      * Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
      * are rejected.
+     *
      * Any operation that affects conditional role bindings must specify version
      * `3`. This requirement applies to the following operations:
+     *
      * * Getting a policy that includes a conditional role binding
      * * Adding a conditional role binding to a policy
      * * Changing a conditional role binding in a policy
      * * Removing any role binding, with or without a condition, from a policy
      *   that includes conditions
+     *
      * **Important:** If you use IAM Conditions, you must include the `etag` field
      * whenever you call `setIamPolicy`. If you omit this field, then IAM allows
      * you to overwrite a version `3` policy with a version `1` policy, and all of
      * the conditions in the version `3` policy are lost.
+     *
      * If a policy does not include any conditions, operations on that policy may
      * specify any valid version or leave the field unset.
+     *
      * To learn which resources support conditions in their IAM policies, see the
      * [IAM
      * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -1050,6 +1058,7 @@ private void ensureBindingsIsMutable() {
      * Associates a list of `members`, or principals, with a `role`. Optionally,
      * may specify a `condition` that determines how and when the `bindings` are
      * applied. Each of the `bindings` must contain at least one principal.
+     *
      * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
      * of these principals can be Google groups. Each occurrence of a principal
      * counts towards these limits. For example, if the `bindings` grant 50
@@ -1074,6 +1083,7 @@ public java.util.List<com.google.iam.v1.Binding> getBindingsList() {
      * Associates a list of `members`, or principals, with a `role`. Optionally,
      * may specify a `condition` that determines how and when the `bindings` are
      * applied. Each of the `bindings` must contain at least one principal.
+     *
      * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
      * of these principals can be Google groups. Each occurrence of a principal
      * counts towards these limits. For example, if the `bindings` grant 50
@@ -1098,6 +1108,7 @@ public int getBindingsCount() {
      * Associates a list of `members`, or principals, with a `role`. Optionally,
      * may specify a `condition` that determines how and when the `bindings` are
      * applied. Each of the `bindings` must contain at least one principal.
+     *
      * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
      * of these principals can be Google groups. Each occurrence of a principal
      * counts towards these limits. For example, if the `bindings` grant 50
@@ -1122,6 +1133,7 @@ public com.google.iam.v1.Binding getBindings(int index) {
      * Associates a list of `members`, or principals, with a `role`. Optionally,
      * may specify a `condition` that determines how and when the `bindings` are
      * applied. Each of the `bindings` must contain at least one principal.
+     *
      * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
      * of these principals can be Google groups. Each occurrence of a principal
      * counts towards these limits. For example, if the `bindings` grant 50
@@ -1152,6 +1164,7 @@ public Builder setBindings(int index, com.google.iam.v1.Binding value) {
      * Associates a list of `members`, or principals, with a `role`. Optionally,
      * may specify a `condition` that determines how and when the `bindings` are
      * applied. Each of the `bindings` must contain at least one principal.
+     *
      * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
      * of these principals can be Google groups. Each occurrence of a principal
      * counts towards these limits. For example, if the `bindings` grant 50
@@ -1179,6 +1192,7 @@ public Builder setBindings(int index, com.google.iam.v1.Binding.Builder builderF
      * Associates a list of `members`, or principals, with a `role`. Optionally,
      * may specify a `condition` that determines how and when the `bindings` are
      * applied. Each of the `bindings` must contain at least one principal.
+     *
      * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
      * of these principals can be Google groups. Each occurrence of a principal
      * counts towards these limits. For example, if the `bindings` grant 50
@@ -1209,6 +1223,7 @@ public Builder addBindings(com.google.iam.v1.Binding value) {
      * Associates a list of `members`, or principals, with a `role`. Optionally,
      * may specify a `condition` that determines how and when the `bindings` are
      * applied. Each of the `bindings` must contain at least one principal.
+     *
      * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
      * of these principals can be Google groups. Each occurrence of a principal
      * counts towards these limits. For example, if the `bindings` grant 50
@@ -1239,6 +1254,7 @@ public Builder addBindings(int index, com.google.iam.v1.Binding value) {
      * Associates a list of `members`, or principals, with a `role`. Optionally,
      * may specify a `condition` that determines how and when the `bindings` are
      * applied. Each of the `bindings` must contain at least one principal.
+     *
      * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
      * of these principals can be Google groups. Each occurrence of a principal
      * counts towards these limits. For example, if the `bindings` grant 50
@@ -1266,6 +1282,7 @@ public Builder addBindings(com.google.iam.v1.Binding.Builder builderForValue) {
      * Associates a list of `members`, or principals, with a `role`. Optionally,
      * may specify a `condition` that determines how and when the `bindings` are
      * applied. Each of the `bindings` must contain at least one principal.
+     *
      * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
      * of these principals can be Google groups. Each occurrence of a principal
      * counts towards these limits. For example, if the `bindings` grant 50
@@ -1293,6 +1310,7 @@ public Builder addBindings(int index, com.google.iam.v1.Binding.Builder builderF
      * Associates a list of `members`, or principals, with a `role`. Optionally,
      * may specify a `condition` that determines how and when the `bindings` are
      * applied. Each of the `bindings` must contain at least one principal.
+     *
      * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
      * of these principals can be Google groups. Each occurrence of a principal
      * counts towards these limits. For example, if the `bindings` grant 50
@@ -1320,6 +1338,7 @@ public Builder addAllBindings(java.lang.Iterable<? extends com.google.iam.v1.Bin
      * Associates a list of `members`, or principals, with a `role`. Optionally,
      * may specify a `condition` that determines how and when the `bindings` are
      * applied. Each of the `bindings` must contain at least one principal.
+     *
      * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
      * of these principals can be Google groups. Each occurrence of a principal
      * counts towards these limits. For example, if the `bindings` grant 50
@@ -1347,6 +1366,7 @@ public Builder clearBindings() {
      * Associates a list of `members`, or principals, with a `role`. Optionally,
      * may specify a `condition` that determines how and when the `bindings` are
      * applied. Each of the `bindings` must contain at least one principal.
+     *
      * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
      * of these principals can be Google groups. Each occurrence of a principal
      * counts towards these limits. For example, if the `bindings` grant 50
@@ -1374,6 +1394,7 @@ public Builder removeBindings(int index) {
      * Associates a list of `members`, or principals, with a `role`. Optionally,
      * may specify a `condition` that determines how and when the `bindings` are
      * applied. Each of the `bindings` must contain at least one principal.
+     *
      * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
      * of these principals can be Google groups. Each occurrence of a principal
      * counts towards these limits. For example, if the `bindings` grant 50
@@ -1394,6 +1415,7 @@ public com.google.iam.v1.Binding.Builder getBindingsBuilder(int index) {
      * Associates a list of `members`, or principals, with a `role`. Optionally,
      * may specify a `condition` that determines how and when the `bindings` are
      * applied. Each of the `bindings` must contain at least one principal.
+     *
      * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
      * of these principals can be Google groups. Each occurrence of a principal
      * counts towards these limits. For example, if the `bindings` grant 50
@@ -1418,6 +1440,7 @@ public com.google.iam.v1.BindingOrBuilder getBindingsOrBuilder(int index) {
      * Associates a list of `members`, or principals, with a `role`. Optionally,
      * may specify a `condition` that determines how and when the `bindings` are
      * applied. Each of the `bindings` must contain at least one principal.
+     *
      * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
      * of these principals can be Google groups. Each occurrence of a principal
      * counts towards these limits. For example, if the `bindings` grant 50
@@ -1442,6 +1465,7 @@ public java.util.List<? extends com.google.iam.v1.BindingOrBuilder> getBindingsO
      * Associates a list of `members`, or principals, with a `role`. Optionally,
      * may specify a `condition` that determines how and when the `bindings` are
      * applied. Each of the `bindings` must contain at least one principal.
+     *
      * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
      * of these principals can be Google groups. Each occurrence of a principal
      * counts towards these limits. For example, if the `bindings` grant 50
@@ -1462,6 +1486,7 @@ public com.google.iam.v1.Binding.Builder addBindingsBuilder() {
      * Associates a list of `members`, or principals, with a `role`. Optionally,
      * may specify a `condition` that determines how and when the `bindings` are
      * applied. Each of the `bindings` must contain at least one principal.
+     *
      * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
      * of these principals can be Google groups. Each occurrence of a principal
      * counts towards these limits. For example, if the `bindings` grant 50
@@ -1483,6 +1508,7 @@ public com.google.iam.v1.Binding.Builder addBindingsBuilder(int index) {
      * Associates a list of `members`, or principals, with a `role`. Optionally,
      * may specify a `condition` that determines how and when the `bindings` are
      * applied. Each of the `bindings` must contain at least one principal.
+     *
      * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
      * of these principals can be Google groups. Each occurrence of a principal
      * counts towards these limits. For example, if the `bindings` grant 50
@@ -1874,6 +1900,7 @@ public java.util.List<com.google.iam.v1.AuditConfig.Builder> getAuditConfigsBuil
      * conditions: An `etag` is returned in the response to `getIamPolicy`, and
      * systems are expected to put that etag in the request to `setIamPolicy` to
      * ensure that their change will be applied to the same version of the policy.
+     *
      * **Important:** If you use IAM Conditions, you must include the `etag` field
      * whenever you call `setIamPolicy`. If you omit this field, then IAM allows
      * you to overwrite a version `3` policy with a version `1` policy, and all of
@@ -1899,6 +1926,7 @@ public com.google.protobuf.ByteString getEtag() {
      * conditions: An `etag` is returned in the response to `getIamPolicy`, and
      * systems are expected to put that etag in the request to `setIamPolicy` to
      * ensure that their change will be applied to the same version of the policy.
+     *
      * **Important:** If you use IAM Conditions, you must include the `etag` field
      * whenever you call `setIamPolicy`. If you omit this field, then IAM allows
      * you to overwrite a version `3` policy with a version `1` policy, and all of
@@ -1930,6 +1958,7 @@ public Builder setEtag(com.google.protobuf.ByteString value) {
      * conditions: An `etag` is returned in the response to `getIamPolicy`, and
      * systems are expected to put that etag in the request to `setIamPolicy` to
      * ensure that their change will be applied to the same version of the policy.
+     *
      * **Important:** If you use IAM Conditions, you must include the `etag` field
      * whenever you call `setIamPolicy`. If you omit this field, then IAM allows
      * you to overwrite a version `3` policy with a version `1` policy, and all of
diff --git a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/PolicyDelta.java b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/PolicyDelta.java
index 9ee92e988c..167801f546 100644
--- a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/PolicyDelta.java
+++ b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/PolicyDelta.java
@@ -48,11 +48,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new PolicyDelta();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v1.PolicyProto.internal_static_google_iam_v1_PolicyDelta_descriptor;
   }
@@ -488,39 +483,6 @@ private void buildPartial0(com.google.iam.v1.PolicyDelta result) {
       int from_bitField0_ = bitField0_;
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v1.PolicyDelta) {
diff --git a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/PolicyOrBuilder.java b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/PolicyOrBuilder.java
index 449c1d790c..2039d3792a 100644
--- a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/PolicyOrBuilder.java
+++ b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/PolicyOrBuilder.java
@@ -28,21 +28,27 @@ public interface PolicyOrBuilder
    *
    * <pre>
    * Specifies the format of the policy.
+   *
    * Valid values are `0`, `1`, and `3`. Requests that specify an invalid value
    * are rejected.
+   *
    * Any operation that affects conditional role bindings must specify version
    * `3`. This requirement applies to the following operations:
+   *
    * * Getting a policy that includes a conditional role binding
    * * Adding a conditional role binding to a policy
    * * Changing a conditional role binding in a policy
    * * Removing any role binding, with or without a condition, from a policy
    *   that includes conditions
+   *
    * **Important:** If you use IAM Conditions, you must include the `etag` field
    * whenever you call `setIamPolicy`. If you omit this field, then IAM allows
    * you to overwrite a version `3` policy with a version `1` policy, and all of
    * the conditions in the version `3` policy are lost.
+   *
    * If a policy does not include any conditions, operations on that policy may
    * specify any valid version or leave the field unset.
+   *
    * To learn which resources support conditions in their IAM policies, see the
    * [IAM
    * documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
@@ -61,6 +67,7 @@ public interface PolicyOrBuilder
    * Associates a list of `members`, or principals, with a `role`. Optionally,
    * may specify a `condition` that determines how and when the `bindings` are
    * applied. Each of the `bindings` must contain at least one principal.
+   *
    * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
    * of these principals can be Google groups. Each occurrence of a principal
    * counts towards these limits. For example, if the `bindings` grant 50
@@ -79,6 +86,7 @@ public interface PolicyOrBuilder
    * Associates a list of `members`, or principals, with a `role`. Optionally,
    * may specify a `condition` that determines how and when the `bindings` are
    * applied. Each of the `bindings` must contain at least one principal.
+   *
    * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
    * of these principals can be Google groups. Each occurrence of a principal
    * counts towards these limits. For example, if the `bindings` grant 50
@@ -97,6 +105,7 @@ public interface PolicyOrBuilder
    * Associates a list of `members`, or principals, with a `role`. Optionally,
    * may specify a `condition` that determines how and when the `bindings` are
    * applied. Each of the `bindings` must contain at least one principal.
+   *
    * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
    * of these principals can be Google groups. Each occurrence of a principal
    * counts towards these limits. For example, if the `bindings` grant 50
@@ -115,6 +124,7 @@ public interface PolicyOrBuilder
    * Associates a list of `members`, or principals, with a `role`. Optionally,
    * may specify a `condition` that determines how and when the `bindings` are
    * applied. Each of the `bindings` must contain at least one principal.
+   *
    * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
    * of these principals can be Google groups. Each occurrence of a principal
    * counts towards these limits. For example, if the `bindings` grant 50
@@ -133,6 +143,7 @@ public interface PolicyOrBuilder
    * Associates a list of `members`, or principals, with a `role`. Optionally,
    * may specify a `condition` that determines how and when the `bindings` are
    * applied. Each of the `bindings` must contain at least one principal.
+   *
    * The `bindings` in a `Policy` can refer to up to 1,500 principals; up to 250
    * of these principals can be Google groups. Each occurrence of a principal
    * counts towards these limits. For example, if the `bindings` grant 50
@@ -207,6 +218,7 @@ public interface PolicyOrBuilder
    * conditions: An `etag` is returned in the response to `getIamPolicy`, and
    * systems are expected to put that etag in the request to `setIamPolicy` to
    * ensure that their change will be applied to the same version of the policy.
+   *
    * **Important:** If you use IAM Conditions, you must include the `etag` field
    * whenever you call `setIamPolicy`. If you omit this field, then IAM allows
    * you to overwrite a version `3` policy with a version `1` policy, and all of
diff --git a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/SetIamPolicyRequest.java b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/SetIamPolicyRequest.java
index 15561955bd..7790e2c1c3 100644
--- a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/SetIamPolicyRequest.java
+++ b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/SetIamPolicyRequest.java
@@ -47,11 +47,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new SetIamPolicyRequest();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v1.IamPolicyProto
         .internal_static_google_iam_v1_SetIamPolicyRequest_descriptor;
@@ -188,6 +183,7 @@ public com.google.iam.v1.PolicyOrBuilder getPolicyOrBuilder() {
    * OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only
    * the fields in the mask will be modified. If no mask is provided, the
    * following default mask is used:
+   *
    * `paths: "bindings, etag"`
    * </pre>
    *
@@ -206,6 +202,7 @@ public boolean hasUpdateMask() {
    * OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only
    * the fields in the mask will be modified. If no mask is provided, the
    * following default mask is used:
+   *
    * `paths: "bindings, etag"`
    * </pre>
    *
@@ -224,6 +221,7 @@ public com.google.protobuf.FieldMask getUpdateMask() {
    * OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only
    * the fields in the mask will be modified. If no mask is provided, the
    * following default mask is used:
+   *
    * `paths: "bindings, etag"`
    * </pre>
    *
@@ -516,39 +514,6 @@ private void buildPartial0(com.google.iam.v1.SetIamPolicyRequest result) {
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v1.SetIamPolicyRequest) {
@@ -974,6 +939,7 @@ public com.google.iam.v1.PolicyOrBuilder getPolicyOrBuilder() {
      * OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only
      * the fields in the mask will be modified. If no mask is provided, the
      * following default mask is used:
+     *
      * `paths: "bindings, etag"`
      * </pre>
      *
@@ -991,6 +957,7 @@ public boolean hasUpdateMask() {
      * OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only
      * the fields in the mask will be modified. If no mask is provided, the
      * following default mask is used:
+     *
      * `paths: "bindings, etag"`
      * </pre>
      *
@@ -1014,6 +981,7 @@ public com.google.protobuf.FieldMask getUpdateMask() {
      * OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only
      * the fields in the mask will be modified. If no mask is provided, the
      * following default mask is used:
+     *
      * `paths: "bindings, etag"`
      * </pre>
      *
@@ -1039,6 +1007,7 @@ public Builder setUpdateMask(com.google.protobuf.FieldMask value) {
      * OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only
      * the fields in the mask will be modified. If no mask is provided, the
      * following default mask is used:
+     *
      * `paths: "bindings, etag"`
      * </pre>
      *
@@ -1061,6 +1030,7 @@ public Builder setUpdateMask(com.google.protobuf.FieldMask.Builder builderForVal
      * OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only
      * the fields in the mask will be modified. If no mask is provided, the
      * following default mask is used:
+     *
      * `paths: "bindings, etag"`
      * </pre>
      *
@@ -1089,6 +1059,7 @@ public Builder mergeUpdateMask(com.google.protobuf.FieldMask value) {
      * OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only
      * the fields in the mask will be modified. If no mask is provided, the
      * following default mask is used:
+     *
      * `paths: "bindings, etag"`
      * </pre>
      *
@@ -1111,6 +1082,7 @@ public Builder clearUpdateMask() {
      * OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only
      * the fields in the mask will be modified. If no mask is provided, the
      * following default mask is used:
+     *
      * `paths: "bindings, etag"`
      * </pre>
      *
@@ -1128,6 +1100,7 @@ public com.google.protobuf.FieldMask.Builder getUpdateMaskBuilder() {
      * OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only
      * the fields in the mask will be modified. If no mask is provided, the
      * following default mask is used:
+     *
      * `paths: "bindings, etag"`
      * </pre>
      *
@@ -1149,6 +1122,7 @@ public com.google.protobuf.FieldMaskOrBuilder getUpdateMaskOrBuilder() {
      * OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only
      * the fields in the mask will be modified. If no mask is provided, the
      * following default mask is used:
+     *
      * `paths: "bindings, etag"`
      * </pre>
      *
diff --git a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/SetIamPolicyRequestOrBuilder.java b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/SetIamPolicyRequestOrBuilder.java
index 48ab0dff5d..b7c42c8855 100644
--- a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/SetIamPolicyRequestOrBuilder.java
+++ b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/SetIamPolicyRequestOrBuilder.java
@@ -105,6 +105,7 @@ public interface SetIamPolicyRequestOrBuilder
    * OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only
    * the fields in the mask will be modified. If no mask is provided, the
    * following default mask is used:
+   *
    * `paths: "bindings, etag"`
    * </pre>
    *
@@ -120,6 +121,7 @@ public interface SetIamPolicyRequestOrBuilder
    * OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only
    * the fields in the mask will be modified. If no mask is provided, the
    * following default mask is used:
+   *
    * `paths: "bindings, etag"`
    * </pre>
    *
@@ -135,6 +137,7 @@ public interface SetIamPolicyRequestOrBuilder
    * OPTIONAL: A FieldMask specifying which fields of the policy to modify. Only
    * the fields in the mask will be modified. If no mask is provided, the
    * following default mask is used:
+   *
    * `paths: "bindings, etag"`
    * </pre>
    *
diff --git a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/TestIamPermissionsRequest.java b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/TestIamPermissionsRequest.java
index ee3530d94e..4393be5528 100644
--- a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/TestIamPermissionsRequest.java
+++ b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/TestIamPermissionsRequest.java
@@ -39,7 +39,7 @@ private TestIamPermissionsRequest(com.google.protobuf.GeneratedMessageV3.Builder
 
   private TestIamPermissionsRequest() {
     resource_ = "";
-    permissions_ = com.google.protobuf.LazyStringArrayList.EMPTY;
+    permissions_ = com.google.protobuf.LazyStringArrayList.emptyList();
   }
 
   @java.lang.Override
@@ -48,11 +48,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new TestIamPermissionsRequest();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v1.IamPolicyProto
         .internal_static_google_iam_v1_TestIamPermissionsRequest_descriptor;
@@ -128,7 +123,8 @@ public com.google.protobuf.ByteString getResourceBytes() {
   public static final int PERMISSIONS_FIELD_NUMBER = 2;
 
   @SuppressWarnings("serial")
-  private com.google.protobuf.LazyStringList permissions_;
+  private com.google.protobuf.LazyStringArrayList permissions_ =
+      com.google.protobuf.LazyStringArrayList.emptyList();
   /**
    *
    *
@@ -415,8 +411,7 @@ public Builder clear() {
       super.clear();
       bitField0_ = 0;
       resource_ = "";
-      permissions_ = com.google.protobuf.LazyStringArrayList.EMPTY;
-      bitField0_ = (bitField0_ & ~0x00000002);
+      permissions_ = com.google.protobuf.LazyStringArrayList.emptyList();
       return this;
     }
 
@@ -444,7 +439,6 @@ public com.google.iam.v1.TestIamPermissionsRequest build() {
     public com.google.iam.v1.TestIamPermissionsRequest buildPartial() {
       com.google.iam.v1.TestIamPermissionsRequest result =
           new com.google.iam.v1.TestIamPermissionsRequest(this);
-      buildPartialRepeatedFields(result);
       if (bitField0_ != 0) {
         buildPartial0(result);
       }
@@ -452,52 +446,15 @@ public com.google.iam.v1.TestIamPermissionsRequest buildPartial() {
       return result;
     }
 
-    private void buildPartialRepeatedFields(com.google.iam.v1.TestIamPermissionsRequest result) {
-      if (((bitField0_ & 0x00000002) != 0)) {
-        permissions_ = permissions_.getUnmodifiableView();
-        bitField0_ = (bitField0_ & ~0x00000002);
-      }
-      result.permissions_ = permissions_;
-    }
-
     private void buildPartial0(com.google.iam.v1.TestIamPermissionsRequest result) {
       int from_bitField0_ = bitField0_;
       if (((from_bitField0_ & 0x00000001) != 0)) {
         result.resource_ = resource_;
       }
-    }
-
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
+      if (((from_bitField0_ & 0x00000002) != 0)) {
+        permissions_.makeImmutable();
+        result.permissions_ = permissions_;
+      }
     }
 
     @java.lang.Override
@@ -520,7 +477,7 @@ public Builder mergeFrom(com.google.iam.v1.TestIamPermissionsRequest other) {
       if (!other.permissions_.isEmpty()) {
         if (permissions_.isEmpty()) {
           permissions_ = other.permissions_;
-          bitField0_ = (bitField0_ & ~0x00000002);
+          bitField0_ |= 0x00000002;
         } else {
           ensurePermissionsIsMutable();
           permissions_.addAll(other.permissions_);
@@ -706,14 +663,14 @@ public Builder setResourceBytes(com.google.protobuf.ByteString value) {
       return this;
     }
 
-    private com.google.protobuf.LazyStringList permissions_ =
-        com.google.protobuf.LazyStringArrayList.EMPTY;
+    private com.google.protobuf.LazyStringArrayList permissions_ =
+        com.google.protobuf.LazyStringArrayList.emptyList();
 
     private void ensurePermissionsIsMutable() {
-      if (!((bitField0_ & 0x00000002) != 0)) {
+      if (!permissions_.isModifiable()) {
         permissions_ = new com.google.protobuf.LazyStringArrayList(permissions_);
-        bitField0_ |= 0x00000002;
       }
+      bitField0_ |= 0x00000002;
     }
     /**
      *
@@ -730,7 +687,8 @@ private void ensurePermissionsIsMutable() {
      * @return A list containing the permissions.
      */
     public com.google.protobuf.ProtocolStringList getPermissionsList() {
-      return permissions_.getUnmodifiableView();
+      permissions_.makeImmutable();
+      return permissions_;
     }
     /**
      *
@@ -807,6 +765,7 @@ public Builder setPermissions(int index, java.lang.String value) {
       }
       ensurePermissionsIsMutable();
       permissions_.set(index, value);
+      bitField0_ |= 0x00000002;
       onChanged();
       return this;
     }
@@ -831,6 +790,7 @@ public Builder addPermissions(java.lang.String value) {
       }
       ensurePermissionsIsMutable();
       permissions_.add(value);
+      bitField0_ |= 0x00000002;
       onChanged();
       return this;
     }
@@ -852,6 +812,7 @@ public Builder addPermissions(java.lang.String value) {
     public Builder addAllPermissions(java.lang.Iterable<java.lang.String> values) {
       ensurePermissionsIsMutable();
       com.google.protobuf.AbstractMessageLite.Builder.addAll(values, permissions_);
+      bitField0_ |= 0x00000002;
       onChanged();
       return this;
     }
@@ -870,8 +831,9 @@ public Builder addAllPermissions(java.lang.Iterable<java.lang.String> values) {
      * @return This builder for chaining.
      */
     public Builder clearPermissions() {
-      permissions_ = com.google.protobuf.LazyStringArrayList.EMPTY;
+      permissions_ = com.google.protobuf.LazyStringArrayList.emptyList();
       bitField0_ = (bitField0_ & ~0x00000002);
+      ;
       onChanged();
       return this;
     }
@@ -897,6 +859,7 @@ public Builder addPermissionsBytes(com.google.protobuf.ByteString value) {
       checkByteStringIsUtf8(value);
       ensurePermissionsIsMutable();
       permissions_.add(value);
+      bitField0_ |= 0x00000002;
       onChanged();
       return this;
     }
diff --git a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/TestIamPermissionsResponse.java b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/TestIamPermissionsResponse.java
index 25fb71590e..4eb8379bbd 100644
--- a/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/TestIamPermissionsResponse.java
+++ b/java-iam/proto-google-iam-v1/src/main/java/com/google/iam/v1/TestIamPermissionsResponse.java
@@ -38,7 +38,7 @@ private TestIamPermissionsResponse(com.google.protobuf.GeneratedMessageV3.Builde
   }
 
   private TestIamPermissionsResponse() {
-    permissions_ = com.google.protobuf.LazyStringArrayList.EMPTY;
+    permissions_ = com.google.protobuf.LazyStringArrayList.emptyList();
   }
 
   @java.lang.Override
@@ -47,11 +47,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new TestIamPermissionsResponse();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v1.IamPolicyProto
         .internal_static_google_iam_v1_TestIamPermissionsResponse_descriptor;
@@ -70,7 +65,8 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
   public static final int PERMISSIONS_FIELD_NUMBER = 1;
 
   @SuppressWarnings("serial")
-  private com.google.protobuf.LazyStringList permissions_;
+  private com.google.protobuf.LazyStringArrayList permissions_ =
+      com.google.protobuf.LazyStringArrayList.emptyList();
   /**
    *
    *
@@ -339,8 +335,7 @@ private Builder(com.google.protobuf.GeneratedMessageV3.BuilderParent parent) {
     public Builder clear() {
       super.clear();
       bitField0_ = 0;
-      permissions_ = com.google.protobuf.LazyStringArrayList.EMPTY;
-      bitField0_ = (bitField0_ & ~0x00000001);
+      permissions_ = com.google.protobuf.LazyStringArrayList.emptyList();
       return this;
     }
 
@@ -368,7 +363,6 @@ public com.google.iam.v1.TestIamPermissionsResponse build() {
     public com.google.iam.v1.TestIamPermissionsResponse buildPartial() {
       com.google.iam.v1.TestIamPermissionsResponse result =
           new com.google.iam.v1.TestIamPermissionsResponse(this);
-      buildPartialRepeatedFields(result);
       if (bitField0_ != 0) {
         buildPartial0(result);
       }
@@ -376,49 +370,12 @@ public com.google.iam.v1.TestIamPermissionsResponse buildPartial() {
       return result;
     }
 
-    private void buildPartialRepeatedFields(com.google.iam.v1.TestIamPermissionsResponse result) {
-      if (((bitField0_ & 0x00000001) != 0)) {
-        permissions_ = permissions_.getUnmodifiableView();
-        bitField0_ = (bitField0_ & ~0x00000001);
-      }
-      result.permissions_ = permissions_;
-    }
-
     private void buildPartial0(com.google.iam.v1.TestIamPermissionsResponse result) {
       int from_bitField0_ = bitField0_;
-    }
-
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
+      if (((from_bitField0_ & 0x00000001) != 0)) {
+        permissions_.makeImmutable();
+        result.permissions_ = permissions_;
+      }
     }
 
     @java.lang.Override
@@ -436,7 +393,7 @@ public Builder mergeFrom(com.google.iam.v1.TestIamPermissionsResponse other) {
       if (!other.permissions_.isEmpty()) {
         if (permissions_.isEmpty()) {
           permissions_ = other.permissions_;
-          bitField0_ = (bitField0_ & ~0x00000001);
+          bitField0_ |= 0x00000001;
         } else {
           ensurePermissionsIsMutable();
           permissions_.addAll(other.permissions_);
@@ -495,14 +452,14 @@ public Builder mergeFrom(
 
     private int bitField0_;
 
-    private com.google.protobuf.LazyStringList permissions_ =
-        com.google.protobuf.LazyStringArrayList.EMPTY;
+    private com.google.protobuf.LazyStringArrayList permissions_ =
+        com.google.protobuf.LazyStringArrayList.emptyList();
 
     private void ensurePermissionsIsMutable() {
-      if (!((bitField0_ & 0x00000001) != 0)) {
+      if (!permissions_.isModifiable()) {
         permissions_ = new com.google.protobuf.LazyStringArrayList(permissions_);
-        bitField0_ |= 0x00000001;
       }
+      bitField0_ |= 0x00000001;
     }
     /**
      *
@@ -517,7 +474,8 @@ private void ensurePermissionsIsMutable() {
      * @return A list containing the permissions.
      */
     public com.google.protobuf.ProtocolStringList getPermissionsList() {
-      return permissions_.getUnmodifiableView();
+      permissions_.makeImmutable();
+      return permissions_;
     }
     /**
      *
@@ -586,6 +544,7 @@ public Builder setPermissions(int index, java.lang.String value) {
       }
       ensurePermissionsIsMutable();
       permissions_.set(index, value);
+      bitField0_ |= 0x00000001;
       onChanged();
       return this;
     }
@@ -608,6 +567,7 @@ public Builder addPermissions(java.lang.String value) {
       }
       ensurePermissionsIsMutable();
       permissions_.add(value);
+      bitField0_ |= 0x00000001;
       onChanged();
       return this;
     }
@@ -627,6 +587,7 @@ public Builder addPermissions(java.lang.String value) {
     public Builder addAllPermissions(java.lang.Iterable<java.lang.String> values) {
       ensurePermissionsIsMutable();
       com.google.protobuf.AbstractMessageLite.Builder.addAll(values, permissions_);
+      bitField0_ |= 0x00000001;
       onChanged();
       return this;
     }
@@ -643,8 +604,9 @@ public Builder addAllPermissions(java.lang.Iterable<java.lang.String> values) {
      * @return This builder for chaining.
      */
     public Builder clearPermissions() {
-      permissions_ = com.google.protobuf.LazyStringArrayList.EMPTY;
+      permissions_ = com.google.protobuf.LazyStringArrayList.emptyList();
       bitField0_ = (bitField0_ & ~0x00000001);
+      ;
       onChanged();
       return this;
     }
@@ -668,6 +630,7 @@ public Builder addPermissionsBytes(com.google.protobuf.ByteString value) {
       checkByteStringIsUtf8(value);
       ensurePermissionsIsMutable();
       permissions_.add(value);
+      bitField0_ |= 0x00000001;
       onChanged();
       return this;
     }
diff --git a/java-iam/proto-google-iam-v2/clirr-ignored-differences.xml b/java-iam/proto-google-iam-v2/clirr-ignored-differences.xml
index f9346449b7..dca810c57f 100644
--- a/java-iam/proto-google-iam-v2/clirr-ignored-differences.xml
+++ b/java-iam/proto-google-iam-v2/clirr-ignored-differences.xml
@@ -1,6 +1,36 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!-- see http://www.mojohaus.org/clirr-maven-plugin/examples/ignored-differences.html -->
 <differences>
+  <difference>
+    <differenceType>7002</differenceType>
+    <className>com/google/iam/v2/*Builder</className>
+    <method>* addRepeatedField(*)</method>
+  </difference>
+  <difference>
+    <differenceType>7002</differenceType>
+    <className>com/google/iam/v2/*Builder</className>
+    <method>* clearField(*)</method>
+  </difference>
+  <difference>
+    <differenceType>7002</differenceType>
+    <className>com/google/iam/v2/*Builder</className>
+    <method>* clearOneof(*)</method>
+  </difference>
+  <difference>
+    <differenceType>7002</differenceType>
+    <className>com/google/iam/v2/*Builder</className>
+    <method>* clone()</method>
+  </difference>
+  <difference>
+    <differenceType>7002</differenceType>
+    <className>com/google/iam/v2/*Builder</className>
+    <method>* setField(*)</method>
+  </difference>
+  <difference>
+    <differenceType>7002</differenceType>
+    <className>com/google/iam/v2/*Builder</className>
+    <method>* setRepeatedField(*)</method>
+  </difference>
   <difference>
     <differenceType>7012</differenceType>
     <className>com/google/iam/v2/*OrBuilder</className>
diff --git a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/CreatePolicyRequest.java b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/CreatePolicyRequest.java
index 6d67c52f34..038188c87f 100644
--- a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/CreatePolicyRequest.java
+++ b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/CreatePolicyRequest.java
@@ -48,11 +48,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new CreatePolicyRequest();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v2.PolicyProto
         .internal_static_google_iam_v2_CreatePolicyRequest_descriptor;
@@ -78,10 +73,13 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
    * <pre>
    * Required. The resource that the policy is attached to, along with the kind of policy
    * to create. Format: `policies/{attachment_point}/denypolicies`
+   *
+   *
    * The attachment point is identified by its URL-encoded full resource name,
    * which means that the forward-slash character, `/`, must be written as
    * `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
@@ -108,10 +106,13 @@ public java.lang.String getParent() {
    * <pre>
    * Required. The resource that the policy is attached to, along with the kind of policy
    * to create. Format: `policies/{attachment_point}/denypolicies`
+   *
+   *
    * The attachment point is identified by its URL-encoded full resource name,
    * which means that the forward-slash character, `/`, must be written as
    * `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
@@ -509,39 +510,6 @@ private void buildPartial0(com.google.iam.v2.CreatePolicyRequest result) {
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v2.CreatePolicyRequest) {
@@ -637,10 +605,13 @@ public Builder mergeFrom(
      * <pre>
      * Required. The resource that the policy is attached to, along with the kind of policy
      * to create. Format: `policies/{attachment_point}/denypolicies`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -666,10 +637,13 @@ public java.lang.String getParent() {
      * <pre>
      * Required. The resource that the policy is attached to, along with the kind of policy
      * to create. Format: `policies/{attachment_point}/denypolicies`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -695,10 +669,13 @@ public com.google.protobuf.ByteString getParentBytes() {
      * <pre>
      * Required. The resource that the policy is attached to, along with the kind of policy
      * to create. Format: `policies/{attachment_point}/denypolicies`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -723,10 +700,13 @@ public Builder setParent(java.lang.String value) {
      * <pre>
      * Required. The resource that the policy is attached to, along with the kind of policy
      * to create. Format: `policies/{attachment_point}/denypolicies`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -747,10 +727,13 @@ public Builder clearParent() {
      * <pre>
      * Required. The resource that the policy is attached to, along with the kind of policy
      * to create. Format: `policies/{attachment_point}/denypolicies`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
diff --git a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/CreatePolicyRequestOrBuilder.java b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/CreatePolicyRequestOrBuilder.java
index 3825ae18ff..750931920c 100644
--- a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/CreatePolicyRequestOrBuilder.java
+++ b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/CreatePolicyRequestOrBuilder.java
@@ -29,10 +29,13 @@ public interface CreatePolicyRequestOrBuilder
    * <pre>
    * Required. The resource that the policy is attached to, along with the kind of policy
    * to create. Format: `policies/{attachment_point}/denypolicies`
+   *
+   *
    * The attachment point is identified by its URL-encoded full resource name,
    * which means that the forward-slash character, `/`, must be written as
    * `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
@@ -48,10 +51,13 @@ public interface CreatePolicyRequestOrBuilder
    * <pre>
    * Required. The resource that the policy is attached to, along with the kind of policy
    * to create. Format: `policies/{attachment_point}/denypolicies`
+   *
+   *
    * The attachment point is identified by its URL-encoded full resource name,
    * which means that the forward-slash character, `/`, must be written as
    * `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
diff --git a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/DeletePolicyRequest.java b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/DeletePolicyRequest.java
index a1fc39876b..0c0b229bf6 100644
--- a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/DeletePolicyRequest.java
+++ b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/DeletePolicyRequest.java
@@ -48,11 +48,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new DeletePolicyRequest();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v2.PolicyProto
         .internal_static_google_iam_v2_DeletePolicyRequest_descriptor;
@@ -78,9 +73,12 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
    * <pre>
    * Required. The resource name of the policy to delete. Format:
    * `policies/{attachment_point}/denypolicies/{policy_id}`
+   *
+   *
    * Use the URL-encoded full resource name, which means that the forward-slash
    * character, `/`, must be written as `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
@@ -107,9 +105,12 @@ public java.lang.String getName() {
    * <pre>
    * Required. The resource name of the policy to delete. Format:
    * `policies/{attachment_point}/denypolicies/{policy_id}`
+   *
+   *
    * Use the URL-encoded full resource name, which means that the forward-slash
    * character, `/`, must be written as `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
@@ -142,6 +143,7 @@ public com.google.protobuf.ByteString getNameBytes() {
    * Optional. The expected `etag` of the policy to delete. If the value does not match
    * the value that is stored in IAM, the request fails with a `409` error code
    * and `ABORTED` status.
+   *
    * If you omit this field, the policy is deleted regardless of its current
    * `etag`.
    * </pre>
@@ -169,6 +171,7 @@ public java.lang.String getEtag() {
    * Optional. The expected `etag` of the policy to delete. If the value does not match
    * the value that is stored in IAM, the request fails with a `409` error code
    * and `ABORTED` status.
+   *
    * If you omit this field, the policy is deleted regardless of its current
    * `etag`.
    * </pre>
@@ -441,39 +444,6 @@ private void buildPartial0(com.google.iam.v2.DeletePolicyRequest result) {
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v2.DeletePolicyRequest) {
@@ -560,9 +530,12 @@ public Builder mergeFrom(
      * <pre>
      * Required. The resource name of the policy to delete. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * Use the URL-encoded full resource name, which means that the forward-slash
      * character, `/`, must be written as `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -588,9 +561,12 @@ public java.lang.String getName() {
      * <pre>
      * Required. The resource name of the policy to delete. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * Use the URL-encoded full resource name, which means that the forward-slash
      * character, `/`, must be written as `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -616,9 +592,12 @@ public com.google.protobuf.ByteString getNameBytes() {
      * <pre>
      * Required. The resource name of the policy to delete. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * Use the URL-encoded full resource name, which means that the forward-slash
      * character, `/`, must be written as `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -643,9 +622,12 @@ public Builder setName(java.lang.String value) {
      * <pre>
      * Required. The resource name of the policy to delete. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * Use the URL-encoded full resource name, which means that the forward-slash
      * character, `/`, must be written as `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -666,9 +648,12 @@ public Builder clearName() {
      * <pre>
      * Required. The resource name of the policy to delete. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * Use the URL-encoded full resource name, which means that the forward-slash
      * character, `/`, must be written as `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -697,6 +682,7 @@ public Builder setNameBytes(com.google.protobuf.ByteString value) {
      * Optional. The expected `etag` of the policy to delete. If the value does not match
      * the value that is stored in IAM, the request fails with a `409` error code
      * and `ABORTED` status.
+     *
      * If you omit this field, the policy is deleted regardless of its current
      * `etag`.
      * </pre>
@@ -723,6 +709,7 @@ public java.lang.String getEtag() {
      * Optional. The expected `etag` of the policy to delete. If the value does not match
      * the value that is stored in IAM, the request fails with a `409` error code
      * and `ABORTED` status.
+     *
      * If you omit this field, the policy is deleted regardless of its current
      * `etag`.
      * </pre>
@@ -749,6 +736,7 @@ public com.google.protobuf.ByteString getEtagBytes() {
      * Optional. The expected `etag` of the policy to delete. If the value does not match
      * the value that is stored in IAM, the request fails with a `409` error code
      * and `ABORTED` status.
+     *
      * If you omit this field, the policy is deleted regardless of its current
      * `etag`.
      * </pre>
@@ -774,6 +762,7 @@ public Builder setEtag(java.lang.String value) {
      * Optional. The expected `etag` of the policy to delete. If the value does not match
      * the value that is stored in IAM, the request fails with a `409` error code
      * and `ABORTED` status.
+     *
      * If you omit this field, the policy is deleted regardless of its current
      * `etag`.
      * </pre>
@@ -795,6 +784,7 @@ public Builder clearEtag() {
      * Optional. The expected `etag` of the policy to delete. If the value does not match
      * the value that is stored in IAM, the request fails with a `409` error code
      * and `ABORTED` status.
+     *
      * If you omit this field, the policy is deleted regardless of its current
      * `etag`.
      * </pre>
diff --git a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/DeletePolicyRequestOrBuilder.java b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/DeletePolicyRequestOrBuilder.java
index 9bdd7fc3d3..16a7afe664 100644
--- a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/DeletePolicyRequestOrBuilder.java
+++ b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/DeletePolicyRequestOrBuilder.java
@@ -29,9 +29,12 @@ public interface DeletePolicyRequestOrBuilder
    * <pre>
    * Required. The resource name of the policy to delete. Format:
    * `policies/{attachment_point}/denypolicies/{policy_id}`
+   *
+   *
    * Use the URL-encoded full resource name, which means that the forward-slash
    * character, `/`, must be written as `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
@@ -47,9 +50,12 @@ public interface DeletePolicyRequestOrBuilder
    * <pre>
    * Required. The resource name of the policy to delete. Format:
    * `policies/{attachment_point}/denypolicies/{policy_id}`
+   *
+   *
    * Use the URL-encoded full resource name, which means that the forward-slash
    * character, `/`, must be written as `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
@@ -67,6 +73,7 @@ public interface DeletePolicyRequestOrBuilder
    * Optional. The expected `etag` of the policy to delete. If the value does not match
    * the value that is stored in IAM, the request fails with a `409` error code
    * and `ABORTED` status.
+   *
    * If you omit this field, the policy is deleted regardless of its current
    * `etag`.
    * </pre>
@@ -83,6 +90,7 @@ public interface DeletePolicyRequestOrBuilder
    * Optional. The expected `etag` of the policy to delete. If the value does not match
    * the value that is stored in IAM, the request fails with a `409` error code
    * and `ABORTED` status.
+   *
    * If you omit this field, the policy is deleted regardless of its current
    * `etag`.
    * </pre>
diff --git a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/DenyRule.java b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/DenyRule.java
index 8fcf2a56fe..be4c9b2f25 100644
--- a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/DenyRule.java
+++ b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/DenyRule.java
@@ -38,10 +38,10 @@ private DenyRule(com.google.protobuf.GeneratedMessageV3.Builder<?> builder) {
   }
 
   private DenyRule() {
-    deniedPrincipals_ = com.google.protobuf.LazyStringArrayList.EMPTY;
-    exceptionPrincipals_ = com.google.protobuf.LazyStringArrayList.EMPTY;
-    deniedPermissions_ = com.google.protobuf.LazyStringArrayList.EMPTY;
-    exceptionPermissions_ = com.google.protobuf.LazyStringArrayList.EMPTY;
+    deniedPrincipals_ = com.google.protobuf.LazyStringArrayList.emptyList();
+    exceptionPrincipals_ = com.google.protobuf.LazyStringArrayList.emptyList();
+    deniedPermissions_ = com.google.protobuf.LazyStringArrayList.emptyList();
+    exceptionPermissions_ = com.google.protobuf.LazyStringArrayList.emptyList();
   }
 
   @java.lang.Override
@@ -50,11 +50,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new DenyRule();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v2.DenyRuleProto.internal_static_google_iam_v2_DenyRule_descriptor;
   }
@@ -70,39 +65,48 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
   public static final int DENIED_PRINCIPALS_FIELD_NUMBER = 1;
 
   @SuppressWarnings("serial")
-  private com.google.protobuf.LazyStringList deniedPrincipals_;
+  private com.google.protobuf.LazyStringArrayList deniedPrincipals_ =
+      com.google.protobuf.LazyStringArrayList.emptyList();
   /**
    *
    *
    * <pre>
    * The identities that are prevented from using one or more permissions on
    * Google Cloud resources. This field can contain the following values:
+   *
    * * `principalSet://goog/public:all`: A special identifier that represents
    *   any principal that is on the internet, even if they do not have a Google
    *   Account or are not logged in.
+   *
    * * `principal://goog/subject/{email_id}`: A specific Google Account.
    *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
    *   example, `principal://goog/subject/alice&#64;example.com`.
+   *
    * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
    *   Google Account that was deleted recently. For example,
    *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
    *   the Google Account is recovered, this identifier reverts to the standard
    *   identifier for a Google Account.
+   *
    * * `principalSet://goog/group/{group_id}`: A Google group. For example,
    *   `principalSet://goog/group/admins&#64;example.com`.
+   *
    * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
    *   that was deleted recently. For example,
    *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
    *   the Google group is restored, this identifier reverts to the standard
    *   identifier for a Google group.
+   *
    * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
    *   A Google Cloud service account. For example,
    *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+   *
    * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
    *   A Google Cloud service account that was deleted recently. For example,
    *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
    *   If the service account is undeleted, this identifier reverts to the
    *   standard identifier for a service account.
+   *
    * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
    *   principals associated with the specified Google Workspace or Cloud
    *   Identity customer ID. For example,
@@ -122,32 +126,40 @@ public com.google.protobuf.ProtocolStringList getDeniedPrincipalsList() {
    * <pre>
    * The identities that are prevented from using one or more permissions on
    * Google Cloud resources. This field can contain the following values:
+   *
    * * `principalSet://goog/public:all`: A special identifier that represents
    *   any principal that is on the internet, even if they do not have a Google
    *   Account or are not logged in.
+   *
    * * `principal://goog/subject/{email_id}`: A specific Google Account.
    *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
    *   example, `principal://goog/subject/alice&#64;example.com`.
+   *
    * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
    *   Google Account that was deleted recently. For example,
    *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
    *   the Google Account is recovered, this identifier reverts to the standard
    *   identifier for a Google Account.
+   *
    * * `principalSet://goog/group/{group_id}`: A Google group. For example,
    *   `principalSet://goog/group/admins&#64;example.com`.
+   *
    * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
    *   that was deleted recently. For example,
    *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
    *   the Google group is restored, this identifier reverts to the standard
    *   identifier for a Google group.
+   *
    * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
    *   A Google Cloud service account. For example,
    *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+   *
    * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
    *   A Google Cloud service account that was deleted recently. For example,
    *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
    *   If the service account is undeleted, this identifier reverts to the
    *   standard identifier for a service account.
+   *
    * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
    *   principals associated with the specified Google Workspace or Cloud
    *   Identity customer ID. For example,
@@ -167,32 +179,40 @@ public int getDeniedPrincipalsCount() {
    * <pre>
    * The identities that are prevented from using one or more permissions on
    * Google Cloud resources. This field can contain the following values:
+   *
    * * `principalSet://goog/public:all`: A special identifier that represents
    *   any principal that is on the internet, even if they do not have a Google
    *   Account or are not logged in.
+   *
    * * `principal://goog/subject/{email_id}`: A specific Google Account.
    *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
    *   example, `principal://goog/subject/alice&#64;example.com`.
+   *
    * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
    *   Google Account that was deleted recently. For example,
    *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
    *   the Google Account is recovered, this identifier reverts to the standard
    *   identifier for a Google Account.
+   *
    * * `principalSet://goog/group/{group_id}`: A Google group. For example,
    *   `principalSet://goog/group/admins&#64;example.com`.
+   *
    * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
    *   that was deleted recently. For example,
    *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
    *   the Google group is restored, this identifier reverts to the standard
    *   identifier for a Google group.
+   *
    * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
    *   A Google Cloud service account. For example,
    *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+   *
    * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
    *   A Google Cloud service account that was deleted recently. For example,
    *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
    *   If the service account is undeleted, this identifier reverts to the
    *   standard identifier for a service account.
+   *
    * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
    *   principals associated with the specified Google Workspace or Cloud
    *   Identity customer ID. For example,
@@ -213,32 +233,40 @@ public java.lang.String getDeniedPrincipals(int index) {
    * <pre>
    * The identities that are prevented from using one or more permissions on
    * Google Cloud resources. This field can contain the following values:
+   *
    * * `principalSet://goog/public:all`: A special identifier that represents
    *   any principal that is on the internet, even if they do not have a Google
    *   Account or are not logged in.
+   *
    * * `principal://goog/subject/{email_id}`: A specific Google Account.
    *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
    *   example, `principal://goog/subject/alice&#64;example.com`.
+   *
    * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
    *   Google Account that was deleted recently. For example,
    *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
    *   the Google Account is recovered, this identifier reverts to the standard
    *   identifier for a Google Account.
+   *
    * * `principalSet://goog/group/{group_id}`: A Google group. For example,
    *   `principalSet://goog/group/admins&#64;example.com`.
+   *
    * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
    *   that was deleted recently. For example,
    *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
    *   the Google group is restored, this identifier reverts to the standard
    *   identifier for a Google group.
+   *
    * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
    *   A Google Cloud service account. For example,
    *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+   *
    * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
    *   A Google Cloud service account that was deleted recently. For example,
    *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
    *   If the service account is undeleted, this identifier reverts to the
    *   standard identifier for a service account.
+   *
    * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
    *   principals associated with the specified Google Workspace or Cloud
    *   Identity customer ID. For example,
@@ -257,7 +285,8 @@ public com.google.protobuf.ByteString getDeniedPrincipalsBytes(int index) {
   public static final int EXCEPTION_PRINCIPALS_FIELD_NUMBER = 2;
 
   @SuppressWarnings("serial")
-  private com.google.protobuf.LazyStringList exceptionPrincipals_;
+  private com.google.protobuf.LazyStringArrayList exceptionPrincipals_ =
+      com.google.protobuf.LazyStringArrayList.emptyList();
   /**
    *
    *
@@ -266,6 +295,7 @@ public com.google.protobuf.ByteString getDeniedPrincipalsBytes(int index) {
    * listed in the `denied_principals`. For example, you could add a Google
    * group to the `denied_principals`, then exclude specific users who belong to
    * that group.
+   *
    * This field can contain the same values as the `denied_principals` field,
    * excluding `principalSet://goog/public:all`, which represents all users on
    * the internet.
@@ -286,6 +316,7 @@ public com.google.protobuf.ProtocolStringList getExceptionPrincipalsList() {
    * listed in the `denied_principals`. For example, you could add a Google
    * group to the `denied_principals`, then exclude specific users who belong to
    * that group.
+   *
    * This field can contain the same values as the `denied_principals` field,
    * excluding `principalSet://goog/public:all`, which represents all users on
    * the internet.
@@ -306,6 +337,7 @@ public int getExceptionPrincipalsCount() {
    * listed in the `denied_principals`. For example, you could add a Google
    * group to the `denied_principals`, then exclude specific users who belong to
    * that group.
+   *
    * This field can contain the same values as the `denied_principals` field,
    * excluding `principalSet://goog/public:all`, which represents all users on
    * the internet.
@@ -327,6 +359,7 @@ public java.lang.String getExceptionPrincipals(int index) {
    * listed in the `denied_principals`. For example, you could add a Google
    * group to the `denied_principals`, then exclude specific users who belong to
    * that group.
+   *
    * This field can contain the same values as the `denied_principals` field,
    * excluding `principalSet://goog/public:all`, which represents all users on
    * the internet.
@@ -344,7 +377,8 @@ public com.google.protobuf.ByteString getExceptionPrincipalsBytes(int index) {
   public static final int DENIED_PERMISSIONS_FIELD_NUMBER = 3;
 
   @SuppressWarnings("serial")
-  private com.google.protobuf.LazyStringList deniedPermissions_;
+  private com.google.protobuf.LazyStringArrayList deniedPermissions_ =
+      com.google.protobuf.LazyStringArrayList.emptyList();
   /**
    *
    *
@@ -419,7 +453,8 @@ public com.google.protobuf.ByteString getDeniedPermissionsBytes(int index) {
   public static final int EXCEPTION_PERMISSIONS_FIELD_NUMBER = 4;
 
   @SuppressWarnings("serial")
-  private com.google.protobuf.LazyStringList exceptionPermissions_;
+  private com.google.protobuf.LazyStringArrayList exceptionPermissions_ =
+      com.google.protobuf.LazyStringArrayList.emptyList();
   /**
    *
    *
@@ -428,6 +463,7 @@ public com.google.protobuf.ByteString getDeniedPermissionsBytes(int index) {
    * permissions given by `denied_permissions`. If a permission appears in
    * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
    * denied.
+   *
    * The excluded permissions can be specified using the same syntax as
    * `denied_permissions`.
    * </pre>
@@ -447,6 +483,7 @@ public com.google.protobuf.ProtocolStringList getExceptionPermissionsList() {
    * permissions given by `denied_permissions`. If a permission appears in
    * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
    * denied.
+   *
    * The excluded permissions can be specified using the same syntax as
    * `denied_permissions`.
    * </pre>
@@ -466,6 +503,7 @@ public int getExceptionPermissionsCount() {
    * permissions given by `denied_permissions`. If a permission appears in
    * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
    * denied.
+   *
    * The excluded permissions can be specified using the same syntax as
    * `denied_permissions`.
    * </pre>
@@ -486,6 +524,7 @@ public java.lang.String getExceptionPermissions(int index) {
    * permissions given by `denied_permissions`. If a permission appears in
    * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
    * denied.
+   *
    * The excluded permissions can be specified using the same syntax as
    * `denied_permissions`.
    * </pre>
@@ -508,8 +547,10 @@ public com.google.protobuf.ByteString getExceptionPermissionsBytes(int index) {
    * The condition that determines whether this deny rule applies to a request.
    * If the condition expression evaluates to `true`, then the deny rule is
    * applied; otherwise, the deny rule is not applied.
+   *
    * Each deny rule is evaluated independently. If this deny rule does not apply
    * to a request, other deny rules might still apply.
+   *
    * The condition can use CEL functions that evaluate
    * [resource
    * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
@@ -531,8 +572,10 @@ public boolean hasDenialCondition() {
    * The condition that determines whether this deny rule applies to a request.
    * If the condition expression evaluates to `true`, then the deny rule is
    * applied; otherwise, the deny rule is not applied.
+   *
    * Each deny rule is evaluated independently. If this deny rule does not apply
    * to a request, other deny rules might still apply.
+   *
    * The condition can use CEL functions that evaluate
    * [resource
    * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
@@ -554,8 +597,10 @@ public com.google.type.Expr getDenialCondition() {
    * The condition that determines whether this deny rule applies to a request.
    * If the condition expression evaluates to `true`, then the deny rule is
    * applied; otherwise, the deny rule is not applied.
+   *
    * Each deny rule is evaluated independently. If this deny rule does not apply
    * to a request, other deny rules might still apply.
+   *
    * The condition can use CEL functions that evaluate
    * [resource
    * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
@@ -833,14 +878,10 @@ private Builder(com.google.protobuf.GeneratedMessageV3.BuilderParent parent) {
     public Builder clear() {
       super.clear();
       bitField0_ = 0;
-      deniedPrincipals_ = com.google.protobuf.LazyStringArrayList.EMPTY;
-      bitField0_ = (bitField0_ & ~0x00000001);
-      exceptionPrincipals_ = com.google.protobuf.LazyStringArrayList.EMPTY;
-      bitField0_ = (bitField0_ & ~0x00000002);
-      deniedPermissions_ = com.google.protobuf.LazyStringArrayList.EMPTY;
-      bitField0_ = (bitField0_ & ~0x00000004);
-      exceptionPermissions_ = com.google.protobuf.LazyStringArrayList.EMPTY;
-      bitField0_ = (bitField0_ & ~0x00000008);
+      deniedPrincipals_ = com.google.protobuf.LazyStringArrayList.emptyList();
+      exceptionPrincipals_ = com.google.protobuf.LazyStringArrayList.emptyList();
+      deniedPermissions_ = com.google.protobuf.LazyStringArrayList.emptyList();
+      exceptionPermissions_ = com.google.protobuf.LazyStringArrayList.emptyList();
       denialCondition_ = null;
       if (denialConditionBuilder_ != null) {
         denialConditionBuilder_.dispose();
@@ -871,7 +912,6 @@ public com.google.iam.v2.DenyRule build() {
     @java.lang.Override
     public com.google.iam.v2.DenyRule buildPartial() {
       com.google.iam.v2.DenyRule result = new com.google.iam.v2.DenyRule(this);
-      buildPartialRepeatedFields(result);
       if (bitField0_ != 0) {
         buildPartial0(result);
       }
@@ -879,70 +919,30 @@ public com.google.iam.v2.DenyRule buildPartial() {
       return result;
     }
 
-    private void buildPartialRepeatedFields(com.google.iam.v2.DenyRule result) {
-      if (((bitField0_ & 0x00000001) != 0)) {
-        deniedPrincipals_ = deniedPrincipals_.getUnmodifiableView();
-        bitField0_ = (bitField0_ & ~0x00000001);
+    private void buildPartial0(com.google.iam.v2.DenyRule result) {
+      int from_bitField0_ = bitField0_;
+      if (((from_bitField0_ & 0x00000001) != 0)) {
+        deniedPrincipals_.makeImmutable();
+        result.deniedPrincipals_ = deniedPrincipals_;
       }
-      result.deniedPrincipals_ = deniedPrincipals_;
-      if (((bitField0_ & 0x00000002) != 0)) {
-        exceptionPrincipals_ = exceptionPrincipals_.getUnmodifiableView();
-        bitField0_ = (bitField0_ & ~0x00000002);
+      if (((from_bitField0_ & 0x00000002) != 0)) {
+        exceptionPrincipals_.makeImmutable();
+        result.exceptionPrincipals_ = exceptionPrincipals_;
       }
-      result.exceptionPrincipals_ = exceptionPrincipals_;
-      if (((bitField0_ & 0x00000004) != 0)) {
-        deniedPermissions_ = deniedPermissions_.getUnmodifiableView();
-        bitField0_ = (bitField0_ & ~0x00000004);
+      if (((from_bitField0_ & 0x00000004) != 0)) {
+        deniedPermissions_.makeImmutable();
+        result.deniedPermissions_ = deniedPermissions_;
       }
-      result.deniedPermissions_ = deniedPermissions_;
-      if (((bitField0_ & 0x00000008) != 0)) {
-        exceptionPermissions_ = exceptionPermissions_.getUnmodifiableView();
-        bitField0_ = (bitField0_ & ~0x00000008);
+      if (((from_bitField0_ & 0x00000008) != 0)) {
+        exceptionPermissions_.makeImmutable();
+        result.exceptionPermissions_ = exceptionPermissions_;
       }
-      result.exceptionPermissions_ = exceptionPermissions_;
-    }
-
-    private void buildPartial0(com.google.iam.v2.DenyRule result) {
-      int from_bitField0_ = bitField0_;
       if (((from_bitField0_ & 0x00000010) != 0)) {
         result.denialCondition_ =
             denialConditionBuilder_ == null ? denialCondition_ : denialConditionBuilder_.build();
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v2.DenyRule) {
@@ -958,7 +958,7 @@ public Builder mergeFrom(com.google.iam.v2.DenyRule other) {
       if (!other.deniedPrincipals_.isEmpty()) {
         if (deniedPrincipals_.isEmpty()) {
           deniedPrincipals_ = other.deniedPrincipals_;
-          bitField0_ = (bitField0_ & ~0x00000001);
+          bitField0_ |= 0x00000001;
         } else {
           ensureDeniedPrincipalsIsMutable();
           deniedPrincipals_.addAll(other.deniedPrincipals_);
@@ -968,7 +968,7 @@ public Builder mergeFrom(com.google.iam.v2.DenyRule other) {
       if (!other.exceptionPrincipals_.isEmpty()) {
         if (exceptionPrincipals_.isEmpty()) {
           exceptionPrincipals_ = other.exceptionPrincipals_;
-          bitField0_ = (bitField0_ & ~0x00000002);
+          bitField0_ |= 0x00000002;
         } else {
           ensureExceptionPrincipalsIsMutable();
           exceptionPrincipals_.addAll(other.exceptionPrincipals_);
@@ -978,7 +978,7 @@ public Builder mergeFrom(com.google.iam.v2.DenyRule other) {
       if (!other.deniedPermissions_.isEmpty()) {
         if (deniedPermissions_.isEmpty()) {
           deniedPermissions_ = other.deniedPermissions_;
-          bitField0_ = (bitField0_ & ~0x00000004);
+          bitField0_ |= 0x00000004;
         } else {
           ensureDeniedPermissionsIsMutable();
           deniedPermissions_.addAll(other.deniedPermissions_);
@@ -988,7 +988,7 @@ public Builder mergeFrom(com.google.iam.v2.DenyRule other) {
       if (!other.exceptionPermissions_.isEmpty()) {
         if (exceptionPermissions_.isEmpty()) {
           exceptionPermissions_ = other.exceptionPermissions_;
-          bitField0_ = (bitField0_ & ~0x00000008);
+          bitField0_ |= 0x00000008;
         } else {
           ensureExceptionPermissionsIsMutable();
           exceptionPermissions_.addAll(other.exceptionPermissions_);
@@ -1077,14 +1077,14 @@ public Builder mergeFrom(
 
     private int bitField0_;
 
-    private com.google.protobuf.LazyStringList deniedPrincipals_ =
-        com.google.protobuf.LazyStringArrayList.EMPTY;
+    private com.google.protobuf.LazyStringArrayList deniedPrincipals_ =
+        com.google.protobuf.LazyStringArrayList.emptyList();
 
     private void ensureDeniedPrincipalsIsMutable() {
-      if (!((bitField0_ & 0x00000001) != 0)) {
+      if (!deniedPrincipals_.isModifiable()) {
         deniedPrincipals_ = new com.google.protobuf.LazyStringArrayList(deniedPrincipals_);
-        bitField0_ |= 0x00000001;
       }
+      bitField0_ |= 0x00000001;
     }
     /**
      *
@@ -1092,32 +1092,40 @@ private void ensureDeniedPrincipalsIsMutable() {
      * <pre>
      * The identities that are prevented from using one or more permissions on
      * Google Cloud resources. This field can contain the following values:
+     *
      * * `principalSet://goog/public:all`: A special identifier that represents
      *   any principal that is on the internet, even if they do not have a Google
      *   Account or are not logged in.
+     *
      * * `principal://goog/subject/{email_id}`: A specific Google Account.
      *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
      *   example, `principal://goog/subject/alice&#64;example.com`.
+     *
      * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
      *   Google Account that was deleted recently. For example,
      *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
      *   the Google Account is recovered, this identifier reverts to the standard
      *   identifier for a Google Account.
+     *
      * * `principalSet://goog/group/{group_id}`: A Google group. For example,
      *   `principalSet://goog/group/admins&#64;example.com`.
+     *
      * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
      *   that was deleted recently. For example,
      *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
      *   the Google group is restored, this identifier reverts to the standard
      *   identifier for a Google group.
+     *
      * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
      *   A Google Cloud service account. For example,
      *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+     *
      * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
      *   A Google Cloud service account that was deleted recently. For example,
      *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
      *   If the service account is undeleted, this identifier reverts to the
      *   standard identifier for a service account.
+     *
      * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
      *   principals associated with the specified Google Workspace or Cloud
      *   Identity customer ID. For example,
@@ -1129,7 +1137,8 @@ private void ensureDeniedPrincipalsIsMutable() {
      * @return A list containing the deniedPrincipals.
      */
     public com.google.protobuf.ProtocolStringList getDeniedPrincipalsList() {
-      return deniedPrincipals_.getUnmodifiableView();
+      deniedPrincipals_.makeImmutable();
+      return deniedPrincipals_;
     }
     /**
      *
@@ -1137,32 +1146,40 @@ public com.google.protobuf.ProtocolStringList getDeniedPrincipalsList() {
      * <pre>
      * The identities that are prevented from using one or more permissions on
      * Google Cloud resources. This field can contain the following values:
+     *
      * * `principalSet://goog/public:all`: A special identifier that represents
      *   any principal that is on the internet, even if they do not have a Google
      *   Account or are not logged in.
+     *
      * * `principal://goog/subject/{email_id}`: A specific Google Account.
      *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
      *   example, `principal://goog/subject/alice&#64;example.com`.
+     *
      * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
      *   Google Account that was deleted recently. For example,
      *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
      *   the Google Account is recovered, this identifier reverts to the standard
      *   identifier for a Google Account.
+     *
      * * `principalSet://goog/group/{group_id}`: A Google group. For example,
      *   `principalSet://goog/group/admins&#64;example.com`.
+     *
      * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
      *   that was deleted recently. For example,
      *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
      *   the Google group is restored, this identifier reverts to the standard
      *   identifier for a Google group.
+     *
      * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
      *   A Google Cloud service account. For example,
      *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+     *
      * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
      *   A Google Cloud service account that was deleted recently. For example,
      *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
      *   If the service account is undeleted, this identifier reverts to the
      *   standard identifier for a service account.
+     *
      * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
      *   principals associated with the specified Google Workspace or Cloud
      *   Identity customer ID. For example,
@@ -1182,32 +1199,40 @@ public int getDeniedPrincipalsCount() {
      * <pre>
      * The identities that are prevented from using one or more permissions on
      * Google Cloud resources. This field can contain the following values:
+     *
      * * `principalSet://goog/public:all`: A special identifier that represents
      *   any principal that is on the internet, even if they do not have a Google
      *   Account or are not logged in.
+     *
      * * `principal://goog/subject/{email_id}`: A specific Google Account.
      *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
      *   example, `principal://goog/subject/alice&#64;example.com`.
+     *
      * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
      *   Google Account that was deleted recently. For example,
      *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
      *   the Google Account is recovered, this identifier reverts to the standard
      *   identifier for a Google Account.
+     *
      * * `principalSet://goog/group/{group_id}`: A Google group. For example,
      *   `principalSet://goog/group/admins&#64;example.com`.
+     *
      * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
      *   that was deleted recently. For example,
      *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
      *   the Google group is restored, this identifier reverts to the standard
      *   identifier for a Google group.
+     *
      * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
      *   A Google Cloud service account. For example,
      *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+     *
      * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
      *   A Google Cloud service account that was deleted recently. For example,
      *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
      *   If the service account is undeleted, this identifier reverts to the
      *   standard identifier for a service account.
+     *
      * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
      *   principals associated with the specified Google Workspace or Cloud
      *   Identity customer ID. For example,
@@ -1228,32 +1253,40 @@ public java.lang.String getDeniedPrincipals(int index) {
      * <pre>
      * The identities that are prevented from using one or more permissions on
      * Google Cloud resources. This field can contain the following values:
+     *
      * * `principalSet://goog/public:all`: A special identifier that represents
      *   any principal that is on the internet, even if they do not have a Google
      *   Account or are not logged in.
+     *
      * * `principal://goog/subject/{email_id}`: A specific Google Account.
      *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
      *   example, `principal://goog/subject/alice&#64;example.com`.
+     *
      * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
      *   Google Account that was deleted recently. For example,
      *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
      *   the Google Account is recovered, this identifier reverts to the standard
      *   identifier for a Google Account.
+     *
      * * `principalSet://goog/group/{group_id}`: A Google group. For example,
      *   `principalSet://goog/group/admins&#64;example.com`.
+     *
      * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
      *   that was deleted recently. For example,
      *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
      *   the Google group is restored, this identifier reverts to the standard
      *   identifier for a Google group.
+     *
      * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
      *   A Google Cloud service account. For example,
      *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+     *
      * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
      *   A Google Cloud service account that was deleted recently. For example,
      *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
      *   If the service account is undeleted, this identifier reverts to the
      *   standard identifier for a service account.
+     *
      * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
      *   principals associated with the specified Google Workspace or Cloud
      *   Identity customer ID. For example,
@@ -1274,32 +1307,40 @@ public com.google.protobuf.ByteString getDeniedPrincipalsBytes(int index) {
      * <pre>
      * The identities that are prevented from using one or more permissions on
      * Google Cloud resources. This field can contain the following values:
+     *
      * * `principalSet://goog/public:all`: A special identifier that represents
      *   any principal that is on the internet, even if they do not have a Google
      *   Account or are not logged in.
+     *
      * * `principal://goog/subject/{email_id}`: A specific Google Account.
      *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
      *   example, `principal://goog/subject/alice&#64;example.com`.
+     *
      * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
      *   Google Account that was deleted recently. For example,
      *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
      *   the Google Account is recovered, this identifier reverts to the standard
      *   identifier for a Google Account.
+     *
      * * `principalSet://goog/group/{group_id}`: A Google group. For example,
      *   `principalSet://goog/group/admins&#64;example.com`.
+     *
      * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
      *   that was deleted recently. For example,
      *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
      *   the Google group is restored, this identifier reverts to the standard
      *   identifier for a Google group.
+     *
      * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
      *   A Google Cloud service account. For example,
      *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+     *
      * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
      *   A Google Cloud service account that was deleted recently. For example,
      *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
      *   If the service account is undeleted, this identifier reverts to the
      *   standard identifier for a service account.
+     *
      * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
      *   principals associated with the specified Google Workspace or Cloud
      *   Identity customer ID. For example,
@@ -1318,6 +1359,7 @@ public Builder setDeniedPrincipals(int index, java.lang.String value) {
       }
       ensureDeniedPrincipalsIsMutable();
       deniedPrincipals_.set(index, value);
+      bitField0_ |= 0x00000001;
       onChanged();
       return this;
     }
@@ -1327,32 +1369,40 @@ public Builder setDeniedPrincipals(int index, java.lang.String value) {
      * <pre>
      * The identities that are prevented from using one or more permissions on
      * Google Cloud resources. This field can contain the following values:
+     *
      * * `principalSet://goog/public:all`: A special identifier that represents
      *   any principal that is on the internet, even if they do not have a Google
      *   Account or are not logged in.
+     *
      * * `principal://goog/subject/{email_id}`: A specific Google Account.
      *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
      *   example, `principal://goog/subject/alice&#64;example.com`.
+     *
      * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
      *   Google Account that was deleted recently. For example,
      *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
      *   the Google Account is recovered, this identifier reverts to the standard
      *   identifier for a Google Account.
+     *
      * * `principalSet://goog/group/{group_id}`: A Google group. For example,
      *   `principalSet://goog/group/admins&#64;example.com`.
+     *
      * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
      *   that was deleted recently. For example,
      *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
      *   the Google group is restored, this identifier reverts to the standard
      *   identifier for a Google group.
+     *
      * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
      *   A Google Cloud service account. For example,
      *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+     *
      * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
      *   A Google Cloud service account that was deleted recently. For example,
      *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
      *   If the service account is undeleted, this identifier reverts to the
      *   standard identifier for a service account.
+     *
      * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
      *   principals associated with the specified Google Workspace or Cloud
      *   Identity customer ID. For example,
@@ -1370,6 +1420,7 @@ public Builder addDeniedPrincipals(java.lang.String value) {
       }
       ensureDeniedPrincipalsIsMutable();
       deniedPrincipals_.add(value);
+      bitField0_ |= 0x00000001;
       onChanged();
       return this;
     }
@@ -1379,32 +1430,40 @@ public Builder addDeniedPrincipals(java.lang.String value) {
      * <pre>
      * The identities that are prevented from using one or more permissions on
      * Google Cloud resources. This field can contain the following values:
+     *
      * * `principalSet://goog/public:all`: A special identifier that represents
      *   any principal that is on the internet, even if they do not have a Google
      *   Account or are not logged in.
+     *
      * * `principal://goog/subject/{email_id}`: A specific Google Account.
      *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
      *   example, `principal://goog/subject/alice&#64;example.com`.
+     *
      * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
      *   Google Account that was deleted recently. For example,
      *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
      *   the Google Account is recovered, this identifier reverts to the standard
      *   identifier for a Google Account.
+     *
      * * `principalSet://goog/group/{group_id}`: A Google group. For example,
      *   `principalSet://goog/group/admins&#64;example.com`.
+     *
      * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
      *   that was deleted recently. For example,
      *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
      *   the Google group is restored, this identifier reverts to the standard
      *   identifier for a Google group.
+     *
      * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
      *   A Google Cloud service account. For example,
      *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+     *
      * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
      *   A Google Cloud service account that was deleted recently. For example,
      *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
      *   If the service account is undeleted, this identifier reverts to the
      *   standard identifier for a service account.
+     *
      * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
      *   principals associated with the specified Google Workspace or Cloud
      *   Identity customer ID. For example,
@@ -1419,6 +1478,7 @@ public Builder addDeniedPrincipals(java.lang.String value) {
     public Builder addAllDeniedPrincipals(java.lang.Iterable<java.lang.String> values) {
       ensureDeniedPrincipalsIsMutable();
       com.google.protobuf.AbstractMessageLite.Builder.addAll(values, deniedPrincipals_);
+      bitField0_ |= 0x00000001;
       onChanged();
       return this;
     }
@@ -1428,32 +1488,40 @@ public Builder addAllDeniedPrincipals(java.lang.Iterable<java.lang.String> value
      * <pre>
      * The identities that are prevented from using one or more permissions on
      * Google Cloud resources. This field can contain the following values:
+     *
      * * `principalSet://goog/public:all`: A special identifier that represents
      *   any principal that is on the internet, even if they do not have a Google
      *   Account or are not logged in.
+     *
      * * `principal://goog/subject/{email_id}`: A specific Google Account.
      *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
      *   example, `principal://goog/subject/alice&#64;example.com`.
+     *
      * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
      *   Google Account that was deleted recently. For example,
      *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
      *   the Google Account is recovered, this identifier reverts to the standard
      *   identifier for a Google Account.
+     *
      * * `principalSet://goog/group/{group_id}`: A Google group. For example,
      *   `principalSet://goog/group/admins&#64;example.com`.
+     *
      * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
      *   that was deleted recently. For example,
      *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
      *   the Google group is restored, this identifier reverts to the standard
      *   identifier for a Google group.
+     *
      * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
      *   A Google Cloud service account. For example,
      *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+     *
      * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
      *   A Google Cloud service account that was deleted recently. For example,
      *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
      *   If the service account is undeleted, this identifier reverts to the
      *   standard identifier for a service account.
+     *
      * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
      *   principals associated with the specified Google Workspace or Cloud
      *   Identity customer ID. For example,
@@ -1465,8 +1533,9 @@ public Builder addAllDeniedPrincipals(java.lang.Iterable<java.lang.String> value
      * @return This builder for chaining.
      */
     public Builder clearDeniedPrincipals() {
-      deniedPrincipals_ = com.google.protobuf.LazyStringArrayList.EMPTY;
+      deniedPrincipals_ = com.google.protobuf.LazyStringArrayList.emptyList();
       bitField0_ = (bitField0_ & ~0x00000001);
+      ;
       onChanged();
       return this;
     }
@@ -1476,32 +1545,40 @@ public Builder clearDeniedPrincipals() {
      * <pre>
      * The identities that are prevented from using one or more permissions on
      * Google Cloud resources. This field can contain the following values:
+     *
      * * `principalSet://goog/public:all`: A special identifier that represents
      *   any principal that is on the internet, even if they do not have a Google
      *   Account or are not logged in.
+     *
      * * `principal://goog/subject/{email_id}`: A specific Google Account.
      *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
      *   example, `principal://goog/subject/alice&#64;example.com`.
+     *
      * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
      *   Google Account that was deleted recently. For example,
      *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
      *   the Google Account is recovered, this identifier reverts to the standard
      *   identifier for a Google Account.
+     *
      * * `principalSet://goog/group/{group_id}`: A Google group. For example,
      *   `principalSet://goog/group/admins&#64;example.com`.
+     *
      * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
      *   that was deleted recently. For example,
      *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
      *   the Google group is restored, this identifier reverts to the standard
      *   identifier for a Google group.
+     *
      * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
      *   A Google Cloud service account. For example,
      *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+     *
      * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
      *   A Google Cloud service account that was deleted recently. For example,
      *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
      *   If the service account is undeleted, this identifier reverts to the
      *   standard identifier for a service account.
+     *
      * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
      *   principals associated with the specified Google Workspace or Cloud
      *   Identity customer ID. For example,
@@ -1520,18 +1597,19 @@ public Builder addDeniedPrincipalsBytes(com.google.protobuf.ByteString value) {
       checkByteStringIsUtf8(value);
       ensureDeniedPrincipalsIsMutable();
       deniedPrincipals_.add(value);
+      bitField0_ |= 0x00000001;
       onChanged();
       return this;
     }
 
-    private com.google.protobuf.LazyStringList exceptionPrincipals_ =
-        com.google.protobuf.LazyStringArrayList.EMPTY;
+    private com.google.protobuf.LazyStringArrayList exceptionPrincipals_ =
+        com.google.protobuf.LazyStringArrayList.emptyList();
 
     private void ensureExceptionPrincipalsIsMutable() {
-      if (!((bitField0_ & 0x00000002) != 0)) {
+      if (!exceptionPrincipals_.isModifiable()) {
         exceptionPrincipals_ = new com.google.protobuf.LazyStringArrayList(exceptionPrincipals_);
-        bitField0_ |= 0x00000002;
       }
+      bitField0_ |= 0x00000002;
     }
     /**
      *
@@ -1541,6 +1619,7 @@ private void ensureExceptionPrincipalsIsMutable() {
      * listed in the `denied_principals`. For example, you could add a Google
      * group to the `denied_principals`, then exclude specific users who belong to
      * that group.
+     *
      * This field can contain the same values as the `denied_principals` field,
      * excluding `principalSet://goog/public:all`, which represents all users on
      * the internet.
@@ -1551,7 +1630,8 @@ private void ensureExceptionPrincipalsIsMutable() {
      * @return A list containing the exceptionPrincipals.
      */
     public com.google.protobuf.ProtocolStringList getExceptionPrincipalsList() {
-      return exceptionPrincipals_.getUnmodifiableView();
+      exceptionPrincipals_.makeImmutable();
+      return exceptionPrincipals_;
     }
     /**
      *
@@ -1561,6 +1641,7 @@ public com.google.protobuf.ProtocolStringList getExceptionPrincipalsList() {
      * listed in the `denied_principals`. For example, you could add a Google
      * group to the `denied_principals`, then exclude specific users who belong to
      * that group.
+     *
      * This field can contain the same values as the `denied_principals` field,
      * excluding `principalSet://goog/public:all`, which represents all users on
      * the internet.
@@ -1581,6 +1662,7 @@ public int getExceptionPrincipalsCount() {
      * listed in the `denied_principals`. For example, you could add a Google
      * group to the `denied_principals`, then exclude specific users who belong to
      * that group.
+     *
      * This field can contain the same values as the `denied_principals` field,
      * excluding `principalSet://goog/public:all`, which represents all users on
      * the internet.
@@ -1602,6 +1684,7 @@ public java.lang.String getExceptionPrincipals(int index) {
      * listed in the `denied_principals`. For example, you could add a Google
      * group to the `denied_principals`, then exclude specific users who belong to
      * that group.
+     *
      * This field can contain the same values as the `denied_principals` field,
      * excluding `principalSet://goog/public:all`, which represents all users on
      * the internet.
@@ -1623,6 +1706,7 @@ public com.google.protobuf.ByteString getExceptionPrincipalsBytes(int index) {
      * listed in the `denied_principals`. For example, you could add a Google
      * group to the `denied_principals`, then exclude specific users who belong to
      * that group.
+     *
      * This field can contain the same values as the `denied_principals` field,
      * excluding `principalSet://goog/public:all`, which represents all users on
      * the internet.
@@ -1640,6 +1724,7 @@ public Builder setExceptionPrincipals(int index, java.lang.String value) {
       }
       ensureExceptionPrincipalsIsMutable();
       exceptionPrincipals_.set(index, value);
+      bitField0_ |= 0x00000002;
       onChanged();
       return this;
     }
@@ -1651,6 +1736,7 @@ public Builder setExceptionPrincipals(int index, java.lang.String value) {
      * listed in the `denied_principals`. For example, you could add a Google
      * group to the `denied_principals`, then exclude specific users who belong to
      * that group.
+     *
      * This field can contain the same values as the `denied_principals` field,
      * excluding `principalSet://goog/public:all`, which represents all users on
      * the internet.
@@ -1667,6 +1753,7 @@ public Builder addExceptionPrincipals(java.lang.String value) {
       }
       ensureExceptionPrincipalsIsMutable();
       exceptionPrincipals_.add(value);
+      bitField0_ |= 0x00000002;
       onChanged();
       return this;
     }
@@ -1678,6 +1765,7 @@ public Builder addExceptionPrincipals(java.lang.String value) {
      * listed in the `denied_principals`. For example, you could add a Google
      * group to the `denied_principals`, then exclude specific users who belong to
      * that group.
+     *
      * This field can contain the same values as the `denied_principals` field,
      * excluding `principalSet://goog/public:all`, which represents all users on
      * the internet.
@@ -1691,6 +1779,7 @@ public Builder addExceptionPrincipals(java.lang.String value) {
     public Builder addAllExceptionPrincipals(java.lang.Iterable<java.lang.String> values) {
       ensureExceptionPrincipalsIsMutable();
       com.google.protobuf.AbstractMessageLite.Builder.addAll(values, exceptionPrincipals_);
+      bitField0_ |= 0x00000002;
       onChanged();
       return this;
     }
@@ -1702,6 +1791,7 @@ public Builder addAllExceptionPrincipals(java.lang.Iterable<java.lang.String> va
      * listed in the `denied_principals`. For example, you could add a Google
      * group to the `denied_principals`, then exclude specific users who belong to
      * that group.
+     *
      * This field can contain the same values as the `denied_principals` field,
      * excluding `principalSet://goog/public:all`, which represents all users on
      * the internet.
@@ -1712,8 +1802,9 @@ public Builder addAllExceptionPrincipals(java.lang.Iterable<java.lang.String> va
      * @return This builder for chaining.
      */
     public Builder clearExceptionPrincipals() {
-      exceptionPrincipals_ = com.google.protobuf.LazyStringArrayList.EMPTY;
+      exceptionPrincipals_ = com.google.protobuf.LazyStringArrayList.emptyList();
       bitField0_ = (bitField0_ & ~0x00000002);
+      ;
       onChanged();
       return this;
     }
@@ -1725,6 +1816,7 @@ public Builder clearExceptionPrincipals() {
      * listed in the `denied_principals`. For example, you could add a Google
      * group to the `denied_principals`, then exclude specific users who belong to
      * that group.
+     *
      * This field can contain the same values as the `denied_principals` field,
      * excluding `principalSet://goog/public:all`, which represents all users on
      * the internet.
@@ -1742,18 +1834,19 @@ public Builder addExceptionPrincipalsBytes(com.google.protobuf.ByteString value)
       checkByteStringIsUtf8(value);
       ensureExceptionPrincipalsIsMutable();
       exceptionPrincipals_.add(value);
+      bitField0_ |= 0x00000002;
       onChanged();
       return this;
     }
 
-    private com.google.protobuf.LazyStringList deniedPermissions_ =
-        com.google.protobuf.LazyStringArrayList.EMPTY;
+    private com.google.protobuf.LazyStringArrayList deniedPermissions_ =
+        com.google.protobuf.LazyStringArrayList.emptyList();
 
     private void ensureDeniedPermissionsIsMutable() {
-      if (!((bitField0_ & 0x00000004) != 0)) {
+      if (!deniedPermissions_.isModifiable()) {
         deniedPermissions_ = new com.google.protobuf.LazyStringArrayList(deniedPermissions_);
-        bitField0_ |= 0x00000004;
       }
+      bitField0_ |= 0x00000004;
     }
     /**
      *
@@ -1770,7 +1863,8 @@ private void ensureDeniedPermissionsIsMutable() {
      * @return A list containing the deniedPermissions.
      */
     public com.google.protobuf.ProtocolStringList getDeniedPermissionsList() {
-      return deniedPermissions_.getUnmodifiableView();
+      deniedPermissions_.makeImmutable();
+      return deniedPermissions_;
     }
     /**
      *
@@ -1847,6 +1941,7 @@ public Builder setDeniedPermissions(int index, java.lang.String value) {
       }
       ensureDeniedPermissionsIsMutable();
       deniedPermissions_.set(index, value);
+      bitField0_ |= 0x00000004;
       onChanged();
       return this;
     }
@@ -1871,6 +1966,7 @@ public Builder addDeniedPermissions(java.lang.String value) {
       }
       ensureDeniedPermissionsIsMutable();
       deniedPermissions_.add(value);
+      bitField0_ |= 0x00000004;
       onChanged();
       return this;
     }
@@ -1892,6 +1988,7 @@ public Builder addDeniedPermissions(java.lang.String value) {
     public Builder addAllDeniedPermissions(java.lang.Iterable<java.lang.String> values) {
       ensureDeniedPermissionsIsMutable();
       com.google.protobuf.AbstractMessageLite.Builder.addAll(values, deniedPermissions_);
+      bitField0_ |= 0x00000004;
       onChanged();
       return this;
     }
@@ -1910,8 +2007,9 @@ public Builder addAllDeniedPermissions(java.lang.Iterable<java.lang.String> valu
      * @return This builder for chaining.
      */
     public Builder clearDeniedPermissions() {
-      deniedPermissions_ = com.google.protobuf.LazyStringArrayList.EMPTY;
+      deniedPermissions_ = com.google.protobuf.LazyStringArrayList.emptyList();
       bitField0_ = (bitField0_ & ~0x00000004);
+      ;
       onChanged();
       return this;
     }
@@ -1937,18 +2035,19 @@ public Builder addDeniedPermissionsBytes(com.google.protobuf.ByteString value) {
       checkByteStringIsUtf8(value);
       ensureDeniedPermissionsIsMutable();
       deniedPermissions_.add(value);
+      bitField0_ |= 0x00000004;
       onChanged();
       return this;
     }
 
-    private com.google.protobuf.LazyStringList exceptionPermissions_ =
-        com.google.protobuf.LazyStringArrayList.EMPTY;
+    private com.google.protobuf.LazyStringArrayList exceptionPermissions_ =
+        com.google.protobuf.LazyStringArrayList.emptyList();
 
     private void ensureExceptionPermissionsIsMutable() {
-      if (!((bitField0_ & 0x00000008) != 0)) {
+      if (!exceptionPermissions_.isModifiable()) {
         exceptionPermissions_ = new com.google.protobuf.LazyStringArrayList(exceptionPermissions_);
-        bitField0_ |= 0x00000008;
       }
+      bitField0_ |= 0x00000008;
     }
     /**
      *
@@ -1958,6 +2057,7 @@ private void ensureExceptionPermissionsIsMutable() {
      * permissions given by `denied_permissions`. If a permission appears in
      * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
      * denied.
+     *
      * The excluded permissions can be specified using the same syntax as
      * `denied_permissions`.
      * </pre>
@@ -1967,7 +2067,8 @@ private void ensureExceptionPermissionsIsMutable() {
      * @return A list containing the exceptionPermissions.
      */
     public com.google.protobuf.ProtocolStringList getExceptionPermissionsList() {
-      return exceptionPermissions_.getUnmodifiableView();
+      exceptionPermissions_.makeImmutable();
+      return exceptionPermissions_;
     }
     /**
      *
@@ -1977,6 +2078,7 @@ public com.google.protobuf.ProtocolStringList getExceptionPermissionsList() {
      * permissions given by `denied_permissions`. If a permission appears in
      * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
      * denied.
+     *
      * The excluded permissions can be specified using the same syntax as
      * `denied_permissions`.
      * </pre>
@@ -1996,6 +2098,7 @@ public int getExceptionPermissionsCount() {
      * permissions given by `denied_permissions`. If a permission appears in
      * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
      * denied.
+     *
      * The excluded permissions can be specified using the same syntax as
      * `denied_permissions`.
      * </pre>
@@ -2016,6 +2119,7 @@ public java.lang.String getExceptionPermissions(int index) {
      * permissions given by `denied_permissions`. If a permission appears in
      * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
      * denied.
+     *
      * The excluded permissions can be specified using the same syntax as
      * `denied_permissions`.
      * </pre>
@@ -2036,6 +2140,7 @@ public com.google.protobuf.ByteString getExceptionPermissionsBytes(int index) {
      * permissions given by `denied_permissions`. If a permission appears in
      * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
      * denied.
+     *
      * The excluded permissions can be specified using the same syntax as
      * `denied_permissions`.
      * </pre>
@@ -2052,6 +2157,7 @@ public Builder setExceptionPermissions(int index, java.lang.String value) {
       }
       ensureExceptionPermissionsIsMutable();
       exceptionPermissions_.set(index, value);
+      bitField0_ |= 0x00000008;
       onChanged();
       return this;
     }
@@ -2063,6 +2169,7 @@ public Builder setExceptionPermissions(int index, java.lang.String value) {
      * permissions given by `denied_permissions`. If a permission appears in
      * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
      * denied.
+     *
      * The excluded permissions can be specified using the same syntax as
      * `denied_permissions`.
      * </pre>
@@ -2078,6 +2185,7 @@ public Builder addExceptionPermissions(java.lang.String value) {
       }
       ensureExceptionPermissionsIsMutable();
       exceptionPermissions_.add(value);
+      bitField0_ |= 0x00000008;
       onChanged();
       return this;
     }
@@ -2089,6 +2197,7 @@ public Builder addExceptionPermissions(java.lang.String value) {
      * permissions given by `denied_permissions`. If a permission appears in
      * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
      * denied.
+     *
      * The excluded permissions can be specified using the same syntax as
      * `denied_permissions`.
      * </pre>
@@ -2101,6 +2210,7 @@ public Builder addExceptionPermissions(java.lang.String value) {
     public Builder addAllExceptionPermissions(java.lang.Iterable<java.lang.String> values) {
       ensureExceptionPermissionsIsMutable();
       com.google.protobuf.AbstractMessageLite.Builder.addAll(values, exceptionPermissions_);
+      bitField0_ |= 0x00000008;
       onChanged();
       return this;
     }
@@ -2112,6 +2222,7 @@ public Builder addAllExceptionPermissions(java.lang.Iterable<java.lang.String> v
      * permissions given by `denied_permissions`. If a permission appears in
      * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
      * denied.
+     *
      * The excluded permissions can be specified using the same syntax as
      * `denied_permissions`.
      * </pre>
@@ -2121,8 +2232,9 @@ public Builder addAllExceptionPermissions(java.lang.Iterable<java.lang.String> v
      * @return This builder for chaining.
      */
     public Builder clearExceptionPermissions() {
-      exceptionPermissions_ = com.google.protobuf.LazyStringArrayList.EMPTY;
+      exceptionPermissions_ = com.google.protobuf.LazyStringArrayList.emptyList();
       bitField0_ = (bitField0_ & ~0x00000008);
+      ;
       onChanged();
       return this;
     }
@@ -2134,6 +2246,7 @@ public Builder clearExceptionPermissions() {
      * permissions given by `denied_permissions`. If a permission appears in
      * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
      * denied.
+     *
      * The excluded permissions can be specified using the same syntax as
      * `denied_permissions`.
      * </pre>
@@ -2150,6 +2263,7 @@ public Builder addExceptionPermissionsBytes(com.google.protobuf.ByteString value
       checkByteStringIsUtf8(value);
       ensureExceptionPermissionsIsMutable();
       exceptionPermissions_.add(value);
+      bitField0_ |= 0x00000008;
       onChanged();
       return this;
     }
@@ -2165,8 +2279,10 @@ public Builder addExceptionPermissionsBytes(com.google.protobuf.ByteString value
      * The condition that determines whether this deny rule applies to a request.
      * If the condition expression evaluates to `true`, then the deny rule is
      * applied; otherwise, the deny rule is not applied.
+     *
      * Each deny rule is evaluated independently. If this deny rule does not apply
      * to a request, other deny rules might still apply.
+     *
      * The condition can use CEL functions that evaluate
      * [resource
      * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
@@ -2187,8 +2303,10 @@ public boolean hasDenialCondition() {
      * The condition that determines whether this deny rule applies to a request.
      * If the condition expression evaluates to `true`, then the deny rule is
      * applied; otherwise, the deny rule is not applied.
+     *
      * Each deny rule is evaluated independently. If this deny rule does not apply
      * to a request, other deny rules might still apply.
+     *
      * The condition can use CEL functions that evaluate
      * [resource
      * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
@@ -2215,8 +2333,10 @@ public com.google.type.Expr getDenialCondition() {
      * The condition that determines whether this deny rule applies to a request.
      * If the condition expression evaluates to `true`, then the deny rule is
      * applied; otherwise, the deny rule is not applied.
+     *
      * Each deny rule is evaluated independently. If this deny rule does not apply
      * to a request, other deny rules might still apply.
+     *
      * The condition can use CEL functions that evaluate
      * [resource
      * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
@@ -2245,8 +2365,10 @@ public Builder setDenialCondition(com.google.type.Expr value) {
      * The condition that determines whether this deny rule applies to a request.
      * If the condition expression evaluates to `true`, then the deny rule is
      * applied; otherwise, the deny rule is not applied.
+     *
      * Each deny rule is evaluated independently. If this deny rule does not apply
      * to a request, other deny rules might still apply.
+     *
      * The condition can use CEL functions that evaluate
      * [resource
      * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
@@ -2272,8 +2394,10 @@ public Builder setDenialCondition(com.google.type.Expr.Builder builderForValue)
      * The condition that determines whether this deny rule applies to a request.
      * If the condition expression evaluates to `true`, then the deny rule is
      * applied; otherwise, the deny rule is not applied.
+     *
      * Each deny rule is evaluated independently. If this deny rule does not apply
      * to a request, other deny rules might still apply.
+     *
      * The condition can use CEL functions that evaluate
      * [resource
      * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
@@ -2305,8 +2429,10 @@ public Builder mergeDenialCondition(com.google.type.Expr value) {
      * The condition that determines whether this deny rule applies to a request.
      * If the condition expression evaluates to `true`, then the deny rule is
      * applied; otherwise, the deny rule is not applied.
+     *
      * Each deny rule is evaluated independently. If this deny rule does not apply
      * to a request, other deny rules might still apply.
+     *
      * The condition can use CEL functions that evaluate
      * [resource
      * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
@@ -2332,8 +2458,10 @@ public Builder clearDenialCondition() {
      * The condition that determines whether this deny rule applies to a request.
      * If the condition expression evaluates to `true`, then the deny rule is
      * applied; otherwise, the deny rule is not applied.
+     *
      * Each deny rule is evaluated independently. If this deny rule does not apply
      * to a request, other deny rules might still apply.
+     *
      * The condition can use CEL functions that evaluate
      * [resource
      * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
@@ -2354,8 +2482,10 @@ public com.google.type.Expr.Builder getDenialConditionBuilder() {
      * The condition that determines whether this deny rule applies to a request.
      * If the condition expression evaluates to `true`, then the deny rule is
      * applied; otherwise, the deny rule is not applied.
+     *
      * Each deny rule is evaluated independently. If this deny rule does not apply
      * to a request, other deny rules might still apply.
+     *
      * The condition can use CEL functions that evaluate
      * [resource
      * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
@@ -2380,8 +2510,10 @@ public com.google.type.ExprOrBuilder getDenialConditionOrBuilder() {
      * The condition that determines whether this deny rule applies to a request.
      * If the condition expression evaluates to `true`, then the deny rule is
      * applied; otherwise, the deny rule is not applied.
+     *
      * Each deny rule is evaluated independently. If this deny rule does not apply
      * to a request, other deny rules might still apply.
+     *
      * The condition can use CEL functions that evaluate
      * [resource
      * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
diff --git a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/DenyRuleOrBuilder.java b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/DenyRuleOrBuilder.java
index 1d35367fb8..cb8dd9758c 100644
--- a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/DenyRuleOrBuilder.java
+++ b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/DenyRuleOrBuilder.java
@@ -29,32 +29,40 @@ public interface DenyRuleOrBuilder
    * <pre>
    * The identities that are prevented from using one or more permissions on
    * Google Cloud resources. This field can contain the following values:
+   *
    * * `principalSet://goog/public:all`: A special identifier that represents
    *   any principal that is on the internet, even if they do not have a Google
    *   Account or are not logged in.
+   *
    * * `principal://goog/subject/{email_id}`: A specific Google Account.
    *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
    *   example, `principal://goog/subject/alice&#64;example.com`.
+   *
    * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
    *   Google Account that was deleted recently. For example,
    *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
    *   the Google Account is recovered, this identifier reverts to the standard
    *   identifier for a Google Account.
+   *
    * * `principalSet://goog/group/{group_id}`: A Google group. For example,
    *   `principalSet://goog/group/admins&#64;example.com`.
+   *
    * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
    *   that was deleted recently. For example,
    *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
    *   the Google group is restored, this identifier reverts to the standard
    *   identifier for a Google group.
+   *
    * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
    *   A Google Cloud service account. For example,
    *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+   *
    * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
    *   A Google Cloud service account that was deleted recently. For example,
    *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
    *   If the service account is undeleted, this identifier reverts to the
    *   standard identifier for a service account.
+   *
    * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
    *   principals associated with the specified Google Workspace or Cloud
    *   Identity customer ID. For example,
@@ -72,32 +80,40 @@ public interface DenyRuleOrBuilder
    * <pre>
    * The identities that are prevented from using one or more permissions on
    * Google Cloud resources. This field can contain the following values:
+   *
    * * `principalSet://goog/public:all`: A special identifier that represents
    *   any principal that is on the internet, even if they do not have a Google
    *   Account or are not logged in.
+   *
    * * `principal://goog/subject/{email_id}`: A specific Google Account.
    *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
    *   example, `principal://goog/subject/alice&#64;example.com`.
+   *
    * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
    *   Google Account that was deleted recently. For example,
    *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
    *   the Google Account is recovered, this identifier reverts to the standard
    *   identifier for a Google Account.
+   *
    * * `principalSet://goog/group/{group_id}`: A Google group. For example,
    *   `principalSet://goog/group/admins&#64;example.com`.
+   *
    * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
    *   that was deleted recently. For example,
    *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
    *   the Google group is restored, this identifier reverts to the standard
    *   identifier for a Google group.
+   *
    * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
    *   A Google Cloud service account. For example,
    *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+   *
    * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
    *   A Google Cloud service account that was deleted recently. For example,
    *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
    *   If the service account is undeleted, this identifier reverts to the
    *   standard identifier for a service account.
+   *
    * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
    *   principals associated with the specified Google Workspace or Cloud
    *   Identity customer ID. For example,
@@ -115,32 +131,40 @@ public interface DenyRuleOrBuilder
    * <pre>
    * The identities that are prevented from using one or more permissions on
    * Google Cloud resources. This field can contain the following values:
+   *
    * * `principalSet://goog/public:all`: A special identifier that represents
    *   any principal that is on the internet, even if they do not have a Google
    *   Account or are not logged in.
+   *
    * * `principal://goog/subject/{email_id}`: A specific Google Account.
    *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
    *   example, `principal://goog/subject/alice&#64;example.com`.
+   *
    * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
    *   Google Account that was deleted recently. For example,
    *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
    *   the Google Account is recovered, this identifier reverts to the standard
    *   identifier for a Google Account.
+   *
    * * `principalSet://goog/group/{group_id}`: A Google group. For example,
    *   `principalSet://goog/group/admins&#64;example.com`.
+   *
    * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
    *   that was deleted recently. For example,
    *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
    *   the Google group is restored, this identifier reverts to the standard
    *   identifier for a Google group.
+   *
    * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
    *   A Google Cloud service account. For example,
    *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+   *
    * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
    *   A Google Cloud service account that was deleted recently. For example,
    *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
    *   If the service account is undeleted, this identifier reverts to the
    *   standard identifier for a service account.
+   *
    * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
    *   principals associated with the specified Google Workspace or Cloud
    *   Identity customer ID. For example,
@@ -159,32 +183,40 @@ public interface DenyRuleOrBuilder
    * <pre>
    * The identities that are prevented from using one or more permissions on
    * Google Cloud resources. This field can contain the following values:
+   *
    * * `principalSet://goog/public:all`: A special identifier that represents
    *   any principal that is on the internet, even if they do not have a Google
    *   Account or are not logged in.
+   *
    * * `principal://goog/subject/{email_id}`: A specific Google Account.
    *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
    *   example, `principal://goog/subject/alice&#64;example.com`.
+   *
    * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
    *   Google Account that was deleted recently. For example,
    *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
    *   the Google Account is recovered, this identifier reverts to the standard
    *   identifier for a Google Account.
+   *
    * * `principalSet://goog/group/{group_id}`: A Google group. For example,
    *   `principalSet://goog/group/admins&#64;example.com`.
+   *
    * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
    *   that was deleted recently. For example,
    *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
    *   the Google group is restored, this identifier reverts to the standard
    *   identifier for a Google group.
+   *
    * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
    *   A Google Cloud service account. For example,
    *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+   *
    * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
    *   A Google Cloud service account that was deleted recently. For example,
    *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
    *   If the service account is undeleted, this identifier reverts to the
    *   standard identifier for a service account.
+   *
    * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
    *   principals associated with the specified Google Workspace or Cloud
    *   Identity customer ID. For example,
@@ -206,6 +238,7 @@ public interface DenyRuleOrBuilder
    * listed in the `denied_principals`. For example, you could add a Google
    * group to the `denied_principals`, then exclude specific users who belong to
    * that group.
+   *
    * This field can contain the same values as the `denied_principals` field,
    * excluding `principalSet://goog/public:all`, which represents all users on
    * the internet.
@@ -224,6 +257,7 @@ public interface DenyRuleOrBuilder
    * listed in the `denied_principals`. For example, you could add a Google
    * group to the `denied_principals`, then exclude specific users who belong to
    * that group.
+   *
    * This field can contain the same values as the `denied_principals` field,
    * excluding `principalSet://goog/public:all`, which represents all users on
    * the internet.
@@ -242,6 +276,7 @@ public interface DenyRuleOrBuilder
    * listed in the `denied_principals`. For example, you could add a Google
    * group to the `denied_principals`, then exclude specific users who belong to
    * that group.
+   *
    * This field can contain the same values as the `denied_principals` field,
    * excluding `principalSet://goog/public:all`, which represents all users on
    * the internet.
@@ -261,6 +296,7 @@ public interface DenyRuleOrBuilder
    * listed in the `denied_principals`. For example, you could add a Google
    * group to the `denied_principals`, then exclude specific users who belong to
    * that group.
+   *
    * This field can contain the same values as the `denied_principals` field,
    * excluding `principalSet://goog/public:all`, which represents all users on
    * the internet.
@@ -344,6 +380,7 @@ public interface DenyRuleOrBuilder
    * permissions given by `denied_permissions`. If a permission appears in
    * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
    * denied.
+   *
    * The excluded permissions can be specified using the same syntax as
    * `denied_permissions`.
    * </pre>
@@ -361,6 +398,7 @@ public interface DenyRuleOrBuilder
    * permissions given by `denied_permissions`. If a permission appears in
    * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
    * denied.
+   *
    * The excluded permissions can be specified using the same syntax as
    * `denied_permissions`.
    * </pre>
@@ -378,6 +416,7 @@ public interface DenyRuleOrBuilder
    * permissions given by `denied_permissions`. If a permission appears in
    * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
    * denied.
+   *
    * The excluded permissions can be specified using the same syntax as
    * `denied_permissions`.
    * </pre>
@@ -396,6 +435,7 @@ public interface DenyRuleOrBuilder
    * permissions given by `denied_permissions`. If a permission appears in
    * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
    * denied.
+   *
    * The excluded permissions can be specified using the same syntax as
    * `denied_permissions`.
    * </pre>
@@ -414,8 +454,10 @@ public interface DenyRuleOrBuilder
    * The condition that determines whether this deny rule applies to a request.
    * If the condition expression evaluates to `true`, then the deny rule is
    * applied; otherwise, the deny rule is not applied.
+   *
    * Each deny rule is evaluated independently. If this deny rule does not apply
    * to a request, other deny rules might still apply.
+   *
    * The condition can use CEL functions that evaluate
    * [resource
    * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
@@ -434,8 +476,10 @@ public interface DenyRuleOrBuilder
    * The condition that determines whether this deny rule applies to a request.
    * If the condition expression evaluates to `true`, then the deny rule is
    * applied; otherwise, the deny rule is not applied.
+   *
    * Each deny rule is evaluated independently. If this deny rule does not apply
    * to a request, other deny rules might still apply.
+   *
    * The condition can use CEL functions that evaluate
    * [resource
    * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
@@ -454,8 +498,10 @@ public interface DenyRuleOrBuilder
    * The condition that determines whether this deny rule applies to a request.
    * If the condition expression evaluates to `true`, then the deny rule is
    * applied; otherwise, the deny rule is not applied.
+   *
    * Each deny rule is evaluated independently. If this deny rule does not apply
    * to a request, other deny rules might still apply.
+   *
    * The condition can use CEL functions that evaluate
    * [resource
    * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
diff --git a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/GetPolicyRequest.java b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/GetPolicyRequest.java
index 31ae9840b5..1f51e3a3e6 100644
--- a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/GetPolicyRequest.java
+++ b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/GetPolicyRequest.java
@@ -47,11 +47,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new GetPolicyRequest();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v2.PolicyProto.internal_static_google_iam_v2_GetPolicyRequest_descriptor;
   }
@@ -76,9 +71,12 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
    * <pre>
    * Required. The resource name of the policy to retrieve. Format:
    * `policies/{attachment_point}/denypolicies/{policy_id}`
+   *
+   *
    * Use the URL-encoded full resource name, which means that the forward-slash
    * character, `/`, must be written as `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
@@ -105,9 +103,12 @@ public java.lang.String getName() {
    * <pre>
    * Required. The resource name of the policy to retrieve. Format:
    * `policies/{attachment_point}/denypolicies/{policy_id}`
+   *
+   *
    * Use the URL-encoded full resource name, which means that the forward-slash
    * character, `/`, must be written as `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
@@ -366,39 +367,6 @@ private void buildPartial0(com.google.iam.v2.GetPolicyRequest result) {
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v2.GetPolicyRequest) {
@@ -474,9 +442,12 @@ public Builder mergeFrom(
      * <pre>
      * Required. The resource name of the policy to retrieve. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * Use the URL-encoded full resource name, which means that the forward-slash
      * character, `/`, must be written as `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -502,9 +473,12 @@ public java.lang.String getName() {
      * <pre>
      * Required. The resource name of the policy to retrieve. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * Use the URL-encoded full resource name, which means that the forward-slash
      * character, `/`, must be written as `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -530,9 +504,12 @@ public com.google.protobuf.ByteString getNameBytes() {
      * <pre>
      * Required. The resource name of the policy to retrieve. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * Use the URL-encoded full resource name, which means that the forward-slash
      * character, `/`, must be written as `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -557,9 +534,12 @@ public Builder setName(java.lang.String value) {
      * <pre>
      * Required. The resource name of the policy to retrieve. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * Use the URL-encoded full resource name, which means that the forward-slash
      * character, `/`, must be written as `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -580,9 +560,12 @@ public Builder clearName() {
      * <pre>
      * Required. The resource name of the policy to retrieve. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * Use the URL-encoded full resource name, which means that the forward-slash
      * character, `/`, must be written as `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
diff --git a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/GetPolicyRequestOrBuilder.java b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/GetPolicyRequestOrBuilder.java
index 6f293a3267..4756f85ed0 100644
--- a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/GetPolicyRequestOrBuilder.java
+++ b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/GetPolicyRequestOrBuilder.java
@@ -29,9 +29,12 @@ public interface GetPolicyRequestOrBuilder
    * <pre>
    * Required. The resource name of the policy to retrieve. Format:
    * `policies/{attachment_point}/denypolicies/{policy_id}`
+   *
+   *
    * Use the URL-encoded full resource name, which means that the forward-slash
    * character, `/`, must be written as `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
@@ -47,9 +50,12 @@ public interface GetPolicyRequestOrBuilder
    * <pre>
    * Required. The resource name of the policy to retrieve. Format:
    * `policies/{attachment_point}/denypolicies/{policy_id}`
+   *
+   *
    * Use the URL-encoded full resource name, which means that the forward-slash
    * character, `/`, must be written as `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
diff --git a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/ListPoliciesRequest.java b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/ListPoliciesRequest.java
index 42f23221d0..053058d820 100644
--- a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/ListPoliciesRequest.java
+++ b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/ListPoliciesRequest.java
@@ -48,11 +48,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new ListPoliciesRequest();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v2.PolicyProto
         .internal_static_google_iam_v2_ListPoliciesRequest_descriptor;
@@ -79,10 +74,13 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
    * Required. The resource that the policy is attached to, along with the kind of policy
    * to list. Format:
    * `policies/{attachment_point}/denypolicies`
+   *
+   *
    * The attachment point is identified by its URL-encoded full resource name,
    * which means that the forward-slash character, `/`, must be written as
    * `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
@@ -110,10 +108,13 @@ public java.lang.String getParent() {
    * Required. The resource that the policy is attached to, along with the kind of policy
    * to list. Format:
    * `policies/{attachment_point}/denypolicies`
+   *
+   *
    * The attachment point is identified by its URL-encoded full resource name,
    * which means that the forward-slash character, `/`, must be written as
    * `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
@@ -471,39 +472,6 @@ private void buildPartial0(com.google.iam.v2.ListPoliciesRequest result) {
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v2.ListPoliciesRequest) {
@@ -600,10 +568,13 @@ public Builder mergeFrom(
      * Required. The resource that the policy is attached to, along with the kind of policy
      * to list. Format:
      * `policies/{attachment_point}/denypolicies`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -630,10 +601,13 @@ public java.lang.String getParent() {
      * Required. The resource that the policy is attached to, along with the kind of policy
      * to list. Format:
      * `policies/{attachment_point}/denypolicies`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -660,10 +634,13 @@ public com.google.protobuf.ByteString getParentBytes() {
      * Required. The resource that the policy is attached to, along with the kind of policy
      * to list. Format:
      * `policies/{attachment_point}/denypolicies`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -689,10 +666,13 @@ public Builder setParent(java.lang.String value) {
      * Required. The resource that the policy is attached to, along with the kind of policy
      * to list. Format:
      * `policies/{attachment_point}/denypolicies`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -714,10 +694,13 @@ public Builder clearParent() {
      * Required. The resource that the policy is attached to, along with the kind of policy
      * to list. Format:
      * `policies/{attachment_point}/denypolicies`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
diff --git a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/ListPoliciesRequestOrBuilder.java b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/ListPoliciesRequestOrBuilder.java
index bfea871b46..45bde87af8 100644
--- a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/ListPoliciesRequestOrBuilder.java
+++ b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/ListPoliciesRequestOrBuilder.java
@@ -30,10 +30,13 @@ public interface ListPoliciesRequestOrBuilder
    * Required. The resource that the policy is attached to, along with the kind of policy
    * to list. Format:
    * `policies/{attachment_point}/denypolicies`
+   *
+   *
    * The attachment point is identified by its URL-encoded full resource name,
    * which means that the forward-slash character, `/`, must be written as
    * `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
@@ -50,10 +53,13 @@ public interface ListPoliciesRequestOrBuilder
    * Required. The resource that the policy is attached to, along with the kind of policy
    * to list. Format:
    * `policies/{attachment_point}/denypolicies`
+   *
+   *
    * The attachment point is identified by its URL-encoded full resource name,
    * which means that the forward-slash character, `/`, must be written as
    * `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
diff --git a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/ListPoliciesResponse.java b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/ListPoliciesResponse.java
index 85d5cf7b5d..0003d236d0 100644
--- a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/ListPoliciesResponse.java
+++ b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/ListPoliciesResponse.java
@@ -48,11 +48,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new ListPoliciesResponse();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v2.PolicyProto
         .internal_static_google_iam_v2_ListPoliciesResponse_descriptor;
@@ -461,39 +456,6 @@ private void buildPartial0(com.google.iam.v2.ListPoliciesResponse result) {
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v2.ListPoliciesResponse) {
diff --git a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/Policy.java b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/Policy.java
index 2c6ad8972b..7b4e45d901 100644
--- a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/Policy.java
+++ b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/Policy.java
@@ -53,11 +53,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new Policy();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v2.PolicyProto.internal_static_google_iam_v2_Policy_descriptor;
   }
@@ -91,10 +86,13 @@ protected com.google.protobuf.MapField internalGetMapField(int number) {
    * <pre>
    * Immutable. The resource name of the `Policy`, which must be unique. Format:
    * `policies/{attachment_point}/denypolicies/{policy_id}`
+   *
+   *
    * The attachment point is identified by its URL-encoded full resource name,
    * which means that the forward-slash character, `/`, must be written as
    * `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-deny-policy`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, requests can use the alphanumeric or the numeric ID.
    * Responses always contain the numeric ID.
@@ -122,10 +120,13 @@ public java.lang.String getName() {
    * <pre>
    * Immutable. The resource name of the `Policy`, which must be unique. Format:
    * `policies/{attachment_point}/denypolicies/{policy_id}`
+   *
+   *
    * The attachment point is identified by its URL-encoded full resource name,
    * which means that the forward-slash character, `/`, must be written as
    * `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-deny-policy`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, requests can use the alphanumeric or the numeric ID.
    * Responses always contain the numeric ID.
@@ -423,6 +424,7 @@ public java.lang.String getAnnotationsOrThrow(java.lang.String key) {
    * An opaque tag that identifies the current version of the `Policy`. IAM uses
    * this value to help manage concurrent updates, so they do not cause one
    * update to be overwritten by another.
+   *
    * If this field is present in a [CreatePolicy][] request, the value is
    * ignored.
    * </pre>
@@ -450,6 +452,7 @@ public java.lang.String getEtag() {
    * An opaque tag that identifies the current version of the `Policy`. IAM uses
    * this value to help manage concurrent updates, so they do not cause one
    * update to be overwritten by another.
+   *
    * If this field is present in a [CreatePolicy][] request, the value is
    * ignored.
    * </pre>
@@ -1183,39 +1186,6 @@ private void buildPartial0(com.google.iam.v2.Policy result) {
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v2.Policy) {
@@ -1426,10 +1396,13 @@ public Builder mergeFrom(
      * <pre>
      * Immutable. The resource name of the `Policy`, which must be unique. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-deny-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, requests can use the alphanumeric or the numeric ID.
      * Responses always contain the numeric ID.
@@ -1456,10 +1429,13 @@ public java.lang.String getName() {
      * <pre>
      * Immutable. The resource name of the `Policy`, which must be unique. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-deny-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, requests can use the alphanumeric or the numeric ID.
      * Responses always contain the numeric ID.
@@ -1486,10 +1462,13 @@ public com.google.protobuf.ByteString getNameBytes() {
      * <pre>
      * Immutable. The resource name of the `Policy`, which must be unique. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-deny-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, requests can use the alphanumeric or the numeric ID.
      * Responses always contain the numeric ID.
@@ -1515,10 +1494,13 @@ public Builder setName(java.lang.String value) {
      * <pre>
      * Immutable. The resource name of the `Policy`, which must be unique. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-deny-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, requests can use the alphanumeric or the numeric ID.
      * Responses always contain the numeric ID.
@@ -1540,10 +1522,13 @@ public Builder clearName() {
      * <pre>
      * Immutable. The resource name of the `Policy`, which must be unique. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-deny-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, requests can use the alphanumeric or the numeric ID.
      * Responses always contain the numeric ID.
@@ -2074,6 +2059,7 @@ public Builder putAllAnnotations(java.util.Map<java.lang.String, java.lang.Strin
      * An opaque tag that identifies the current version of the `Policy`. IAM uses
      * this value to help manage concurrent updates, so they do not cause one
      * update to be overwritten by another.
+     *
      * If this field is present in a [CreatePolicy][] request, the value is
      * ignored.
      * </pre>
@@ -2100,6 +2086,7 @@ public java.lang.String getEtag() {
      * An opaque tag that identifies the current version of the `Policy`. IAM uses
      * this value to help manage concurrent updates, so they do not cause one
      * update to be overwritten by another.
+     *
      * If this field is present in a [CreatePolicy][] request, the value is
      * ignored.
      * </pre>
@@ -2126,6 +2113,7 @@ public com.google.protobuf.ByteString getEtagBytes() {
      * An opaque tag that identifies the current version of the `Policy`. IAM uses
      * this value to help manage concurrent updates, so they do not cause one
      * update to be overwritten by another.
+     *
      * If this field is present in a [CreatePolicy][] request, the value is
      * ignored.
      * </pre>
@@ -2151,6 +2139,7 @@ public Builder setEtag(java.lang.String value) {
      * An opaque tag that identifies the current version of the `Policy`. IAM uses
      * this value to help manage concurrent updates, so they do not cause one
      * update to be overwritten by another.
+     *
      * If this field is present in a [CreatePolicy][] request, the value is
      * ignored.
      * </pre>
@@ -2172,6 +2161,7 @@ public Builder clearEtag() {
      * An opaque tag that identifies the current version of the `Policy`. IAM uses
      * this value to help manage concurrent updates, so they do not cause one
      * update to be overwritten by another.
+     *
      * If this field is present in a [CreatePolicy][] request, the value is
      * ignored.
      * </pre>
diff --git a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/PolicyOperationMetadata.java b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/PolicyOperationMetadata.java
index 15a04e7840..ba3e43f112 100644
--- a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/PolicyOperationMetadata.java
+++ b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/PolicyOperationMetadata.java
@@ -45,11 +45,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new PolicyOperationMetadata();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v2.PolicyProto
         .internal_static_google_iam_v2_PolicyOperationMetadata_descriptor;
@@ -360,39 +355,6 @@ private void buildPartial0(com.google.iam.v2.PolicyOperationMetadata result) {
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v2.PolicyOperationMetadata) {
diff --git a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/PolicyOrBuilder.java b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/PolicyOrBuilder.java
index 44e15c3d3b..8e87db6374 100644
--- a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/PolicyOrBuilder.java
+++ b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/PolicyOrBuilder.java
@@ -29,10 +29,13 @@ public interface PolicyOrBuilder
    * <pre>
    * Immutable. The resource name of the `Policy`, which must be unique. Format:
    * `policies/{attachment_point}/denypolicies/{policy_id}`
+   *
+   *
    * The attachment point is identified by its URL-encoded full resource name,
    * which means that the forward-slash character, `/`, must be written as
    * `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-deny-policy`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, requests can use the alphanumeric or the numeric ID.
    * Responses always contain the numeric ID.
@@ -49,10 +52,13 @@ public interface PolicyOrBuilder
    * <pre>
    * Immutable. The resource name of the `Policy`, which must be unique. Format:
    * `policies/{attachment_point}/denypolicies/{policy_id}`
+   *
+   *
    * The attachment point is identified by its URL-encoded full resource name,
    * which means that the forward-slash character, `/`, must be written as
    * `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-deny-policy`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, requests can use the alphanumeric or the numeric ID.
    * Responses always contain the numeric ID.
@@ -213,6 +219,7 @@ java.lang.String getAnnotationsOrDefault(
    * An opaque tag that identifies the current version of the `Policy`. IAM uses
    * this value to help manage concurrent updates, so they do not cause one
    * update to be overwritten by another.
+   *
    * If this field is present in a [CreatePolicy][] request, the value is
    * ignored.
    * </pre>
@@ -229,6 +236,7 @@ java.lang.String getAnnotationsOrDefault(
    * An opaque tag that identifies the current version of the `Policy`. IAM uses
    * this value to help manage concurrent updates, so they do not cause one
    * update to be overwritten by another.
+   *
    * If this field is present in a [CreatePolicy][] request, the value is
    * ignored.
    * </pre>
diff --git a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/PolicyProto.java b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/PolicyProto.java
index d7b59bfe2a..e8933f1a0c 100644
--- a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/PolicyProto.java
+++ b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/PolicyProto.java
@@ -81,58 +81,59 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
           + "e/api/client.proto\032\037google/api/field_beh"
           + "avior.proto\032\030google/iam/v2/deny.proto\032#g"
           + "oogle/longrunning/operations.proto\032\037goog"
-          + "le/protobuf/timestamp.proto\"\302\003\n\006Policy\022\021"
-          + "\n\004name\030\001 \001(\tB\003\340A\005\022\020\n\003uid\030\002 \001(\tB\003\340A\005\022\021\n\004k"
-          + "ind\030\003 \001(\tB\003\340A\003\022\024\n\014display_name\030\004 \001(\t\022;\n\013"
-          + "annotations\030\005 \003(\0132&.google.iam.v2.Policy"
-          + ".AnnotationsEntry\022\014\n\004etag\030\006 \001(\t\0224\n\013creat"
-          + "e_time\030\007 \001(\0132\032.google.protobuf.Timestamp"
-          + "B\003\340A\003\0224\n\013update_time\030\010 \001(\0132\032.google.prot"
-          + "obuf.TimestampB\003\340A\003\0224\n\013delete_time\030\t \001(\013"
-          + "2\032.google.protobuf.TimestampB\003\340A\003\022(\n\005rul"
-          + "es\030\n \003(\0132\031.google.iam.v2.PolicyRule\022\037\n\022m"
-          + "anaging_authority\030\013 \001(\tB\003\340A\005\0322\n\020Annotati"
-          + "onsEntry\022\013\n\003key\030\001 \001(\t\022\r\n\005value\030\002 \001(\t:\0028\001"
-          + "\"W\n\nPolicyRule\022,\n\tdeny_rule\030\002 \001(\0132\027.goog"
-          + "le.iam.v2.DenyRuleH\000\022\023\n\013description\030\001 \001("
-          + "\tB\006\n\004kind\"Q\n\023ListPoliciesRequest\022\023\n\006pare"
-          + "nt\030\001 \001(\tB\003\340A\002\022\021\n\tpage_size\030\002 \001(\005\022\022\n\npage"
-          + "_token\030\003 \001(\t\"X\n\024ListPoliciesResponse\022\'\n\010"
-          + "policies\030\001 \003(\0132\025.google.iam.v2.Policy\022\027\n"
-          + "\017next_page_token\030\002 \001(\t\"%\n\020GetPolicyReque"
-          + "st\022\021\n\004name\030\001 \001(\tB\003\340A\002\"i\n\023CreatePolicyReq"
-          + "uest\022\023\n\006parent\030\001 \001(\tB\003\340A\002\022*\n\006policy\030\002 \001("
-          + "\0132\025.google.iam.v2.PolicyB\003\340A\002\022\021\n\tpolicy_"
-          + "id\030\003 \001(\t\"A\n\023UpdatePolicyRequest\022*\n\006polic"
-          + "y\030\001 \001(\0132\025.google.iam.v2.PolicyB\003\340A\002\";\n\023D"
-          + "eletePolicyRequest\022\021\n\004name\030\001 \001(\tB\003\340A\002\022\021\n"
-          + "\004etag\030\002 \001(\tB\003\340A\001\"J\n\027PolicyOperationMetad"
-          + "ata\022/\n\013create_time\030\001 \001(\0132\032.google.protob"
-          + "uf.Timestamp2\320\006\n\010Policies\022\203\001\n\014ListPolici"
-          + "es\022\".google.iam.v2.ListPoliciesRequest\032#"
-          + ".google.iam.v2.ListPoliciesResponse\"*\202\323\344"
-          + "\223\002\033\022\031/v2/{parent=policies/*/*}\332A\006parent\022"
-          + "m\n\tGetPolicy\022\037.google.iam.v2.GetPolicyRe"
-          + "quest\032\025.google.iam.v2.Policy\"(\202\323\344\223\002\033\022\031/v"
-          + "2/{name=policies/*/*/*}\332A\004name\022\272\001\n\014Creat"
-          + "ePolicy\022\".google.iam.v2.CreatePolicyRequ"
-          + "est\032\035.google.longrunning.Operation\"g\202\323\344\223"
-          + "\002#\"\031/v2/{parent=policies/*/*}:\006policy\332A\027"
-          + "parent,policy,policy_id\312A!\n\006Policy\022\027Poli"
-          + "cyOperationMetadata\022\247\001\n\014UpdatePolicy\022\".g"
-          + "oogle.iam.v2.UpdatePolicyRequest\032\035.googl"
-          + "e.longrunning.Operation\"T\202\323\344\223\002*\032 /v2/{po"
-          + "licy.name=policies/*/*/*}:\006policy\312A!\n\006Po"
-          + "licy\022\027PolicyOperationMetadata\022\237\001\n\014Delete"
-          + "Policy\022\".google.iam.v2.DeletePolicyReque"
-          + "st\032\035.google.longrunning.Operation\"L\202\323\344\223\002"
-          + "\033*\031/v2/{name=policies/*/*/*}\332A\004name\312A!\n\006"
-          + "Policy\022\027PolicyOperationMetadata\032F\312A\022iam."
-          + "googleapis.com\322A.https://www.googleapis."
-          + "com/auth/cloud-platformBy\n\021com.google.ia"
-          + "m.v2B\013PolicyProtoP\001Z)cloud.google.com/go"
-          + "/iam/apiv2/iampb;iampb\252\002\023Google.Cloud.Ia"
-          + "m.V2\312\002\023Google\\Cloud\\Iam\\V2b\006proto3"
+          + "le/protobuf/timestamp.proto\"\311\003\n\006Policy\022\022"
+          + "\n\004name\030\001 \001(\tB\004\342A\001\005\022\021\n\003uid\030\002 \001(\tB\004\342A\001\005\022\022\n"
+          + "\004kind\030\003 \001(\tB\004\342A\001\003\022\024\n\014display_name\030\004 \001(\t\022"
+          + ";\n\013annotations\030\005 \003(\0132&.google.iam.v2.Pol"
+          + "icy.AnnotationsEntry\022\014\n\004etag\030\006 \001(\t\0225\n\013cr"
+          + "eate_time\030\007 \001(\0132\032.google.protobuf.Timest"
+          + "ampB\004\342A\001\003\0225\n\013update_time\030\010 \001(\0132\032.google."
+          + "protobuf.TimestampB\004\342A\001\003\0225\n\013delete_time\030"
+          + "\t \001(\0132\032.google.protobuf.TimestampB\004\342A\001\003\022"
+          + "(\n\005rules\030\n \003(\0132\031.google.iam.v2.PolicyRul"
+          + "e\022 \n\022managing_authority\030\013 \001(\tB\004\342A\001\005\0322\n\020A"
+          + "nnotationsEntry\022\013\n\003key\030\001 \001(\t\022\r\n\005value\030\002 "
+          + "\001(\t:\0028\001\"W\n\nPolicyRule\022,\n\tdeny_rule\030\002 \001(\013"
+          + "2\027.google.iam.v2.DenyRuleH\000\022\023\n\013descripti"
+          + "on\030\001 \001(\tB\006\n\004kind\"R\n\023ListPoliciesRequest\022"
+          + "\024\n\006parent\030\001 \001(\tB\004\342A\001\002\022\021\n\tpage_size\030\002 \001(\005"
+          + "\022\022\n\npage_token\030\003 \001(\t\"X\n\024ListPoliciesResp"
+          + "onse\022\'\n\010policies\030\001 \003(\0132\025.google.iam.v2.P"
+          + "olicy\022\027\n\017next_page_token\030\002 \001(\t\"&\n\020GetPol"
+          + "icyRequest\022\022\n\004name\030\001 \001(\tB\004\342A\001\002\"k\n\023Create"
+          + "PolicyRequest\022\024\n\006parent\030\001 \001(\tB\004\342A\001\002\022+\n\006p"
+          + "olicy\030\002 \001(\0132\025.google.iam.v2.PolicyB\004\342A\001\002"
+          + "\022\021\n\tpolicy_id\030\003 \001(\t\"B\n\023UpdatePolicyReque"
+          + "st\022+\n\006policy\030\001 \001(\0132\025.google.iam.v2.Polic"
+          + "yB\004\342A\001\002\"=\n\023DeletePolicyRequest\022\022\n\004name\030\001"
+          + " \001(\tB\004\342A\001\002\022\022\n\004etag\030\002 \001(\tB\004\342A\001\001\"J\n\027Policy"
+          + "OperationMetadata\022/\n\013create_time\030\001 \001(\0132\032"
+          + ".google.protobuf.Timestamp2\320\006\n\010Policies\022"
+          + "\203\001\n\014ListPolicies\022\".google.iam.v2.ListPol"
+          + "iciesRequest\032#.google.iam.v2.ListPolicie"
+          + "sResponse\"*\332A\006parent\202\323\344\223\002\033\022\031/v2/{parent="
+          + "policies/*/*}\022m\n\tGetPolicy\022\037.google.iam."
+          + "v2.GetPolicyRequest\032\025.google.iam.v2.Poli"
+          + "cy\"(\332A\004name\202\323\344\223\002\033\022\031/v2/{name=policies/*/"
+          + "*/*}\022\272\001\n\014CreatePolicy\022\".google.iam.v2.Cr"
+          + "eatePolicyRequest\032\035.google.longrunning.O"
+          + "peration\"g\312A!\n\006Policy\022\027PolicyOperationMe"
+          + "tadata\332A\027parent,policy,policy_id\202\323\344\223\002#\"\031"
+          + "/v2/{parent=policies/*/*}:\006policy\022\247\001\n\014Up"
+          + "datePolicy\022\".google.iam.v2.UpdatePolicyR"
+          + "equest\032\035.google.longrunning.Operation\"T\312"
+          + "A!\n\006Policy\022\027PolicyOperationMetadata\202\323\344\223\002"
+          + "*\032 /v2/{policy.name=policies/*/*/*}:\006pol"
+          + "icy\022\237\001\n\014DeletePolicy\022\".google.iam.v2.Del"
+          + "etePolicyRequest\032\035.google.longrunning.Op"
+          + "eration\"L\312A!\n\006Policy\022\027PolicyOperationMet"
+          + "adata\332A\004name\202\323\344\223\002\033*\031/v2/{name=policies/*"
+          + "/*/*}\032F\312A\022iam.googleapis.com\322A.https://w"
+          + "ww.googleapis.com/auth/cloud-platformBy\n"
+          + "\021com.google.iam.v2B\013PolicyProtoP\001Z)cloud"
+          + ".google.com/go/iam/apiv2/iampb;iampb\252\002\023G"
+          + "oogle.Cloud.Iam.V2\312\002\023Google\\Cloud\\Iam\\V2"
+          + "b\006proto3"
     };
     descriptor =
         com.google.protobuf.Descriptors.FileDescriptor.internalBuildGeneratedFileFrom(
diff --git a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/PolicyRule.java b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/PolicyRule.java
index 9e842ab3f1..8de7d2eb9b 100644
--- a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/PolicyRule.java
+++ b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/PolicyRule.java
@@ -47,11 +47,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new PolicyRule();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v2.PolicyProto.internal_static_google_iam_v2_PolicyRule_descriptor;
   }
@@ -65,6 +60,8 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
   }
 
   private int kindCase_ = 0;
+
+  @SuppressWarnings("serial")
   private java.lang.Object kind_;
 
   public enum KindCase
@@ -484,39 +481,6 @@ private void buildPartialOneofs(com.google.iam.v2.PolicyRule result) {
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v2.PolicyRule) {
diff --git a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/PolicyRuleOrBuilder.java b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/PolicyRuleOrBuilder.java
index 712ec0723f..d3c32e76c7 100644
--- a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/PolicyRuleOrBuilder.java
+++ b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/PolicyRuleOrBuilder.java
@@ -85,5 +85,5 @@ public interface PolicyRuleOrBuilder
    */
   com.google.protobuf.ByteString getDescriptionBytes();
 
-  public com.google.iam.v2.PolicyRule.KindCase getKindCase();
+  com.google.iam.v2.PolicyRule.KindCase getKindCase();
 }
diff --git a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/UpdatePolicyRequest.java b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/UpdatePolicyRequest.java
index bc506e2671..cc7bdd8393 100644
--- a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/UpdatePolicyRequest.java
+++ b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/UpdatePolicyRequest.java
@@ -45,11 +45,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new UpdatePolicyRequest();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v2.PolicyProto
         .internal_static_google_iam_v2_UpdatePolicyRequest_descriptor;
@@ -72,6 +67,7 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
    *
    * <pre>
    * Required. The policy to update.
+   *
    * To prevent conflicting updates, the `etag` value must match the value that
    * is stored in IAM. If the `etag` values do not match, the request fails with
    * a `409` error code and `ABORTED` status.
@@ -90,6 +86,7 @@ public boolean hasPolicy() {
    *
    * <pre>
    * Required. The policy to update.
+   *
    * To prevent conflicting updates, the `etag` value must match the value that
    * is stored in IAM. If the `etag` values do not match, the request fails with
    * a `409` error code and `ABORTED` status.
@@ -108,6 +105,7 @@ public com.google.iam.v2.Policy getPolicy() {
    *
    * <pre>
    * Required. The policy to update.
+   *
    * To prevent conflicting updates, the `etag` value must match the value that
    * is stored in IAM. If the `etag` values do not match, the request fails with
    * a `409` error code and `ABORTED` status.
@@ -367,39 +365,6 @@ private void buildPartial0(com.google.iam.v2.UpdatePolicyRequest result) {
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v2.UpdatePolicyRequest) {
@@ -477,6 +442,7 @@ public Builder mergeFrom(
      *
      * <pre>
      * Required. The policy to update.
+     *
      * To prevent conflicting updates, the `etag` value must match the value that
      * is stored in IAM. If the `etag` values do not match, the request fails with
      * a `409` error code and `ABORTED` status.
@@ -494,6 +460,7 @@ public boolean hasPolicy() {
      *
      * <pre>
      * Required. The policy to update.
+     *
      * To prevent conflicting updates, the `etag` value must match the value that
      * is stored in IAM. If the `etag` values do not match, the request fails with
      * a `409` error code and `ABORTED` status.
@@ -515,6 +482,7 @@ public com.google.iam.v2.Policy getPolicy() {
      *
      * <pre>
      * Required. The policy to update.
+     *
      * To prevent conflicting updates, the `etag` value must match the value that
      * is stored in IAM. If the `etag` values do not match, the request fails with
      * a `409` error code and `ABORTED` status.
@@ -540,6 +508,7 @@ public Builder setPolicy(com.google.iam.v2.Policy value) {
      *
      * <pre>
      * Required. The policy to update.
+     *
      * To prevent conflicting updates, the `etag` value must match the value that
      * is stored in IAM. If the `etag` values do not match, the request fails with
      * a `409` error code and `ABORTED` status.
@@ -562,6 +531,7 @@ public Builder setPolicy(com.google.iam.v2.Policy.Builder builderForValue) {
      *
      * <pre>
      * Required. The policy to update.
+     *
      * To prevent conflicting updates, the `etag` value must match the value that
      * is stored in IAM. If the `etag` values do not match, the request fails with
      * a `409` error code and `ABORTED` status.
@@ -590,6 +560,7 @@ public Builder mergePolicy(com.google.iam.v2.Policy value) {
      *
      * <pre>
      * Required. The policy to update.
+     *
      * To prevent conflicting updates, the `etag` value must match the value that
      * is stored in IAM. If the `etag` values do not match, the request fails with
      * a `409` error code and `ABORTED` status.
@@ -612,6 +583,7 @@ public Builder clearPolicy() {
      *
      * <pre>
      * Required. The policy to update.
+     *
      * To prevent conflicting updates, the `etag` value must match the value that
      * is stored in IAM. If the `etag` values do not match, the request fails with
      * a `409` error code and `ABORTED` status.
@@ -629,6 +601,7 @@ public com.google.iam.v2.Policy.Builder getPolicyBuilder() {
      *
      * <pre>
      * Required. The policy to update.
+     *
      * To prevent conflicting updates, the `etag` value must match the value that
      * is stored in IAM. If the `etag` values do not match, the request fails with
      * a `409` error code and `ABORTED` status.
@@ -648,6 +621,7 @@ public com.google.iam.v2.PolicyOrBuilder getPolicyOrBuilder() {
      *
      * <pre>
      * Required. The policy to update.
+     *
      * To prevent conflicting updates, the `etag` value must match the value that
      * is stored in IAM. If the `etag` values do not match, the request fails with
      * a `409` error code and `ABORTED` status.
diff --git a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/UpdatePolicyRequestOrBuilder.java b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/UpdatePolicyRequestOrBuilder.java
index fa20ec03d5..3a26ee64ee 100644
--- a/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/UpdatePolicyRequestOrBuilder.java
+++ b/java-iam/proto-google-iam-v2/src/main/java/com/google/iam/v2/UpdatePolicyRequestOrBuilder.java
@@ -28,6 +28,7 @@ public interface UpdatePolicyRequestOrBuilder
    *
    * <pre>
    * Required. The policy to update.
+   *
    * To prevent conflicting updates, the `etag` value must match the value that
    * is stored in IAM. If the `etag` values do not match, the request fails with
    * a `409` error code and `ABORTED` status.
@@ -43,6 +44,7 @@ public interface UpdatePolicyRequestOrBuilder
    *
    * <pre>
    * Required. The policy to update.
+   *
    * To prevent conflicting updates, the `etag` value must match the value that
    * is stored in IAM. If the `etag` values do not match, the request fails with
    * a `409` error code and `ABORTED` status.
@@ -58,6 +60,7 @@ public interface UpdatePolicyRequestOrBuilder
    *
    * <pre>
    * Required. The policy to update.
+   *
    * To prevent conflicting updates, the `etag` value must match the value that
    * is stored in IAM. If the `etag` values do not match, the request fails with
    * a `409` error code and `ABORTED` status.
diff --git a/java-iam/proto-google-iam-v2beta/clirr-ignored-differences.xml b/java-iam/proto-google-iam-v2beta/clirr-ignored-differences.xml
index 136c027be8..7c7553c4b6 100644
--- a/java-iam/proto-google-iam-v2beta/clirr-ignored-differences.xml
+++ b/java-iam/proto-google-iam-v2beta/clirr-ignored-differences.xml
@@ -1,6 +1,36 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!-- see http://www.mojohaus.org/clirr-maven-plugin/examples/ignored-differences.html -->
 <differences>
+  <difference>
+    <differenceType>7002</differenceType>
+    <className>com/google/iam/v2beta/*Builder</className>
+    <method>* addRepeatedField(*)</method>
+  </difference>
+  <difference>
+    <differenceType>7002</differenceType>
+    <className>com/google/iam/v2beta/*Builder</className>
+    <method>* clearField(*)</method>
+  </difference>
+  <difference>
+    <differenceType>7002</differenceType>
+    <className>com/google/iam/v2beta/*Builder</className>
+    <method>* clearOneof(*)</method>
+  </difference>
+  <difference>
+    <differenceType>7002</differenceType>
+    <className>com/google/iam/v2beta/*Builder</className>
+    <method>* clone()</method>
+  </difference>
+  <difference>
+    <differenceType>7002</differenceType>
+    <className>com/google/iam/v2beta/*Builder</className>
+    <method>* setField(*)</method>
+  </difference>
+  <difference>
+    <differenceType>7002</differenceType>
+    <className>com/google/iam/v2beta/*Builder</className>
+    <method>* setRepeatedField(*)</method>
+  </difference>
   <difference>
     <differenceType>7012</differenceType>
     <className>com/google/iam/v2beta/*OrBuilder</className>
diff --git a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/CreatePolicyRequest.java b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/CreatePolicyRequest.java
index 370189917a..65f5f6cda6 100644
--- a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/CreatePolicyRequest.java
+++ b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/CreatePolicyRequest.java
@@ -48,11 +48,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new CreatePolicyRequest();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v2beta.PolicyProto
         .internal_static_google_iam_v2beta_CreatePolicyRequest_descriptor;
@@ -78,10 +73,13 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
    * <pre>
    * Required. The resource that the policy is attached to, along with the kind of policy
    * to create. Format: `policies/{attachment_point}/denypolicies`
+   *
+   *
    * The attachment point is identified by its URL-encoded full resource name,
    * which means that the forward-slash character, `/`, must be written as
    * `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
@@ -108,10 +106,13 @@ public java.lang.String getParent() {
    * <pre>
    * Required. The resource that the policy is attached to, along with the kind of policy
    * to create. Format: `policies/{attachment_point}/denypolicies`
+   *
+   *
    * The attachment point is identified by its URL-encoded full resource name,
    * which means that the forward-slash character, `/`, must be written as
    * `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
@@ -511,39 +512,6 @@ private void buildPartial0(com.google.iam.v2beta.CreatePolicyRequest result) {
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v2beta.CreatePolicyRequest) {
@@ -639,10 +607,13 @@ public Builder mergeFrom(
      * <pre>
      * Required. The resource that the policy is attached to, along with the kind of policy
      * to create. Format: `policies/{attachment_point}/denypolicies`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -668,10 +639,13 @@ public java.lang.String getParent() {
      * <pre>
      * Required. The resource that the policy is attached to, along with the kind of policy
      * to create. Format: `policies/{attachment_point}/denypolicies`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -697,10 +671,13 @@ public com.google.protobuf.ByteString getParentBytes() {
      * <pre>
      * Required. The resource that the policy is attached to, along with the kind of policy
      * to create. Format: `policies/{attachment_point}/denypolicies`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -725,10 +702,13 @@ public Builder setParent(java.lang.String value) {
      * <pre>
      * Required. The resource that the policy is attached to, along with the kind of policy
      * to create. Format: `policies/{attachment_point}/denypolicies`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -749,10 +729,13 @@ public Builder clearParent() {
      * <pre>
      * Required. The resource that the policy is attached to, along with the kind of policy
      * to create. Format: `policies/{attachment_point}/denypolicies`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
diff --git a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/CreatePolicyRequestOrBuilder.java b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/CreatePolicyRequestOrBuilder.java
index 24c4fc2fb6..51a7e57106 100644
--- a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/CreatePolicyRequestOrBuilder.java
+++ b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/CreatePolicyRequestOrBuilder.java
@@ -29,10 +29,13 @@ public interface CreatePolicyRequestOrBuilder
    * <pre>
    * Required. The resource that the policy is attached to, along with the kind of policy
    * to create. Format: `policies/{attachment_point}/denypolicies`
+   *
+   *
    * The attachment point is identified by its URL-encoded full resource name,
    * which means that the forward-slash character, `/`, must be written as
    * `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
@@ -48,10 +51,13 @@ public interface CreatePolicyRequestOrBuilder
    * <pre>
    * Required. The resource that the policy is attached to, along with the kind of policy
    * to create. Format: `policies/{attachment_point}/denypolicies`
+   *
+   *
    * The attachment point is identified by its URL-encoded full resource name,
    * which means that the forward-slash character, `/`, must be written as
    * `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
diff --git a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/DeletePolicyRequest.java b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/DeletePolicyRequest.java
index 9eae189aef..d9a1ca0ad5 100644
--- a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/DeletePolicyRequest.java
+++ b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/DeletePolicyRequest.java
@@ -48,11 +48,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new DeletePolicyRequest();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v2beta.PolicyProto
         .internal_static_google_iam_v2beta_DeletePolicyRequest_descriptor;
@@ -78,9 +73,12 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
    * <pre>
    * Required. The resource name of the policy to delete. Format:
    * `policies/{attachment_point}/denypolicies/{policy_id}`
+   *
+   *
    * Use the URL-encoded full resource name, which means that the forward-slash
    * character, `/`, must be written as `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
@@ -107,9 +105,12 @@ public java.lang.String getName() {
    * <pre>
    * Required. The resource name of the policy to delete. Format:
    * `policies/{attachment_point}/denypolicies/{policy_id}`
+   *
+   *
    * Use the URL-encoded full resource name, which means that the forward-slash
    * character, `/`, must be written as `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
@@ -142,6 +143,7 @@ public com.google.protobuf.ByteString getNameBytes() {
    * Optional. The expected `etag` of the policy to delete. If the value does not match
    * the value that is stored in IAM, the request fails with a `409` error code
    * and `ABORTED` status.
+   *
    * If you omit this field, the policy is deleted regardless of its current
    * `etag`.
    * </pre>
@@ -169,6 +171,7 @@ public java.lang.String getEtag() {
    * Optional. The expected `etag` of the policy to delete. If the value does not match
    * the value that is stored in IAM, the request fails with a `409` error code
    * and `ABORTED` status.
+   *
    * If you omit this field, the policy is deleted regardless of its current
    * `etag`.
    * </pre>
@@ -443,39 +446,6 @@ private void buildPartial0(com.google.iam.v2beta.DeletePolicyRequest result) {
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v2beta.DeletePolicyRequest) {
@@ -562,9 +532,12 @@ public Builder mergeFrom(
      * <pre>
      * Required. The resource name of the policy to delete. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * Use the URL-encoded full resource name, which means that the forward-slash
      * character, `/`, must be written as `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -590,9 +563,12 @@ public java.lang.String getName() {
      * <pre>
      * Required. The resource name of the policy to delete. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * Use the URL-encoded full resource name, which means that the forward-slash
      * character, `/`, must be written as `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -618,9 +594,12 @@ public com.google.protobuf.ByteString getNameBytes() {
      * <pre>
      * Required. The resource name of the policy to delete. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * Use the URL-encoded full resource name, which means that the forward-slash
      * character, `/`, must be written as `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -645,9 +624,12 @@ public Builder setName(java.lang.String value) {
      * <pre>
      * Required. The resource name of the policy to delete. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * Use the URL-encoded full resource name, which means that the forward-slash
      * character, `/`, must be written as `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -668,9 +650,12 @@ public Builder clearName() {
      * <pre>
      * Required. The resource name of the policy to delete. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * Use the URL-encoded full resource name, which means that the forward-slash
      * character, `/`, must be written as `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -699,6 +684,7 @@ public Builder setNameBytes(com.google.protobuf.ByteString value) {
      * Optional. The expected `etag` of the policy to delete. If the value does not match
      * the value that is stored in IAM, the request fails with a `409` error code
      * and `ABORTED` status.
+     *
      * If you omit this field, the policy is deleted regardless of its current
      * `etag`.
      * </pre>
@@ -725,6 +711,7 @@ public java.lang.String getEtag() {
      * Optional. The expected `etag` of the policy to delete. If the value does not match
      * the value that is stored in IAM, the request fails with a `409` error code
      * and `ABORTED` status.
+     *
      * If you omit this field, the policy is deleted regardless of its current
      * `etag`.
      * </pre>
@@ -751,6 +738,7 @@ public com.google.protobuf.ByteString getEtagBytes() {
      * Optional. The expected `etag` of the policy to delete. If the value does not match
      * the value that is stored in IAM, the request fails with a `409` error code
      * and `ABORTED` status.
+     *
      * If you omit this field, the policy is deleted regardless of its current
      * `etag`.
      * </pre>
@@ -776,6 +764,7 @@ public Builder setEtag(java.lang.String value) {
      * Optional. The expected `etag` of the policy to delete. If the value does not match
      * the value that is stored in IAM, the request fails with a `409` error code
      * and `ABORTED` status.
+     *
      * If you omit this field, the policy is deleted regardless of its current
      * `etag`.
      * </pre>
@@ -797,6 +786,7 @@ public Builder clearEtag() {
      * Optional. The expected `etag` of the policy to delete. If the value does not match
      * the value that is stored in IAM, the request fails with a `409` error code
      * and `ABORTED` status.
+     *
      * If you omit this field, the policy is deleted regardless of its current
      * `etag`.
      * </pre>
diff --git a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/DeletePolicyRequestOrBuilder.java b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/DeletePolicyRequestOrBuilder.java
index 1b19529885..101572706d 100644
--- a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/DeletePolicyRequestOrBuilder.java
+++ b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/DeletePolicyRequestOrBuilder.java
@@ -29,9 +29,12 @@ public interface DeletePolicyRequestOrBuilder
    * <pre>
    * Required. The resource name of the policy to delete. Format:
    * `policies/{attachment_point}/denypolicies/{policy_id}`
+   *
+   *
    * Use the URL-encoded full resource name, which means that the forward-slash
    * character, `/`, must be written as `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
@@ -47,9 +50,12 @@ public interface DeletePolicyRequestOrBuilder
    * <pre>
    * Required. The resource name of the policy to delete. Format:
    * `policies/{attachment_point}/denypolicies/{policy_id}`
+   *
+   *
    * Use the URL-encoded full resource name, which means that the forward-slash
    * character, `/`, must be written as `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
@@ -67,6 +73,7 @@ public interface DeletePolicyRequestOrBuilder
    * Optional. The expected `etag` of the policy to delete. If the value does not match
    * the value that is stored in IAM, the request fails with a `409` error code
    * and `ABORTED` status.
+   *
    * If you omit this field, the policy is deleted regardless of its current
    * `etag`.
    * </pre>
@@ -83,6 +90,7 @@ public interface DeletePolicyRequestOrBuilder
    * Optional. The expected `etag` of the policy to delete. If the value does not match
    * the value that is stored in IAM, the request fails with a `409` error code
    * and `ABORTED` status.
+   *
    * If you omit this field, the policy is deleted regardless of its current
    * `etag`.
    * </pre>
diff --git a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/DenyRule.java b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/DenyRule.java
index 2d2a3b6363..2763ff66f0 100644
--- a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/DenyRule.java
+++ b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/DenyRule.java
@@ -38,10 +38,10 @@ private DenyRule(com.google.protobuf.GeneratedMessageV3.Builder<?> builder) {
   }
 
   private DenyRule() {
-    deniedPrincipals_ = com.google.protobuf.LazyStringArrayList.EMPTY;
-    exceptionPrincipals_ = com.google.protobuf.LazyStringArrayList.EMPTY;
-    deniedPermissions_ = com.google.protobuf.LazyStringArrayList.EMPTY;
-    exceptionPermissions_ = com.google.protobuf.LazyStringArrayList.EMPTY;
+    deniedPrincipals_ = com.google.protobuf.LazyStringArrayList.emptyList();
+    exceptionPrincipals_ = com.google.protobuf.LazyStringArrayList.emptyList();
+    deniedPermissions_ = com.google.protobuf.LazyStringArrayList.emptyList();
+    exceptionPermissions_ = com.google.protobuf.LazyStringArrayList.emptyList();
   }
 
   @java.lang.Override
@@ -50,11 +50,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new DenyRule();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v2beta.DenyRuleProto
         .internal_static_google_iam_v2beta_DenyRule_descriptor;
@@ -72,39 +67,48 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
   public static final int DENIED_PRINCIPALS_FIELD_NUMBER = 1;
 
   @SuppressWarnings("serial")
-  private com.google.protobuf.LazyStringList deniedPrincipals_;
+  private com.google.protobuf.LazyStringArrayList deniedPrincipals_ =
+      com.google.protobuf.LazyStringArrayList.emptyList();
   /**
    *
    *
    * <pre>
    * The identities that are prevented from using one or more permissions on
    * Google Cloud resources. This field can contain the following values:
+   *
    * * `principalSet://goog/public:all`: A special identifier that represents
    *   any principal that is on the internet, even if they do not have a Google
    *   Account or are not logged in.
+   *
    * * `principal://goog/subject/{email_id}`: A specific Google Account.
    *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
    *   example, `principal://goog/subject/alice&#64;example.com`.
+   *
    * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
    *   Google Account that was deleted recently. For example,
    *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
    *   the Google Account is recovered, this identifier reverts to the standard
    *   identifier for a Google Account.
+   *
    * * `principalSet://goog/group/{group_id}`: A Google group. For example,
    *   `principalSet://goog/group/admins&#64;example.com`.
+   *
    * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
    *   that was deleted recently. For example,
    *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
    *   the Google group is restored, this identifier reverts to the standard
    *   identifier for a Google group.
+   *
    * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
    *   A Google Cloud service account. For example,
    *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+   *
    * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
    *   A Google Cloud service account that was deleted recently. For example,
    *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
    *   If the service account is undeleted, this identifier reverts to the
    *   standard identifier for a service account.
+   *
    * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
    *   principals associated with the specified Google Workspace or Cloud
    *   Identity customer ID. For example,
@@ -124,32 +128,40 @@ public com.google.protobuf.ProtocolStringList getDeniedPrincipalsList() {
    * <pre>
    * The identities that are prevented from using one or more permissions on
    * Google Cloud resources. This field can contain the following values:
+   *
    * * `principalSet://goog/public:all`: A special identifier that represents
    *   any principal that is on the internet, even if they do not have a Google
    *   Account or are not logged in.
+   *
    * * `principal://goog/subject/{email_id}`: A specific Google Account.
    *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
    *   example, `principal://goog/subject/alice&#64;example.com`.
+   *
    * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
    *   Google Account that was deleted recently. For example,
    *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
    *   the Google Account is recovered, this identifier reverts to the standard
    *   identifier for a Google Account.
+   *
    * * `principalSet://goog/group/{group_id}`: A Google group. For example,
    *   `principalSet://goog/group/admins&#64;example.com`.
+   *
    * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
    *   that was deleted recently. For example,
    *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
    *   the Google group is restored, this identifier reverts to the standard
    *   identifier for a Google group.
+   *
    * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
    *   A Google Cloud service account. For example,
    *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+   *
    * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
    *   A Google Cloud service account that was deleted recently. For example,
    *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
    *   If the service account is undeleted, this identifier reverts to the
    *   standard identifier for a service account.
+   *
    * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
    *   principals associated with the specified Google Workspace or Cloud
    *   Identity customer ID. For example,
@@ -169,32 +181,40 @@ public int getDeniedPrincipalsCount() {
    * <pre>
    * The identities that are prevented from using one or more permissions on
    * Google Cloud resources. This field can contain the following values:
+   *
    * * `principalSet://goog/public:all`: A special identifier that represents
    *   any principal that is on the internet, even if they do not have a Google
    *   Account or are not logged in.
+   *
    * * `principal://goog/subject/{email_id}`: A specific Google Account.
    *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
    *   example, `principal://goog/subject/alice&#64;example.com`.
+   *
    * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
    *   Google Account that was deleted recently. For example,
    *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
    *   the Google Account is recovered, this identifier reverts to the standard
    *   identifier for a Google Account.
+   *
    * * `principalSet://goog/group/{group_id}`: A Google group. For example,
    *   `principalSet://goog/group/admins&#64;example.com`.
+   *
    * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
    *   that was deleted recently. For example,
    *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
    *   the Google group is restored, this identifier reverts to the standard
    *   identifier for a Google group.
+   *
    * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
    *   A Google Cloud service account. For example,
    *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+   *
    * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
    *   A Google Cloud service account that was deleted recently. For example,
    *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
    *   If the service account is undeleted, this identifier reverts to the
    *   standard identifier for a service account.
+   *
    * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
    *   principals associated with the specified Google Workspace or Cloud
    *   Identity customer ID. For example,
@@ -215,32 +235,40 @@ public java.lang.String getDeniedPrincipals(int index) {
    * <pre>
    * The identities that are prevented from using one or more permissions on
    * Google Cloud resources. This field can contain the following values:
+   *
    * * `principalSet://goog/public:all`: A special identifier that represents
    *   any principal that is on the internet, even if they do not have a Google
    *   Account or are not logged in.
+   *
    * * `principal://goog/subject/{email_id}`: A specific Google Account.
    *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
    *   example, `principal://goog/subject/alice&#64;example.com`.
+   *
    * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
    *   Google Account that was deleted recently. For example,
    *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
    *   the Google Account is recovered, this identifier reverts to the standard
    *   identifier for a Google Account.
+   *
    * * `principalSet://goog/group/{group_id}`: A Google group. For example,
    *   `principalSet://goog/group/admins&#64;example.com`.
+   *
    * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
    *   that was deleted recently. For example,
    *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
    *   the Google group is restored, this identifier reverts to the standard
    *   identifier for a Google group.
+   *
    * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
    *   A Google Cloud service account. For example,
    *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+   *
    * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
    *   A Google Cloud service account that was deleted recently. For example,
    *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
    *   If the service account is undeleted, this identifier reverts to the
    *   standard identifier for a service account.
+   *
    * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
    *   principals associated with the specified Google Workspace or Cloud
    *   Identity customer ID. For example,
@@ -259,7 +287,8 @@ public com.google.protobuf.ByteString getDeniedPrincipalsBytes(int index) {
   public static final int EXCEPTION_PRINCIPALS_FIELD_NUMBER = 2;
 
   @SuppressWarnings("serial")
-  private com.google.protobuf.LazyStringList exceptionPrincipals_;
+  private com.google.protobuf.LazyStringArrayList exceptionPrincipals_ =
+      com.google.protobuf.LazyStringArrayList.emptyList();
   /**
    *
    *
@@ -268,6 +297,7 @@ public com.google.protobuf.ByteString getDeniedPrincipalsBytes(int index) {
    * listed in the `denied_principals`. For example, you could add a Google
    * group to the `denied_principals`, then exclude specific users who belong to
    * that group.
+   *
    * This field can contain the same values as the `denied_principals` field,
    * excluding `principalSet://goog/public:all`, which represents all users on
    * the internet.
@@ -288,6 +318,7 @@ public com.google.protobuf.ProtocolStringList getExceptionPrincipalsList() {
    * listed in the `denied_principals`. For example, you could add a Google
    * group to the `denied_principals`, then exclude specific users who belong to
    * that group.
+   *
    * This field can contain the same values as the `denied_principals` field,
    * excluding `principalSet://goog/public:all`, which represents all users on
    * the internet.
@@ -308,6 +339,7 @@ public int getExceptionPrincipalsCount() {
    * listed in the `denied_principals`. For example, you could add a Google
    * group to the `denied_principals`, then exclude specific users who belong to
    * that group.
+   *
    * This field can contain the same values as the `denied_principals` field,
    * excluding `principalSet://goog/public:all`, which represents all users on
    * the internet.
@@ -329,6 +361,7 @@ public java.lang.String getExceptionPrincipals(int index) {
    * listed in the `denied_principals`. For example, you could add a Google
    * group to the `denied_principals`, then exclude specific users who belong to
    * that group.
+   *
    * This field can contain the same values as the `denied_principals` field,
    * excluding `principalSet://goog/public:all`, which represents all users on
    * the internet.
@@ -346,7 +379,8 @@ public com.google.protobuf.ByteString getExceptionPrincipalsBytes(int index) {
   public static final int DENIED_PERMISSIONS_FIELD_NUMBER = 3;
 
   @SuppressWarnings("serial")
-  private com.google.protobuf.LazyStringList deniedPermissions_;
+  private com.google.protobuf.LazyStringArrayList deniedPermissions_ =
+      com.google.protobuf.LazyStringArrayList.emptyList();
   /**
    *
    *
@@ -421,7 +455,8 @@ public com.google.protobuf.ByteString getDeniedPermissionsBytes(int index) {
   public static final int EXCEPTION_PERMISSIONS_FIELD_NUMBER = 4;
 
   @SuppressWarnings("serial")
-  private com.google.protobuf.LazyStringList exceptionPermissions_;
+  private com.google.protobuf.LazyStringArrayList exceptionPermissions_ =
+      com.google.protobuf.LazyStringArrayList.emptyList();
   /**
    *
    *
@@ -430,6 +465,7 @@ public com.google.protobuf.ByteString getDeniedPermissionsBytes(int index) {
    * permissions given by `denied_permissions`. If a permission appears in
    * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
    * denied.
+   *
    * The excluded permissions can be specified using the same syntax as
    * `denied_permissions`.
    * </pre>
@@ -449,6 +485,7 @@ public com.google.protobuf.ProtocolStringList getExceptionPermissionsList() {
    * permissions given by `denied_permissions`. If a permission appears in
    * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
    * denied.
+   *
    * The excluded permissions can be specified using the same syntax as
    * `denied_permissions`.
    * </pre>
@@ -468,6 +505,7 @@ public int getExceptionPermissionsCount() {
    * permissions given by `denied_permissions`. If a permission appears in
    * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
    * denied.
+   *
    * The excluded permissions can be specified using the same syntax as
    * `denied_permissions`.
    * </pre>
@@ -488,6 +526,7 @@ public java.lang.String getExceptionPermissions(int index) {
    * permissions given by `denied_permissions`. If a permission appears in
    * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
    * denied.
+   *
    * The excluded permissions can be specified using the same syntax as
    * `denied_permissions`.
    * </pre>
@@ -510,8 +549,10 @@ public com.google.protobuf.ByteString getExceptionPermissionsBytes(int index) {
    * The condition that determines whether this deny rule applies to a request.
    * If the condition expression evaluates to `true`, then the deny rule is
    * applied; otherwise, the deny rule is not applied.
+   *
    * Each deny rule is evaluated independently. If this deny rule does not apply
    * to a request, other deny rules might still apply.
+   *
    * The condition can use CEL functions that evaluate
    * [resource
    * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
@@ -533,8 +574,10 @@ public boolean hasDenialCondition() {
    * The condition that determines whether this deny rule applies to a request.
    * If the condition expression evaluates to `true`, then the deny rule is
    * applied; otherwise, the deny rule is not applied.
+   *
    * Each deny rule is evaluated independently. If this deny rule does not apply
    * to a request, other deny rules might still apply.
+   *
    * The condition can use CEL functions that evaluate
    * [resource
    * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
@@ -556,8 +599,10 @@ public com.google.type.Expr getDenialCondition() {
    * The condition that determines whether this deny rule applies to a request.
    * If the condition expression evaluates to `true`, then the deny rule is
    * applied; otherwise, the deny rule is not applied.
+   *
    * Each deny rule is evaluated independently. If this deny rule does not apply
    * to a request, other deny rules might still apply.
+   *
    * The condition can use CEL functions that evaluate
    * [resource
    * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
@@ -836,14 +881,10 @@ private Builder(com.google.protobuf.GeneratedMessageV3.BuilderParent parent) {
     public Builder clear() {
       super.clear();
       bitField0_ = 0;
-      deniedPrincipals_ = com.google.protobuf.LazyStringArrayList.EMPTY;
-      bitField0_ = (bitField0_ & ~0x00000001);
-      exceptionPrincipals_ = com.google.protobuf.LazyStringArrayList.EMPTY;
-      bitField0_ = (bitField0_ & ~0x00000002);
-      deniedPermissions_ = com.google.protobuf.LazyStringArrayList.EMPTY;
-      bitField0_ = (bitField0_ & ~0x00000004);
-      exceptionPermissions_ = com.google.protobuf.LazyStringArrayList.EMPTY;
-      bitField0_ = (bitField0_ & ~0x00000008);
+      deniedPrincipals_ = com.google.protobuf.LazyStringArrayList.emptyList();
+      exceptionPrincipals_ = com.google.protobuf.LazyStringArrayList.emptyList();
+      deniedPermissions_ = com.google.protobuf.LazyStringArrayList.emptyList();
+      exceptionPermissions_ = com.google.protobuf.LazyStringArrayList.emptyList();
       denialCondition_ = null;
       if (denialConditionBuilder_ != null) {
         denialConditionBuilder_.dispose();
@@ -875,7 +916,6 @@ public com.google.iam.v2beta.DenyRule build() {
     @java.lang.Override
     public com.google.iam.v2beta.DenyRule buildPartial() {
       com.google.iam.v2beta.DenyRule result = new com.google.iam.v2beta.DenyRule(this);
-      buildPartialRepeatedFields(result);
       if (bitField0_ != 0) {
         buildPartial0(result);
       }
@@ -883,70 +923,30 @@ public com.google.iam.v2beta.DenyRule buildPartial() {
       return result;
     }
 
-    private void buildPartialRepeatedFields(com.google.iam.v2beta.DenyRule result) {
-      if (((bitField0_ & 0x00000001) != 0)) {
-        deniedPrincipals_ = deniedPrincipals_.getUnmodifiableView();
-        bitField0_ = (bitField0_ & ~0x00000001);
+    private void buildPartial0(com.google.iam.v2beta.DenyRule result) {
+      int from_bitField0_ = bitField0_;
+      if (((from_bitField0_ & 0x00000001) != 0)) {
+        deniedPrincipals_.makeImmutable();
+        result.deniedPrincipals_ = deniedPrincipals_;
       }
-      result.deniedPrincipals_ = deniedPrincipals_;
-      if (((bitField0_ & 0x00000002) != 0)) {
-        exceptionPrincipals_ = exceptionPrincipals_.getUnmodifiableView();
-        bitField0_ = (bitField0_ & ~0x00000002);
+      if (((from_bitField0_ & 0x00000002) != 0)) {
+        exceptionPrincipals_.makeImmutable();
+        result.exceptionPrincipals_ = exceptionPrincipals_;
       }
-      result.exceptionPrincipals_ = exceptionPrincipals_;
-      if (((bitField0_ & 0x00000004) != 0)) {
-        deniedPermissions_ = deniedPermissions_.getUnmodifiableView();
-        bitField0_ = (bitField0_ & ~0x00000004);
+      if (((from_bitField0_ & 0x00000004) != 0)) {
+        deniedPermissions_.makeImmutable();
+        result.deniedPermissions_ = deniedPermissions_;
       }
-      result.deniedPermissions_ = deniedPermissions_;
-      if (((bitField0_ & 0x00000008) != 0)) {
-        exceptionPermissions_ = exceptionPermissions_.getUnmodifiableView();
-        bitField0_ = (bitField0_ & ~0x00000008);
+      if (((from_bitField0_ & 0x00000008) != 0)) {
+        exceptionPermissions_.makeImmutable();
+        result.exceptionPermissions_ = exceptionPermissions_;
       }
-      result.exceptionPermissions_ = exceptionPermissions_;
-    }
-
-    private void buildPartial0(com.google.iam.v2beta.DenyRule result) {
-      int from_bitField0_ = bitField0_;
       if (((from_bitField0_ & 0x00000010) != 0)) {
         result.denialCondition_ =
             denialConditionBuilder_ == null ? denialCondition_ : denialConditionBuilder_.build();
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v2beta.DenyRule) {
@@ -962,7 +962,7 @@ public Builder mergeFrom(com.google.iam.v2beta.DenyRule other) {
       if (!other.deniedPrincipals_.isEmpty()) {
         if (deniedPrincipals_.isEmpty()) {
           deniedPrincipals_ = other.deniedPrincipals_;
-          bitField0_ = (bitField0_ & ~0x00000001);
+          bitField0_ |= 0x00000001;
         } else {
           ensureDeniedPrincipalsIsMutable();
           deniedPrincipals_.addAll(other.deniedPrincipals_);
@@ -972,7 +972,7 @@ public Builder mergeFrom(com.google.iam.v2beta.DenyRule other) {
       if (!other.exceptionPrincipals_.isEmpty()) {
         if (exceptionPrincipals_.isEmpty()) {
           exceptionPrincipals_ = other.exceptionPrincipals_;
-          bitField0_ = (bitField0_ & ~0x00000002);
+          bitField0_ |= 0x00000002;
         } else {
           ensureExceptionPrincipalsIsMutable();
           exceptionPrincipals_.addAll(other.exceptionPrincipals_);
@@ -982,7 +982,7 @@ public Builder mergeFrom(com.google.iam.v2beta.DenyRule other) {
       if (!other.deniedPermissions_.isEmpty()) {
         if (deniedPermissions_.isEmpty()) {
           deniedPermissions_ = other.deniedPermissions_;
-          bitField0_ = (bitField0_ & ~0x00000004);
+          bitField0_ |= 0x00000004;
         } else {
           ensureDeniedPermissionsIsMutable();
           deniedPermissions_.addAll(other.deniedPermissions_);
@@ -992,7 +992,7 @@ public Builder mergeFrom(com.google.iam.v2beta.DenyRule other) {
       if (!other.exceptionPermissions_.isEmpty()) {
         if (exceptionPermissions_.isEmpty()) {
           exceptionPermissions_ = other.exceptionPermissions_;
-          bitField0_ = (bitField0_ & ~0x00000008);
+          bitField0_ |= 0x00000008;
         } else {
           ensureExceptionPermissionsIsMutable();
           exceptionPermissions_.addAll(other.exceptionPermissions_);
@@ -1081,14 +1081,14 @@ public Builder mergeFrom(
 
     private int bitField0_;
 
-    private com.google.protobuf.LazyStringList deniedPrincipals_ =
-        com.google.protobuf.LazyStringArrayList.EMPTY;
+    private com.google.protobuf.LazyStringArrayList deniedPrincipals_ =
+        com.google.protobuf.LazyStringArrayList.emptyList();
 
     private void ensureDeniedPrincipalsIsMutable() {
-      if (!((bitField0_ & 0x00000001) != 0)) {
+      if (!deniedPrincipals_.isModifiable()) {
         deniedPrincipals_ = new com.google.protobuf.LazyStringArrayList(deniedPrincipals_);
-        bitField0_ |= 0x00000001;
       }
+      bitField0_ |= 0x00000001;
     }
     /**
      *
@@ -1096,32 +1096,40 @@ private void ensureDeniedPrincipalsIsMutable() {
      * <pre>
      * The identities that are prevented from using one or more permissions on
      * Google Cloud resources. This field can contain the following values:
+     *
      * * `principalSet://goog/public:all`: A special identifier that represents
      *   any principal that is on the internet, even if they do not have a Google
      *   Account or are not logged in.
+     *
      * * `principal://goog/subject/{email_id}`: A specific Google Account.
      *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
      *   example, `principal://goog/subject/alice&#64;example.com`.
+     *
      * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
      *   Google Account that was deleted recently. For example,
      *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
      *   the Google Account is recovered, this identifier reverts to the standard
      *   identifier for a Google Account.
+     *
      * * `principalSet://goog/group/{group_id}`: A Google group. For example,
      *   `principalSet://goog/group/admins&#64;example.com`.
+     *
      * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
      *   that was deleted recently. For example,
      *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
      *   the Google group is restored, this identifier reverts to the standard
      *   identifier for a Google group.
+     *
      * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
      *   A Google Cloud service account. For example,
      *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+     *
      * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
      *   A Google Cloud service account that was deleted recently. For example,
      *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
      *   If the service account is undeleted, this identifier reverts to the
      *   standard identifier for a service account.
+     *
      * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
      *   principals associated with the specified Google Workspace or Cloud
      *   Identity customer ID. For example,
@@ -1133,7 +1141,8 @@ private void ensureDeniedPrincipalsIsMutable() {
      * @return A list containing the deniedPrincipals.
      */
     public com.google.protobuf.ProtocolStringList getDeniedPrincipalsList() {
-      return deniedPrincipals_.getUnmodifiableView();
+      deniedPrincipals_.makeImmutable();
+      return deniedPrincipals_;
     }
     /**
      *
@@ -1141,32 +1150,40 @@ public com.google.protobuf.ProtocolStringList getDeniedPrincipalsList() {
      * <pre>
      * The identities that are prevented from using one or more permissions on
      * Google Cloud resources. This field can contain the following values:
+     *
      * * `principalSet://goog/public:all`: A special identifier that represents
      *   any principal that is on the internet, even if they do not have a Google
      *   Account or are not logged in.
+     *
      * * `principal://goog/subject/{email_id}`: A specific Google Account.
      *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
      *   example, `principal://goog/subject/alice&#64;example.com`.
+     *
      * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
      *   Google Account that was deleted recently. For example,
      *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
      *   the Google Account is recovered, this identifier reverts to the standard
      *   identifier for a Google Account.
+     *
      * * `principalSet://goog/group/{group_id}`: A Google group. For example,
      *   `principalSet://goog/group/admins&#64;example.com`.
+     *
      * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
      *   that was deleted recently. For example,
      *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
      *   the Google group is restored, this identifier reverts to the standard
      *   identifier for a Google group.
+     *
      * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
      *   A Google Cloud service account. For example,
      *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+     *
      * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
      *   A Google Cloud service account that was deleted recently. For example,
      *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
      *   If the service account is undeleted, this identifier reverts to the
      *   standard identifier for a service account.
+     *
      * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
      *   principals associated with the specified Google Workspace or Cloud
      *   Identity customer ID. For example,
@@ -1186,32 +1203,40 @@ public int getDeniedPrincipalsCount() {
      * <pre>
      * The identities that are prevented from using one or more permissions on
      * Google Cloud resources. This field can contain the following values:
+     *
      * * `principalSet://goog/public:all`: A special identifier that represents
      *   any principal that is on the internet, even if they do not have a Google
      *   Account or are not logged in.
+     *
      * * `principal://goog/subject/{email_id}`: A specific Google Account.
      *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
      *   example, `principal://goog/subject/alice&#64;example.com`.
+     *
      * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
      *   Google Account that was deleted recently. For example,
      *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
      *   the Google Account is recovered, this identifier reverts to the standard
      *   identifier for a Google Account.
+     *
      * * `principalSet://goog/group/{group_id}`: A Google group. For example,
      *   `principalSet://goog/group/admins&#64;example.com`.
+     *
      * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
      *   that was deleted recently. For example,
      *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
      *   the Google group is restored, this identifier reverts to the standard
      *   identifier for a Google group.
+     *
      * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
      *   A Google Cloud service account. For example,
      *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+     *
      * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
      *   A Google Cloud service account that was deleted recently. For example,
      *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
      *   If the service account is undeleted, this identifier reverts to the
      *   standard identifier for a service account.
+     *
      * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
      *   principals associated with the specified Google Workspace or Cloud
      *   Identity customer ID. For example,
@@ -1232,32 +1257,40 @@ public java.lang.String getDeniedPrincipals(int index) {
      * <pre>
      * The identities that are prevented from using one or more permissions on
      * Google Cloud resources. This field can contain the following values:
+     *
      * * `principalSet://goog/public:all`: A special identifier that represents
      *   any principal that is on the internet, even if they do not have a Google
      *   Account or are not logged in.
+     *
      * * `principal://goog/subject/{email_id}`: A specific Google Account.
      *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
      *   example, `principal://goog/subject/alice&#64;example.com`.
+     *
      * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
      *   Google Account that was deleted recently. For example,
      *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
      *   the Google Account is recovered, this identifier reverts to the standard
      *   identifier for a Google Account.
+     *
      * * `principalSet://goog/group/{group_id}`: A Google group. For example,
      *   `principalSet://goog/group/admins&#64;example.com`.
+     *
      * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
      *   that was deleted recently. For example,
      *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
      *   the Google group is restored, this identifier reverts to the standard
      *   identifier for a Google group.
+     *
      * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
      *   A Google Cloud service account. For example,
      *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+     *
      * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
      *   A Google Cloud service account that was deleted recently. For example,
      *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
      *   If the service account is undeleted, this identifier reverts to the
      *   standard identifier for a service account.
+     *
      * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
      *   principals associated with the specified Google Workspace or Cloud
      *   Identity customer ID. For example,
@@ -1278,32 +1311,40 @@ public com.google.protobuf.ByteString getDeniedPrincipalsBytes(int index) {
      * <pre>
      * The identities that are prevented from using one or more permissions on
      * Google Cloud resources. This field can contain the following values:
+     *
      * * `principalSet://goog/public:all`: A special identifier that represents
      *   any principal that is on the internet, even if they do not have a Google
      *   Account or are not logged in.
+     *
      * * `principal://goog/subject/{email_id}`: A specific Google Account.
      *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
      *   example, `principal://goog/subject/alice&#64;example.com`.
+     *
      * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
      *   Google Account that was deleted recently. For example,
      *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
      *   the Google Account is recovered, this identifier reverts to the standard
      *   identifier for a Google Account.
+     *
      * * `principalSet://goog/group/{group_id}`: A Google group. For example,
      *   `principalSet://goog/group/admins&#64;example.com`.
+     *
      * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
      *   that was deleted recently. For example,
      *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
      *   the Google group is restored, this identifier reverts to the standard
      *   identifier for a Google group.
+     *
      * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
      *   A Google Cloud service account. For example,
      *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+     *
      * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
      *   A Google Cloud service account that was deleted recently. For example,
      *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
      *   If the service account is undeleted, this identifier reverts to the
      *   standard identifier for a service account.
+     *
      * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
      *   principals associated with the specified Google Workspace or Cloud
      *   Identity customer ID. For example,
@@ -1322,6 +1363,7 @@ public Builder setDeniedPrincipals(int index, java.lang.String value) {
       }
       ensureDeniedPrincipalsIsMutable();
       deniedPrincipals_.set(index, value);
+      bitField0_ |= 0x00000001;
       onChanged();
       return this;
     }
@@ -1331,32 +1373,40 @@ public Builder setDeniedPrincipals(int index, java.lang.String value) {
      * <pre>
      * The identities that are prevented from using one or more permissions on
      * Google Cloud resources. This field can contain the following values:
+     *
      * * `principalSet://goog/public:all`: A special identifier that represents
      *   any principal that is on the internet, even if they do not have a Google
      *   Account or are not logged in.
+     *
      * * `principal://goog/subject/{email_id}`: A specific Google Account.
      *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
      *   example, `principal://goog/subject/alice&#64;example.com`.
+     *
      * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
      *   Google Account that was deleted recently. For example,
      *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
      *   the Google Account is recovered, this identifier reverts to the standard
      *   identifier for a Google Account.
+     *
      * * `principalSet://goog/group/{group_id}`: A Google group. For example,
      *   `principalSet://goog/group/admins&#64;example.com`.
+     *
      * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
      *   that was deleted recently. For example,
      *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
      *   the Google group is restored, this identifier reverts to the standard
      *   identifier for a Google group.
+     *
      * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
      *   A Google Cloud service account. For example,
      *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+     *
      * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
      *   A Google Cloud service account that was deleted recently. For example,
      *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
      *   If the service account is undeleted, this identifier reverts to the
      *   standard identifier for a service account.
+     *
      * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
      *   principals associated with the specified Google Workspace or Cloud
      *   Identity customer ID. For example,
@@ -1374,6 +1424,7 @@ public Builder addDeniedPrincipals(java.lang.String value) {
       }
       ensureDeniedPrincipalsIsMutable();
       deniedPrincipals_.add(value);
+      bitField0_ |= 0x00000001;
       onChanged();
       return this;
     }
@@ -1383,32 +1434,40 @@ public Builder addDeniedPrincipals(java.lang.String value) {
      * <pre>
      * The identities that are prevented from using one or more permissions on
      * Google Cloud resources. This field can contain the following values:
+     *
      * * `principalSet://goog/public:all`: A special identifier that represents
      *   any principal that is on the internet, even if they do not have a Google
      *   Account or are not logged in.
+     *
      * * `principal://goog/subject/{email_id}`: A specific Google Account.
      *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
      *   example, `principal://goog/subject/alice&#64;example.com`.
+     *
      * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
      *   Google Account that was deleted recently. For example,
      *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
      *   the Google Account is recovered, this identifier reverts to the standard
      *   identifier for a Google Account.
+     *
      * * `principalSet://goog/group/{group_id}`: A Google group. For example,
      *   `principalSet://goog/group/admins&#64;example.com`.
+     *
      * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
      *   that was deleted recently. For example,
      *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
      *   the Google group is restored, this identifier reverts to the standard
      *   identifier for a Google group.
+     *
      * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
      *   A Google Cloud service account. For example,
      *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+     *
      * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
      *   A Google Cloud service account that was deleted recently. For example,
      *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
      *   If the service account is undeleted, this identifier reverts to the
      *   standard identifier for a service account.
+     *
      * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
      *   principals associated with the specified Google Workspace or Cloud
      *   Identity customer ID. For example,
@@ -1423,6 +1482,7 @@ public Builder addDeniedPrincipals(java.lang.String value) {
     public Builder addAllDeniedPrincipals(java.lang.Iterable<java.lang.String> values) {
       ensureDeniedPrincipalsIsMutable();
       com.google.protobuf.AbstractMessageLite.Builder.addAll(values, deniedPrincipals_);
+      bitField0_ |= 0x00000001;
       onChanged();
       return this;
     }
@@ -1432,32 +1492,40 @@ public Builder addAllDeniedPrincipals(java.lang.Iterable<java.lang.String> value
      * <pre>
      * The identities that are prevented from using one or more permissions on
      * Google Cloud resources. This field can contain the following values:
+     *
      * * `principalSet://goog/public:all`: A special identifier that represents
      *   any principal that is on the internet, even if they do not have a Google
      *   Account or are not logged in.
+     *
      * * `principal://goog/subject/{email_id}`: A specific Google Account.
      *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
      *   example, `principal://goog/subject/alice&#64;example.com`.
+     *
      * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
      *   Google Account that was deleted recently. For example,
      *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
      *   the Google Account is recovered, this identifier reverts to the standard
      *   identifier for a Google Account.
+     *
      * * `principalSet://goog/group/{group_id}`: A Google group. For example,
      *   `principalSet://goog/group/admins&#64;example.com`.
+     *
      * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
      *   that was deleted recently. For example,
      *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
      *   the Google group is restored, this identifier reverts to the standard
      *   identifier for a Google group.
+     *
      * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
      *   A Google Cloud service account. For example,
      *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+     *
      * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
      *   A Google Cloud service account that was deleted recently. For example,
      *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
      *   If the service account is undeleted, this identifier reverts to the
      *   standard identifier for a service account.
+     *
      * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
      *   principals associated with the specified Google Workspace or Cloud
      *   Identity customer ID. For example,
@@ -1469,8 +1537,9 @@ public Builder addAllDeniedPrincipals(java.lang.Iterable<java.lang.String> value
      * @return This builder for chaining.
      */
     public Builder clearDeniedPrincipals() {
-      deniedPrincipals_ = com.google.protobuf.LazyStringArrayList.EMPTY;
+      deniedPrincipals_ = com.google.protobuf.LazyStringArrayList.emptyList();
       bitField0_ = (bitField0_ & ~0x00000001);
+      ;
       onChanged();
       return this;
     }
@@ -1480,32 +1549,40 @@ public Builder clearDeniedPrincipals() {
      * <pre>
      * The identities that are prevented from using one or more permissions on
      * Google Cloud resources. This field can contain the following values:
+     *
      * * `principalSet://goog/public:all`: A special identifier that represents
      *   any principal that is on the internet, even if they do not have a Google
      *   Account or are not logged in.
+     *
      * * `principal://goog/subject/{email_id}`: A specific Google Account.
      *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
      *   example, `principal://goog/subject/alice&#64;example.com`.
+     *
      * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
      *   Google Account that was deleted recently. For example,
      *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
      *   the Google Account is recovered, this identifier reverts to the standard
      *   identifier for a Google Account.
+     *
      * * `principalSet://goog/group/{group_id}`: A Google group. For example,
      *   `principalSet://goog/group/admins&#64;example.com`.
+     *
      * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
      *   that was deleted recently. For example,
      *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
      *   the Google group is restored, this identifier reverts to the standard
      *   identifier for a Google group.
+     *
      * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
      *   A Google Cloud service account. For example,
      *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+     *
      * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
      *   A Google Cloud service account that was deleted recently. For example,
      *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
      *   If the service account is undeleted, this identifier reverts to the
      *   standard identifier for a service account.
+     *
      * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
      *   principals associated with the specified Google Workspace or Cloud
      *   Identity customer ID. For example,
@@ -1524,18 +1601,19 @@ public Builder addDeniedPrincipalsBytes(com.google.protobuf.ByteString value) {
       checkByteStringIsUtf8(value);
       ensureDeniedPrincipalsIsMutable();
       deniedPrincipals_.add(value);
+      bitField0_ |= 0x00000001;
       onChanged();
       return this;
     }
 
-    private com.google.protobuf.LazyStringList exceptionPrincipals_ =
-        com.google.protobuf.LazyStringArrayList.EMPTY;
+    private com.google.protobuf.LazyStringArrayList exceptionPrincipals_ =
+        com.google.protobuf.LazyStringArrayList.emptyList();
 
     private void ensureExceptionPrincipalsIsMutable() {
-      if (!((bitField0_ & 0x00000002) != 0)) {
+      if (!exceptionPrincipals_.isModifiable()) {
         exceptionPrincipals_ = new com.google.protobuf.LazyStringArrayList(exceptionPrincipals_);
-        bitField0_ |= 0x00000002;
       }
+      bitField0_ |= 0x00000002;
     }
     /**
      *
@@ -1545,6 +1623,7 @@ private void ensureExceptionPrincipalsIsMutable() {
      * listed in the `denied_principals`. For example, you could add a Google
      * group to the `denied_principals`, then exclude specific users who belong to
      * that group.
+     *
      * This field can contain the same values as the `denied_principals` field,
      * excluding `principalSet://goog/public:all`, which represents all users on
      * the internet.
@@ -1555,7 +1634,8 @@ private void ensureExceptionPrincipalsIsMutable() {
      * @return A list containing the exceptionPrincipals.
      */
     public com.google.protobuf.ProtocolStringList getExceptionPrincipalsList() {
-      return exceptionPrincipals_.getUnmodifiableView();
+      exceptionPrincipals_.makeImmutable();
+      return exceptionPrincipals_;
     }
     /**
      *
@@ -1565,6 +1645,7 @@ public com.google.protobuf.ProtocolStringList getExceptionPrincipalsList() {
      * listed in the `denied_principals`. For example, you could add a Google
      * group to the `denied_principals`, then exclude specific users who belong to
      * that group.
+     *
      * This field can contain the same values as the `denied_principals` field,
      * excluding `principalSet://goog/public:all`, which represents all users on
      * the internet.
@@ -1585,6 +1666,7 @@ public int getExceptionPrincipalsCount() {
      * listed in the `denied_principals`. For example, you could add a Google
      * group to the `denied_principals`, then exclude specific users who belong to
      * that group.
+     *
      * This field can contain the same values as the `denied_principals` field,
      * excluding `principalSet://goog/public:all`, which represents all users on
      * the internet.
@@ -1606,6 +1688,7 @@ public java.lang.String getExceptionPrincipals(int index) {
      * listed in the `denied_principals`. For example, you could add a Google
      * group to the `denied_principals`, then exclude specific users who belong to
      * that group.
+     *
      * This field can contain the same values as the `denied_principals` field,
      * excluding `principalSet://goog/public:all`, which represents all users on
      * the internet.
@@ -1627,6 +1710,7 @@ public com.google.protobuf.ByteString getExceptionPrincipalsBytes(int index) {
      * listed in the `denied_principals`. For example, you could add a Google
      * group to the `denied_principals`, then exclude specific users who belong to
      * that group.
+     *
      * This field can contain the same values as the `denied_principals` field,
      * excluding `principalSet://goog/public:all`, which represents all users on
      * the internet.
@@ -1644,6 +1728,7 @@ public Builder setExceptionPrincipals(int index, java.lang.String value) {
       }
       ensureExceptionPrincipalsIsMutable();
       exceptionPrincipals_.set(index, value);
+      bitField0_ |= 0x00000002;
       onChanged();
       return this;
     }
@@ -1655,6 +1740,7 @@ public Builder setExceptionPrincipals(int index, java.lang.String value) {
      * listed in the `denied_principals`. For example, you could add a Google
      * group to the `denied_principals`, then exclude specific users who belong to
      * that group.
+     *
      * This field can contain the same values as the `denied_principals` field,
      * excluding `principalSet://goog/public:all`, which represents all users on
      * the internet.
@@ -1671,6 +1757,7 @@ public Builder addExceptionPrincipals(java.lang.String value) {
       }
       ensureExceptionPrincipalsIsMutable();
       exceptionPrincipals_.add(value);
+      bitField0_ |= 0x00000002;
       onChanged();
       return this;
     }
@@ -1682,6 +1769,7 @@ public Builder addExceptionPrincipals(java.lang.String value) {
      * listed in the `denied_principals`. For example, you could add a Google
      * group to the `denied_principals`, then exclude specific users who belong to
      * that group.
+     *
      * This field can contain the same values as the `denied_principals` field,
      * excluding `principalSet://goog/public:all`, which represents all users on
      * the internet.
@@ -1695,6 +1783,7 @@ public Builder addExceptionPrincipals(java.lang.String value) {
     public Builder addAllExceptionPrincipals(java.lang.Iterable<java.lang.String> values) {
       ensureExceptionPrincipalsIsMutable();
       com.google.protobuf.AbstractMessageLite.Builder.addAll(values, exceptionPrincipals_);
+      bitField0_ |= 0x00000002;
       onChanged();
       return this;
     }
@@ -1706,6 +1795,7 @@ public Builder addAllExceptionPrincipals(java.lang.Iterable<java.lang.String> va
      * listed in the `denied_principals`. For example, you could add a Google
      * group to the `denied_principals`, then exclude specific users who belong to
      * that group.
+     *
      * This field can contain the same values as the `denied_principals` field,
      * excluding `principalSet://goog/public:all`, which represents all users on
      * the internet.
@@ -1716,8 +1806,9 @@ public Builder addAllExceptionPrincipals(java.lang.Iterable<java.lang.String> va
      * @return This builder for chaining.
      */
     public Builder clearExceptionPrincipals() {
-      exceptionPrincipals_ = com.google.protobuf.LazyStringArrayList.EMPTY;
+      exceptionPrincipals_ = com.google.protobuf.LazyStringArrayList.emptyList();
       bitField0_ = (bitField0_ & ~0x00000002);
+      ;
       onChanged();
       return this;
     }
@@ -1729,6 +1820,7 @@ public Builder clearExceptionPrincipals() {
      * listed in the `denied_principals`. For example, you could add a Google
      * group to the `denied_principals`, then exclude specific users who belong to
      * that group.
+     *
      * This field can contain the same values as the `denied_principals` field,
      * excluding `principalSet://goog/public:all`, which represents all users on
      * the internet.
@@ -1746,18 +1838,19 @@ public Builder addExceptionPrincipalsBytes(com.google.protobuf.ByteString value)
       checkByteStringIsUtf8(value);
       ensureExceptionPrincipalsIsMutable();
       exceptionPrincipals_.add(value);
+      bitField0_ |= 0x00000002;
       onChanged();
       return this;
     }
 
-    private com.google.protobuf.LazyStringList deniedPermissions_ =
-        com.google.protobuf.LazyStringArrayList.EMPTY;
+    private com.google.protobuf.LazyStringArrayList deniedPermissions_ =
+        com.google.protobuf.LazyStringArrayList.emptyList();
 
     private void ensureDeniedPermissionsIsMutable() {
-      if (!((bitField0_ & 0x00000004) != 0)) {
+      if (!deniedPermissions_.isModifiable()) {
         deniedPermissions_ = new com.google.protobuf.LazyStringArrayList(deniedPermissions_);
-        bitField0_ |= 0x00000004;
       }
+      bitField0_ |= 0x00000004;
     }
     /**
      *
@@ -1774,7 +1867,8 @@ private void ensureDeniedPermissionsIsMutable() {
      * @return A list containing the deniedPermissions.
      */
     public com.google.protobuf.ProtocolStringList getDeniedPermissionsList() {
-      return deniedPermissions_.getUnmodifiableView();
+      deniedPermissions_.makeImmutable();
+      return deniedPermissions_;
     }
     /**
      *
@@ -1851,6 +1945,7 @@ public Builder setDeniedPermissions(int index, java.lang.String value) {
       }
       ensureDeniedPermissionsIsMutable();
       deniedPermissions_.set(index, value);
+      bitField0_ |= 0x00000004;
       onChanged();
       return this;
     }
@@ -1875,6 +1970,7 @@ public Builder addDeniedPermissions(java.lang.String value) {
       }
       ensureDeniedPermissionsIsMutable();
       deniedPermissions_.add(value);
+      bitField0_ |= 0x00000004;
       onChanged();
       return this;
     }
@@ -1896,6 +1992,7 @@ public Builder addDeniedPermissions(java.lang.String value) {
     public Builder addAllDeniedPermissions(java.lang.Iterable<java.lang.String> values) {
       ensureDeniedPermissionsIsMutable();
       com.google.protobuf.AbstractMessageLite.Builder.addAll(values, deniedPermissions_);
+      bitField0_ |= 0x00000004;
       onChanged();
       return this;
     }
@@ -1914,8 +2011,9 @@ public Builder addAllDeniedPermissions(java.lang.Iterable<java.lang.String> valu
      * @return This builder for chaining.
      */
     public Builder clearDeniedPermissions() {
-      deniedPermissions_ = com.google.protobuf.LazyStringArrayList.EMPTY;
+      deniedPermissions_ = com.google.protobuf.LazyStringArrayList.emptyList();
       bitField0_ = (bitField0_ & ~0x00000004);
+      ;
       onChanged();
       return this;
     }
@@ -1941,18 +2039,19 @@ public Builder addDeniedPermissionsBytes(com.google.protobuf.ByteString value) {
       checkByteStringIsUtf8(value);
       ensureDeniedPermissionsIsMutable();
       deniedPermissions_.add(value);
+      bitField0_ |= 0x00000004;
       onChanged();
       return this;
     }
 
-    private com.google.protobuf.LazyStringList exceptionPermissions_ =
-        com.google.protobuf.LazyStringArrayList.EMPTY;
+    private com.google.protobuf.LazyStringArrayList exceptionPermissions_ =
+        com.google.protobuf.LazyStringArrayList.emptyList();
 
     private void ensureExceptionPermissionsIsMutable() {
-      if (!((bitField0_ & 0x00000008) != 0)) {
+      if (!exceptionPermissions_.isModifiable()) {
         exceptionPermissions_ = new com.google.protobuf.LazyStringArrayList(exceptionPermissions_);
-        bitField0_ |= 0x00000008;
       }
+      bitField0_ |= 0x00000008;
     }
     /**
      *
@@ -1962,6 +2061,7 @@ private void ensureExceptionPermissionsIsMutable() {
      * permissions given by `denied_permissions`. If a permission appears in
      * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
      * denied.
+     *
      * The excluded permissions can be specified using the same syntax as
      * `denied_permissions`.
      * </pre>
@@ -1971,7 +2071,8 @@ private void ensureExceptionPermissionsIsMutable() {
      * @return A list containing the exceptionPermissions.
      */
     public com.google.protobuf.ProtocolStringList getExceptionPermissionsList() {
-      return exceptionPermissions_.getUnmodifiableView();
+      exceptionPermissions_.makeImmutable();
+      return exceptionPermissions_;
     }
     /**
      *
@@ -1981,6 +2082,7 @@ public com.google.protobuf.ProtocolStringList getExceptionPermissionsList() {
      * permissions given by `denied_permissions`. If a permission appears in
      * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
      * denied.
+     *
      * The excluded permissions can be specified using the same syntax as
      * `denied_permissions`.
      * </pre>
@@ -2000,6 +2102,7 @@ public int getExceptionPermissionsCount() {
      * permissions given by `denied_permissions`. If a permission appears in
      * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
      * denied.
+     *
      * The excluded permissions can be specified using the same syntax as
      * `denied_permissions`.
      * </pre>
@@ -2020,6 +2123,7 @@ public java.lang.String getExceptionPermissions(int index) {
      * permissions given by `denied_permissions`. If a permission appears in
      * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
      * denied.
+     *
      * The excluded permissions can be specified using the same syntax as
      * `denied_permissions`.
      * </pre>
@@ -2040,6 +2144,7 @@ public com.google.protobuf.ByteString getExceptionPermissionsBytes(int index) {
      * permissions given by `denied_permissions`. If a permission appears in
      * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
      * denied.
+     *
      * The excluded permissions can be specified using the same syntax as
      * `denied_permissions`.
      * </pre>
@@ -2056,6 +2161,7 @@ public Builder setExceptionPermissions(int index, java.lang.String value) {
       }
       ensureExceptionPermissionsIsMutable();
       exceptionPermissions_.set(index, value);
+      bitField0_ |= 0x00000008;
       onChanged();
       return this;
     }
@@ -2067,6 +2173,7 @@ public Builder setExceptionPermissions(int index, java.lang.String value) {
      * permissions given by `denied_permissions`. If a permission appears in
      * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
      * denied.
+     *
      * The excluded permissions can be specified using the same syntax as
      * `denied_permissions`.
      * </pre>
@@ -2082,6 +2189,7 @@ public Builder addExceptionPermissions(java.lang.String value) {
       }
       ensureExceptionPermissionsIsMutable();
       exceptionPermissions_.add(value);
+      bitField0_ |= 0x00000008;
       onChanged();
       return this;
     }
@@ -2093,6 +2201,7 @@ public Builder addExceptionPermissions(java.lang.String value) {
      * permissions given by `denied_permissions`. If a permission appears in
      * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
      * denied.
+     *
      * The excluded permissions can be specified using the same syntax as
      * `denied_permissions`.
      * </pre>
@@ -2105,6 +2214,7 @@ public Builder addExceptionPermissions(java.lang.String value) {
     public Builder addAllExceptionPermissions(java.lang.Iterable<java.lang.String> values) {
       ensureExceptionPermissionsIsMutable();
       com.google.protobuf.AbstractMessageLite.Builder.addAll(values, exceptionPermissions_);
+      bitField0_ |= 0x00000008;
       onChanged();
       return this;
     }
@@ -2116,6 +2226,7 @@ public Builder addAllExceptionPermissions(java.lang.Iterable<java.lang.String> v
      * permissions given by `denied_permissions`. If a permission appears in
      * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
      * denied.
+     *
      * The excluded permissions can be specified using the same syntax as
      * `denied_permissions`.
      * </pre>
@@ -2125,8 +2236,9 @@ public Builder addAllExceptionPermissions(java.lang.Iterable<java.lang.String> v
      * @return This builder for chaining.
      */
     public Builder clearExceptionPermissions() {
-      exceptionPermissions_ = com.google.protobuf.LazyStringArrayList.EMPTY;
+      exceptionPermissions_ = com.google.protobuf.LazyStringArrayList.emptyList();
       bitField0_ = (bitField0_ & ~0x00000008);
+      ;
       onChanged();
       return this;
     }
@@ -2138,6 +2250,7 @@ public Builder clearExceptionPermissions() {
      * permissions given by `denied_permissions`. If a permission appears in
      * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
      * denied.
+     *
      * The excluded permissions can be specified using the same syntax as
      * `denied_permissions`.
      * </pre>
@@ -2154,6 +2267,7 @@ public Builder addExceptionPermissionsBytes(com.google.protobuf.ByteString value
       checkByteStringIsUtf8(value);
       ensureExceptionPermissionsIsMutable();
       exceptionPermissions_.add(value);
+      bitField0_ |= 0x00000008;
       onChanged();
       return this;
     }
@@ -2169,8 +2283,10 @@ public Builder addExceptionPermissionsBytes(com.google.protobuf.ByteString value
      * The condition that determines whether this deny rule applies to a request.
      * If the condition expression evaluates to `true`, then the deny rule is
      * applied; otherwise, the deny rule is not applied.
+     *
      * Each deny rule is evaluated independently. If this deny rule does not apply
      * to a request, other deny rules might still apply.
+     *
      * The condition can use CEL functions that evaluate
      * [resource
      * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
@@ -2191,8 +2307,10 @@ public boolean hasDenialCondition() {
      * The condition that determines whether this deny rule applies to a request.
      * If the condition expression evaluates to `true`, then the deny rule is
      * applied; otherwise, the deny rule is not applied.
+     *
      * Each deny rule is evaluated independently. If this deny rule does not apply
      * to a request, other deny rules might still apply.
+     *
      * The condition can use CEL functions that evaluate
      * [resource
      * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
@@ -2219,8 +2337,10 @@ public com.google.type.Expr getDenialCondition() {
      * The condition that determines whether this deny rule applies to a request.
      * If the condition expression evaluates to `true`, then the deny rule is
      * applied; otherwise, the deny rule is not applied.
+     *
      * Each deny rule is evaluated independently. If this deny rule does not apply
      * to a request, other deny rules might still apply.
+     *
      * The condition can use CEL functions that evaluate
      * [resource
      * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
@@ -2249,8 +2369,10 @@ public Builder setDenialCondition(com.google.type.Expr value) {
      * The condition that determines whether this deny rule applies to a request.
      * If the condition expression evaluates to `true`, then the deny rule is
      * applied; otherwise, the deny rule is not applied.
+     *
      * Each deny rule is evaluated independently. If this deny rule does not apply
      * to a request, other deny rules might still apply.
+     *
      * The condition can use CEL functions that evaluate
      * [resource
      * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
@@ -2276,8 +2398,10 @@ public Builder setDenialCondition(com.google.type.Expr.Builder builderForValue)
      * The condition that determines whether this deny rule applies to a request.
      * If the condition expression evaluates to `true`, then the deny rule is
      * applied; otherwise, the deny rule is not applied.
+     *
      * Each deny rule is evaluated independently. If this deny rule does not apply
      * to a request, other deny rules might still apply.
+     *
      * The condition can use CEL functions that evaluate
      * [resource
      * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
@@ -2309,8 +2433,10 @@ public Builder mergeDenialCondition(com.google.type.Expr value) {
      * The condition that determines whether this deny rule applies to a request.
      * If the condition expression evaluates to `true`, then the deny rule is
      * applied; otherwise, the deny rule is not applied.
+     *
      * Each deny rule is evaluated independently. If this deny rule does not apply
      * to a request, other deny rules might still apply.
+     *
      * The condition can use CEL functions that evaluate
      * [resource
      * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
@@ -2336,8 +2462,10 @@ public Builder clearDenialCondition() {
      * The condition that determines whether this deny rule applies to a request.
      * If the condition expression evaluates to `true`, then the deny rule is
      * applied; otherwise, the deny rule is not applied.
+     *
      * Each deny rule is evaluated independently. If this deny rule does not apply
      * to a request, other deny rules might still apply.
+     *
      * The condition can use CEL functions that evaluate
      * [resource
      * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
@@ -2358,8 +2486,10 @@ public com.google.type.Expr.Builder getDenialConditionBuilder() {
      * The condition that determines whether this deny rule applies to a request.
      * If the condition expression evaluates to `true`, then the deny rule is
      * applied; otherwise, the deny rule is not applied.
+     *
      * Each deny rule is evaluated independently. If this deny rule does not apply
      * to a request, other deny rules might still apply.
+     *
      * The condition can use CEL functions that evaluate
      * [resource
      * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
@@ -2384,8 +2514,10 @@ public com.google.type.ExprOrBuilder getDenialConditionOrBuilder() {
      * The condition that determines whether this deny rule applies to a request.
      * If the condition expression evaluates to `true`, then the deny rule is
      * applied; otherwise, the deny rule is not applied.
+     *
      * Each deny rule is evaluated independently. If this deny rule does not apply
      * to a request, other deny rules might still apply.
+     *
      * The condition can use CEL functions that evaluate
      * [resource
      * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
diff --git a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/DenyRuleOrBuilder.java b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/DenyRuleOrBuilder.java
index 30258206ce..28e0b45b8f 100644
--- a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/DenyRuleOrBuilder.java
+++ b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/DenyRuleOrBuilder.java
@@ -29,32 +29,40 @@ public interface DenyRuleOrBuilder
    * <pre>
    * The identities that are prevented from using one or more permissions on
    * Google Cloud resources. This field can contain the following values:
+   *
    * * `principalSet://goog/public:all`: A special identifier that represents
    *   any principal that is on the internet, even if they do not have a Google
    *   Account or are not logged in.
+   *
    * * `principal://goog/subject/{email_id}`: A specific Google Account.
    *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
    *   example, `principal://goog/subject/alice&#64;example.com`.
+   *
    * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
    *   Google Account that was deleted recently. For example,
    *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
    *   the Google Account is recovered, this identifier reverts to the standard
    *   identifier for a Google Account.
+   *
    * * `principalSet://goog/group/{group_id}`: A Google group. For example,
    *   `principalSet://goog/group/admins&#64;example.com`.
+   *
    * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
    *   that was deleted recently. For example,
    *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
    *   the Google group is restored, this identifier reverts to the standard
    *   identifier for a Google group.
+   *
    * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
    *   A Google Cloud service account. For example,
    *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+   *
    * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
    *   A Google Cloud service account that was deleted recently. For example,
    *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
    *   If the service account is undeleted, this identifier reverts to the
    *   standard identifier for a service account.
+   *
    * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
    *   principals associated with the specified Google Workspace or Cloud
    *   Identity customer ID. For example,
@@ -72,32 +80,40 @@ public interface DenyRuleOrBuilder
    * <pre>
    * The identities that are prevented from using one or more permissions on
    * Google Cloud resources. This field can contain the following values:
+   *
    * * `principalSet://goog/public:all`: A special identifier that represents
    *   any principal that is on the internet, even if they do not have a Google
    *   Account or are not logged in.
+   *
    * * `principal://goog/subject/{email_id}`: A specific Google Account.
    *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
    *   example, `principal://goog/subject/alice&#64;example.com`.
+   *
    * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
    *   Google Account that was deleted recently. For example,
    *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
    *   the Google Account is recovered, this identifier reverts to the standard
    *   identifier for a Google Account.
+   *
    * * `principalSet://goog/group/{group_id}`: A Google group. For example,
    *   `principalSet://goog/group/admins&#64;example.com`.
+   *
    * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
    *   that was deleted recently. For example,
    *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
    *   the Google group is restored, this identifier reverts to the standard
    *   identifier for a Google group.
+   *
    * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
    *   A Google Cloud service account. For example,
    *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+   *
    * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
    *   A Google Cloud service account that was deleted recently. For example,
    *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
    *   If the service account is undeleted, this identifier reverts to the
    *   standard identifier for a service account.
+   *
    * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
    *   principals associated with the specified Google Workspace or Cloud
    *   Identity customer ID. For example,
@@ -115,32 +131,40 @@ public interface DenyRuleOrBuilder
    * <pre>
    * The identities that are prevented from using one or more permissions on
    * Google Cloud resources. This field can contain the following values:
+   *
    * * `principalSet://goog/public:all`: A special identifier that represents
    *   any principal that is on the internet, even if they do not have a Google
    *   Account or are not logged in.
+   *
    * * `principal://goog/subject/{email_id}`: A specific Google Account.
    *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
    *   example, `principal://goog/subject/alice&#64;example.com`.
+   *
    * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
    *   Google Account that was deleted recently. For example,
    *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
    *   the Google Account is recovered, this identifier reverts to the standard
    *   identifier for a Google Account.
+   *
    * * `principalSet://goog/group/{group_id}`: A Google group. For example,
    *   `principalSet://goog/group/admins&#64;example.com`.
+   *
    * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
    *   that was deleted recently. For example,
    *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
    *   the Google group is restored, this identifier reverts to the standard
    *   identifier for a Google group.
+   *
    * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
    *   A Google Cloud service account. For example,
    *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+   *
    * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
    *   A Google Cloud service account that was deleted recently. For example,
    *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
    *   If the service account is undeleted, this identifier reverts to the
    *   standard identifier for a service account.
+   *
    * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
    *   principals associated with the specified Google Workspace or Cloud
    *   Identity customer ID. For example,
@@ -159,32 +183,40 @@ public interface DenyRuleOrBuilder
    * <pre>
    * The identities that are prevented from using one or more permissions on
    * Google Cloud resources. This field can contain the following values:
+   *
    * * `principalSet://goog/public:all`: A special identifier that represents
    *   any principal that is on the internet, even if they do not have a Google
    *   Account or are not logged in.
+   *
    * * `principal://goog/subject/{email_id}`: A specific Google Account.
    *   Includes Gmail, Cloud Identity, and Google Workspace user accounts. For
    *   example, `principal://goog/subject/alice&#64;example.com`.
+   *
    * * `deleted:principal://goog/subject/{email_id}?uid={uid}`: A specific
    *   Google Account that was deleted recently. For example,
    *   `deleted:principal://goog/subject/alice&#64;example.com?uid=1234567890`. If
    *   the Google Account is recovered, this identifier reverts to the standard
    *   identifier for a Google Account.
+   *
    * * `principalSet://goog/group/{group_id}`: A Google group. For example,
    *   `principalSet://goog/group/admins&#64;example.com`.
+   *
    * * `deleted:principalSet://goog/group/{group_id}?uid={uid}`: A Google group
    *   that was deleted recently. For example,
    *   `deleted:principalSet://goog/group/admins&#64;example.com?uid=1234567890`. If
    *   the Google group is restored, this identifier reverts to the standard
    *   identifier for a Google group.
+   *
    * * `principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}`:
    *   A Google Cloud service account. For example,
    *   `principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com`.
+   *
    * * `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/{service_account_id}?uid={uid}`:
    *   A Google Cloud service account that was deleted recently. For example,
    *   `deleted:principal://iam.googleapis.com/projects/-/serviceAccounts/my-service-account&#64;iam.gserviceaccount.com?uid=1234567890`.
    *   If the service account is undeleted, this identifier reverts to the
    *   standard identifier for a service account.
+   *
    * * `principalSet://goog/cloudIdentityCustomerId/{customer_id}`: All of the
    *   principals associated with the specified Google Workspace or Cloud
    *   Identity customer ID. For example,
@@ -206,6 +238,7 @@ public interface DenyRuleOrBuilder
    * listed in the `denied_principals`. For example, you could add a Google
    * group to the `denied_principals`, then exclude specific users who belong to
    * that group.
+   *
    * This field can contain the same values as the `denied_principals` field,
    * excluding `principalSet://goog/public:all`, which represents all users on
    * the internet.
@@ -224,6 +257,7 @@ public interface DenyRuleOrBuilder
    * listed in the `denied_principals`. For example, you could add a Google
    * group to the `denied_principals`, then exclude specific users who belong to
    * that group.
+   *
    * This field can contain the same values as the `denied_principals` field,
    * excluding `principalSet://goog/public:all`, which represents all users on
    * the internet.
@@ -242,6 +276,7 @@ public interface DenyRuleOrBuilder
    * listed in the `denied_principals`. For example, you could add a Google
    * group to the `denied_principals`, then exclude specific users who belong to
    * that group.
+   *
    * This field can contain the same values as the `denied_principals` field,
    * excluding `principalSet://goog/public:all`, which represents all users on
    * the internet.
@@ -261,6 +296,7 @@ public interface DenyRuleOrBuilder
    * listed in the `denied_principals`. For example, you could add a Google
    * group to the `denied_principals`, then exclude specific users who belong to
    * that group.
+   *
    * This field can contain the same values as the `denied_principals` field,
    * excluding `principalSet://goog/public:all`, which represents all users on
    * the internet.
@@ -344,6 +380,7 @@ public interface DenyRuleOrBuilder
    * permissions given by `denied_permissions`. If a permission appears in
    * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
    * denied.
+   *
    * The excluded permissions can be specified using the same syntax as
    * `denied_permissions`.
    * </pre>
@@ -361,6 +398,7 @@ public interface DenyRuleOrBuilder
    * permissions given by `denied_permissions`. If a permission appears in
    * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
    * denied.
+   *
    * The excluded permissions can be specified using the same syntax as
    * `denied_permissions`.
    * </pre>
@@ -378,6 +416,7 @@ public interface DenyRuleOrBuilder
    * permissions given by `denied_permissions`. If a permission appears in
    * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
    * denied.
+   *
    * The excluded permissions can be specified using the same syntax as
    * `denied_permissions`.
    * </pre>
@@ -396,6 +435,7 @@ public interface DenyRuleOrBuilder
    * permissions given by `denied_permissions`. If a permission appears in
    * `denied_permissions` _and_ in `exception_permissions` then it will _not_ be
    * denied.
+   *
    * The excluded permissions can be specified using the same syntax as
    * `denied_permissions`.
    * </pre>
@@ -414,8 +454,10 @@ public interface DenyRuleOrBuilder
    * The condition that determines whether this deny rule applies to a request.
    * If the condition expression evaluates to `true`, then the deny rule is
    * applied; otherwise, the deny rule is not applied.
+   *
    * Each deny rule is evaluated independently. If this deny rule does not apply
    * to a request, other deny rules might still apply.
+   *
    * The condition can use CEL functions that evaluate
    * [resource
    * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
@@ -434,8 +476,10 @@ public interface DenyRuleOrBuilder
    * The condition that determines whether this deny rule applies to a request.
    * If the condition expression evaluates to `true`, then the deny rule is
    * applied; otherwise, the deny rule is not applied.
+   *
    * Each deny rule is evaluated independently. If this deny rule does not apply
    * to a request, other deny rules might still apply.
+   *
    * The condition can use CEL functions that evaluate
    * [resource
    * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
@@ -454,8 +498,10 @@ public interface DenyRuleOrBuilder
    * The condition that determines whether this deny rule applies to a request.
    * If the condition expression evaluates to `true`, then the deny rule is
    * applied; otherwise, the deny rule is not applied.
+   *
    * Each deny rule is evaluated independently. If this deny rule does not apply
    * to a request, other deny rules might still apply.
+   *
    * The condition can use CEL functions that evaluate
    * [resource
    * tags](https://cloud.google.com/iam/help/conditions/resource-tags). Other
diff --git a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/GetPolicyRequest.java b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/GetPolicyRequest.java
index fbe4827adc..31ac088455 100644
--- a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/GetPolicyRequest.java
+++ b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/GetPolicyRequest.java
@@ -47,11 +47,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new GetPolicyRequest();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v2beta.PolicyProto
         .internal_static_google_iam_v2beta_GetPolicyRequest_descriptor;
@@ -77,9 +72,12 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
    * <pre>
    * Required. The resource name of the policy to retrieve. Format:
    * `policies/{attachment_point}/denypolicies/{policy_id}`
+   *
+   *
    * Use the URL-encoded full resource name, which means that the forward-slash
    * character, `/`, must be written as `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
@@ -106,9 +104,12 @@ public java.lang.String getName() {
    * <pre>
    * Required. The resource name of the policy to retrieve. Format:
    * `policies/{attachment_point}/denypolicies/{policy_id}`
+   *
+   *
    * Use the URL-encoded full resource name, which means that the forward-slash
    * character, `/`, must be written as `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
@@ -369,39 +370,6 @@ private void buildPartial0(com.google.iam.v2beta.GetPolicyRequest result) {
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v2beta.GetPolicyRequest) {
@@ -477,9 +445,12 @@ public Builder mergeFrom(
      * <pre>
      * Required. The resource name of the policy to retrieve. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * Use the URL-encoded full resource name, which means that the forward-slash
      * character, `/`, must be written as `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -505,9 +476,12 @@ public java.lang.String getName() {
      * <pre>
      * Required. The resource name of the policy to retrieve. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * Use the URL-encoded full resource name, which means that the forward-slash
      * character, `/`, must be written as `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -533,9 +507,12 @@ public com.google.protobuf.ByteString getNameBytes() {
      * <pre>
      * Required. The resource name of the policy to retrieve. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * Use the URL-encoded full resource name, which means that the forward-slash
      * character, `/`, must be written as `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -560,9 +537,12 @@ public Builder setName(java.lang.String value) {
      * <pre>
      * Required. The resource name of the policy to retrieve. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * Use the URL-encoded full resource name, which means that the forward-slash
      * character, `/`, must be written as `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -583,9 +563,12 @@ public Builder clearName() {
      * <pre>
      * Required. The resource name of the policy to retrieve. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * Use the URL-encoded full resource name, which means that the forward-slash
      * character, `/`, must be written as `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
diff --git a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/GetPolicyRequestOrBuilder.java b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/GetPolicyRequestOrBuilder.java
index def786214b..589313315d 100644
--- a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/GetPolicyRequestOrBuilder.java
+++ b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/GetPolicyRequestOrBuilder.java
@@ -29,9 +29,12 @@ public interface GetPolicyRequestOrBuilder
    * <pre>
    * Required. The resource name of the policy to retrieve. Format:
    * `policies/{attachment_point}/denypolicies/{policy_id}`
+   *
+   *
    * Use the URL-encoded full resource name, which means that the forward-slash
    * character, `/`, must be written as `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
@@ -47,9 +50,12 @@ public interface GetPolicyRequestOrBuilder
    * <pre>
    * Required. The resource name of the policy to retrieve. Format:
    * `policies/{attachment_point}/denypolicies/{policy_id}`
+   *
+   *
    * Use the URL-encoded full resource name, which means that the forward-slash
    * character, `/`, must be written as `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-policy`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
diff --git a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/ListPoliciesRequest.java b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/ListPoliciesRequest.java
index 36db2f0ff0..24ce49a716 100644
--- a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/ListPoliciesRequest.java
+++ b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/ListPoliciesRequest.java
@@ -48,11 +48,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new ListPoliciesRequest();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v2beta.PolicyProto
         .internal_static_google_iam_v2beta_ListPoliciesRequest_descriptor;
@@ -79,10 +74,13 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
    * Required. The resource that the policy is attached to, along with the kind of policy
    * to list. Format:
    * `policies/{attachment_point}/denypolicies`
+   *
+   *
    * The attachment point is identified by its URL-encoded full resource name,
    * which means that the forward-slash character, `/`, must be written as
    * `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
@@ -110,10 +108,13 @@ public java.lang.String getParent() {
    * Required. The resource that the policy is attached to, along with the kind of policy
    * to list. Format:
    * `policies/{attachment_point}/denypolicies`
+   *
+   *
    * The attachment point is identified by its URL-encoded full resource name,
    * which means that the forward-slash character, `/`, must be written as
    * `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
@@ -473,39 +474,6 @@ private void buildPartial0(com.google.iam.v2beta.ListPoliciesRequest result) {
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v2beta.ListPoliciesRequest) {
@@ -602,10 +570,13 @@ public Builder mergeFrom(
      * Required. The resource that the policy is attached to, along with the kind of policy
      * to list. Format:
      * `policies/{attachment_point}/denypolicies`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -632,10 +603,13 @@ public java.lang.String getParent() {
      * Required. The resource that the policy is attached to, along with the kind of policy
      * to list. Format:
      * `policies/{attachment_point}/denypolicies`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -662,10 +636,13 @@ public com.google.protobuf.ByteString getParentBytes() {
      * Required. The resource that the policy is attached to, along with the kind of policy
      * to list. Format:
      * `policies/{attachment_point}/denypolicies`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -691,10 +668,13 @@ public Builder setParent(java.lang.String value) {
      * Required. The resource that the policy is attached to, along with the kind of policy
      * to list. Format:
      * `policies/{attachment_point}/denypolicies`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
@@ -716,10 +696,13 @@ public Builder clearParent() {
      * Required. The resource that the policy is attached to, along with the kind of policy
      * to list. Format:
      * `policies/{attachment_point}/denypolicies`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, you can use the alphanumeric or the numeric ID.
      * </pre>
diff --git a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/ListPoliciesRequestOrBuilder.java b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/ListPoliciesRequestOrBuilder.java
index 3090b50243..1370a31505 100644
--- a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/ListPoliciesRequestOrBuilder.java
+++ b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/ListPoliciesRequestOrBuilder.java
@@ -30,10 +30,13 @@ public interface ListPoliciesRequestOrBuilder
    * Required. The resource that the policy is attached to, along with the kind of policy
    * to list. Format:
    * `policies/{attachment_point}/denypolicies`
+   *
+   *
    * The attachment point is identified by its URL-encoded full resource name,
    * which means that the forward-slash character, `/`, must be written as
    * `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
@@ -50,10 +53,13 @@ public interface ListPoliciesRequestOrBuilder
    * Required. The resource that the policy is attached to, along with the kind of policy
    * to list. Format:
    * `policies/{attachment_point}/denypolicies`
+   *
+   *
    * The attachment point is identified by its URL-encoded full resource name,
    * which means that the forward-slash character, `/`, must be written as
    * `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, you can use the alphanumeric or the numeric ID.
    * </pre>
diff --git a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/ListPoliciesResponse.java b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/ListPoliciesResponse.java
index 423bc3f3ff..388e703aa4 100644
--- a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/ListPoliciesResponse.java
+++ b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/ListPoliciesResponse.java
@@ -48,11 +48,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new ListPoliciesResponse();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v2beta.PolicyProto
         .internal_static_google_iam_v2beta_ListPoliciesResponse_descriptor;
@@ -463,39 +458,6 @@ private void buildPartial0(com.google.iam.v2beta.ListPoliciesResponse result) {
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v2beta.ListPoliciesResponse) {
diff --git a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/Policy.java b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/Policy.java
index 55ce515fb5..708315bd33 100644
--- a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/Policy.java
+++ b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/Policy.java
@@ -52,11 +52,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new Policy();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v2beta.PolicyProto.internal_static_google_iam_v2beta_Policy_descriptor;
   }
@@ -91,10 +86,13 @@ protected com.google.protobuf.MapField internalGetMapField(int number) {
    * <pre>
    * Immutable. The resource name of the `Policy`, which must be unique. Format:
    * `policies/{attachment_point}/denypolicies/{policy_id}`
+   *
+   *
    * The attachment point is identified by its URL-encoded full resource name,
    * which means that the forward-slash character, `/`, must be written as
    * `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-deny-policy`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, requests can use the alphanumeric or the numeric ID.
    * Responses always contain the numeric ID.
@@ -122,10 +120,13 @@ public java.lang.String getName() {
    * <pre>
    * Immutable. The resource name of the `Policy`, which must be unique. Format:
    * `policies/{attachment_point}/denypolicies/{policy_id}`
+   *
+   *
    * The attachment point is identified by its URL-encoded full resource name,
    * which means that the forward-slash character, `/`, must be written as
    * `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-deny-policy`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, requests can use the alphanumeric or the numeric ID.
    * Responses always contain the numeric ID.
@@ -423,6 +424,7 @@ public java.lang.String getAnnotationsOrThrow(java.lang.String key) {
    * An opaque tag that identifies the current version of the `Policy`. IAM uses
    * this value to help manage concurrent updates, so they do not cause one
    * update to be overwritten by another.
+   *
    * If this field is present in a [CreatePolicy][] request, the value is
    * ignored.
    * </pre>
@@ -450,6 +452,7 @@ public java.lang.String getEtag() {
    * An opaque tag that identifies the current version of the `Policy`. IAM uses
    * this value to help manage concurrent updates, so they do not cause one
    * update to be overwritten by another.
+   *
    * If this field is present in a [CreatePolicy][] request, the value is
    * ignored.
    * </pre>
@@ -1119,39 +1122,6 @@ private void buildPartial0(com.google.iam.v2beta.Policy result) {
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v2beta.Policy) {
@@ -1351,10 +1321,13 @@ public Builder mergeFrom(
      * <pre>
      * Immutable. The resource name of the `Policy`, which must be unique. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-deny-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, requests can use the alphanumeric or the numeric ID.
      * Responses always contain the numeric ID.
@@ -1381,10 +1354,13 @@ public java.lang.String getName() {
      * <pre>
      * Immutable. The resource name of the `Policy`, which must be unique. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-deny-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, requests can use the alphanumeric or the numeric ID.
      * Responses always contain the numeric ID.
@@ -1411,10 +1387,13 @@ public com.google.protobuf.ByteString getNameBytes() {
      * <pre>
      * Immutable. The resource name of the `Policy`, which must be unique. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-deny-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, requests can use the alphanumeric or the numeric ID.
      * Responses always contain the numeric ID.
@@ -1440,10 +1419,13 @@ public Builder setName(java.lang.String value) {
      * <pre>
      * Immutable. The resource name of the `Policy`, which must be unique. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-deny-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, requests can use the alphanumeric or the numeric ID.
      * Responses always contain the numeric ID.
@@ -1465,10 +1447,13 @@ public Builder clearName() {
      * <pre>
      * Immutable. The resource name of the `Policy`, which must be unique. Format:
      * `policies/{attachment_point}/denypolicies/{policy_id}`
+     *
+     *
      * The attachment point is identified by its URL-encoded full resource name,
      * which means that the forward-slash character, `/`, must be written as
      * `%2F`. For example,
      * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-deny-policy`.
+     *
      * For organizations and folders, use the numeric ID in the full resource
      * name. For projects, requests can use the alphanumeric or the numeric ID.
      * Responses always contain the numeric ID.
@@ -1999,6 +1984,7 @@ public Builder putAllAnnotations(java.util.Map<java.lang.String, java.lang.Strin
      * An opaque tag that identifies the current version of the `Policy`. IAM uses
      * this value to help manage concurrent updates, so they do not cause one
      * update to be overwritten by another.
+     *
      * If this field is present in a [CreatePolicy][] request, the value is
      * ignored.
      * </pre>
@@ -2025,6 +2011,7 @@ public java.lang.String getEtag() {
      * An opaque tag that identifies the current version of the `Policy`. IAM uses
      * this value to help manage concurrent updates, so they do not cause one
      * update to be overwritten by another.
+     *
      * If this field is present in a [CreatePolicy][] request, the value is
      * ignored.
      * </pre>
@@ -2051,6 +2038,7 @@ public com.google.protobuf.ByteString getEtagBytes() {
      * An opaque tag that identifies the current version of the `Policy`. IAM uses
      * this value to help manage concurrent updates, so they do not cause one
      * update to be overwritten by another.
+     *
      * If this field is present in a [CreatePolicy][] request, the value is
      * ignored.
      * </pre>
@@ -2076,6 +2064,7 @@ public Builder setEtag(java.lang.String value) {
      * An opaque tag that identifies the current version of the `Policy`. IAM uses
      * this value to help manage concurrent updates, so they do not cause one
      * update to be overwritten by another.
+     *
      * If this field is present in a [CreatePolicy][] request, the value is
      * ignored.
      * </pre>
@@ -2097,6 +2086,7 @@ public Builder clearEtag() {
      * An opaque tag that identifies the current version of the `Policy`. IAM uses
      * this value to help manage concurrent updates, so they do not cause one
      * update to be overwritten by another.
+     *
      * If this field is present in a [CreatePolicy][] request, the value is
      * ignored.
      * </pre>
diff --git a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/PolicyOperationMetadata.java b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/PolicyOperationMetadata.java
index 7c1c6a9bb9..e64fe2d448 100644
--- a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/PolicyOperationMetadata.java
+++ b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/PolicyOperationMetadata.java
@@ -45,11 +45,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new PolicyOperationMetadata();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v2beta.PolicyProto
         .internal_static_google_iam_v2beta_PolicyOperationMetadata_descriptor;
@@ -360,39 +355,6 @@ private void buildPartial0(com.google.iam.v2beta.PolicyOperationMetadata result)
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v2beta.PolicyOperationMetadata) {
diff --git a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/PolicyOrBuilder.java b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/PolicyOrBuilder.java
index a1a4d2a7b2..2c6929cd7e 100644
--- a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/PolicyOrBuilder.java
+++ b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/PolicyOrBuilder.java
@@ -29,10 +29,13 @@ public interface PolicyOrBuilder
    * <pre>
    * Immutable. The resource name of the `Policy`, which must be unique. Format:
    * `policies/{attachment_point}/denypolicies/{policy_id}`
+   *
+   *
    * The attachment point is identified by its URL-encoded full resource name,
    * which means that the forward-slash character, `/`, must be written as
    * `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-deny-policy`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, requests can use the alphanumeric or the numeric ID.
    * Responses always contain the numeric ID.
@@ -49,10 +52,13 @@ public interface PolicyOrBuilder
    * <pre>
    * Immutable. The resource name of the `Policy`, which must be unique. Format:
    * `policies/{attachment_point}/denypolicies/{policy_id}`
+   *
+   *
    * The attachment point is identified by its URL-encoded full resource name,
    * which means that the forward-slash character, `/`, must be written as
    * `%2F`. For example,
    * `policies/cloudresourcemanager.googleapis.com%2Fprojects%2Fmy-project/denypolicies/my-deny-policy`.
+   *
    * For organizations and folders, use the numeric ID in the full resource
    * name. For projects, requests can use the alphanumeric or the numeric ID.
    * Responses always contain the numeric ID.
@@ -213,6 +219,7 @@ java.lang.String getAnnotationsOrDefault(
    * An opaque tag that identifies the current version of the `Policy`. IAM uses
    * this value to help manage concurrent updates, so they do not cause one
    * update to be overwritten by another.
+   *
    * If this field is present in a [CreatePolicy][] request, the value is
    * ignored.
    * </pre>
@@ -229,6 +236,7 @@ java.lang.String getAnnotationsOrDefault(
    * An opaque tag that identifies the current version of the `Policy`. IAM uses
    * this value to help manage concurrent updates, so they do not cause one
    * update to be overwritten by another.
+   *
    * If this field is present in a [CreatePolicy][] request, the value is
    * ignored.
    * </pre>
diff --git a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/PolicyProto.java b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/PolicyProto.java
index ac3be8e6d1..fab21840a2 100644
--- a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/PolicyProto.java
+++ b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/PolicyProto.java
@@ -82,59 +82,59 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
           + "ield_behavior.proto\032\034google/iam/v2beta/d"
           + "eny.proto\032#google/longrunning/operations"
           + ".proto\032\037google/protobuf/timestamp.proto\""
-          + "\251\003\n\006Policy\022\021\n\004name\030\001 \001(\tB\003\340A\005\022\020\n\003uid\030\002 \001"
-          + "(\tB\003\340A\005\022\021\n\004kind\030\003 \001(\tB\003\340A\003\022\024\n\014display_na"
-          + "me\030\004 \001(\t\022?\n\013annotations\030\005 \003(\0132*.google.i"
-          + "am.v2beta.Policy.AnnotationsEntry\022\014\n\004eta"
-          + "g\030\006 \001(\t\0224\n\013create_time\030\007 \001(\0132\032.google.pr"
-          + "otobuf.TimestampB\003\340A\003\0224\n\013update_time\030\010 \001"
-          + "(\0132\032.google.protobuf.TimestampB\003\340A\003\0224\n\013d"
-          + "elete_time\030\t \001(\0132\032.google.protobuf.Times"
-          + "tampB\003\340A\003\022,\n\005rules\030\n \003(\0132\035.google.iam.v2"
-          + "beta.PolicyRule\0322\n\020AnnotationsEntry\022\013\n\003k"
-          + "ey\030\001 \001(\t\022\r\n\005value\030\002 \001(\t:\0028\001\"[\n\nPolicyRul"
-          + "e\0220\n\tdeny_rule\030\002 \001(\0132\033.google.iam.v2beta"
-          + ".DenyRuleH\000\022\023\n\013description\030\001 \001(\tB\006\n\004kind"
-          + "\"Q\n\023ListPoliciesRequest\022\023\n\006parent\030\001 \001(\tB"
-          + "\003\340A\002\022\021\n\tpage_size\030\002 \001(\005\022\022\n\npage_token\030\003 "
-          + "\001(\t\"\\\n\024ListPoliciesResponse\022+\n\010policies\030"
-          + "\001 \003(\0132\031.google.iam.v2beta.Policy\022\027\n\017next"
-          + "_page_token\030\002 \001(\t\"%\n\020GetPolicyRequest\022\021\n"
-          + "\004name\030\001 \001(\tB\003\340A\002\"m\n\023CreatePolicyRequest\022"
-          + "\023\n\006parent\030\001 \001(\tB\003\340A\002\022.\n\006policy\030\002 \001(\0132\031.g"
-          + "oogle.iam.v2beta.PolicyB\003\340A\002\022\021\n\tpolicy_i"
-          + "d\030\003 \001(\t\"E\n\023UpdatePolicyRequest\022.\n\006policy"
-          + "\030\001 \001(\0132\031.google.iam.v2beta.PolicyB\003\340A\002\";"
-          + "\n\023DeletePolicyRequest\022\021\n\004name\030\001 \001(\tB\003\340A\002"
-          + "\022\021\n\004etag\030\002 \001(\tB\003\340A\001\"J\n\027PolicyOperationMe"
-          + "tadata\022/\n\013create_time\030\001 \001(\0132\032.google.pro"
-          + "tobuf.Timestamp2\200\007\n\010Policies\022\217\001\n\014ListPol"
-          + "icies\022&.google.iam.v2beta.ListPoliciesRe"
-          + "quest\032\'.google.iam.v2beta.ListPoliciesRe"
-          + "sponse\".\202\323\344\223\002\037\022\035/v2beta/{parent=policies"
-          + "/*/*}\332A\006parent\022y\n\tGetPolicy\022#.google.iam"
-          + ".v2beta.GetPolicyRequest\032\031.google.iam.v2"
-          + "beta.Policy\",\202\323\344\223\002\037\022\035/v2beta/{name=polic"
-          + "ies/*/*/*}\332A\004name\022\302\001\n\014CreatePolicy\022&.goo"
-          + "gle.iam.v2beta.CreatePolicyRequest\032\035.goo"
-          + "gle.longrunning.Operation\"k\202\323\344\223\002\'\"\035/v2be"
-          + "ta/{parent=policies/*/*}:\006policy\332A\027paren"
-          + "t,policy,policy_id\312A!\n\006Policy\022\027PolicyOpe"
-          + "rationMetadata\022\257\001\n\014UpdatePolicy\022&.google"
-          + ".iam.v2beta.UpdatePolicyRequest\032\035.google"
-          + ".longrunning.Operation\"X\202\323\344\223\002.\032$/v2beta/"
-          + "{policy.name=policies/*/*/*}:\006policy\312A!\n"
-          + "\006Policy\022\027PolicyOperationMetadata\022\247\001\n\014Del"
-          + "etePolicy\022&.google.iam.v2beta.DeletePoli"
-          + "cyRequest\032\035.google.longrunning.Operation"
-          + "\"P\202\323\344\223\002\037*\035/v2beta/{name=policies/*/*/*}\332"
-          + "A\004name\312A!\n\006Policy\022\027PolicyOperationMetada"
-          + "ta\032F\312A\022iam.googleapis.com\322A.https://www."
-          + "googleapis.com/auth/cloud-platformB\211\001\n\025c"
-          + "om.google.iam.v2betaB\013PolicyProtoP\001Z-clo"
-          + "ud.google.com/go/iam/apiv2beta/iampb;iam"
-          + "pb\252\002\027Google.Cloud.Iam.V2Beta\312\002\027Google\\Cl"
-          + "oud\\Iam\\V2betab\006proto3"
+          + "\257\003\n\006Policy\022\022\n\004name\030\001 \001(\tB\004\342A\001\005\022\021\n\003uid\030\002 "
+          + "\001(\tB\004\342A\001\005\022\022\n\004kind\030\003 \001(\tB\004\342A\001\003\022\024\n\014display"
+          + "_name\030\004 \001(\t\022?\n\013annotations\030\005 \003(\0132*.googl"
+          + "e.iam.v2beta.Policy.AnnotationsEntry\022\014\n\004"
+          + "etag\030\006 \001(\t\0225\n\013create_time\030\007 \001(\0132\032.google"
+          + ".protobuf.TimestampB\004\342A\001\003\0225\n\013update_time"
+          + "\030\010 \001(\0132\032.google.protobuf.TimestampB\004\342A\001\003"
+          + "\0225\n\013delete_time\030\t \001(\0132\032.google.protobuf."
+          + "TimestampB\004\342A\001\003\022,\n\005rules\030\n \003(\0132\035.google."
+          + "iam.v2beta.PolicyRule\0322\n\020AnnotationsEntr"
+          + "y\022\013\n\003key\030\001 \001(\t\022\r\n\005value\030\002 \001(\t:\0028\001\"[\n\nPol"
+          + "icyRule\0220\n\tdeny_rule\030\002 \001(\0132\033.google.iam."
+          + "v2beta.DenyRuleH\000\022\023\n\013description\030\001 \001(\tB\006"
+          + "\n\004kind\"R\n\023ListPoliciesRequest\022\024\n\006parent\030"
+          + "\001 \001(\tB\004\342A\001\002\022\021\n\tpage_size\030\002 \001(\005\022\022\n\npage_t"
+          + "oken\030\003 \001(\t\"\\\n\024ListPoliciesResponse\022+\n\010po"
+          + "licies\030\001 \003(\0132\031.google.iam.v2beta.Policy\022"
+          + "\027\n\017next_page_token\030\002 \001(\t\"&\n\020GetPolicyReq"
+          + "uest\022\022\n\004name\030\001 \001(\tB\004\342A\001\002\"o\n\023CreatePolicy"
+          + "Request\022\024\n\006parent\030\001 \001(\tB\004\342A\001\002\022/\n\006policy\030"
+          + "\002 \001(\0132\031.google.iam.v2beta.PolicyB\004\342A\001\002\022\021"
+          + "\n\tpolicy_id\030\003 \001(\t\"F\n\023UpdatePolicyRequest"
+          + "\022/\n\006policy\030\001 \001(\0132\031.google.iam.v2beta.Pol"
+          + "icyB\004\342A\001\002\"=\n\023DeletePolicyRequest\022\022\n\004name"
+          + "\030\001 \001(\tB\004\342A\001\002\022\022\n\004etag\030\002 \001(\tB\004\342A\001\001\"J\n\027Poli"
+          + "cyOperationMetadata\022/\n\013create_time\030\001 \001(\013"
+          + "2\032.google.protobuf.Timestamp2\200\007\n\010Policie"
+          + "s\022\217\001\n\014ListPolicies\022&.google.iam.v2beta.L"
+          + "istPoliciesRequest\032\'.google.iam.v2beta.L"
+          + "istPoliciesResponse\".\332A\006parent\202\323\344\223\002\037\022\035/v"
+          + "2beta/{parent=policies/*/*}\022y\n\tGetPolicy"
+          + "\022#.google.iam.v2beta.GetPolicyRequest\032\031."
+          + "google.iam.v2beta.Policy\",\332A\004name\202\323\344\223\002\037\022"
+          + "\035/v2beta/{name=policies/*/*/*}\022\302\001\n\014Creat"
+          + "ePolicy\022&.google.iam.v2beta.CreatePolicy"
+          + "Request\032\035.google.longrunning.Operation\"k"
+          + "\312A!\n\006Policy\022\027PolicyOperationMetadata\332A\027p"
+          + "arent,policy,policy_id\202\323\344\223\002\'\"\035/v2beta/{p"
+          + "arent=policies/*/*}:\006policy\022\257\001\n\014UpdatePo"
+          + "licy\022&.google.iam.v2beta.UpdatePolicyReq"
+          + "uest\032\035.google.longrunning.Operation\"X\312A!"
+          + "\n\006Policy\022\027PolicyOperationMetadata\202\323\344\223\002.\032"
+          + "$/v2beta/{policy.name=policies/*/*/*}:\006p"
+          + "olicy\022\247\001\n\014DeletePolicy\022&.google.iam.v2be"
+          + "ta.DeletePolicyRequest\032\035.google.longrunn"
+          + "ing.Operation\"P\312A!\n\006Policy\022\027PolicyOperat"
+          + "ionMetadata\332A\004name\202\323\344\223\002\037*\035/v2beta/{name="
+          + "policies/*/*/*}\032F\312A\022iam.googleapis.com\322A"
+          + ".https://www.googleapis.com/auth/cloud-p"
+          + "latformB\211\001\n\025com.google.iam.v2betaB\013Polic"
+          + "yProtoP\001Z-cloud.google.com/go/iam/apiv2b"
+          + "eta/iampb;iampb\252\002\027Google.Cloud.Iam.V2Bet"
+          + "a\312\002\027Google\\Cloud\\Iam\\V2betab\006proto3"
     };
     descriptor =
         com.google.protobuf.Descriptors.FileDescriptor.internalBuildGeneratedFileFrom(
diff --git a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/PolicyRule.java b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/PolicyRule.java
index 8da3bc2c5e..c326c9b44e 100644
--- a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/PolicyRule.java
+++ b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/PolicyRule.java
@@ -47,11 +47,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new PolicyRule();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v2beta.PolicyProto
         .internal_static_google_iam_v2beta_PolicyRule_descriptor;
@@ -67,6 +62,8 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
   }
 
   private int kindCase_ = 0;
+
+  @SuppressWarnings("serial")
   private java.lang.Object kind_;
 
   public enum KindCase
@@ -489,39 +486,6 @@ private void buildPartialOneofs(com.google.iam.v2beta.PolicyRule result) {
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v2beta.PolicyRule) {
diff --git a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/PolicyRuleOrBuilder.java b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/PolicyRuleOrBuilder.java
index 1c71f86bff..f6463abdbb 100644
--- a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/PolicyRuleOrBuilder.java
+++ b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/PolicyRuleOrBuilder.java
@@ -85,5 +85,5 @@ public interface PolicyRuleOrBuilder
    */
   com.google.protobuf.ByteString getDescriptionBytes();
 
-  public com.google.iam.v2beta.PolicyRule.KindCase getKindCase();
+  com.google.iam.v2beta.PolicyRule.KindCase getKindCase();
 }
diff --git a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/UpdatePolicyRequest.java b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/UpdatePolicyRequest.java
index 97a01efac9..ef0b3c287f 100644
--- a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/UpdatePolicyRequest.java
+++ b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/UpdatePolicyRequest.java
@@ -45,11 +45,6 @@ protected java.lang.Object newInstance(UnusedPrivateParameter unused) {
     return new UpdatePolicyRequest();
   }
 
-  @java.lang.Override
-  public final com.google.protobuf.UnknownFieldSet getUnknownFields() {
-    return this.unknownFields;
-  }
-
   public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
     return com.google.iam.v2beta.PolicyProto
         .internal_static_google_iam_v2beta_UpdatePolicyRequest_descriptor;
@@ -72,6 +67,7 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
    *
    * <pre>
    * Required. The policy to update.
+   *
    * To prevent conflicting updates, the `etag` value must match the value that
    * is stored in IAM. If the `etag` values do not match, the request fails with
    * a `409` error code and `ABORTED` status.
@@ -90,6 +86,7 @@ public boolean hasPolicy() {
    *
    * <pre>
    * Required. The policy to update.
+   *
    * To prevent conflicting updates, the `etag` value must match the value that
    * is stored in IAM. If the `etag` values do not match, the request fails with
    * a `409` error code and `ABORTED` status.
@@ -108,6 +105,7 @@ public com.google.iam.v2beta.Policy getPolicy() {
    *
    * <pre>
    * Required. The policy to update.
+   *
    * To prevent conflicting updates, the `etag` value must match the value that
    * is stored in IAM. If the `etag` values do not match, the request fails with
    * a `409` error code and `ABORTED` status.
@@ -369,39 +367,6 @@ private void buildPartial0(com.google.iam.v2beta.UpdatePolicyRequest result) {
       }
     }
 
-    @java.lang.Override
-    public Builder clone() {
-      return super.clone();
-    }
-
-    @java.lang.Override
-    public Builder setField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.setField(field, value);
-    }
-
-    @java.lang.Override
-    public Builder clearField(com.google.protobuf.Descriptors.FieldDescriptor field) {
-      return super.clearField(field);
-    }
-
-    @java.lang.Override
-    public Builder clearOneof(com.google.protobuf.Descriptors.OneofDescriptor oneof) {
-      return super.clearOneof(oneof);
-    }
-
-    @java.lang.Override
-    public Builder setRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, int index, java.lang.Object value) {
-      return super.setRepeatedField(field, index, value);
-    }
-
-    @java.lang.Override
-    public Builder addRepeatedField(
-        com.google.protobuf.Descriptors.FieldDescriptor field, java.lang.Object value) {
-      return super.addRepeatedField(field, value);
-    }
-
     @java.lang.Override
     public Builder mergeFrom(com.google.protobuf.Message other) {
       if (other instanceof com.google.iam.v2beta.UpdatePolicyRequest) {
@@ -479,6 +444,7 @@ public Builder mergeFrom(
      *
      * <pre>
      * Required. The policy to update.
+     *
      * To prevent conflicting updates, the `etag` value must match the value that
      * is stored in IAM. If the `etag` values do not match, the request fails with
      * a `409` error code and `ABORTED` status.
@@ -496,6 +462,7 @@ public boolean hasPolicy() {
      *
      * <pre>
      * Required. The policy to update.
+     *
      * To prevent conflicting updates, the `etag` value must match the value that
      * is stored in IAM. If the `etag` values do not match, the request fails with
      * a `409` error code and `ABORTED` status.
@@ -517,6 +484,7 @@ public com.google.iam.v2beta.Policy getPolicy() {
      *
      * <pre>
      * Required. The policy to update.
+     *
      * To prevent conflicting updates, the `etag` value must match the value that
      * is stored in IAM. If the `etag` values do not match, the request fails with
      * a `409` error code and `ABORTED` status.
@@ -542,6 +510,7 @@ public Builder setPolicy(com.google.iam.v2beta.Policy value) {
      *
      * <pre>
      * Required. The policy to update.
+     *
      * To prevent conflicting updates, the `etag` value must match the value that
      * is stored in IAM. If the `etag` values do not match, the request fails with
      * a `409` error code and `ABORTED` status.
@@ -564,6 +533,7 @@ public Builder setPolicy(com.google.iam.v2beta.Policy.Builder builderForValue) {
      *
      * <pre>
      * Required. The policy to update.
+     *
      * To prevent conflicting updates, the `etag` value must match the value that
      * is stored in IAM. If the `etag` values do not match, the request fails with
      * a `409` error code and `ABORTED` status.
@@ -592,6 +562,7 @@ public Builder mergePolicy(com.google.iam.v2beta.Policy value) {
      *
      * <pre>
      * Required. The policy to update.
+     *
      * To prevent conflicting updates, the `etag` value must match the value that
      * is stored in IAM. If the `etag` values do not match, the request fails with
      * a `409` error code and `ABORTED` status.
@@ -614,6 +585,7 @@ public Builder clearPolicy() {
      *
      * <pre>
      * Required. The policy to update.
+     *
      * To prevent conflicting updates, the `etag` value must match the value that
      * is stored in IAM. If the `etag` values do not match, the request fails with
      * a `409` error code and `ABORTED` status.
@@ -631,6 +603,7 @@ public com.google.iam.v2beta.Policy.Builder getPolicyBuilder() {
      *
      * <pre>
      * Required. The policy to update.
+     *
      * To prevent conflicting updates, the `etag` value must match the value that
      * is stored in IAM. If the `etag` values do not match, the request fails with
      * a `409` error code and `ABORTED` status.
@@ -650,6 +623,7 @@ public com.google.iam.v2beta.PolicyOrBuilder getPolicyOrBuilder() {
      *
      * <pre>
      * Required. The policy to update.
+     *
      * To prevent conflicting updates, the `etag` value must match the value that
      * is stored in IAM. If the `etag` values do not match, the request fails with
      * a `409` error code and `ABORTED` status.
diff --git a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/UpdatePolicyRequestOrBuilder.java b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/UpdatePolicyRequestOrBuilder.java
index ffbd2892e1..231607713a 100644
--- a/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/UpdatePolicyRequestOrBuilder.java
+++ b/java-iam/proto-google-iam-v2beta/src/main/java/com/google/iam/v2beta/UpdatePolicyRequestOrBuilder.java
@@ -28,6 +28,7 @@ public interface UpdatePolicyRequestOrBuilder
    *
    * <pre>
    * Required. The policy to update.
+   *
    * To prevent conflicting updates, the `etag` value must match the value that
    * is stored in IAM. If the `etag` values do not match, the request fails with
    * a `409` error code and `ABORTED` status.
@@ -43,6 +44,7 @@ public interface UpdatePolicyRequestOrBuilder
    *
    * <pre>
    * Required. The policy to update.
+   *
    * To prevent conflicting updates, the `etag` value must match the value that
    * is stored in IAM. If the `etag` values do not match, the request fails with
    * a `409` error code and `ABORTED` status.
@@ -58,6 +60,7 @@ public interface UpdatePolicyRequestOrBuilder
    *
    * <pre>
    * Required. The policy to update.
+   *
    * To prevent conflicting updates, the `etag` value must match the value that
    * is stored in IAM. If the `etag` values do not match, the request fails with
    * a `409` error code and `ABORTED` status.