diff --git a/inventory/v1/inventory.proto-descriptor b/inventory/v1/inventory.proto-descriptor
index 51fab870ab..177f941ecc 100644
Binary files a/inventory/v1/inventory.proto-descriptor and b/inventory/v1/inventory.proto-descriptor differ
diff --git a/inventory/v1/service.pb.go b/inventory/v1/service.pb.go
index 7d32d127a7..25d07619a8 100644
--- a/inventory/v1/service.pb.go
+++ b/inventory/v1/service.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // source: service.proto
 
-package tetrate_api_inventory_v1
+package invv1 // import "github.com/tetrateio/tetrate/api/inventory/v1"
 
 import proto "github.com/golang/protobuf/proto"
 import fmt "fmt"
@@ -51,7 +51,7 @@ func (x Service_Kind) String() string {
 	return proto.EnumName(Service_Kind_name, int32(x))
 }
 func (Service_Kind) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_service_9f2b8006ef59627a, []int{0, 0}
+	return fileDescriptor_service_c308603f74b15884, []int{0, 0}
 }
 
 // ServiceStatus represents the health status of this service
@@ -75,7 +75,7 @@ func (x Service_Status) String() string {
 	return proto.EnumName(Service_Status_name, int32(x))
 }
 func (Service_Status) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_service_9f2b8006ef59627a, []int{0, 1}
+	return fileDescriptor_service_c308603f74b15884, []int{0, 1}
 }
 
 // Transport protocols that are currently supported
@@ -105,7 +105,7 @@ func (x PortSpec_Protocol) String() string {
 	return proto.EnumName(PortSpec_Protocol_name, int32(x))
 }
 func (PortSpec_Protocol) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_service_9f2b8006ef59627a, []int{7, 0}
+	return fileDescriptor_service_c308603f74b15884, []int{7, 0}
 }
 
 // Tetrate service definition that uniquely identifies services
@@ -135,7 +135,7 @@ func (m *Service) Reset()         { *m = Service{} }
 func (m *Service) String() string { return proto.CompactTextString(m) }
 func (*Service) ProtoMessage()    {}
 func (*Service) Descriptor() ([]byte, []int) {
-	return fileDescriptor_service_9f2b8006ef59627a, []int{0}
+	return fileDescriptor_service_c308603f74b15884, []int{0}
 }
 func (m *Service) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_Service.Unmarshal(m, b)
@@ -222,7 +222,7 @@ func (m *ListServicesRequest) Reset()         { *m = ListServicesRequest{} }
 func (m *ListServicesRequest) String() string { return proto.CompactTextString(m) }
 func (*ListServicesRequest) ProtoMessage()    {}
 func (*ListServicesRequest) Descriptor() ([]byte, []int) {
-	return fileDescriptor_service_9f2b8006ef59627a, []int{1}
+	return fileDescriptor_service_c308603f74b15884, []int{1}
 }
 func (m *ListServicesRequest) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ListServicesRequest.Unmarshal(m, b)
@@ -254,7 +254,7 @@ func (m *ListServicesResponse) Reset()         { *m = ListServicesResponse{} }
 func (m *ListServicesResponse) String() string { return proto.CompactTextString(m) }
 func (*ListServicesResponse) ProtoMessage()    {}
 func (*ListServicesResponse) Descriptor() ([]byte, []int) {
-	return fileDescriptor_service_9f2b8006ef59627a, []int{2}
+	return fileDescriptor_service_c308603f74b15884, []int{2}
 }
 func (m *ListServicesResponse) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ListServicesResponse.Unmarshal(m, b)
@@ -307,7 +307,7 @@ func (m *Metadata) Reset()         { *m = Metadata{} }
 func (m *Metadata) String() string { return proto.CompactTextString(m) }
 func (*Metadata) ProtoMessage()    {}
 func (*Metadata) Descriptor() ([]byte, []int) {
-	return fileDescriptor_service_9f2b8006ef59627a, []int{3}
+	return fileDescriptor_service_c308603f74b15884, []int{3}
 }
 func (m *Metadata) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_Metadata.Unmarshal(m, b)
@@ -386,7 +386,7 @@ func (m *Cluster) Reset()         { *m = Cluster{} }
 func (m *Cluster) String() string { return proto.CompactTextString(m) }
 func (*Cluster) ProtoMessage()    {}
 func (*Cluster) Descriptor() ([]byte, []int) {
-	return fileDescriptor_service_9f2b8006ef59627a, []int{4}
+	return fileDescriptor_service_c308603f74b15884, []int{4}
 }
 func (m *Cluster) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_Cluster.Unmarshal(m, b)
@@ -448,7 +448,7 @@ func (m *Workload) Reset()         { *m = Workload{} }
 func (m *Workload) String() string { return proto.CompactTextString(m) }
 func (*Workload) ProtoMessage()    {}
 func (*Workload) Descriptor() ([]byte, []int) {
-	return fileDescriptor_service_9f2b8006ef59627a, []int{5}
+	return fileDescriptor_service_c308603f74b15884, []int{5}
 }
 func (m *Workload) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_Workload.Unmarshal(m, b)
@@ -516,7 +516,7 @@ func (m *Endpoint) Reset()         { *m = Endpoint{} }
 func (m *Endpoint) String() string { return proto.CompactTextString(m) }
 func (*Endpoint) ProtoMessage()    {}
 func (*Endpoint) Descriptor() ([]byte, []int) {
-	return fileDescriptor_service_9f2b8006ef59627a, []int{6}
+	return fileDescriptor_service_c308603f74b15884, []int{6}
 }
 func (m *Endpoint) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_Endpoint.Unmarshal(m, b)
@@ -678,8 +678,6 @@ type PortSpec struct {
 	Protocol PortSpec_Protocol `protobuf:"varint,2,opt,name=protocol,proto3,enum=tetrate.api.inventory.v1.PortSpec_Protocol" json:"protocol,omitempty"`
 	// Port facing external network
 	ExternalPort int32 `protobuf:"varint,3,opt,name=external_port,json=externalPort,proto3" json:"external_port,omitempty"`
-	// This service's incoming port redirected to specific target
-	TargetPort int32 `protobuf:"varint,4,opt,name=target_port,json=targetPort,proto3" json:"target_port,omitempty"`
 	// Container port that services this request
 	ContainerPort        int32    `protobuf:"varint,5,opt,name=container_port,json=containerPort,proto3" json:"container_port,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
@@ -691,7 +689,7 @@ func (m *PortSpec) Reset()         { *m = PortSpec{} }
 func (m *PortSpec) String() string { return proto.CompactTextString(m) }
 func (*PortSpec) ProtoMessage()    {}
 func (*PortSpec) Descriptor() ([]byte, []int) {
-	return fileDescriptor_service_9f2b8006ef59627a, []int{7}
+	return fileDescriptor_service_c308603f74b15884, []int{7}
 }
 func (m *PortSpec) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_PortSpec.Unmarshal(m, b)
@@ -732,13 +730,6 @@ func (m *PortSpec) GetExternalPort() int32 {
 	return 0
 }
 
-func (m *PortSpec) GetTargetPort() int32 {
-	if m != nil {
-		return m.TargetPort
-	}
-	return 0
-}
-
 func (m *PortSpec) GetContainerPort() int32 {
 	if m != nil {
 		return m.ContainerPort
@@ -834,63 +825,64 @@ var _InventoryService_serviceDesc = grpc.ServiceDesc{
 	Metadata: "service.proto",
 }
 
-func init() { proto.RegisterFile("service.proto", fileDescriptor_service_9f2b8006ef59627a) }
-
-var fileDescriptor_service_9f2b8006ef59627a = []byte{
-	// 868 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0x94, 0x55, 0x5d, 0x6f, 0xe3, 0x44,
-	0x14, 0x5d, 0xe7, 0xd3, 0xb9, 0x4d, 0x42, 0x34, 0x14, 0x64, 0x85, 0x95, 0x76, 0x31, 0x1f, 0xaa,
-	0x84, 0x70, 0xd8, 0x80, 0xaa, 0x65, 0xd1, 0xc2, 0x76, 0x4b, 0xd8, 0x16, 0xba, 0x4b, 0x34, 0x4d,
-	0x17, 0xf1, 0x54, 0x4d, 0xe3, 0x69, 0x65, 0xd5, 0xf1, 0x18, 0xcf, 0xc4, 0xd0, 0x37, 0x04, 0x2f,
-	0xbc, 0x23, 0x21, 0x1e, 0x79, 0xe7, 0xe7, 0xf0, 0x17, 0xf8, 0x21, 0x5c, 0x8f, 0x67, 0xdc, 0x02,
-	0xcd, 0xa6, 0xfb, 0xe6, 0xb9, 0x73, 0xce, 0x3d, 0x73, 0xe7, 0x9e, 0xb9, 0x86, 0x9e, 0xe4, 0x59,
-	0x1e, 0xcd, 0x79, 0x90, 0x66, 0x42, 0x09, 0xe2, 0x29, 0xae, 0x32, 0xa6, 0x78, 0xc0, 0xd2, 0x28,
-	0x88, 0x92, 0x9c, 0x27, 0x4a, 0x64, 0x17, 0x41, 0x7e, 0x6f, 0x78, 0xfb, 0x4c, 0x88, 0xb3, 0x98,
-	0x8f, 0x70, 0x63, 0xc4, 0x92, 0x44, 0x28, 0xa6, 0x22, 0x91, 0xc8, 0x92, 0x37, 0xbc, 0x63, 0x76,
-	0xf5, 0xea, 0x64, 0x79, 0x3a, 0x52, 0xd1, 0x82, 0x4b, 0xc5, 0x16, 0x69, 0x09, 0xf0, 0xff, 0x6c,
-	0x40, 0xfb, 0xb0, 0x94, 0x22, 0x04, 0x1a, 0x09, 0x5b, 0x70, 0xcf, 0xb9, 0xeb, 0x6c, 0x75, 0xa8,
-	0xfe, 0x26, 0x0f, 0xa0, 0x71, 0x1e, 0x25, 0xa1, 0x57, 0xc3, 0x58, 0x7f, 0xfc, 0x6e, 0xb0, 0xea,
-	0x1c, 0x81, 0x49, 0x12, 0x7c, 0x85, 0x68, 0xaa, 0x39, 0xe4, 0x11, 0xb4, 0x50, 0x4a, 0x2d, 0xa5,
-	0x57, 0xd7, 0xec, 0xad, 0xf5, 0xec, 0x43, 0x8d, 0xa7, 0x86, 0x47, 0xee, 0x43, 0x33, 0x15, 0x99,
-	0x92, 0x5e, 0xe3, 0x6e, 0x7d, 0x6b, 0x63, 0xec, 0xaf, 0x4e, 0x30, 0x45, 0xd8, 0x61, 0xca, 0xe7,
-	0xb4, 0x24, 0x90, 0x4f, 0xc1, 0x5d, 0x70, 0xc5, 0x42, 0xa6, 0x98, 0xd7, 0x44, 0xf5, 0x17, 0x92,
-	0x9f, 0x1a, 0x24, 0xad, 0x38, 0xe4, 0x13, 0x68, 0xcf, 0xe3, 0xa5, 0x54, 0x3c, 0xf3, 0x5a, 0x5a,
-	0xfb, 0xcd, 0xd5, 0xf4, 0xdd, 0x12, 0x48, 0x2d, 0xa3, 0x10, 0xff, 0x5e, 0x64, 0xe7, 0xb1, 0x60,
-	0xa1, 0xd7, 0x5e, 0x27, 0xfe, 0x8d, 0x41, 0xd2, 0x8a, 0x43, 0x3e, 0x83, 0x5e, 0xcc, 0xa4, 0x3a,
-	0x5e, 0x88, 0x30, 0x3a, 0x8d, 0x78, 0xe8, 0xb9, 0x3a, 0xc9, 0x30, 0x28, 0xbb, 0x19, 0xd8, 0x6e,
-	0x06, 0x33, 0xdb, 0x4d, 0xda, 0x2d, 0x08, 0x4f, 0x0d, 0xde, 0xff, 0x00, 0x1a, 0x45, 0x1f, 0xc8,
-	0x06, 0x36, 0x77, 0x42, 0x9f, 0xef, 0xef, 0x4e, 0x06, 0xb7, 0x48, 0x1b, 0xea, 0x5f, 0x7e, 0xfd,
-	0x78, 0xe0, 0x60, 0x9f, 0xfb, 0xcf, 0xf7, 0xe9, 0xec, 0x68, 0xe7, 0xc0, 0x6e, 0xd6, 0xfc, 0xb7,
-	0xa1, 0x55, 0xde, 0x3d, 0xe9, 0x41, 0xe7, 0xe8, 0xd9, 0xde, 0x64, 0xe7, 0x60, 0xb6, 0xf7, 0x2d,
-	0xb2, 0x30, 0x85, 0x5d, 0x38, 0xfe, 0x6b, 0xf0, 0xea, 0x41, 0x24, 0x95, 0xe9, 0x96, 0xa4, 0xfc,
-	0xbb, 0x25, 0xea, 0xfb, 0x47, 0xb0, 0xf9, 0xef, 0xb0, 0x4c, 0xd1, 0x82, 0x9c, 0x3c, 0x04, 0xd7,
-	0xd8, 0x58, 0xa2, 0xa9, 0xd6, 0xdc, 0xa2, 0x61, 0xd3, 0x8a, 0xe2, 0xff, 0x58, 0x07, 0xd7, 0xb6,
-	0x86, 0xdc, 0x86, 0x4e, 0x61, 0x48, 0x99, 0xb2, 0xb9, 0x75, 0xe8, 0x65, 0x80, 0xbc, 0x0e, 0xad,
-	0x50, 0x2c, 0x58, 0x94, 0x68, 0xa3, 0x76, 0xa8, 0x59, 0x11, 0x0f, 0xda, 0x39, 0xcf, 0x24, 0xbe,
-	0x08, 0xed, 0xc1, 0x0e, 0xb5, 0x4b, 0xf2, 0x05, 0xb4, 0x62, 0x76, 0xc2, 0x63, 0xeb, 0xad, 0x60,
-	0xbd, 0x3d, 0x82, 0x03, 0x4d, 0x98, 0x24, 0x2a, 0xbb, 0xa0, 0x86, 0x4d, 0x28, 0xc0, 0xe5, 0xb3,
-	0x43, 0xab, 0x15, 0xb9, 0xc6, 0x37, 0xc8, 0xb5, 0x53, 0x91, 0xca, 0x7c, 0x57, 0xb2, 0x90, 0x3e,
-	0xd4, 0xc4, 0x12, 0x7d, 0x57, 0x1c, 0x18, 0xbf, 0x86, 0x1f, 0xc3, 0xc6, 0x15, 0x69, 0x32, 0x80,
-	0xfa, 0x39, 0xbf, 0x30, 0x97, 0x50, 0x7c, 0x92, 0x4d, 0x68, 0xe6, 0x2c, 0x5e, 0x72, 0x53, 0x7d,
-	0xb9, 0x78, 0x50, 0xbb, 0xef, 0x0c, 0x1f, 0xc2, 0x2b, 0xff, 0x51, 0x7a, 0x19, 0xba, 0xff, 0x87,
-	0x03, 0x6d, 0x63, 0xef, 0x6b, 0xc7, 0xc3, 0x23, 0xe8, 0xf0, 0x24, 0x4c, 0x45, 0x94, 0xe0, 0x23,
-	0xad, 0xad, 0x7b, 0xa4, 0x13, 0x03, 0xa5, 0x97, 0xa4, 0xff, 0x7b, 0xbd, 0xfe, 0x92, 0x5e, 0x3f,
-	0x05, 0xd7, 0x3e, 0xa1, 0x6b, 0x8f, 0x38, 0x04, 0x17, 0x73, 0xe4, 0x51, 0x88, 0x4f, 0xb9, 0xac,
-	0xaf, 0x5a, 0x17, 0xb6, 0xc9, 0xf8, 0xd9, 0xa5, 0x3b, 0xcc, 0x4a, 0xe7, 0x11, 0x21, 0x47, 0x6b,
-	0x94, 0x79, 0xf0, 0xdb, 0xff, 0xcd, 0x01, 0xd7, 0x16, 0x80, 0x37, 0xd6, 0x88, 0xd2, 0xfc, 0x23,
-	0x2d, 0xd4, 0xdd, 0xbb, 0x45, 0xf5, 0xca, 0x44, 0xb7, 0xb5, 0x8c, 0x8d, 0x6e, 0x93, 0x37, 0xc0,
-	0x0d, 0x13, 0x79, 0xac, 0x0f, 0xa6, 0x65, 0x70, 0xa7, 0x8d, 0x91, 0x67, 0xc5, 0xe9, 0xb6, 0xa1,
-	0x51, 0x0c, 0x2c, 0xad, 0x74, 0xb3, 0x01, 0xa7, 0xf1, 0x8f, 0x3b, 0xd0, 0x66, 0x61, 0x98, 0x71,
-	0x29, 0xfd, 0x5f, 0x6a, 0xe0, 0xda, 0xdd, 0x6b, 0x6f, 0xe0, 0x89, 0xbe, 0x01, 0x25, 0xe6, 0x22,
-	0x36, 0x73, 0xfc, 0xbd, 0xf5, 0x3a, 0xc1, 0xd4, 0x50, 0x68, 0x45, 0x26, 0x6f, 0x41, 0x8f, 0xff,
-	0x80, 0x56, 0x48, 0x58, 0x7c, 0xac, 0x4f, 0x5d, 0x94, 0xd3, 0xa4, 0x5d, 0x1b, 0x2c, 0xb8, 0xe4,
-	0x0e, 0x6c, 0x28, 0x96, 0x9d, 0x71, 0x75, 0x5c, 0x15, 0xd6, 0xa4, 0x50, 0x86, 0x34, 0xe0, 0x1d,
-	0xe8, 0xcf, 0x45, 0xa2, 0xf0, 0x79, 0xf2, 0xac, 0xc4, 0x34, 0x35, 0xa6, 0x57, 0x45, 0x0b, 0x98,
-	0x3f, 0xc6, 0xaa, 0xac, 0x30, 0x8e, 0xae, 0xd9, 0xee, 0x14, 0xa7, 0x91, 0x0b, 0x8d, 0xbd, 0xd9,
-	0x6c, 0x8a, 0x43, 0x0c, 0xbf, 0x9e, 0xd0, 0xe9, 0xee, 0xa0, 0x46, 0x3a, 0xd0, 0xa4, 0x93, 0xcf,
-	0xf7, 0x0f, 0x07, 0xf5, 0xf1, 0xef, 0x0e, 0x0c, 0xf6, 0x6d, 0x35, 0xf6, 0xb7, 0xf6, 0xb3, 0x03,
-	0xdd, 0xab, 0xe3, 0x89, 0xbc, 0xbf, 0xba, 0xfa, 0x6b, 0xa6, 0xdb, 0x30, 0xb8, 0x29, 0xbc, 0x9c,
-	0x7a, 0xfe, 0xe6, 0x4f, 0x7f, 0xfd, 0xfd, 0x6b, 0xad, 0x4f, 0xba, 0xa3, 0xfc, 0xde, 0xc8, 0x0e,
-	0xb3, 0x93, 0x96, 0xbe, 0xc5, 0x0f, 0xff, 0x09, 0x00, 0x00, 0xff, 0xff, 0x4b, 0x37, 0x9f, 0x16,
-	0xd9, 0x07, 0x00, 0x00,
+func init() { proto.RegisterFile("service.proto", fileDescriptor_service_c308603f74b15884) }
+
+var fileDescriptor_service_c308603f74b15884 = []byte{
+	// 882 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x94, 0x55, 0xdd, 0x6e, 0xe3, 0x44,
+	0x14, 0xae, 0x13, 0x27, 0x76, 0x4e, 0x93, 0x60, 0x0d, 0x05, 0x59, 0x61, 0x25, 0x8a, 0xf9, 0x51,
+	0x25, 0x84, 0x43, 0xb3, 0x50, 0x2d, 0xbb, 0x5a, 0xd8, 0xb6, 0x84, 0x4d, 0xa1, 0xbb, 0x44, 0x93,
+	0x74, 0x11, 0xdc, 0x54, 0xd3, 0x78, 0x5a, 0x46, 0x75, 0x66, 0x8c, 0x67, 0x62, 0xe8, 0x1d, 0x82,
+	0x47, 0x40, 0x42, 0x5c, 0x72, 0xcf, 0xe3, 0xf0, 0x0a, 0x48, 0xbc, 0x06, 0xf2, 0x78, 0x26, 0x2d,
+	0xd0, 0x6e, 0xba, 0x77, 0x73, 0xc6, 0xe7, 0xfb, 0xbe, 0x33, 0x73, 0xbe, 0x39, 0x86, 0x8e, 0xa4,
+	0x79, 0xc1, 0x66, 0x34, 0xce, 0x72, 0xa1, 0x04, 0x0a, 0x15, 0x55, 0x39, 0x51, 0x34, 0x26, 0x19,
+	0x8b, 0x19, 0x2f, 0x28, 0x57, 0x22, 0xbf, 0x88, 0x8b, 0xed, 0xde, 0x9d, 0x33, 0x21, 0xce, 0x52,
+	0xda, 0x27, 0x19, 0xeb, 0x13, 0xce, 0x85, 0x22, 0x8a, 0x09, 0x2e, 0x2b, 0x5c, 0xef, 0x75, 0xf3,
+	0x55, 0x47, 0x27, 0x8b, 0xd3, 0xbe, 0x62, 0x73, 0x2a, 0x15, 0x99, 0x67, 0x55, 0x42, 0xf4, 0x87,
+	0x0b, 0xde, 0xa4, 0x92, 0x42, 0x08, 0x5c, 0x4e, 0xe6, 0x34, 0x74, 0x36, 0x9d, 0xad, 0x16, 0xd6,
+	0x6b, 0x74, 0x1f, 0xdc, 0x73, 0xc6, 0x93, 0xb0, 0xb6, 0xe9, 0x6c, 0x75, 0x07, 0xef, 0xc4, 0x37,
+	0xd5, 0x11, 0x1b, 0x92, 0xf8, 0x0b, 0xc6, 0x13, 0xac, 0x31, 0xe8, 0x11, 0x34, 0xa5, 0x22, 0x6a,
+	0x21, 0xc3, 0xba, 0x46, 0x6f, 0xad, 0x46, 0x4f, 0x74, 0x3e, 0x36, 0x38, 0x74, 0x0f, 0x1a, 0x99,
+	0xc8, 0x95, 0x0c, 0xdd, 0xcd, 0xfa, 0xd6, 0xfa, 0x20, 0xba, 0x99, 0x60, 0x2c, 0x72, 0x35, 0xc9,
+	0xe8, 0x0c, 0x57, 0x00, 0xf4, 0x31, 0xf8, 0x73, 0xaa, 0x48, 0x42, 0x14, 0x09, 0x1b, 0x9b, 0xce,
+	0xf3, 0xc1, 0x4f, 0x4c, 0x26, 0x5e, 0x62, 0xd0, 0x03, 0xf0, 0x66, 0xe9, 0x42, 0x2a, 0x9a, 0x87,
+	0x4d, 0xad, 0xfd, 0xc6, 0xcd, 0xf0, 0xfd, 0x2a, 0x11, 0x5b, 0x44, 0x29, 0xfe, 0xbd, 0xc8, 0xcf,
+	0x53, 0x41, 0x92, 0xd0, 0x5b, 0x25, 0xfe, 0x95, 0xc9, 0xc4, 0x4b, 0x0c, 0xfa, 0x04, 0x3a, 0x29,
+	0x91, 0xea, 0x78, 0x2e, 0x12, 0x76, 0xca, 0x68, 0x12, 0xfa, 0x9a, 0xa4, 0x17, 0x57, 0xdd, 0x8c,
+	0x6d, 0x37, 0xe3, 0xa9, 0xed, 0x26, 0x6e, 0x97, 0x80, 0x27, 0x26, 0x3f, 0x7a, 0x1f, 0xdc, 0xb2,
+	0x0f, 0x68, 0x1d, 0xbc, 0xc9, 0x10, 0x3f, 0x3b, 0xd8, 0x1f, 0x06, 0x6b, 0xc8, 0x83, 0xfa, 0xe7,
+	0x5f, 0xee, 0x05, 0x0e, 0x42, 0xd0, 0x7d, 0x76, 0x80, 0xa7, 0x47, 0xbb, 0x87, 0xf6, 0x63, 0x2d,
+	0x7a, 0x0b, 0x9a, 0xd5, 0xdd, 0xa3, 0x0e, 0xb4, 0x8e, 0x9e, 0x8e, 0x86, 0xbb, 0x87, 0xd3, 0xd1,
+	0xd7, 0xc1, 0x5a, 0x49, 0x61, 0x03, 0x27, 0x7a, 0x05, 0x5e, 0x3e, 0x64, 0x52, 0x99, 0x6e, 0x49,
+	0x4c, 0xbf, 0x5b, 0x50, 0xa9, 0xa2, 0x23, 0xd8, 0xf8, 0xf7, 0xb6, 0xcc, 0x04, 0x97, 0x14, 0x3d,
+	0x04, 0xdf, 0xd8, 0x58, 0x86, 0xce, 0xaa, 0x5b, 0x34, 0x68, 0xbc, 0x84, 0x44, 0x3f, 0xd6, 0xc1,
+	0xb7, 0xad, 0x41, 0x77, 0xa0, 0x55, 0x1a, 0x52, 0x66, 0x64, 0x66, 0x1d, 0x7a, 0xb9, 0x81, 0x5e,
+	0x85, 0x66, 0x22, 0xe6, 0x84, 0x71, 0x6d, 0xd4, 0x16, 0x36, 0x11, 0x0a, 0xc1, 0x2b, 0x68, 0x2e,
+	0x99, 0xe0, 0xda, 0x83, 0x2d, 0x6c, 0x43, 0xf4, 0x19, 0x34, 0x53, 0x72, 0x42, 0x53, 0xeb, 0xad,
+	0x78, 0xb5, 0x3d, 0xe2, 0x43, 0x0d, 0x18, 0x72, 0x95, 0x5f, 0x60, 0x83, 0x46, 0x18, 0xe0, 0xf2,
+	0xd9, 0x85, 0x0d, 0xcd, 0x35, 0xb8, 0x05, 0xd7, 0xee, 0x12, 0x54, 0xf1, 0x5d, 0x61, 0x41, 0x5d,
+	0xa8, 0x89, 0x45, 0xd8, 0xd4, 0x05, 0xd7, 0xc4, 0xa2, 0xf7, 0x11, 0xac, 0x5f, 0x91, 0x46, 0x01,
+	0xd4, 0xcf, 0xe9, 0x85, 0xb9, 0x84, 0x72, 0x89, 0x36, 0xa0, 0x51, 0x90, 0x74, 0x41, 0xcd, 0xe9,
+	0xab, 0xe0, 0x7e, 0xed, 0x9e, 0xd3, 0x7b, 0x08, 0x2f, 0xfd, 0x47, 0xe9, 0x45, 0xe0, 0xd1, 0xef,
+	0x0e, 0x78, 0xc6, 0xde, 0xd7, 0x8e, 0x87, 0x47, 0xd0, 0xa2, 0x3c, 0xc9, 0x04, 0xe3, 0x4a, 0x86,
+	0xb5, 0x55, 0x8f, 0x74, 0x68, 0x52, 0xf1, 0x25, 0xe8, 0xff, 0x5e, 0xaf, 0xbf, 0xa0, 0xd7, 0x4f,
+	0xc1, 0xb7, 0x4f, 0xe8, 0xda, 0x12, 0x7b, 0xe0, 0x67, 0xb9, 0x28, 0x58, 0x42, 0x73, 0x73, 0xbe,
+	0x65, 0x5c, 0xda, 0x26, 0xa7, 0x67, 0x97, 0xee, 0x30, 0x91, 0xe6, 0x11, 0x09, 0x0d, 0x5d, 0xc3,
+	0x23, 0x12, 0x1a, 0xfd, 0xea, 0x80, 0x6f, 0x0f, 0x80, 0x36, 0xc0, 0x65, 0x59, 0xf1, 0x81, 0x16,
+	0x6a, 0x8f, 0xd6, 0xb0, 0x8e, 0xcc, 0xee, 0x8e, 0x96, 0xb1, 0xbb, 0x3b, 0xe8, 0x35, 0xf0, 0x13,
+	0x2e, 0x8f, 0x75, 0x61, 0x5a, 0x66, 0xb4, 0x86, 0xbd, 0x84, 0xcb, 0xa7, 0x65, 0x75, 0x3b, 0xe0,
+	0x96, 0x03, 0x4b, 0x2b, 0xdd, 0x6e, 0xc0, 0xe9, 0xfc, 0xbd, 0x16, 0x78, 0x24, 0x49, 0x72, 0x2a,
+	0x65, 0xf4, 0xb7, 0x03, 0xbe, 0xfd, 0x7a, 0xed, 0x0d, 0x3c, 0xd6, 0x37, 0xa0, 0xc4, 0x4c, 0xa4,
+	0x66, 0x8e, 0xbf, 0xbb, 0x5a, 0x27, 0x1e, 0x1b, 0x08, 0x5e, 0x82, 0xd1, 0x9b, 0xd0, 0xa1, 0x3f,
+	0x28, 0x9a, 0x73, 0x92, 0x1e, 0xeb, 0xaa, 0xcb, 0xe3, 0x34, 0x70, 0xdb, 0x6e, 0x96, 0x58, 0xf4,
+	0x36, 0x74, 0x67, 0x82, 0x2b, 0xc2, 0x38, 0xcd, 0xab, 0xac, 0x86, 0xce, 0xea, 0x2c, 0x77, 0xcb,
+	0xb4, 0x68, 0x00, 0xbe, 0x55, 0x28, 0x27, 0xd3, 0x74, 0x7f, 0x1c, 0xac, 0x21, 0x1f, 0xdc, 0xd1,
+	0x74, 0x3a, 0x0e, 0x9c, 0x72, 0xf5, 0x18, 0x8f, 0xf7, 0x83, 0x1a, 0x6a, 0x41, 0x03, 0x0f, 0x3f,
+	0x3d, 0x98, 0x04, 0xf5, 0xc1, 0x6f, 0x0e, 0x04, 0x07, 0xb6, 0x58, 0xfb, 0xd7, 0xfa, 0xd9, 0x81,
+	0xf6, 0xd5, 0xe9, 0x83, 0xde, 0xbb, 0xf9, 0x70, 0xd7, 0x0c, 0xaf, 0x5e, 0x7c, 0xdb, 0xf4, 0x6a,
+	0xa8, 0x45, 0x1b, 0x3f, 0xfd, 0xf9, 0xd7, 0x2f, 0xb5, 0x2e, 0x6a, 0xf7, 0x8b, 0xed, 0xbe, 0x9d,
+	0x55, 0x7b, 0x1f, 0x7e, 0x73, 0xf7, 0x8c, 0xa9, 0x6f, 0x17, 0x27, 0xf1, 0x4c, 0xcc, 0xfb, 0x86,
+	0x91, 0x09, 0xbb, 0xd2, 0xbf, 0xe7, 0x25, 0x77, 0xbf, 0xd8, 0x7e, 0xc0, 0x78, 0x51, 0x6c, 0x9f,
+	0x34, 0xf5, 0xdd, 0xde, 0xfd, 0x27, 0x00, 0x00, 0xff, 0xff, 0x25, 0x12, 0x89, 0xb8, 0xef, 0x07,
+	0x00, 0x00,
 }
diff --git a/inventory/v1/service.proto b/inventory/v1/service.proto
index 7efc3a2cdf..2a35141d5f 100644
--- a/inventory/v1/service.proto
+++ b/inventory/v1/service.proto
@@ -3,7 +3,7 @@
 syntax = "proto3";
 
 package tetrate.api.inventory.v1;
-option go_package = "github.com/tetatrateio/tetrate/api/inventory/v1;invv1";
+option go_package = "github.com/tetrateio/tetrate/api/inventory/v1;invv1";
 
 import "google/api/annotations.proto";
 import "google/protobuf/timestamp.proto";
diff --git a/inventory/v1/team.pb.go b/inventory/v1/team.pb.go
new file mode 100644
index 0000000000..a9d1199580
--- /dev/null
+++ b/inventory/v1/team.pb.go
@@ -0,0 +1,863 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// source: team.proto
+
+package invv1 // import "github.com/tetrateio/tetrate/api/inventory/v1"
+
+import proto "github.com/golang/protobuf/proto"
+import fmt "fmt"
+import math "math"
+import _ "google.golang.org/genproto/googleapis/api/annotations"
+
+import (
+	context "golang.org/x/net/context"
+	grpc "google.golang.org/grpc"
+)
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the proto package it is being compiled against.
+// A compilation error at this line likely means your copy of the
+// proto package needs to be updated.
+const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
+
+// User represents a cloud principal
+// TODO: Are we going to support here just user accounts, or do we want to support
+// other types such as service accounts, applications or other "cloud consumers" ?
+type User struct {
+	// Unique Identifier of the user across clouds
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// Friendly name of the user
+	DisplayName string `protobuf:"bytes,2,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
+	// Groups the user belongs to
+	Groups               []*ResourceRef `protobuf:"bytes,3,rep,name=groups,proto3" json:"groups,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}       `json:"-"`
+	XXX_unrecognized     []byte         `json:"-"`
+	XXX_sizecache        int32          `json:"-"`
+}
+
+func (m *User) Reset()         { *m = User{} }
+func (m *User) String() string { return proto.CompactTextString(m) }
+func (*User) ProtoMessage()    {}
+func (*User) Descriptor() ([]byte, []int) {
+	return fileDescriptor_team_f95abd32fdf5eb00, []int{0}
+}
+func (m *User) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_User.Unmarshal(m, b)
+}
+func (m *User) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_User.Marshal(b, m, deterministic)
+}
+func (dst *User) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_User.Merge(dst, src)
+}
+func (m *User) XXX_Size() int {
+	return xxx_messageInfo_User.Size(m)
+}
+func (m *User) XXX_DiscardUnknown() {
+	xxx_messageInfo_User.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_User proto.InternalMessageInfo
+
+func (m *User) GetName() string {
+	if m != nil {
+		return m.Name
+	}
+	return ""
+}
+
+func (m *User) GetDisplayName() string {
+	if m != nil {
+		return m.DisplayName
+	}
+	return ""
+}
+
+func (m *User) GetGroups() []*ResourceRef {
+	if m != nil {
+		return m.Groups
+	}
+	return nil
+}
+
+// Group represents a logical grouping of entities in a hierarchy.
+// Groups can contain users or other groups. Each group has a parent
+// except th root group.
+type Group struct {
+	// Unique Identifier of the group across clouds
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// Friendly name of the group
+	DisplayName string `protobuf:"bytes,2,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
+	// Group's parents. Will be empty for the root group
+	Parents []*ResourceRef `protobuf:"bytes,4,rep,name=parents,proto3" json:"parents,omitempty"`
+	// List of users that belong to this group
+	Users                []*ResourceRef `protobuf:"bytes,5,rep,name=users,proto3" json:"users,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}       `json:"-"`
+	XXX_unrecognized     []byte         `json:"-"`
+	XXX_sizecache        int32          `json:"-"`
+}
+
+func (m *Group) Reset()         { *m = Group{} }
+func (m *Group) String() string { return proto.CompactTextString(m) }
+func (*Group) ProtoMessage()    {}
+func (*Group) Descriptor() ([]byte, []int) {
+	return fileDescriptor_team_f95abd32fdf5eb00, []int{1}
+}
+func (m *Group) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_Group.Unmarshal(m, b)
+}
+func (m *Group) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_Group.Marshal(b, m, deterministic)
+}
+func (dst *Group) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_Group.Merge(dst, src)
+}
+func (m *Group) XXX_Size() int {
+	return xxx_messageInfo_Group.Size(m)
+}
+func (m *Group) XXX_DiscardUnknown() {
+	xxx_messageInfo_Group.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Group proto.InternalMessageInfo
+
+func (m *Group) GetName() string {
+	if m != nil {
+		return m.Name
+	}
+	return ""
+}
+
+func (m *Group) GetDisplayName() string {
+	if m != nil {
+		return m.DisplayName
+	}
+	return ""
+}
+
+func (m *Group) GetParents() []*ResourceRef {
+	if m != nil {
+		return m.Parents
+	}
+	return nil
+}
+
+func (m *Group) GetUsers() []*ResourceRef {
+	if m != nil {
+		return m.Users
+	}
+	return nil
+}
+
+// Role is a grouping of permissions that can be assigned to groups and users
+type Role struct {
+	// Unique Identifier of the role across clouds
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// Friendly name of the role
+	DisplayName string `protobuf:"bytes,2,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
+	// Permissions granted by this role
+	Permissions          []string `protobuf:"bytes,3,rep,name=permissions,proto3" json:"permissions,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *Role) Reset()         { *m = Role{} }
+func (m *Role) String() string { return proto.CompactTextString(m) }
+func (*Role) ProtoMessage()    {}
+func (*Role) Descriptor() ([]byte, []int) {
+	return fileDescriptor_team_f95abd32fdf5eb00, []int{2}
+}
+func (m *Role) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_Role.Unmarshal(m, b)
+}
+func (m *Role) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_Role.Marshal(b, m, deterministic)
+}
+func (dst *Role) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_Role.Merge(dst, src)
+}
+func (m *Role) XXX_Size() int {
+	return xxx_messageInfo_Role.Size(m)
+}
+func (m *Role) XXX_DiscardUnknown() {
+	xxx_messageInfo_Role.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_Role proto.InternalMessageInfo
+
+func (m *Role) GetName() string {
+	if m != nil {
+		return m.Name
+	}
+	return ""
+}
+
+func (m *Role) GetDisplayName() string {
+	if m != nil {
+		return m.DisplayName
+	}
+	return ""
+}
+
+func (m *Role) GetPermissions() []string {
+	if m != nil {
+		return m.Permissions
+	}
+	return nil
+}
+
+// RoleBinding represents a grant of permissions to a user on certain resources
+type RoleBinding struct {
+	// Represents the resource where the role permissions are applied
+	// to the target entity
+	Resource *ResourceRef `protobuf:"bytes,1,opt,name=resource,proto3" json:"resource,omitempty"`
+	// Role to be assigned to the target entity (user or group)
+	Role *ResourceRef `protobuf:"bytes,2,opt,name=role,proto3" json:"role,omitempty"`
+	// Users or groups that will be granted the permissions of the bound role on the
+	// given resource.
+	Principals           []*ResourceRef `protobuf:"bytes,3,rep,name=principals,proto3" json:"principals,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}       `json:"-"`
+	XXX_unrecognized     []byte         `json:"-"`
+	XXX_sizecache        int32          `json:"-"`
+}
+
+func (m *RoleBinding) Reset()         { *m = RoleBinding{} }
+func (m *RoleBinding) String() string { return proto.CompactTextString(m) }
+func (*RoleBinding) ProtoMessage()    {}
+func (*RoleBinding) Descriptor() ([]byte, []int) {
+	return fileDescriptor_team_f95abd32fdf5eb00, []int{3}
+}
+func (m *RoleBinding) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_RoleBinding.Unmarshal(m, b)
+}
+func (m *RoleBinding) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_RoleBinding.Marshal(b, m, deterministic)
+}
+func (dst *RoleBinding) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_RoleBinding.Merge(dst, src)
+}
+func (m *RoleBinding) XXX_Size() int {
+	return xxx_messageInfo_RoleBinding.Size(m)
+}
+func (m *RoleBinding) XXX_DiscardUnknown() {
+	xxx_messageInfo_RoleBinding.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_RoleBinding proto.InternalMessageInfo
+
+func (m *RoleBinding) GetResource() *ResourceRef {
+	if m != nil {
+		return m.Resource
+	}
+	return nil
+}
+
+func (m *RoleBinding) GetRole() *ResourceRef {
+	if m != nil {
+		return m.Role
+	}
+	return nil
+}
+
+func (m *RoleBinding) GetPrincipals() []*ResourceRef {
+	if m != nil {
+		return m.Principals
+	}
+	return nil
+}
+
+// ResourceRef represents a reference to a cloud resource
+type ResourceRef struct {
+	// Unique Identifier of the resource across clouds
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// (Optional) The friendly name of the resource
+	DisplayName string `protobuf:"bytes,2,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
+	// Type of the resource in the target cloud provider
+	Type                 string   `protobuf:"bytes,3,opt,name=type,proto3" json:"type,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ResourceRef) Reset()         { *m = ResourceRef{} }
+func (m *ResourceRef) String() string { return proto.CompactTextString(m) }
+func (*ResourceRef) ProtoMessage()    {}
+func (*ResourceRef) Descriptor() ([]byte, []int) {
+	return fileDescriptor_team_f95abd32fdf5eb00, []int{4}
+}
+func (m *ResourceRef) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_ResourceRef.Unmarshal(m, b)
+}
+func (m *ResourceRef) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_ResourceRef.Marshal(b, m, deterministic)
+}
+func (dst *ResourceRef) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ResourceRef.Merge(dst, src)
+}
+func (m *ResourceRef) XXX_Size() int {
+	return xxx_messageInfo_ResourceRef.Size(m)
+}
+func (m *ResourceRef) XXX_DiscardUnknown() {
+	xxx_messageInfo_ResourceRef.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ResourceRef proto.InternalMessageInfo
+
+func (m *ResourceRef) GetName() string {
+	if m != nil {
+		return m.Name
+	}
+	return ""
+}
+
+func (m *ResourceRef) GetDisplayName() string {
+	if m != nil {
+		return m.DisplayName
+	}
+	return ""
+}
+
+func (m *ResourceRef) GetType() string {
+	if m != nil {
+		return m.Type
+	}
+	return ""
+}
+
+// ListGroupsRequest requests all existing groups
+type ListGroupsRequest struct {
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListGroupsRequest) Reset()         { *m = ListGroupsRequest{} }
+func (m *ListGroupsRequest) String() string { return proto.CompactTextString(m) }
+func (*ListGroupsRequest) ProtoMessage()    {}
+func (*ListGroupsRequest) Descriptor() ([]byte, []int) {
+	return fileDescriptor_team_f95abd32fdf5eb00, []int{5}
+}
+func (m *ListGroupsRequest) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_ListGroupsRequest.Unmarshal(m, b)
+}
+func (m *ListGroupsRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_ListGroupsRequest.Marshal(b, m, deterministic)
+}
+func (dst *ListGroupsRequest) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListGroupsRequest.Merge(dst, src)
+}
+func (m *ListGroupsRequest) XXX_Size() int {
+	return xxx_messageInfo_ListGroupsRequest.Size(m)
+}
+func (m *ListGroupsRequest) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListGroupsRequest.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListGroupsRequest proto.InternalMessageInfo
+
+// ListGroupsResponse represents a response to the list groups service call
+type ListGroupsResponse struct {
+	// The list of groups
+	Groups               []*Group `protobuf:"bytes,1,rep,name=groups,proto3" json:"groups,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListGroupsResponse) Reset()         { *m = ListGroupsResponse{} }
+func (m *ListGroupsResponse) String() string { return proto.CompactTextString(m) }
+func (*ListGroupsResponse) ProtoMessage()    {}
+func (*ListGroupsResponse) Descriptor() ([]byte, []int) {
+	return fileDescriptor_team_f95abd32fdf5eb00, []int{6}
+}
+func (m *ListGroupsResponse) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_ListGroupsResponse.Unmarshal(m, b)
+}
+func (m *ListGroupsResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_ListGroupsResponse.Marshal(b, m, deterministic)
+}
+func (dst *ListGroupsResponse) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListGroupsResponse.Merge(dst, src)
+}
+func (m *ListGroupsResponse) XXX_Size() int {
+	return xxx_messageInfo_ListGroupsResponse.Size(m)
+}
+func (m *ListGroupsResponse) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListGroupsResponse.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListGroupsResponse proto.InternalMessageInfo
+
+func (m *ListGroupsResponse) GetGroups() []*Group {
+	if m != nil {
+		return m.Groups
+	}
+	return nil
+}
+
+// istUsersRequest requests all existing users
+type ListUsersRequest struct {
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListUsersRequest) Reset()         { *m = ListUsersRequest{} }
+func (m *ListUsersRequest) String() string { return proto.CompactTextString(m) }
+func (*ListUsersRequest) ProtoMessage()    {}
+func (*ListUsersRequest) Descriptor() ([]byte, []int) {
+	return fileDescriptor_team_f95abd32fdf5eb00, []int{7}
+}
+func (m *ListUsersRequest) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_ListUsersRequest.Unmarshal(m, b)
+}
+func (m *ListUsersRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_ListUsersRequest.Marshal(b, m, deterministic)
+}
+func (dst *ListUsersRequest) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListUsersRequest.Merge(dst, src)
+}
+func (m *ListUsersRequest) XXX_Size() int {
+	return xxx_messageInfo_ListUsersRequest.Size(m)
+}
+func (m *ListUsersRequest) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListUsersRequest.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListUsersRequest proto.InternalMessageInfo
+
+// ListUsersResponse represents a response to the list users service call
+type ListUsersResponse struct {
+	// The list of users
+	Users                []*User  `protobuf:"bytes,1,rep,name=users,proto3" json:"users,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListUsersResponse) Reset()         { *m = ListUsersResponse{} }
+func (m *ListUsersResponse) String() string { return proto.CompactTextString(m) }
+func (*ListUsersResponse) ProtoMessage()    {}
+func (*ListUsersResponse) Descriptor() ([]byte, []int) {
+	return fileDescriptor_team_f95abd32fdf5eb00, []int{8}
+}
+func (m *ListUsersResponse) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_ListUsersResponse.Unmarshal(m, b)
+}
+func (m *ListUsersResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_ListUsersResponse.Marshal(b, m, deterministic)
+}
+func (dst *ListUsersResponse) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListUsersResponse.Merge(dst, src)
+}
+func (m *ListUsersResponse) XXX_Size() int {
+	return xxx_messageInfo_ListUsersResponse.Size(m)
+}
+func (m *ListUsersResponse) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListUsersResponse.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListUsersResponse proto.InternalMessageInfo
+
+func (m *ListUsersResponse) GetUsers() []*User {
+	if m != nil {
+		return m.Users
+	}
+	return nil
+}
+
+// ListRolesRequest requests all existing roles
+type ListRolesRequest struct {
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListRolesRequest) Reset()         { *m = ListRolesRequest{} }
+func (m *ListRolesRequest) String() string { return proto.CompactTextString(m) }
+func (*ListRolesRequest) ProtoMessage()    {}
+func (*ListRolesRequest) Descriptor() ([]byte, []int) {
+	return fileDescriptor_team_f95abd32fdf5eb00, []int{9}
+}
+func (m *ListRolesRequest) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_ListRolesRequest.Unmarshal(m, b)
+}
+func (m *ListRolesRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_ListRolesRequest.Marshal(b, m, deterministic)
+}
+func (dst *ListRolesRequest) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListRolesRequest.Merge(dst, src)
+}
+func (m *ListRolesRequest) XXX_Size() int {
+	return xxx_messageInfo_ListRolesRequest.Size(m)
+}
+func (m *ListRolesRequest) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListRolesRequest.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListRolesRequest proto.InternalMessageInfo
+
+// ListRolesResponse represents a response to the list roles service call
+type ListRolesResponse struct {
+	// The list of existing roles
+	Roles                []*Role  `protobuf:"bytes,1,rep,name=roles,proto3" json:"roles,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListRolesResponse) Reset()         { *m = ListRolesResponse{} }
+func (m *ListRolesResponse) String() string { return proto.CompactTextString(m) }
+func (*ListRolesResponse) ProtoMessage()    {}
+func (*ListRolesResponse) Descriptor() ([]byte, []int) {
+	return fileDescriptor_team_f95abd32fdf5eb00, []int{10}
+}
+func (m *ListRolesResponse) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_ListRolesResponse.Unmarshal(m, b)
+}
+func (m *ListRolesResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_ListRolesResponse.Marshal(b, m, deterministic)
+}
+func (dst *ListRolesResponse) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListRolesResponse.Merge(dst, src)
+}
+func (m *ListRolesResponse) XXX_Size() int {
+	return xxx_messageInfo_ListRolesResponse.Size(m)
+}
+func (m *ListRolesResponse) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListRolesResponse.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListRolesResponse proto.InternalMessageInfo
+
+func (m *ListRolesResponse) GetRoles() []*Role {
+	if m != nil {
+		return m.Roles
+	}
+	return nil
+}
+
+// ListRoleBindingsRequest requests all existing role bindings for hte given role across all resources
+type ListRoleBindingsRequest struct {
+	// Identifier of the resource to get the bindings for
+	Name                 string   `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
+}
+
+func (m *ListRoleBindingsRequest) Reset()         { *m = ListRoleBindingsRequest{} }
+func (m *ListRoleBindingsRequest) String() string { return proto.CompactTextString(m) }
+func (*ListRoleBindingsRequest) ProtoMessage()    {}
+func (*ListRoleBindingsRequest) Descriptor() ([]byte, []int) {
+	return fileDescriptor_team_f95abd32fdf5eb00, []int{11}
+}
+func (m *ListRoleBindingsRequest) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_ListRoleBindingsRequest.Unmarshal(m, b)
+}
+func (m *ListRoleBindingsRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_ListRoleBindingsRequest.Marshal(b, m, deterministic)
+}
+func (dst *ListRoleBindingsRequest) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListRoleBindingsRequest.Merge(dst, src)
+}
+func (m *ListRoleBindingsRequest) XXX_Size() int {
+	return xxx_messageInfo_ListRoleBindingsRequest.Size(m)
+}
+func (m *ListRoleBindingsRequest) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListRoleBindingsRequest.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListRoleBindingsRequest proto.InternalMessageInfo
+
+func (m *ListRoleBindingsRequest) GetName() string {
+	if m != nil {
+		return m.Name
+	}
+	return ""
+}
+
+// ListRoleBindingsResponse represents a response to the list role bindings service call
+type ListRoleBindingsResponse struct {
+	// Existing bindings for the requested resource
+	Bindings             []*RoleBinding `protobuf:"bytes,1,rep,name=bindings,proto3" json:"bindings,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}       `json:"-"`
+	XXX_unrecognized     []byte         `json:"-"`
+	XXX_sizecache        int32          `json:"-"`
+}
+
+func (m *ListRoleBindingsResponse) Reset()         { *m = ListRoleBindingsResponse{} }
+func (m *ListRoleBindingsResponse) String() string { return proto.CompactTextString(m) }
+func (*ListRoleBindingsResponse) ProtoMessage()    {}
+func (*ListRoleBindingsResponse) Descriptor() ([]byte, []int) {
+	return fileDescriptor_team_f95abd32fdf5eb00, []int{12}
+}
+func (m *ListRoleBindingsResponse) XXX_Unmarshal(b []byte) error {
+	return xxx_messageInfo_ListRoleBindingsResponse.Unmarshal(m, b)
+}
+func (m *ListRoleBindingsResponse) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {
+	return xxx_messageInfo_ListRoleBindingsResponse.Marshal(b, m, deterministic)
+}
+func (dst *ListRoleBindingsResponse) XXX_Merge(src proto.Message) {
+	xxx_messageInfo_ListRoleBindingsResponse.Merge(dst, src)
+}
+func (m *ListRoleBindingsResponse) XXX_Size() int {
+	return xxx_messageInfo_ListRoleBindingsResponse.Size(m)
+}
+func (m *ListRoleBindingsResponse) XXX_DiscardUnknown() {
+	xxx_messageInfo_ListRoleBindingsResponse.DiscardUnknown(m)
+}
+
+var xxx_messageInfo_ListRoleBindingsResponse proto.InternalMessageInfo
+
+func (m *ListRoleBindingsResponse) GetBindings() []*RoleBinding {
+	if m != nil {
+		return m.Bindings
+	}
+	return nil
+}
+
+func init() {
+	proto.RegisterType((*User)(nil), "tetrate.api.inventory.v1.User")
+	proto.RegisterType((*Group)(nil), "tetrate.api.inventory.v1.Group")
+	proto.RegisterType((*Role)(nil), "tetrate.api.inventory.v1.Role")
+	proto.RegisterType((*RoleBinding)(nil), "tetrate.api.inventory.v1.RoleBinding")
+	proto.RegisterType((*ResourceRef)(nil), "tetrate.api.inventory.v1.ResourceRef")
+	proto.RegisterType((*ListGroupsRequest)(nil), "tetrate.api.inventory.v1.ListGroupsRequest")
+	proto.RegisterType((*ListGroupsResponse)(nil), "tetrate.api.inventory.v1.ListGroupsResponse")
+	proto.RegisterType((*ListUsersRequest)(nil), "tetrate.api.inventory.v1.ListUsersRequest")
+	proto.RegisterType((*ListUsersResponse)(nil), "tetrate.api.inventory.v1.ListUsersResponse")
+	proto.RegisterType((*ListRolesRequest)(nil), "tetrate.api.inventory.v1.ListRolesRequest")
+	proto.RegisterType((*ListRolesResponse)(nil), "tetrate.api.inventory.v1.ListRolesResponse")
+	proto.RegisterType((*ListRoleBindingsRequest)(nil), "tetrate.api.inventory.v1.ListRoleBindingsRequest")
+	proto.RegisterType((*ListRoleBindingsResponse)(nil), "tetrate.api.inventory.v1.ListRoleBindingsResponse")
+}
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ context.Context
+var _ grpc.ClientConn
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+const _ = grpc.SupportPackageIsVersion4
+
+// TeamServiceClient is the client API for TeamService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
+type TeamServiceClient interface {
+	// Gets the existing groups in the target cloud provider
+	ListGroups(ctx context.Context, in *ListGroupsRequest, opts ...grpc.CallOption) (*ListGroupsResponse, error)
+	// Gets the existing users in hte target cloud provider
+	ListUsers(ctx context.Context, in *ListUsersRequest, opts ...grpc.CallOption) (*ListUsersResponse, error)
+	// Get the roles and their bindings
+	// Roles can be global or scoped to certaing groups/IAM entities.
+	ListRoles(ctx context.Context, in *ListRolesRequest, opts ...grpc.CallOption) (*ListRolesResponse, error)
+	// Returns all bindings for the given resource
+	ListRoleBindings(ctx context.Context, in *ListRoleBindingsRequest, opts ...grpc.CallOption) (*ListRoleBindingsResponse, error)
+}
+
+type teamServiceClient struct {
+	cc *grpc.ClientConn
+}
+
+func NewTeamServiceClient(cc *grpc.ClientConn) TeamServiceClient {
+	return &teamServiceClient{cc}
+}
+
+func (c *teamServiceClient) ListGroups(ctx context.Context, in *ListGroupsRequest, opts ...grpc.CallOption) (*ListGroupsResponse, error) {
+	out := new(ListGroupsResponse)
+	err := c.cc.Invoke(ctx, "/tetrate.api.inventory.v1.TeamService/ListGroups", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *teamServiceClient) ListUsers(ctx context.Context, in *ListUsersRequest, opts ...grpc.CallOption) (*ListUsersResponse, error) {
+	out := new(ListUsersResponse)
+	err := c.cc.Invoke(ctx, "/tetrate.api.inventory.v1.TeamService/ListUsers", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *teamServiceClient) ListRoles(ctx context.Context, in *ListRolesRequest, opts ...grpc.CallOption) (*ListRolesResponse, error) {
+	out := new(ListRolesResponse)
+	err := c.cc.Invoke(ctx, "/tetrate.api.inventory.v1.TeamService/ListRoles", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *teamServiceClient) ListRoleBindings(ctx context.Context, in *ListRoleBindingsRequest, opts ...grpc.CallOption) (*ListRoleBindingsResponse, error) {
+	out := new(ListRoleBindingsResponse)
+	err := c.cc.Invoke(ctx, "/tetrate.api.inventory.v1.TeamService/ListRoleBindings", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// TeamServiceServer is the server API for TeamService service.
+type TeamServiceServer interface {
+	// Gets the existing groups in the target cloud provider
+	ListGroups(context.Context, *ListGroupsRequest) (*ListGroupsResponse, error)
+	// Gets the existing users in hte target cloud provider
+	ListUsers(context.Context, *ListUsersRequest) (*ListUsersResponse, error)
+	// Get the roles and their bindings
+	// Roles can be global or scoped to certaing groups/IAM entities.
+	ListRoles(context.Context, *ListRolesRequest) (*ListRolesResponse, error)
+	// Returns all bindings for the given resource
+	ListRoleBindings(context.Context, *ListRoleBindingsRequest) (*ListRoleBindingsResponse, error)
+}
+
+func RegisterTeamServiceServer(s *grpc.Server, srv TeamServiceServer) {
+	s.RegisterService(&_TeamService_serviceDesc, srv)
+}
+
+func _TeamService_ListGroups_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListGroupsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TeamServiceServer).ListGroups(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/tetrate.api.inventory.v1.TeamService/ListGroups",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TeamServiceServer).ListGroups(ctx, req.(*ListGroupsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _TeamService_ListUsers_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListUsersRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TeamServiceServer).ListUsers(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/tetrate.api.inventory.v1.TeamService/ListUsers",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TeamServiceServer).ListUsers(ctx, req.(*ListUsersRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _TeamService_ListRoles_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListRolesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TeamServiceServer).ListRoles(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/tetrate.api.inventory.v1.TeamService/ListRoles",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TeamServiceServer).ListRoles(ctx, req.(*ListRolesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _TeamService_ListRoleBindings_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListRoleBindingsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TeamServiceServer).ListRoleBindings(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/tetrate.api.inventory.v1.TeamService/ListRoleBindings",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TeamServiceServer).ListRoleBindings(ctx, req.(*ListRoleBindingsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+var _TeamService_serviceDesc = grpc.ServiceDesc{
+	ServiceName: "tetrate.api.inventory.v1.TeamService",
+	HandlerType: (*TeamServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "ListGroups",
+			Handler:    _TeamService_ListGroups_Handler,
+		},
+		{
+			MethodName: "ListUsers",
+			Handler:    _TeamService_ListUsers_Handler,
+		},
+		{
+			MethodName: "ListRoles",
+			Handler:    _TeamService_ListRoles_Handler,
+		},
+		{
+			MethodName: "ListRoleBindings",
+			Handler:    _TeamService_ListRoleBindings_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "team.proto",
+}
+
+func init() { proto.RegisterFile("team.proto", fileDescriptor_team_f95abd32fdf5eb00) }
+
+var fileDescriptor_team_f95abd32fdf5eb00 = []byte{
+	// 592 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x9c, 0x55, 0xdd, 0x6a, 0xd4, 0x40,
+	0x14, 0x26, 0x6d, 0x5a, 0xbb, 0x27, 0xbd, 0xb0, 0xa7, 0x88, 0x61, 0x15, 0xad, 0x81, 0x42, 0xb1,
+	0x9a, 0xb0, 0x5b, 0x45, 0xa4, 0x88, 0xb4, 0x20, 0x22, 0xa8, 0x17, 0x51, 0x41, 0x04, 0x29, 0xd9,
+	0xed, 0xb8, 0x0e, 0xec, 0xce, 0x8c, 0x33, 0xb3, 0x91, 0xa5, 0x7a, 0xe3, 0x2b, 0x88, 0x3e, 0x8d,
+	0x4f, 0xa1, 0xaf, 0xe0, 0x83, 0xc8, 0x4c, 0x26, 0xd9, 0xb4, 0x75, 0xbb, 0x3f, 0x77, 0xc3, 0x99,
+	0xf3, 0xfd, 0x24, 0xdf, 0x17, 0x02, 0xa0, 0x49, 0x36, 0x88, 0x85, 0xe4, 0x9a, 0x63, 0xa8, 0x89,
+	0x96, 0x99, 0x26, 0x71, 0x26, 0x68, 0x4c, 0x59, 0x4e, 0x98, 0xe6, 0x72, 0x14, 0xe7, 0xad, 0xe6,
+	0xf5, 0x1e, 0xe7, 0xbd, 0x3e, 0x49, 0x32, 0x41, 0x93, 0x8c, 0x31, 0xae, 0x33, 0x4d, 0x39, 0x53,
+	0x05, 0x2e, 0xfa, 0x02, 0xfe, 0x1b, 0x45, 0x24, 0x22, 0xf8, 0x2c, 0x1b, 0x90, 0xd0, 0xdb, 0xf2,
+	0x76, 0x1a, 0xa9, 0x3d, 0xe3, 0x2d, 0x58, 0x3f, 0xa6, 0x4a, 0xf4, 0xb3, 0xd1, 0x91, 0xbd, 0x5b,
+	0xb2, 0x77, 0x81, 0x9b, 0xbd, 0x34, 0x2b, 0x8f, 0x60, 0xb5, 0x27, 0xf9, 0x50, 0xa8, 0x70, 0x79,
+	0x6b, 0x79, 0x27, 0x68, 0x6f, 0xc7, 0x93, 0x7c, 0xc4, 0x29, 0x51, 0x7c, 0x28, 0xbb, 0x24, 0x25,
+	0x1f, 0x52, 0x07, 0x8a, 0x7e, 0x79, 0xb0, 0xf2, 0xd4, 0x1c, 0x17, 0xd5, 0x7f, 0x0c, 0x97, 0x44,
+	0x26, 0x09, 0xd3, 0x2a, 0xf4, 0xe7, 0x31, 0x50, 0xa2, 0x70, 0x1f, 0x56, 0x86, 0x8a, 0x48, 0x15,
+	0xae, 0xcc, 0x03, 0x2f, 0x30, 0xd1, 0x11, 0xf8, 0x29, 0xef, 0x93, 0x45, 0xcd, 0x6f, 0x41, 0x20,
+	0x88, 0x1c, 0x50, 0xa5, 0x4c, 0x20, 0xf6, 0x0d, 0x36, 0xd2, 0xfa, 0x28, 0xfa, 0xed, 0x41, 0x60,
+	0x14, 0x0e, 0x29, 0x3b, 0xa6, 0xac, 0x87, 0x07, 0xb0, 0x26, 0x9d, 0x0d, 0x2b, 0x36, 0xb3, 0xe1,
+	0x0a, 0x86, 0x0f, 0xc1, 0x97, 0xbc, 0x5f, 0xf8, 0x99, 0x19, 0x6e, 0x21, 0xf8, 0x04, 0x40, 0x48,
+	0xca, 0xba, 0x54, 0x64, 0xfd, 0x39, 0x03, 0xaf, 0x01, 0xa3, 0xb7, 0x10, 0xd4, 0xae, 0x16, 0x7d,
+	0x79, 0x08, 0xbe, 0x1e, 0x09, 0x12, 0x2e, 0x17, 0x30, 0x73, 0x8e, 0x36, 0x61, 0xe3, 0x39, 0x55,
+	0xda, 0x36, 0x4a, 0xa5, 0xe4, 0xd3, 0x90, 0x28, 0x1d, 0xbd, 0x00, 0xac, 0x0f, 0x95, 0xe0, 0x4c,
+	0x11, 0x7c, 0x50, 0x15, 0xd7, 0xb3, 0xcf, 0x71, 0x73, 0xf2, 0x73, 0x58, 0x64, 0x55, 0x59, 0x84,
+	0xcb, 0x86, 0xce, 0x7c, 0x34, 0x95, 0xc4, 0xb3, 0x42, 0xd7, 0xcd, 0x9c, 0xc2, 0xbd, 0xb2, 0x59,
+	0x85, 0xc0, 0x8d, 0xc9, 0x02, 0x06, 0x57, 0x56, 0xca, 0xd1, 0x9b, 0xd0, 0xcf, 0xd2, 0xbb, 0xd9,
+	0x98, 0xde, 0x84, 0x32, 0x03, 0xbd, 0xc1, 0xa5, 0xc5, 0x72, 0x74, 0x17, 0xae, 0x96, 0x54, 0xae,
+	0x53, 0xa5, 0xca, 0xff, 0x72, 0x88, 0xde, 0x43, 0x78, 0x7e, 0xdd, 0x19, 0x38, 0x80, 0xb5, 0x8e,
+	0x9b, 0x39, 0x0f, 0xdb, 0x17, 0x7b, 0x70, 0x0c, 0x69, 0x05, 0x6b, 0xff, 0xf0, 0x21, 0x78, 0x4d,
+	0xb2, 0xc1, 0x2b, 0x22, 0x73, 0xda, 0x25, 0x78, 0x02, 0x30, 0x8e, 0x0a, 0x77, 0x27, 0xd3, 0x9d,
+	0x4b, 0xb9, 0x79, 0x67, 0xb6, 0xe5, 0xc2, 0x7b, 0x84, 0xdf, 0xfe, 0xfc, 0xfd, 0xbe, 0xb4, 0x8e,
+	0x90, 0xe4, 0xad, 0xa4, 0x08, 0x16, 0x3f, 0x43, 0xa3, 0x0a, 0x11, 0x6f, 0x5f, 0x4c, 0x57, 0x4f,
+	0xbf, 0xb9, 0x3b, 0xd3, 0xae, 0x53, 0xde, 0xb0, 0xca, 0x01, 0x36, 0x8c, 0xb2, 0x8d, 0xbc, 0x14,
+	0xb6, 0xf1, 0x4e, 0x13, 0xae, 0xf7, 0x62, 0x9a, 0xf0, 0xa9, 0xbe, 0x9c, 0x16, 0xb6, 0x65, 0xc0,
+	0x9f, 0xde, 0xb8, 0x6c, 0x65, 0xbc, 0xd8, 0x9a, 0x4e, 0x7a, 0xa6, 0x39, 0xcd, 0xf6, 0x3c, 0x10,
+	0x67, 0xe7, 0x9a, 0xb5, 0x73, 0x05, 0x37, 0x8d, 0x9d, 0xb2, 0x10, 0xc9, 0x89, 0x69, 0xdd, 0xd7,
+	0xc3, 0xfb, 0xef, 0xf6, 0x7a, 0x54, 0x7f, 0x1c, 0x76, 0xe2, 0x2e, 0x1f, 0x24, 0x8e, 0x9c, 0xf2,
+	0xf2, 0x64, 0x7f, 0x65, 0x95, 0x4c, 0x92, 0xb7, 0xf6, 0x29, 0xcb, 0xf3, 0x56, 0x67, 0xd5, 0xfe,
+	0xd2, 0xf6, 0xfe, 0x05, 0x00, 0x00, 0xff, 0xff, 0x6c, 0xb3, 0x65, 0xb6, 0x18, 0x07, 0x00, 0x00,
+}
diff --git a/inventory/v1/team.proto b/inventory/v1/team.proto
new file mode 100644
index 0000000000..7dbb586a79
--- /dev/null
+++ b/inventory/v1/team.proto
@@ -0,0 +1,146 @@
+// Copyright (c) Tetrate, Inc 2018 All Rights Reserved.
+syntax = "proto3";
+
+package tetrate.api.inventory.v1;
+option go_package = "github.com/tetrateio/tetrate/api/inventory/v1;invv1";
+
+import "google/api/annotations.proto";
+
+
+// Tetrate Team Service
+service TeamService {
+  // Not all users may belong to a group, so they have to be retrieved separately
+  // and correlated afterwards.
+
+  // Gets the existing groups in the target cloud provider
+  rpc ListGroups(ListGroupsRequest) returns (ListGroupsResponse) {
+    option (google.api.http).get = "/v1/groups";
+  };
+  
+  
+  // Gets the existing users in hte target cloud provider
+  rpc ListUsers(ListUsersRequest) returns (ListUsersResponse) {
+    option (google.api.http).get = "/v1/users";
+  };
+
+  // Get the roles and their bindings
+  // Roles can be global or scoped to certaing groups/IAM entities.
+  rpc ListRoles(ListRolesRequest) returns (ListRolesResponse) {
+    option (google.api.http).get = "/v1/roles";
+  };
+
+  // Returns all bindings for the given resource
+  rpc ListRoleBindings(ListRoleBindingsRequest) returns (ListRoleBindingsResponse) {
+    option (google.api.http).get = "/v1/bindings/{name}";
+  };
+}
+
+// User represents a cloud principal
+// TODO: Are we going to support here just user accounts, or do we want to support
+// other types such as service accounts, applications or other "cloud consumers" ?
+message User {
+  // Unique Identifier of the user across clouds
+  string name = 1;
+
+  // Friendly name of the user
+  string display_name = 2;
+
+  // Groups the user belongs to
+  repeated ResourceRef groups = 3;
+
+  // TODO: User details depending on the types we want to support, if needed
+}
+
+// Group represents a logical grouping of entities in a hierarchy.
+// Groups can contain users or other groups. Each group has a parent
+// except th root group.
+message Group {
+  // Unique Identifier of the group across clouds
+  string name = 1;
+
+  // Friendly name of the group
+  string display_name = 2;
+
+  // Group's parents. Will be empty for the root group
+  repeated ResourceRef parents = 4;
+
+  // List of users that belong to this group
+  repeated ResourceRef users = 5;
+}
+
+// Role is a grouping of permissions that can be assigned to groups and users
+message Role {
+  // Unique Identifier of the role across clouds
+  string name = 1;
+
+  // Friendly name of the role
+  string display_name = 2;
+
+  // Permissions granted by this role
+  repeated string permissions = 3;
+}
+
+// RoleBinding represents a grant of permissions to a user on certain resources
+message RoleBinding {
+  // Represents the resource where the role permissions are applied
+  // to the target entity
+  ResourceRef resource = 1;
+
+  // Role to be assigned to the target entity (user or group)
+  ResourceRef role = 2;
+  
+  // Users or groups that will be granted the permissions of the bound role on the
+  // given resource.
+  repeated ResourceRef principals = 3;
+}
+
+// ResourceRef represents a reference to a cloud resource
+message ResourceRef {
+  // Unique Identifier of the resource across clouds
+  string name = 1;
+
+  // (Optional) The friendly name of the resource
+  string display_name = 2;
+
+  // Type of the resource in the target cloud provider
+  string type = 3;
+}
+
+// ListGroupsRequest requests all existing groups
+message ListGroupsRequest { }
+
+// ListGroupsResponse represents a response to the list groups service call
+message ListGroupsResponse {
+  // The list of groups
+  repeated Group groups = 1;
+}
+
+// istUsersRequest requests all existing users
+message ListUsersRequest { }
+
+// ListUsersResponse represents a response to the list users service call
+message ListUsersResponse {
+  // The list of users
+  repeated User users = 1;
+}
+
+// ListRolesRequest requests all existing roles
+message ListRolesRequest { }
+
+// ListRolesResponse represents a response to the list roles service call
+message ListRolesResponse {
+  // The list of existing roles
+  repeated Role roles = 1;
+}
+
+// ListRoleBindingsRequest requests all existing role bindings for hte given role across all resources
+message ListRoleBindingsRequest {
+  // Identifier of the resource to get the bindings for
+  string name = 1;
+}
+
+// ListRoleBindingsResponse represents a response to the list role bindings service call
+message ListRoleBindingsResponse {
+  // Existing bindings for the requested resource
+  repeated RoleBinding bindings = 1;
+}