diff --git a/magefiles/gen.go b/magefiles/gen.go
index c78a89f..dd26c33 100644
--- a/magefiles/gen.go
+++ b/magefiles/gen.go
@@ -24,7 +24,7 @@ func (g Gen) All() error {
 const (
 	ProtoPath     = "proto/authzed/api"
 	BufRepository = "buf.build/authzed/api"
-	BufTag        = "298f3d3a2d4f68ac197b49f849eab6a472604d19"
+	BufTag        = "78c93bbe7e8d69fe7ae4c4c1f6a03fa2840d7797"
 )
 
 // Proto runs proto codegen
diff --git a/proto/authzed/api/materialize/zz_generated.version.go b/proto/authzed/api/materialize/zz_generated.version.go
index b715bec..66b0a61 100644
--- a/proto/authzed/api/materialize/zz_generated.version.go
+++ b/proto/authzed/api/materialize/zz_generated.version.go
@@ -2,5 +2,5 @@ package materialize
 
 const (
 	BufRepository = "buf.build/authzed/api"
-	BufTag        = "298f3d3a2d4f68ac197b49f849eab6a472604d19"
+	BufTag        = "78c93bbe7e8d69fe7ae4c4c1f6a03fa2840d7797"
 )
diff --git a/proto/authzed/api/v0/zz_generated.version.go b/proto/authzed/api/v0/zz_generated.version.go
index c68ae41..2adba1e 100644
--- a/proto/authzed/api/v0/zz_generated.version.go
+++ b/proto/authzed/api/v0/zz_generated.version.go
@@ -2,5 +2,5 @@ package v0
 
 const (
 	BufRepository = "buf.build/authzed/api"
-	BufTag        = "298f3d3a2d4f68ac197b49f849eab6a472604d19"
+	BufTag        = "78c93bbe7e8d69fe7ae4c4c1f6a03fa2840d7797"
 )
diff --git a/proto/authzed/api/v1/error_reason.pb.go b/proto/authzed/api/v1/error_reason.pb.go
index 6883fce..11bb395 100644
--- a/proto/authzed/api/v1/error_reason.pb.go
+++ b/proto/authzed/api/v1/error_reason.pb.go
@@ -376,6 +376,18 @@ const (
 	//	  "metadata": { "counter_name": "name"  }
 	//	}
 	ErrorReason_ERROR_REASON_COUNTER_NOT_REGISTERED ErrorReason = 27
+	// The request failed because a wildcard was not allowed. For CheckPermission,
+	// this means that the subject or resource ID was a wildcard. For LookupResources,
+	// this means that the subject ID was a wildcard.
+	//
+	// Example of an ErrorInfo:
+	//
+	//	{
+	//	  "reason": "ERROR_REASON_WILDCARD_NOT_ALLOWED",
+	//	  "domain": "authzed.com",
+	//	  "metadata": { "disallowed_field": "subject_id" }
+	//	}
+	ErrorReason_ERROR_REASON_WILDCARD_NOT_ALLOWED ErrorReason = 28
 )
 
 // Enum value maps for ErrorReason.
@@ -409,6 +421,7 @@ var (
 		25: "ERROR_REASON_EMPTY_PRECONDITION",
 		26: "ERROR_REASON_COUNTER_ALREADY_REGISTERED",
 		27: "ERROR_REASON_COUNTER_NOT_REGISTERED",
+		28: "ERROR_REASON_WILDCARD_NOT_ALLOWED",
 	}
 	ErrorReason_value = map[string]int32{
 		"ERROR_REASON_UNSPECIFIED":                                     0,
@@ -439,6 +452,7 @@ var (
 		"ERROR_REASON_EMPTY_PRECONDITION":                              25,
 		"ERROR_REASON_COUNTER_ALREADY_REGISTERED":                      26,
 		"ERROR_REASON_COUNTER_NOT_REGISTERED":                          27,
+		"ERROR_REASON_WILDCARD_NOT_ALLOWED":                            28,
 	}
 )
 
@@ -475,7 +489,7 @@ var file_authzed_api_v1_error_reason_proto_rawDesc = []byte{
 	0x0a, 0x21, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31,
 	0x2f, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x2e, 0x70, 0x72,
 	0x6f, 0x74, 0x6f, 0x12, 0x0e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69,
-	0x2e, 0x76, 0x31, 0x2a, 0xca, 0x09, 0x0a, 0x0b, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x52, 0x65, 0x61,
+	0x2e, 0x76, 0x31, 0x2a, 0xf1, 0x09, 0x0a, 0x0b, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x52, 0x65, 0x61,
 	0x73, 0x6f, 0x6e, 0x12, 0x1c, 0x0a, 0x18, 0x45, 0x52, 0x52, 0x4f, 0x52, 0x5f, 0x52, 0x45, 0x41,
 	0x53, 0x4f, 0x4e, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10,
 	0x00, 0x12, 0x23, 0x0a, 0x1f, 0x45, 0x52, 0x52, 0x4f, 0x52, 0x5f, 0x52, 0x45, 0x41, 0x53, 0x4f,
@@ -552,12 +566,14 @@ var file_authzed_api_v1_error_reason_proto_rawDesc = []byte{
 	0x54, 0x45, 0x52, 0x45, 0x44, 0x10, 0x1a, 0x12, 0x27, 0x0a, 0x23, 0x45, 0x52, 0x52, 0x4f, 0x52,
 	0x5f, 0x52, 0x45, 0x41, 0x53, 0x4f, 0x4e, 0x5f, 0x43, 0x4f, 0x55, 0x4e, 0x54, 0x45, 0x52, 0x5f,
 	0x4e, 0x4f, 0x54, 0x5f, 0x52, 0x45, 0x47, 0x49, 0x53, 0x54, 0x45, 0x52, 0x45, 0x44, 0x10, 0x1b,
-	0x42, 0x4a, 0x0a, 0x12, 0x63, 0x6f, 0x6d, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e,
-	0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x50, 0x01, 0x5a, 0x32, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
-	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2f, 0x61, 0x75, 0x74,
-	0x68, 0x7a, 0x65, 0x64, 0x2d, 0x67, 0x6f, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x61, 0x75,
-	0x74, 0x68, 0x7a, 0x65, 0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x33,
+	0x12, 0x25, 0x0a, 0x21, 0x45, 0x52, 0x52, 0x4f, 0x52, 0x5f, 0x52, 0x45, 0x41, 0x53, 0x4f, 0x4e,
+	0x5f, 0x57, 0x49, 0x4c, 0x44, 0x43, 0x41, 0x52, 0x44, 0x5f, 0x4e, 0x4f, 0x54, 0x5f, 0x41, 0x4c,
+	0x4c, 0x4f, 0x57, 0x45, 0x44, 0x10, 0x1c, 0x42, 0x4a, 0x0a, 0x12, 0x63, 0x6f, 0x6d, 0x2e, 0x61,
+	0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x50, 0x01, 0x5a,
+	0x32, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x61, 0x75, 0x74, 0x68,
+	0x7a, 0x65, 0x64, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2d, 0x67, 0x6f, 0x2f, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x61, 0x75, 0x74, 0x68, 0x7a, 0x65, 0x64, 0x2f, 0x61, 0x70, 0x69,
+	0x2f, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/proto/authzed/api/v1/zz_generated.version.go b/proto/authzed/api/v1/zz_generated.version.go
index 1eeaeb0..88dd123 100644
--- a/proto/authzed/api/v1/zz_generated.version.go
+++ b/proto/authzed/api/v1/zz_generated.version.go
@@ -2,5 +2,5 @@ package v1
 
 const (
 	BufRepository = "buf.build/authzed/api"
-	BufTag        = "298f3d3a2d4f68ac197b49f849eab6a472604d19"
+	BufTag        = "78c93bbe7e8d69fe7ae4c4c1f6a03fa2840d7797"
 )
diff --git a/proto/authzed/api/v1alpha1/zz_generated.version.go b/proto/authzed/api/v1alpha1/zz_generated.version.go
index a64ae8e..a306931 100644
--- a/proto/authzed/api/v1alpha1/zz_generated.version.go
+++ b/proto/authzed/api/v1alpha1/zz_generated.version.go
@@ -2,5 +2,5 @@ package v1alpha1
 
 const (
 	BufRepository = "buf.build/authzed/api"
-	BufTag        = "298f3d3a2d4f68ac197b49f849eab6a472604d19"
+	BufTag        = "78c93bbe7e8d69fe7ae4c4c1f6a03fa2840d7797"
 )