diff --git a/proto/kms/api/cmk/registry/tenant_config/v1/tenant_config.pb.go b/proto/kms/api/cmk/registry/tenant_config/v1/tenant_config.pb.go
new file mode 100644
index 0000000..ff93bc1
--- /dev/null
+++ b/proto/kms/api/cmk/registry/tenant_config/v1/tenant_config.pb.go
@@ -0,0 +1,769 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.12
+// 	protoc        v7.36.1
+// source: kms/api/cmk/registry/tenant_config/v1/tenant_config.proto
+
+package tenantconfigv1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	fieldmaskpb "google.golang.org/protobuf/types/known/fieldmaskpb"
+	reflect "reflect"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// TenantConfigStatus represents the reconciliation state of a tenant's configuration.
+// It is used by the orbital job handler in the registry service to track progress.
+type TenantConfigStatus int32
+
+const (
+	TenantConfigStatus_TENANT_CONFIG_STATUS_UNSPECIFIED    TenantConfigStatus = 0
+	TenantConfigStatus_TENANT_CONFIG_STATUS_UPDATING       TenantConfigStatus = 1
+	TenantConfigStatus_TENANT_CONFIG_STATUS_UPDATING_ERROR TenantConfigStatus = 2
+	TenantConfigStatus_TENANT_CONFIG_STATUS_ACTIVE         TenantConfigStatus = 3
+)
+
+// Enum value maps for TenantConfigStatus.
+var (
+	TenantConfigStatus_name = map[int32]string{
+		0: "TENANT_CONFIG_STATUS_UNSPECIFIED",
+		1: "TENANT_CONFIG_STATUS_UPDATING",
+		2: "TENANT_CONFIG_STATUS_UPDATING_ERROR",
+		3: "TENANT_CONFIG_STATUS_ACTIVE",
+	}
+	TenantConfigStatus_value = map[string]int32{
+		"TENANT_CONFIG_STATUS_UNSPECIFIED":    0,
+		"TENANT_CONFIG_STATUS_UPDATING":       1,
+		"TENANT_CONFIG_STATUS_UPDATING_ERROR": 2,
+		"TENANT_CONFIG_STATUS_ACTIVE":         3,
+	}
+)
+
+func (x TenantConfigStatus) Enum() *TenantConfigStatus {
+	p := new(TenantConfigStatus)
+	*p = x
+	return p
+}
+
+func (x TenantConfigStatus) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (TenantConfigStatus) Descriptor() protoreflect.EnumDescriptor {
+	return file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_enumTypes[0].Descriptor()
+}
+
+func (TenantConfigStatus) Type() protoreflect.EnumType {
+	return &file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_enumTypes[0]
+}
+
+func (x TenantConfigStatus) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// TenantConfigAction defines the orbital job types used by the registry service
+// to drive tenant config reconciliation.
+type TenantConfigAction int32
+
+const (
+	TenantConfigAction_TENANT_CONFIG_ACTION_UNSPECIFIED TenantConfigAction = 0
+	TenantConfigAction_TENANT_CONFIG_ACTION_UPDATE      TenantConfigAction = 1
+)
+
+// Enum value maps for TenantConfigAction.
+var (
+	TenantConfigAction_name = map[int32]string{
+		0: "TENANT_CONFIG_ACTION_UNSPECIFIED",
+		1: "TENANT_CONFIG_ACTION_UPDATE",
+	}
+	TenantConfigAction_value = map[string]int32{
+		"TENANT_CONFIG_ACTION_UNSPECIFIED": 0,
+		"TENANT_CONFIG_ACTION_UPDATE":      1,
+	}
+)
+
+func (x TenantConfigAction) Enum() *TenantConfigAction {
+	p := new(TenantConfigAction)
+	*p = x
+	return p
+}
+
+func (x TenantConfigAction) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (TenantConfigAction) Descriptor() protoreflect.EnumDescriptor {
+	return file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_enumTypes[1].Descriptor()
+}
+
+func (TenantConfigAction) Type() protoreflect.EnumType {
+	return &file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_enumTypes[1]
+}
+
+func (x TenantConfigAction) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// TenantConfigurationValues holds the user-settable tenant configuration overrides.
+type TenantConfigurationValues struct {
+	state                  protoimpl.MessageState `protogen:"opaque.v1"`
+	xxx_hidden_SystemLimit int32                  `protobuf:"varint,1,opt,name=system_limit,json=systemLimit"`
+	XXX_raceDetectHookData protoimpl.RaceDetectHookData
+	XXX_presence           [1]uint32
+	unknownFields          protoimpl.UnknownFields
+	sizeCache              protoimpl.SizeCache
+}
+
+func (x *TenantConfigurationValues) Reset() {
+	*x = TenantConfigurationValues{}
+	mi := &file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TenantConfigurationValues) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TenantConfigurationValues) ProtoMessage() {}
+
+func (x *TenantConfigurationValues) ProtoReflect() protoreflect.Message {
+	mi := &file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+func (x *TenantConfigurationValues) GetSystemLimit() int32 {
+	if x != nil {
+		return x.xxx_hidden_SystemLimit
+	}
+	return 0
+}
+
+func (x *TenantConfigurationValues) SetSystemLimit(v int32) {
+	x.xxx_hidden_SystemLimit = v
+	protoimpl.X.SetPresent(&(x.XXX_presence[0]), 0, 1)
+}
+
+func (x *TenantConfigurationValues) HasSystemLimit() bool {
+	if x == nil {
+		return false
+	}
+	return protoimpl.X.Present(&(x.XXX_presence[0]), 0)
+}
+
+func (x *TenantConfigurationValues) ClearSystemLimit() {
+	protoimpl.X.ClearPresent(&(x.XXX_presence[0]), 0)
+	x.xxx_hidden_SystemLimit = 0
+}
+
+type TenantConfigurationValues_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+	// Maximum number of systems allowed per key configuration.
+	// Default: system default (global limit).
+	SystemLimit *int32
+}
+
+func (b0 TenantConfigurationValues_builder) Build() *TenantConfigurationValues {
+	m0 := &TenantConfigurationValues{}
+	b, x := &b0, m0
+	_, _ = b, x
+	if b.SystemLimit != nil {
+		protoimpl.X.SetPresentNonAtomic(&(x.XXX_presence[0]), 0, 1)
+		x.xxx_hidden_SystemLimit = *b.SystemLimit
+	}
+	return m0
+}
+
+type GetTenantConfigRequest struct {
+	state                  protoimpl.MessageState `protogen:"opaque.v1"`
+	xxx_hidden_TenantId    *string                `protobuf:"bytes,1,opt,name=tenant_id,json=tenantId"`
+	XXX_raceDetectHookData protoimpl.RaceDetectHookData
+	XXX_presence           [1]uint32
+	unknownFields          protoimpl.UnknownFields
+	sizeCache              protoimpl.SizeCache
+}
+
+func (x *GetTenantConfigRequest) Reset() {
+	*x = GetTenantConfigRequest{}
+	mi := &file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetTenantConfigRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetTenantConfigRequest) ProtoMessage() {}
+
+func (x *GetTenantConfigRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+func (x *GetTenantConfigRequest) GetTenantId() string {
+	if x != nil {
+		if x.xxx_hidden_TenantId != nil {
+			return *x.xxx_hidden_TenantId
+		}
+		return ""
+	}
+	return ""
+}
+
+func (x *GetTenantConfigRequest) SetTenantId(v string) {
+	x.xxx_hidden_TenantId = &v
+	protoimpl.X.SetPresent(&(x.XXX_presence[0]), 0, 1)
+}
+
+func (x *GetTenantConfigRequest) HasTenantId() bool {
+	if x == nil {
+		return false
+	}
+	return protoimpl.X.Present(&(x.XXX_presence[0]), 0)
+}
+
+func (x *GetTenantConfigRequest) ClearTenantId() {
+	protoimpl.X.ClearPresent(&(x.XXX_presence[0]), 0)
+	x.xxx_hidden_TenantId = nil
+}
+
+type GetTenantConfigRequest_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+	TenantId *string
+}
+
+func (b0 GetTenantConfigRequest_builder) Build() *GetTenantConfigRequest {
+	m0 := &GetTenantConfigRequest{}
+	b, x := &b0, m0
+	_, _ = b, x
+	if b.TenantId != nil {
+		protoimpl.X.SetPresentNonAtomic(&(x.XXX_presence[0]), 0, 1)
+		x.xxx_hidden_TenantId = b.TenantId
+	}
+	return m0
+}
+
+type GetTenantConfigResponse struct {
+	state                   protoimpl.MessageState     `protogen:"opaque.v1"`
+	xxx_hidden_TenantId     *string                    `protobuf:"bytes,1,opt,name=tenant_id,json=tenantId"`
+	xxx_hidden_Values       *TenantConfigurationValues `protobuf:"bytes,2,opt,name=values"`
+	xxx_hidden_Status       TenantConfigStatus         `protobuf:"varint,3,opt,name=status,enum=kms.api.cmk.registry.tenant_config.v1.TenantConfigStatus"`
+	xxx_hidden_ErrorMessage *string                    `protobuf:"bytes,4,opt,name=error_message,json=errorMessage"`
+	xxx_hidden_CreatedAt    *string                    `protobuf:"bytes,5,opt,name=created_at,json=createdAt"`
+	xxx_hidden_UpdatedAt    *string                    `protobuf:"bytes,6,opt,name=updated_at,json=updatedAt"`
+	XXX_raceDetectHookData  protoimpl.RaceDetectHookData
+	XXX_presence            [1]uint32
+	unknownFields           protoimpl.UnknownFields
+	sizeCache               protoimpl.SizeCache
+}
+
+func (x *GetTenantConfigResponse) Reset() {
+	*x = GetTenantConfigResponse{}
+	mi := &file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetTenantConfigResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetTenantConfigResponse) ProtoMessage() {}
+
+func (x *GetTenantConfigResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+func (x *GetTenantConfigResponse) GetTenantId() string {
+	if x != nil {
+		if x.xxx_hidden_TenantId != nil {
+			return *x.xxx_hidden_TenantId
+		}
+		return ""
+	}
+	return ""
+}
+
+func (x *GetTenantConfigResponse) GetValues() *TenantConfigurationValues {
+	if x != nil {
+		return x.xxx_hidden_Values
+	}
+	return nil
+}
+
+func (x *GetTenantConfigResponse) GetStatus() TenantConfigStatus {
+	if x != nil {
+		if protoimpl.X.Present(&(x.XXX_presence[0]), 2) {
+			return x.xxx_hidden_Status
+		}
+	}
+	return TenantConfigStatus_TENANT_CONFIG_STATUS_UNSPECIFIED
+}
+
+func (x *GetTenantConfigResponse) GetErrorMessage() string {
+	if x != nil {
+		if x.xxx_hidden_ErrorMessage != nil {
+			return *x.xxx_hidden_ErrorMessage
+		}
+		return ""
+	}
+	return ""
+}
+
+func (x *GetTenantConfigResponse) GetCreatedAt() string {
+	if x != nil {
+		if x.xxx_hidden_CreatedAt != nil {
+			return *x.xxx_hidden_CreatedAt
+		}
+		return ""
+	}
+	return ""
+}
+
+func (x *GetTenantConfigResponse) GetUpdatedAt() string {
+	if x != nil {
+		if x.xxx_hidden_UpdatedAt != nil {
+			return *x.xxx_hidden_UpdatedAt
+		}
+		return ""
+	}
+	return ""
+}
+
+func (x *GetTenantConfigResponse) SetTenantId(v string) {
+	x.xxx_hidden_TenantId = &v
+	protoimpl.X.SetPresent(&(x.XXX_presence[0]), 0, 6)
+}
+
+func (x *GetTenantConfigResponse) SetValues(v *TenantConfigurationValues) {
+	x.xxx_hidden_Values = v
+}
+
+func (x *GetTenantConfigResponse) SetStatus(v TenantConfigStatus) {
+	x.xxx_hidden_Status = v
+	protoimpl.X.SetPresent(&(x.XXX_presence[0]), 2, 6)
+}
+
+func (x *GetTenantConfigResponse) SetErrorMessage(v string) {
+	x.xxx_hidden_ErrorMessage = &v
+	protoimpl.X.SetPresent(&(x.XXX_presence[0]), 3, 6)
+}
+
+func (x *GetTenantConfigResponse) SetCreatedAt(v string) {
+	x.xxx_hidden_CreatedAt = &v
+	protoimpl.X.SetPresent(&(x.XXX_presence[0]), 4, 6)
+}
+
+func (x *GetTenantConfigResponse) SetUpdatedAt(v string) {
+	x.xxx_hidden_UpdatedAt = &v
+	protoimpl.X.SetPresent(&(x.XXX_presence[0]), 5, 6)
+}
+
+func (x *GetTenantConfigResponse) HasTenantId() bool {
+	if x == nil {
+		return false
+	}
+	return protoimpl.X.Present(&(x.XXX_presence[0]), 0)
+}
+
+func (x *GetTenantConfigResponse) HasValues() bool {
+	if x == nil {
+		return false
+	}
+	return x.xxx_hidden_Values != nil
+}
+
+func (x *GetTenantConfigResponse) HasStatus() bool {
+	if x == nil {
+		return false
+	}
+	return protoimpl.X.Present(&(x.XXX_presence[0]), 2)
+}
+
+func (x *GetTenantConfigResponse) HasErrorMessage() bool {
+	if x == nil {
+		return false
+	}
+	return protoimpl.X.Present(&(x.XXX_presence[0]), 3)
+}
+
+func (x *GetTenantConfigResponse) HasCreatedAt() bool {
+	if x == nil {
+		return false
+	}
+	return protoimpl.X.Present(&(x.XXX_presence[0]), 4)
+}
+
+func (x *GetTenantConfigResponse) HasUpdatedAt() bool {
+	if x == nil {
+		return false
+	}
+	return protoimpl.X.Present(&(x.XXX_presence[0]), 5)
+}
+
+func (x *GetTenantConfigResponse) ClearTenantId() {
+	protoimpl.X.ClearPresent(&(x.XXX_presence[0]), 0)
+	x.xxx_hidden_TenantId = nil
+}
+
+func (x *GetTenantConfigResponse) ClearValues() {
+	x.xxx_hidden_Values = nil
+}
+
+func (x *GetTenantConfigResponse) ClearStatus() {
+	protoimpl.X.ClearPresent(&(x.XXX_presence[0]), 2)
+	x.xxx_hidden_Status = TenantConfigStatus_TENANT_CONFIG_STATUS_UNSPECIFIED
+}
+
+func (x *GetTenantConfigResponse) ClearErrorMessage() {
+	protoimpl.X.ClearPresent(&(x.XXX_presence[0]), 3)
+	x.xxx_hidden_ErrorMessage = nil
+}
+
+func (x *GetTenantConfigResponse) ClearCreatedAt() {
+	protoimpl.X.ClearPresent(&(x.XXX_presence[0]), 4)
+	x.xxx_hidden_CreatedAt = nil
+}
+
+func (x *GetTenantConfigResponse) ClearUpdatedAt() {
+	protoimpl.X.ClearPresent(&(x.XXX_presence[0]), 5)
+	x.xxx_hidden_UpdatedAt = nil
+}
+
+type GetTenantConfigResponse_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+	TenantId     *string
+	Values       *TenantConfigurationValues
+	Status       *TenantConfigStatus
+	ErrorMessage *string
+	CreatedAt    *string
+	UpdatedAt    *string
+}
+
+func (b0 GetTenantConfigResponse_builder) Build() *GetTenantConfigResponse {
+	m0 := &GetTenantConfigResponse{}
+	b, x := &b0, m0
+	_, _ = b, x
+	if b.TenantId != nil {
+		protoimpl.X.SetPresentNonAtomic(&(x.XXX_presence[0]), 0, 6)
+		x.xxx_hidden_TenantId = b.TenantId
+	}
+	x.xxx_hidden_Values = b.Values
+	if b.Status != nil {
+		protoimpl.X.SetPresentNonAtomic(&(x.XXX_presence[0]), 2, 6)
+		x.xxx_hidden_Status = *b.Status
+	}
+	if b.ErrorMessage != nil {
+		protoimpl.X.SetPresentNonAtomic(&(x.XXX_presence[0]), 3, 6)
+		x.xxx_hidden_ErrorMessage = b.ErrorMessage
+	}
+	if b.CreatedAt != nil {
+		protoimpl.X.SetPresentNonAtomic(&(x.XXX_presence[0]), 4, 6)
+		x.xxx_hidden_CreatedAt = b.CreatedAt
+	}
+	if b.UpdatedAt != nil {
+		protoimpl.X.SetPresentNonAtomic(&(x.XXX_presence[0]), 5, 6)
+		x.xxx_hidden_UpdatedAt = b.UpdatedAt
+	}
+	return m0
+}
+
+type UpdateTenantConfigRequest struct {
+	state                  protoimpl.MessageState     `protogen:"opaque.v1"`
+	xxx_hidden_TenantId    *string                    `protobuf:"bytes,1,opt,name=tenant_id,json=tenantId"`
+	xxx_hidden_Values      *TenantConfigurationValues `protobuf:"bytes,2,opt,name=values"`
+	xxx_hidden_UpdateMask  *fieldmaskpb.FieldMask     `protobuf:"bytes,3,opt,name=update_mask,json=updateMask"`
+	XXX_raceDetectHookData protoimpl.RaceDetectHookData
+	XXX_presence           [1]uint32
+	unknownFields          protoimpl.UnknownFields
+	sizeCache              protoimpl.SizeCache
+}
+
+func (x *UpdateTenantConfigRequest) Reset() {
+	*x = UpdateTenantConfigRequest{}
+	mi := &file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateTenantConfigRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateTenantConfigRequest) ProtoMessage() {}
+
+func (x *UpdateTenantConfigRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+func (x *UpdateTenantConfigRequest) GetTenantId() string {
+	if x != nil {
+		if x.xxx_hidden_TenantId != nil {
+			return *x.xxx_hidden_TenantId
+		}
+		return ""
+	}
+	return ""
+}
+
+func (x *UpdateTenantConfigRequest) GetValues() *TenantConfigurationValues {
+	if x != nil {
+		return x.xxx_hidden_Values
+	}
+	return nil
+}
+
+func (x *UpdateTenantConfigRequest) GetUpdateMask() *fieldmaskpb.FieldMask {
+	if x != nil {
+		return x.xxx_hidden_UpdateMask
+	}
+	return nil
+}
+
+func (x *UpdateTenantConfigRequest) SetTenantId(v string) {
+	x.xxx_hidden_TenantId = &v
+	protoimpl.X.SetPresent(&(x.XXX_presence[0]), 0, 3)
+}
+
+func (x *UpdateTenantConfigRequest) SetValues(v *TenantConfigurationValues) {
+	x.xxx_hidden_Values = v
+}
+
+func (x *UpdateTenantConfigRequest) SetUpdateMask(v *fieldmaskpb.FieldMask) {
+	x.xxx_hidden_UpdateMask = v
+}
+
+func (x *UpdateTenantConfigRequest) HasTenantId() bool {
+	if x == nil {
+		return false
+	}
+	return protoimpl.X.Present(&(x.XXX_presence[0]), 0)
+}
+
+func (x *UpdateTenantConfigRequest) HasValues() bool {
+	if x == nil {
+		return false
+	}
+	return x.xxx_hidden_Values != nil
+}
+
+func (x *UpdateTenantConfigRequest) HasUpdateMask() bool {
+	if x == nil {
+		return false
+	}
+	return x.xxx_hidden_UpdateMask != nil
+}
+
+func (x *UpdateTenantConfigRequest) ClearTenantId() {
+	protoimpl.X.ClearPresent(&(x.XXX_presence[0]), 0)
+	x.xxx_hidden_TenantId = nil
+}
+
+func (x *UpdateTenantConfigRequest) ClearValues() {
+	x.xxx_hidden_Values = nil
+}
+
+func (x *UpdateTenantConfigRequest) ClearUpdateMask() {
+	x.xxx_hidden_UpdateMask = nil
+}
+
+type UpdateTenantConfigRequest_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+	TenantId *string
+	// Configuration values to apply. Only fields listed in update_mask are written.
+	Values *TenantConfigurationValues
+	// Controls which fields in values are applied. Only paths listed here are written.
+	// To update a field, include its path and set the desired value in values.
+	// To clear a field back to the system default, include its path in update_mask
+	// but leave it unset in values.
+	UpdateMask *fieldmaskpb.FieldMask
+}
+
+func (b0 UpdateTenantConfigRequest_builder) Build() *UpdateTenantConfigRequest {
+	m0 := &UpdateTenantConfigRequest{}
+	b, x := &b0, m0
+	_, _ = b, x
+	if b.TenantId != nil {
+		protoimpl.X.SetPresentNonAtomic(&(x.XXX_presence[0]), 0, 3)
+		x.xxx_hidden_TenantId = b.TenantId
+	}
+	x.xxx_hidden_Values = b.Values
+	x.xxx_hidden_UpdateMask = b.UpdateMask
+	return m0
+}
+
+type UpdateTenantConfigResponse struct {
+	state         protoimpl.MessageState `protogen:"opaque.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdateTenantConfigResponse) Reset() {
+	*x = UpdateTenantConfigResponse{}
+	mi := &file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateTenantConfigResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateTenantConfigResponse) ProtoMessage() {}
+
+func (x *UpdateTenantConfigResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+type UpdateTenantConfigResponse_builder struct {
+	_ [0]func() // Prevents comparability and use of unkeyed literals for the builder.
+
+}
+
+func (b0 UpdateTenantConfigResponse_builder) Build() *UpdateTenantConfigResponse {
+	m0 := &UpdateTenantConfigResponse{}
+	b, x := &b0, m0
+	_, _ = b, x
+	return m0
+}
+
+var File_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto protoreflect.FileDescriptor
+
+const file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_rawDesc = "" +
+	"\n" +
+	"9kms/api/cmk/registry/tenant_config/v1/tenant_config.proto\x12%kms.api.cmk.registry.tenant_config.v1\x1a google/protobuf/field_mask.proto\"G\n" +
+	"\x19TenantConfigurationValues\x12*\n" +
+	"\fsystem_limit\x18\x01 \x01(\x05B\a\xbaH\x04\x1a\x02(\x01R\vsystemLimit\">\n" +
+	"\x16GetTenantConfigRequest\x12$\n" +
+	"\ttenant_id\x18\x01 \x01(\tB\a\xbaH\x04r\x02\x10\x01R\btenantId\"\xc6\x02\n" +
+	"\x17GetTenantConfigResponse\x12\x1b\n" +
+	"\ttenant_id\x18\x01 \x01(\tR\btenantId\x12X\n" +
+	"\x06values\x18\x02 \x01(\v2@.kms.api.cmk.registry.tenant_config.v1.TenantConfigurationValuesR\x06values\x12Q\n" +
+	"\x06status\x18\x03 \x01(\x0e29.kms.api.cmk.registry.tenant_config.v1.TenantConfigStatusR\x06status\x12#\n" +
+	"\rerror_message\x18\x04 \x01(\tR\ferrorMessage\x12\x1d\n" +
+	"\n" +
+	"created_at\x18\x05 \x01(\tR\tcreatedAt\x12\x1d\n" +
+	"\n" +
+	"updated_at\x18\x06 \x01(\tR\tupdatedAt\"\xd8\x01\n" +
+	"\x19UpdateTenantConfigRequest\x12$\n" +
+	"\ttenant_id\x18\x01 \x01(\tB\a\xbaH\x04r\x02\x10\x01R\btenantId\x12X\n" +
+	"\x06values\x18\x02 \x01(\v2@.kms.api.cmk.registry.tenant_config.v1.TenantConfigurationValuesR\x06values\x12;\n" +
+	"\vupdate_mask\x18\x03 \x01(\v2\x1a.google.protobuf.FieldMaskR\n" +
+	"updateMask\"\x1c\n" +
+	"\x1aUpdateTenantConfigResponse*\xa7\x01\n" +
+	"\x12TenantConfigStatus\x12$\n" +
+	" TENANT_CONFIG_STATUS_UNSPECIFIED\x10\x00\x12!\n" +
+	"\x1dTENANT_CONFIG_STATUS_UPDATING\x10\x01\x12'\n" +
+	"#TENANT_CONFIG_STATUS_UPDATING_ERROR\x10\x02\x12\x1f\n" +
+	"\x1bTENANT_CONFIG_STATUS_ACTIVE\x10\x03*[\n" +
+	"\x12TenantConfigAction\x12$\n" +
+	" TENANT_CONFIG_ACTION_UNSPECIFIED\x10\x00\x12\x1f\n" +
+	"\x1bTENANT_CONFIG_ACTION_UPDATE\x10\x012\xbc\x02\n" +
+	"\aService\x12\x92\x01\n" +
+	"\x0fGetTenantConfig\x12=.kms.api.cmk.registry.tenant_config.v1.GetTenantConfigRequest\x1a>.kms.api.cmk.registry.tenant_config.v1.GetTenantConfigResponse\"\x00\x12\x9b\x01\n" +
+	"\x12UpdateTenantConfig\x12@.kms.api.cmk.registry.tenant_config.v1.UpdateTenantConfigRequest\x1aA.kms.api.cmk.registry.tenant_config.v1.UpdateTenantConfigResponse\"\x00BWZUgithub.com/openkcm/api-sdk/proto/kms/api/cmk/registry/tenant_config/v1;tenantconfigv1b\beditionsp\xe9\az\x1bbuf/validate/validate.proto"
+
+var file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
+var file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_msgTypes = make([]protoimpl.MessageInfo, 5)
+var file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_goTypes = []any{
+	(TenantConfigStatus)(0),            // 0: kms.api.cmk.registry.tenant_config.v1.TenantConfigStatus
+	(TenantConfigAction)(0),            // 1: kms.api.cmk.registry.tenant_config.v1.TenantConfigAction
+	(*TenantConfigurationValues)(nil),  // 2: kms.api.cmk.registry.tenant_config.v1.TenantConfigurationValues
+	(*GetTenantConfigRequest)(nil),     // 3: kms.api.cmk.registry.tenant_config.v1.GetTenantConfigRequest
+	(*GetTenantConfigResponse)(nil),    // 4: kms.api.cmk.registry.tenant_config.v1.GetTenantConfigResponse
+	(*UpdateTenantConfigRequest)(nil),  // 5: kms.api.cmk.registry.tenant_config.v1.UpdateTenantConfigRequest
+	(*UpdateTenantConfigResponse)(nil), // 6: kms.api.cmk.registry.tenant_config.v1.UpdateTenantConfigResponse
+	(*fieldmaskpb.FieldMask)(nil),      // 7: google.protobuf.FieldMask
+}
+var file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_depIdxs = []int32{
+	2, // 0: kms.api.cmk.registry.tenant_config.v1.GetTenantConfigResponse.values:type_name -> kms.api.cmk.registry.tenant_config.v1.TenantConfigurationValues
+	0, // 1: kms.api.cmk.registry.tenant_config.v1.GetTenantConfigResponse.status:type_name -> kms.api.cmk.registry.tenant_config.v1.TenantConfigStatus
+	2, // 2: kms.api.cmk.registry.tenant_config.v1.UpdateTenantConfigRequest.values:type_name -> kms.api.cmk.registry.tenant_config.v1.TenantConfigurationValues
+	7, // 3: kms.api.cmk.registry.tenant_config.v1.UpdateTenantConfigRequest.update_mask:type_name -> google.protobuf.FieldMask
+	3, // 4: kms.api.cmk.registry.tenant_config.v1.Service.GetTenantConfig:input_type -> kms.api.cmk.registry.tenant_config.v1.GetTenantConfigRequest
+	5, // 5: kms.api.cmk.registry.tenant_config.v1.Service.UpdateTenantConfig:input_type -> kms.api.cmk.registry.tenant_config.v1.UpdateTenantConfigRequest
+	4, // 6: kms.api.cmk.registry.tenant_config.v1.Service.GetTenantConfig:output_type -> kms.api.cmk.registry.tenant_config.v1.GetTenantConfigResponse
+	6, // 7: kms.api.cmk.registry.tenant_config.v1.Service.UpdateTenantConfig:output_type -> kms.api.cmk.registry.tenant_config.v1.UpdateTenantConfigResponse
+	6, // [6:8] is the sub-list for method output_type
+	4, // [4:6] is the sub-list for method input_type
+	4, // [4:4] is the sub-list for extension type_name
+	4, // [4:4] is the sub-list for extension extendee
+	0, // [0:4] is the sub-list for field type_name
+}
+
+func init() { file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_init() }
+func file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_init() {
+	if File_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_rawDesc), len(file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_rawDesc)),
+			NumEnums:      2,
+			NumMessages:   5,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_goTypes,
+		DependencyIndexes: file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_depIdxs,
+		EnumInfos:         file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_enumTypes,
+		MessageInfos:      file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_msgTypes,
+	}.Build()
+	File_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto = out.File
+	file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_goTypes = nil
+	file_kms_api_cmk_registry_tenant_config_v1_tenant_config_proto_depIdxs = nil
+}
diff --git a/proto/kms/api/cmk/registry/tenant_config/v1/tenant_config.proto b/proto/kms/api/cmk/registry/tenant_config/v1/tenant_config.proto
new file mode 100644
index 0000000..1530904
--- /dev/null
+++ b/proto/kms/api/cmk/registry/tenant_config/v1/tenant_config.proto
@@ -0,0 +1,62 @@
+edition = "2024";
+
+package kms.api.cmk.registry.tenant_config.v1;
+
+import "google/protobuf/field_mask.proto";
+import option "buf/validate/validate.proto";
+
+option go_package = "github.com/openkcm/api-sdk/proto/kms/api/cmk/registry/tenant_config/v1;tenantconfigv1";
+
+service Service {
+  rpc GetTenantConfig(GetTenantConfigRequest) returns (GetTenantConfigResponse) {}
+  rpc UpdateTenantConfig(UpdateTenantConfigRequest) returns (UpdateTenantConfigResponse) {}
+}
+
+// TenantConfigurationValues holds the user-settable tenant configuration overrides.
+message TenantConfigurationValues {
+  // Maximum number of systems allowed per key configuration.
+  // Default: system default (global limit).
+  int32 system_limit = 1 [(buf.validate.field).int32.gte = 1];
+}
+
+message GetTenantConfigRequest {
+  string tenant_id = 1 [(buf.validate.field).string.min_len = 1];
+}
+
+message GetTenantConfigResponse {
+  string tenant_id = 1;
+  TenantConfigurationValues values = 2;
+  TenantConfigStatus status = 3;
+  string error_message = 4;
+  string created_at = 5;
+  string updated_at = 6;
+}
+
+message UpdateTenantConfigRequest {
+  string tenant_id = 1 [(buf.validate.field).string.min_len = 1];
+  // Configuration values to apply. Only fields listed in update_mask are written.
+  TenantConfigurationValues values = 2;
+  // Controls which fields in values are applied. Only paths listed here are written.
+  // To update a field, include its path and set the desired value in values.
+  // To clear a field back to the system default, include its path in update_mask
+  // but leave it unset in values.
+  google.protobuf.FieldMask update_mask = 3;
+}
+
+message UpdateTenantConfigResponse {}
+
+// TenantConfigStatus represents the reconciliation state of a tenant's configuration.
+// It is used by the orbital job handler in the registry service to track progress.
+enum TenantConfigStatus {
+  TENANT_CONFIG_STATUS_UNSPECIFIED = 0;
+  TENANT_CONFIG_STATUS_UPDATING = 1;
+  TENANT_CONFIG_STATUS_UPDATING_ERROR = 2;
+  TENANT_CONFIG_STATUS_ACTIVE = 3;
+}
+
+// TenantConfigAction defines the orbital job types used by the registry service
+// to drive tenant config reconciliation.
+enum TenantConfigAction {
+  TENANT_CONFIG_ACTION_UNSPECIFIED = 0;
+  TENANT_CONFIG_ACTION_UPDATE = 1;
+}
diff --git a/proto/kms/api/cmk/registry/tenant_config/v1/tenant_config_grpc.pb.go b/proto/kms/api/cmk/registry/tenant_config/v1/tenant_config_grpc.pb.go
new file mode 100644
index 0000000..e3e7d53
--- /dev/null
+++ b/proto/kms/api/cmk/registry/tenant_config/v1/tenant_config_grpc.pb.go
@@ -0,0 +1,159 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.1
+// - protoc             v7.36.1
+// source: kms/api/cmk/registry/tenant_config/v1/tenant_config.proto
+
+package tenantconfigv1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	Service_GetTenantConfig_FullMethodName    = "/kms.api.cmk.registry.tenant_config.v1.Service/GetTenantConfig"
+	Service_UpdateTenantConfig_FullMethodName = "/kms.api.cmk.registry.tenant_config.v1.Service/UpdateTenantConfig"
+)
+
+// ServiceClient is the client API for Service service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type ServiceClient interface {
+	GetTenantConfig(ctx context.Context, in *GetTenantConfigRequest, opts ...grpc.CallOption) (*GetTenantConfigResponse, error)
+	UpdateTenantConfig(ctx context.Context, in *UpdateTenantConfigRequest, opts ...grpc.CallOption) (*UpdateTenantConfigResponse, error)
+}
+
+type serviceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewServiceClient(cc grpc.ClientConnInterface) ServiceClient {
+	return &serviceClient{cc}
+}
+
+func (c *serviceClient) GetTenantConfig(ctx context.Context, in *GetTenantConfigRequest, opts ...grpc.CallOption) (*GetTenantConfigResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetTenantConfigResponse)
+	err := c.cc.Invoke(ctx, Service_GetTenantConfig_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *serviceClient) UpdateTenantConfig(ctx context.Context, in *UpdateTenantConfigRequest, opts ...grpc.CallOption) (*UpdateTenantConfigResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(UpdateTenantConfigResponse)
+	err := c.cc.Invoke(ctx, Service_UpdateTenantConfig_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// ServiceServer is the server API for Service service.
+// All implementations must embed UnimplementedServiceServer
+// for forward compatibility.
+type ServiceServer interface {
+	GetTenantConfig(context.Context, *GetTenantConfigRequest) (*GetTenantConfigResponse, error)
+	UpdateTenantConfig(context.Context, *UpdateTenantConfigRequest) (*UpdateTenantConfigResponse, error)
+	mustEmbedUnimplementedServiceServer()
+}
+
+// UnimplementedServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedServiceServer struct{}
+
+func (UnimplementedServiceServer) GetTenantConfig(context.Context, *GetTenantConfigRequest) (*GetTenantConfigResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetTenantConfig not implemented")
+}
+func (UnimplementedServiceServer) UpdateTenantConfig(context.Context, *UpdateTenantConfigRequest) (*UpdateTenantConfigResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method UpdateTenantConfig not implemented")
+}
+func (UnimplementedServiceServer) mustEmbedUnimplementedServiceServer() {}
+func (UnimplementedServiceServer) testEmbeddedByValue()                 {}
+
+// UnsafeServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to ServiceServer will
+// result in compilation errors.
+type UnsafeServiceServer interface {
+	mustEmbedUnimplementedServiceServer()
+}
+
+func RegisterServiceServer(s grpc.ServiceRegistrar, srv ServiceServer) {
+	// If the following call panics, it indicates UnimplementedServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&Service_ServiceDesc, srv)
+}
+
+func _Service_GetTenantConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetTenantConfigRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ServiceServer).GetTenantConfig(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Service_GetTenantConfig_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ServiceServer).GetTenantConfig(ctx, req.(*GetTenantConfigRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Service_UpdateTenantConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdateTenantConfigRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ServiceServer).UpdateTenantConfig(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Service_UpdateTenantConfig_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ServiceServer).UpdateTenantConfig(ctx, req.(*UpdateTenantConfigRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// Service_ServiceDesc is the grpc.ServiceDesc for Service service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var Service_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "kms.api.cmk.registry.tenant_config.v1.Service",
+	HandlerType: (*ServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "GetTenantConfig",
+			Handler:    _Service_GetTenantConfig_Handler,
+		},
+		{
+			MethodName: "UpdateTenantConfig",
+			Handler:    _Service_UpdateTenantConfig_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "kms/api/cmk/registry/tenant_config/v1/tenant_config.proto",
+}