diff --git a/packages/google-cloud-orgpolicy/protos/google/cloud/orgpolicy/v2/constraint.proto b/packages/google-cloud-orgpolicy/protos/google/cloud/orgpolicy/v2/constraint.proto
index 81af21b5810..9683a6a9c65 100644
--- a/packages/google-cloud-orgpolicy/protos/google/cloud/orgpolicy/v2/constraint.proto
+++ b/packages/google-cloud-orgpolicy/protos/google/cloud/orgpolicy/v2/constraint.proto
@@ -18,6 +18,7 @@ package google.cloud.orgpolicy.v2;
 
 import "google/api/field_behavior.proto";
 import "google/api/resource.proto";
+import "google/protobuf/timestamp.proto";
 
 option csharp_namespace = "Google.Cloud.OrgPolicy.V2";
 option go_package = "google.golang.org/genproto/googleapis/cloud/orgpolicy/v2;orgpolicy";
@@ -87,9 +88,7 @@ message Constraint {
   // For example a constraint `constraints/compute.disableSerialPortAccess`.
   // If it is enforced on a VM instance, serial port connections will not be
   // opened to that instance.
-  message BooleanConstraint {
-
-  }
+  message BooleanConstraint {}
 
   // Immutable. The resource name of the Constraint. Must be in one of
   // the following forms:
diff --git a/packages/google-cloud-orgpolicy/protos/google/cloud/orgpolicy/v2/orgpolicy.proto b/packages/google-cloud-orgpolicy/protos/google/cloud/orgpolicy/v2/orgpolicy.proto
index 043d7d00ae7..1e4b7c00a2a 100644
--- a/packages/google-cloud-orgpolicy/protos/google/cloud/orgpolicy/v2/orgpolicy.proto
+++ b/packages/google-cloud-orgpolicy/protos/google/cloud/orgpolicy/v2/orgpolicy.proto
@@ -22,6 +22,7 @@ import "google/api/field_behavior.proto";
 import "google/api/resource.proto";
 import "google/cloud/orgpolicy/v2/constraint.proto";
 import "google/protobuf/empty.proto";
+import "google/protobuf/field_mask.proto";
 import "google/protobuf/timestamp.proto";
 import "google/type/expr.proto";
 
@@ -55,18 +56,16 @@ option ruby_package = "Google::Cloud::OrgPolicy::V2";
 // particular resource and its child resources.
 service OrgPolicy {
   option (google.api.default_host) = "orgpolicy.googleapis.com";
-  option (google.api.oauth_scopes) = "https://www.googleapis.com/auth/cloud-platform";
+  option (google.api.oauth_scopes) =
+      "https://www.googleapis.com/auth/cloud-platform";
 
   // Lists `Constraints` that could be applied on the specified resource.
-  rpc ListConstraints(ListConstraintsRequest) returns (ListConstraintsResponse) {
+  rpc ListConstraints(ListConstraintsRequest)
+      returns (ListConstraintsResponse) {
     option (google.api.http) = {
       get: "/v2/{parent=projects/*}/constraints"
-      additional_bindings {
-        get: "/v2/{parent=folders/*}/constraints"
-      }
-      additional_bindings {
-        get: "/v2/{parent=organizations/*}/constraints"
-      }
+      additional_bindings { get: "/v2/{parent=folders/*}/constraints" }
+      additional_bindings { get: "/v2/{parent=organizations/*}/constraints" }
     };
     option (google.api.method_signature) = "parent";
   }
@@ -75,12 +74,8 @@ service OrgPolicy {
   rpc ListPolicies(ListPoliciesRequest) returns (ListPoliciesResponse) {
     option (google.api.http) = {
       get: "/v2/{parent=projects/*}/policies"
-      additional_bindings {
-        get: "/v2/{parent=folders/*}/policies"
-      }
-      additional_bindings {
-        get: "/v2/{parent=organizations/*}/policies"
-      }
+      additional_bindings { get: "/v2/{parent=folders/*}/policies" }
+      additional_bindings { get: "/v2/{parent=organizations/*}/policies" }
     };
     option (google.api.method_signature) = "parent";
   }
@@ -93,12 +88,8 @@ service OrgPolicy {
   rpc GetPolicy(GetPolicyRequest) returns (Policy) {
     option (google.api.http) = {
       get: "/v2/{name=projects/*/policies/*}"
-      additional_bindings {
-        get: "/v2/{name=folders/*/policies/*}"
-      }
-      additional_bindings {
-        get: "/v2/{name=organizations/*/policies/*}"
-      }
+      additional_bindings { get: "/v2/{name=folders/*/policies/*}" }
+      additional_bindings { get: "/v2/{name=organizations/*/policies/*}" }
     };
     option (google.api.method_signature) = "name";
   }
@@ -176,12 +167,8 @@ service OrgPolicy {
   rpc DeletePolicy(DeletePolicyRequest) returns (google.protobuf.Empty) {
     option (google.api.http) = {
       delete: "/v2/{name=projects/*/policies/*}"
-      additional_bindings {
-        delete: "/v2/{name=folders/*/policies/*}"
-      }
-      additional_bindings {
-        delete: "/v2/{name=organizations/*/policies/*}"
-      }
+      additional_bindings { delete: "/v2/{name=folders/*/policies/*}" }
+      additional_bindings { delete: "/v2/{name=organizations/*/policies/*}" }
     };
     option (google.api.method_signature) = "name";
   }
@@ -216,6 +203,11 @@ message Policy {
 
   // Deprecated.
   AlternatePolicySpec alternate = 3 [deprecated = true];
+
+  // dry-run policy.
+  // Audit-only policy, can be used to monitor how the policy would have
+  // impacted the existing and future resources if it's enforced.
+  PolicySpec dry_run_spec = 4;
 }
 
 // Similar to PolicySpec but with an extra 'launch' field for launch reference.
@@ -308,7 +300,8 @@ message PolicySpec {
   // Output only. The time stamp this was previously updated. This
   // represents the last time a call to `CreatePolicy` or `UpdatePolicy` was
   // made for that `Policy`.
-  google.protobuf.Timestamp update_time = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
+  google.protobuf.Timestamp update_time = 2
+      [(google.api.field_behavior) = OUTPUT_ONLY];
 
   // Up to 10 PolicyRules are allowed.
   //
@@ -341,8 +334,8 @@ message PolicySpec {
 // The request sent to the [ListConstraints]
 // [google.cloud.orgpolicy.v2.OrgPolicy.ListConstraints] method.
 message ListConstraintsRequest {
-  // Required. The Cloud resource that parents the constraint. Must be in one of the
-  // following forms:
+  // Required. The Cloud resource that parents the constraint. Must be in one of
+  // the following forms:
   // * `projects/{project_number}`
   // * `projects/{project_id}`
   // * `folders/{folder_id}`
@@ -377,9 +370,9 @@ message ListConstraintsResponse {
 // The request sent to the [ListPolicies]
 // [google.cloud.orgpolicy.v2.OrgPolicy.ListPolicies] method.
 message ListPoliciesRequest {
-  // Required. The target Cloud resource that parents the set of constraints and policies
-  // that will be returned from this call. Must be in one of the following
-  // forms:
+  // Required. The target Cloud resource that parents the set of constraints and
+  // policies that will be returned from this call. Must be in one of the
+  // following forms:
   // * `projects/{project_number}`
   // * `projects/{project_id}`
   // * `folders/{folder_id}`
@@ -417,7 +410,8 @@ message ListPoliciesResponse {
 // The request sent to the [GetPolicy]
 // [google.cloud.orgpolicy.v2.OrgPolicy.GetPolicy] method.
 message GetPolicyRequest {
-  // Required. Resource name of the policy. See `Policy` for naming requirements.
+  // Required. Resource name of the policy. See `Policy` for naming
+  // requirements.
   string name = 1 [
     (google.api.field_behavior) = REQUIRED,
     (google.api.resource_reference) = {
@@ -441,8 +435,8 @@ message GetEffectivePolicyRequest {
 // The request sent to the [CreatePolicyRequest]
 // [google.cloud.orgpolicy.v2.OrgPolicy.CreatePolicy] method.
 message CreatePolicyRequest {
-  // Required. The Cloud resource that will parent the new Policy. Must be in one of the
-  // following forms:
+  // Required. The Cloud resource that will parent the new Policy. Must be in
+  // one of the following forms:
   // * `projects/{project_number}`
   // * `projects/{project_id}`
   // * `folders/{folder_id}`
@@ -463,6 +457,11 @@ message CreatePolicyRequest {
 message UpdatePolicyRequest {
   // Required. `Policy` to update.
   Policy policy = 1 [(google.api.field_behavior) = REQUIRED];
+
+  // Field mask used to specify the fields to be overwritten in the policy
+  // by the set. The fields specified in the update_mask are relative to the
+  // policy, not the full request.
+  google.protobuf.FieldMask update_mask = 3;
 }
 
 // The request sent to the [DeletePolicy]
diff --git a/packages/google-cloud-orgpolicy/protos/protos.d.ts b/packages/google-cloud-orgpolicy/protos/protos.d.ts
index 7853ced1ec1..f51bfac04a1 100644
--- a/packages/google-cloud-orgpolicy/protos/protos.d.ts
+++ b/packages/google-cloud-orgpolicy/protos/protos.d.ts
@@ -542,6 +542,9 @@ export namespace google {
 
                     /** Policy alternate */
                     alternate?: (google.cloud.orgpolicy.v2.IAlternatePolicySpec|null);
+
+                    /** Policy dryRunSpec */
+                    dryRunSpec?: (google.cloud.orgpolicy.v2.IPolicySpec|null);
                 }
 
                 /** Represents a Policy. */
@@ -562,6 +565,9 @@ export namespace google {
                     /** Policy alternate. */
                     public alternate?: (google.cloud.orgpolicy.v2.IAlternatePolicySpec|null);
 
+                    /** Policy dryRunSpec. */
+                    public dryRunSpec?: (google.cloud.orgpolicy.v2.IPolicySpec|null);
+
                     /**
                      * Creates a new Policy instance using the specified properties.
                      * @param [properties] Properties to set
@@ -1823,6 +1829,9 @@ export namespace google {
 
                     /** UpdatePolicyRequest policy */
                     policy?: (google.cloud.orgpolicy.v2.IPolicy|null);
+
+                    /** UpdatePolicyRequest updateMask */
+                    updateMask?: (google.protobuf.IFieldMask|null);
                 }
 
                 /** Represents an UpdatePolicyRequest. */
@@ -1837,6 +1846,9 @@ export namespace google {
                     /** UpdatePolicyRequest policy. */
                     public policy?: (google.cloud.orgpolicy.v2.IPolicy|null);
 
+                    /** UpdatePolicyRequest updateMask. */
+                    public updateMask?: (google.protobuf.IFieldMask|null);
+
                     /**
                      * Creates a new UpdatePolicyRequest instance using the specified properties.
                      * @param [properties] Properties to set
@@ -5989,6 +6001,109 @@ export namespace google {
             }
         }
 
+        /** Properties of a Timestamp. */
+        interface ITimestamp {
+
+            /** Timestamp seconds */
+            seconds?: (number|Long|string|null);
+
+            /** Timestamp nanos */
+            nanos?: (number|null);
+        }
+
+        /** Represents a Timestamp. */
+        class Timestamp implements ITimestamp {
+
+            /**
+             * Constructs a new Timestamp.
+             * @param [properties] Properties to set
+             */
+            constructor(properties?: google.protobuf.ITimestamp);
+
+            /** Timestamp seconds. */
+            public seconds: (number|Long|string);
+
+            /** Timestamp nanos. */
+            public nanos: number;
+
+            /**
+             * Creates a new Timestamp instance using the specified properties.
+             * @param [properties] Properties to set
+             * @returns Timestamp instance
+             */
+            public static create(properties?: google.protobuf.ITimestamp): google.protobuf.Timestamp;
+
+            /**
+             * Encodes the specified Timestamp message. Does not implicitly {@link google.protobuf.Timestamp.verify|verify} messages.
+             * @param message Timestamp message or plain object to encode
+             * @param [writer] Writer to encode to
+             * @returns Writer
+             */
+            public static encode(message: google.protobuf.ITimestamp, writer?: $protobuf.Writer): $protobuf.Writer;
+
+            /**
+             * Encodes the specified Timestamp message, length delimited. Does not implicitly {@link google.protobuf.Timestamp.verify|verify} messages.
+             * @param message Timestamp message or plain object to encode
+             * @param [writer] Writer to encode to
+             * @returns Writer
+             */
+            public static encodeDelimited(message: google.protobuf.ITimestamp, writer?: $protobuf.Writer): $protobuf.Writer;
+
+            /**
+             * Decodes a Timestamp message from the specified reader or buffer.
+             * @param reader Reader or buffer to decode from
+             * @param [length] Message length if known beforehand
+             * @returns Timestamp
+             * @throws {Error} If the payload is not a reader or valid buffer
+             * @throws {$protobuf.util.ProtocolError} If required fields are missing
+             */
+            public static decode(reader: ($protobuf.Reader|Uint8Array), length?: number): google.protobuf.Timestamp;
+
+            /**
+             * Decodes a Timestamp message from the specified reader or buffer, length delimited.
+             * @param reader Reader or buffer to decode from
+             * @returns Timestamp
+             * @throws {Error} If the payload is not a reader or valid buffer
+             * @throws {$protobuf.util.ProtocolError} If required fields are missing
+             */
+            public static decodeDelimited(reader: ($protobuf.Reader|Uint8Array)): google.protobuf.Timestamp;
+
+            /**
+             * Verifies a Timestamp message.
+             * @param message Plain object to verify
+             * @returns `null` if valid, otherwise the reason why it is not
+             */
+            public static verify(message: { [k: string]: any }): (string|null);
+
+            /**
+             * Creates a Timestamp message from a plain object. Also converts values to their respective internal types.
+             * @param object Plain object
+             * @returns Timestamp
+             */
+            public static fromObject(object: { [k: string]: any }): google.protobuf.Timestamp;
+
+            /**
+             * Creates a plain object from a Timestamp message. Also converts values to other types if specified.
+             * @param message Timestamp
+             * @param [options] Conversion options
+             * @returns Plain object
+             */
+            public static toObject(message: google.protobuf.Timestamp, options?: $protobuf.IConversionOptions): { [k: string]: any };
+
+            /**
+             * Converts this Timestamp to JSON.
+             * @returns JSON object
+             */
+            public toJSON(): { [k: string]: any };
+
+            /**
+             * Gets the default type url for Timestamp
+             * @param [typeUrlPrefix] your custom typeUrlPrefix(default "type.googleapis.com")
+             * @returns The default type url
+             */
+            public static getTypeUrl(typeUrlPrefix?: string): string;
+        }
+
         /** Properties of an Empty. */
         interface IEmpty {
         }
@@ -6080,103 +6195,97 @@ export namespace google {
             public static getTypeUrl(typeUrlPrefix?: string): string;
         }
 
-        /** Properties of a Timestamp. */
-        interface ITimestamp {
+        /** Properties of a FieldMask. */
+        interface IFieldMask {
 
-            /** Timestamp seconds */
-            seconds?: (number|Long|string|null);
-
-            /** Timestamp nanos */
-            nanos?: (number|null);
+            /** FieldMask paths */
+            paths?: (string[]|null);
         }
 
-        /** Represents a Timestamp. */
-        class Timestamp implements ITimestamp {
+        /** Represents a FieldMask. */
+        class FieldMask implements IFieldMask {
 
             /**
-             * Constructs a new Timestamp.
+             * Constructs a new FieldMask.
              * @param [properties] Properties to set
              */
-            constructor(properties?: google.protobuf.ITimestamp);
-
-            /** Timestamp seconds. */
-            public seconds: (number|Long|string);
+            constructor(properties?: google.protobuf.IFieldMask);
 
-            /** Timestamp nanos. */
-            public nanos: number;
+            /** FieldMask paths. */
+            public paths: string[];
 
             /**
-             * Creates a new Timestamp instance using the specified properties.
+             * Creates a new FieldMask instance using the specified properties.
              * @param [properties] Properties to set
-             * @returns Timestamp instance
+             * @returns FieldMask instance
              */
-            public static create(properties?: google.protobuf.ITimestamp): google.protobuf.Timestamp;
+            public static create(properties?: google.protobuf.IFieldMask): google.protobuf.FieldMask;
 
             /**
-             * Encodes the specified Timestamp message. Does not implicitly {@link google.protobuf.Timestamp.verify|verify} messages.
-             * @param message Timestamp message or plain object to encode
+             * Encodes the specified FieldMask message. Does not implicitly {@link google.protobuf.FieldMask.verify|verify} messages.
+             * @param message FieldMask message or plain object to encode
              * @param [writer] Writer to encode to
              * @returns Writer
              */
-            public static encode(message: google.protobuf.ITimestamp, writer?: $protobuf.Writer): $protobuf.Writer;
+            public static encode(message: google.protobuf.IFieldMask, writer?: $protobuf.Writer): $protobuf.Writer;
 
             /**
-             * Encodes the specified Timestamp message, length delimited. Does not implicitly {@link google.protobuf.Timestamp.verify|verify} messages.
-             * @param message Timestamp message or plain object to encode
+             * Encodes the specified FieldMask message, length delimited. Does not implicitly {@link google.protobuf.FieldMask.verify|verify} messages.
+             * @param message FieldMask message or plain object to encode
              * @param [writer] Writer to encode to
              * @returns Writer
              */
-            public static encodeDelimited(message: google.protobuf.ITimestamp, writer?: $protobuf.Writer): $protobuf.Writer;
+            public static encodeDelimited(message: google.protobuf.IFieldMask, writer?: $protobuf.Writer): $protobuf.Writer;
 
             /**
-             * Decodes a Timestamp message from the specified reader or buffer.
+             * Decodes a FieldMask message from the specified reader or buffer.
              * @param reader Reader or buffer to decode from
              * @param [length] Message length if known beforehand
-             * @returns Timestamp
+             * @returns FieldMask
              * @throws {Error} If the payload is not a reader or valid buffer
              * @throws {$protobuf.util.ProtocolError} If required fields are missing
              */
-            public static decode(reader: ($protobuf.Reader|Uint8Array), length?: number): google.protobuf.Timestamp;
+            public static decode(reader: ($protobuf.Reader|Uint8Array), length?: number): google.protobuf.FieldMask;
 
             /**
-             * Decodes a Timestamp message from the specified reader or buffer, length delimited.
+             * Decodes a FieldMask message from the specified reader or buffer, length delimited.
              * @param reader Reader or buffer to decode from
-             * @returns Timestamp
+             * @returns FieldMask
              * @throws {Error} If the payload is not a reader or valid buffer
              * @throws {$protobuf.util.ProtocolError} If required fields are missing
              */
-            public static decodeDelimited(reader: ($protobuf.Reader|Uint8Array)): google.protobuf.Timestamp;
+            public static decodeDelimited(reader: ($protobuf.Reader|Uint8Array)): google.protobuf.FieldMask;
 
             /**
-             * Verifies a Timestamp message.
+             * Verifies a FieldMask message.
              * @param message Plain object to verify
              * @returns `null` if valid, otherwise the reason why it is not
              */
             public static verify(message: { [k: string]: any }): (string|null);
 
             /**
-             * Creates a Timestamp message from a plain object. Also converts values to their respective internal types.
+             * Creates a FieldMask message from a plain object. Also converts values to their respective internal types.
              * @param object Plain object
-             * @returns Timestamp
+             * @returns FieldMask
              */
-            public static fromObject(object: { [k: string]: any }): google.protobuf.Timestamp;
+            public static fromObject(object: { [k: string]: any }): google.protobuf.FieldMask;
 
             /**
-             * Creates a plain object from a Timestamp message. Also converts values to other types if specified.
-             * @param message Timestamp
+             * Creates a plain object from a FieldMask message. Also converts values to other types if specified.
+             * @param message FieldMask
              * @param [options] Conversion options
              * @returns Plain object
              */
-            public static toObject(message: google.protobuf.Timestamp, options?: $protobuf.IConversionOptions): { [k: string]: any };
+            public static toObject(message: google.protobuf.FieldMask, options?: $protobuf.IConversionOptions): { [k: string]: any };
 
             /**
-             * Converts this Timestamp to JSON.
+             * Converts this FieldMask to JSON.
              * @returns JSON object
              */
             public toJSON(): { [k: string]: any };
 
             /**
-             * Gets the default type url for Timestamp
+             * Gets the default type url for FieldMask
              * @param [typeUrlPrefix] your custom typeUrlPrefix(default "type.googleapis.com")
              * @returns The default type url
              */
diff --git a/packages/google-cloud-orgpolicy/protos/protos.js b/packages/google-cloud-orgpolicy/protos/protos.js
index fe96fd6c5a0..6f47e67b3fe 100644
--- a/packages/google-cloud-orgpolicy/protos/protos.js
+++ b/packages/google-cloud-orgpolicy/protos/protos.js
@@ -1139,6 +1139,7 @@
                          * @property {string|null} [name] Policy name
                          * @property {google.cloud.orgpolicy.v2.IPolicySpec|null} [spec] Policy spec
                          * @property {google.cloud.orgpolicy.v2.IAlternatePolicySpec|null} [alternate] Policy alternate
+                         * @property {google.cloud.orgpolicy.v2.IPolicySpec|null} [dryRunSpec] Policy dryRunSpec
                          */
     
                         /**
@@ -1180,6 +1181,14 @@
                          */
                         Policy.prototype.alternate = null;
     
+                        /**
+                         * Policy dryRunSpec.
+                         * @member {google.cloud.orgpolicy.v2.IPolicySpec|null|undefined} dryRunSpec
+                         * @memberof google.cloud.orgpolicy.v2.Policy
+                         * @instance
+                         */
+                        Policy.prototype.dryRunSpec = null;
+    
                         /**
                          * Creates a new Policy instance using the specified properties.
                          * @function create
@@ -1210,6 +1219,8 @@
                                 $root.google.cloud.orgpolicy.v2.PolicySpec.encode(message.spec, writer.uint32(/* id 2, wireType 2 =*/18).fork()).ldelim();
                             if (message.alternate != null && Object.hasOwnProperty.call(message, "alternate"))
                                 $root.google.cloud.orgpolicy.v2.AlternatePolicySpec.encode(message.alternate, writer.uint32(/* id 3, wireType 2 =*/26).fork()).ldelim();
+                            if (message.dryRunSpec != null && Object.hasOwnProperty.call(message, "dryRunSpec"))
+                                $root.google.cloud.orgpolicy.v2.PolicySpec.encode(message.dryRunSpec, writer.uint32(/* id 4, wireType 2 =*/34).fork()).ldelim();
                             return writer;
                         };
     
@@ -1256,6 +1267,10 @@
                                         message.alternate = $root.google.cloud.orgpolicy.v2.AlternatePolicySpec.decode(reader, reader.uint32());
                                         break;
                                     }
+                                case 4: {
+                                        message.dryRunSpec = $root.google.cloud.orgpolicy.v2.PolicySpec.decode(reader, reader.uint32());
+                                        break;
+                                    }
                                 default:
                                     reader.skipType(tag & 7);
                                     break;
@@ -1304,6 +1319,11 @@
                                 if (error)
                                     return "alternate." + error;
                             }
+                            if (message.dryRunSpec != null && message.hasOwnProperty("dryRunSpec")) {
+                                var error = $root.google.cloud.orgpolicy.v2.PolicySpec.verify(message.dryRunSpec);
+                                if (error)
+                                    return "dryRunSpec." + error;
+                            }
                             return null;
                         };
     
@@ -1331,6 +1351,11 @@
                                     throw TypeError(".google.cloud.orgpolicy.v2.Policy.alternate: object expected");
                                 message.alternate = $root.google.cloud.orgpolicy.v2.AlternatePolicySpec.fromObject(object.alternate);
                             }
+                            if (object.dryRunSpec != null) {
+                                if (typeof object.dryRunSpec !== "object")
+                                    throw TypeError(".google.cloud.orgpolicy.v2.Policy.dryRunSpec: object expected");
+                                message.dryRunSpec = $root.google.cloud.orgpolicy.v2.PolicySpec.fromObject(object.dryRunSpec);
+                            }
                             return message;
                         };
     
@@ -1351,6 +1376,7 @@
                                 object.name = "";
                                 object.spec = null;
                                 object.alternate = null;
+                                object.dryRunSpec = null;
                             }
                             if (message.name != null && message.hasOwnProperty("name"))
                                 object.name = message.name;
@@ -1358,6 +1384,8 @@
                                 object.spec = $root.google.cloud.orgpolicy.v2.PolicySpec.toObject(message.spec, options);
                             if (message.alternate != null && message.hasOwnProperty("alternate"))
                                 object.alternate = $root.google.cloud.orgpolicy.v2.AlternatePolicySpec.toObject(message.alternate, options);
+                            if (message.dryRunSpec != null && message.hasOwnProperty("dryRunSpec"))
+                                object.dryRunSpec = $root.google.cloud.orgpolicy.v2.PolicySpec.toObject(message.dryRunSpec, options);
                             return object;
                         };
     
@@ -4188,6 +4216,7 @@
                          * @memberof google.cloud.orgpolicy.v2
                          * @interface IUpdatePolicyRequest
                          * @property {google.cloud.orgpolicy.v2.IPolicy|null} [policy] UpdatePolicyRequest policy
+                         * @property {google.protobuf.IFieldMask|null} [updateMask] UpdatePolicyRequest updateMask
                          */
     
                         /**
@@ -4213,6 +4242,14 @@
                          */
                         UpdatePolicyRequest.prototype.policy = null;
     
+                        /**
+                         * UpdatePolicyRequest updateMask.
+                         * @member {google.protobuf.IFieldMask|null|undefined} updateMask
+                         * @memberof google.cloud.orgpolicy.v2.UpdatePolicyRequest
+                         * @instance
+                         */
+                        UpdatePolicyRequest.prototype.updateMask = null;
+    
                         /**
                          * Creates a new UpdatePolicyRequest instance using the specified properties.
                          * @function create
@@ -4239,6 +4276,8 @@
                                 writer = $Writer.create();
                             if (message.policy != null && Object.hasOwnProperty.call(message, "policy"))
                                 $root.google.cloud.orgpolicy.v2.Policy.encode(message.policy, writer.uint32(/* id 1, wireType 2 =*/10).fork()).ldelim();
+                            if (message.updateMask != null && Object.hasOwnProperty.call(message, "updateMask"))
+                                $root.google.protobuf.FieldMask.encode(message.updateMask, writer.uint32(/* id 3, wireType 2 =*/26).fork()).ldelim();
                             return writer;
                         };
     
@@ -4277,6 +4316,10 @@
                                         message.policy = $root.google.cloud.orgpolicy.v2.Policy.decode(reader, reader.uint32());
                                         break;
                                     }
+                                case 3: {
+                                        message.updateMask = $root.google.protobuf.FieldMask.decode(reader, reader.uint32());
+                                        break;
+                                    }
                                 default:
                                     reader.skipType(tag & 7);
                                     break;
@@ -4317,6 +4360,11 @@
                                 if (error)
                                     return "policy." + error;
                             }
+                            if (message.updateMask != null && message.hasOwnProperty("updateMask")) {
+                                var error = $root.google.protobuf.FieldMask.verify(message.updateMask);
+                                if (error)
+                                    return "updateMask." + error;
+                            }
                             return null;
                         };
     
@@ -4337,6 +4385,11 @@
                                     throw TypeError(".google.cloud.orgpolicy.v2.UpdatePolicyRequest.policy: object expected");
                                 message.policy = $root.google.cloud.orgpolicy.v2.Policy.fromObject(object.policy);
                             }
+                            if (object.updateMask != null) {
+                                if (typeof object.updateMask !== "object")
+                                    throw TypeError(".google.cloud.orgpolicy.v2.UpdatePolicyRequest.updateMask: object expected");
+                                message.updateMask = $root.google.protobuf.FieldMask.fromObject(object.updateMask);
+                            }
                             return message;
                         };
     
@@ -4353,10 +4406,14 @@
                             if (!options)
                                 options = {};
                             var object = {};
-                            if (options.defaults)
+                            if (options.defaults) {
                                 object.policy = null;
+                                object.updateMask = null;
+                            }
                             if (message.policy != null && message.hasOwnProperty("policy"))
                                 object.policy = $root.google.cloud.orgpolicy.v2.Policy.toObject(message.policy, options);
+                            if (message.updateMask != null && message.hasOwnProperty("updateMask"))
+                                object.updateMask = $root.google.protobuf.FieldMask.toObject(message.updateMask, options);
                             return object;
                         };
     
@@ -15667,6 +15724,247 @@
                 return GeneratedCodeInfo;
             })();
     
+            protobuf.Timestamp = (function() {
+    
+                /**
+                 * Properties of a Timestamp.
+                 * @memberof google.protobuf
+                 * @interface ITimestamp
+                 * @property {number|Long|null} [seconds] Timestamp seconds
+                 * @property {number|null} [nanos] Timestamp nanos
+                 */
+    
+                /**
+                 * Constructs a new Timestamp.
+                 * @memberof google.protobuf
+                 * @classdesc Represents a Timestamp.
+                 * @implements ITimestamp
+                 * @constructor
+                 * @param {google.protobuf.ITimestamp=} [properties] Properties to set
+                 */
+                function Timestamp(properties) {
+                    if (properties)
+                        for (var keys = Object.keys(properties), i = 0; i < keys.length; ++i)
+                            if (properties[keys[i]] != null)
+                                this[keys[i]] = properties[keys[i]];
+                }
+    
+                /**
+                 * Timestamp seconds.
+                 * @member {number|Long} seconds
+                 * @memberof google.protobuf.Timestamp
+                 * @instance
+                 */
+                Timestamp.prototype.seconds = $util.Long ? $util.Long.fromBits(0,0,false) : 0;
+    
+                /**
+                 * Timestamp nanos.
+                 * @member {number} nanos
+                 * @memberof google.protobuf.Timestamp
+                 * @instance
+                 */
+                Timestamp.prototype.nanos = 0;
+    
+                /**
+                 * Creates a new Timestamp instance using the specified properties.
+                 * @function create
+                 * @memberof google.protobuf.Timestamp
+                 * @static
+                 * @param {google.protobuf.ITimestamp=} [properties] Properties to set
+                 * @returns {google.protobuf.Timestamp} Timestamp instance
+                 */
+                Timestamp.create = function create(properties) {
+                    return new Timestamp(properties);
+                };
+    
+                /**
+                 * Encodes the specified Timestamp message. Does not implicitly {@link google.protobuf.Timestamp.verify|verify} messages.
+                 * @function encode
+                 * @memberof google.protobuf.Timestamp
+                 * @static
+                 * @param {google.protobuf.ITimestamp} message Timestamp message or plain object to encode
+                 * @param {$protobuf.Writer} [writer] Writer to encode to
+                 * @returns {$protobuf.Writer} Writer
+                 */
+                Timestamp.encode = function encode(message, writer) {
+                    if (!writer)
+                        writer = $Writer.create();
+                    if (message.seconds != null && Object.hasOwnProperty.call(message, "seconds"))
+                        writer.uint32(/* id 1, wireType 0 =*/8).int64(message.seconds);
+                    if (message.nanos != null && Object.hasOwnProperty.call(message, "nanos"))
+                        writer.uint32(/* id 2, wireType 0 =*/16).int32(message.nanos);
+                    return writer;
+                };
+    
+                /**
+                 * Encodes the specified Timestamp message, length delimited. Does not implicitly {@link google.protobuf.Timestamp.verify|verify} messages.
+                 * @function encodeDelimited
+                 * @memberof google.protobuf.Timestamp
+                 * @static
+                 * @param {google.protobuf.ITimestamp} message Timestamp message or plain object to encode
+                 * @param {$protobuf.Writer} [writer] Writer to encode to
+                 * @returns {$protobuf.Writer} Writer
+                 */
+                Timestamp.encodeDelimited = function encodeDelimited(message, writer) {
+                    return this.encode(message, writer).ldelim();
+                };
+    
+                /**
+                 * Decodes a Timestamp message from the specified reader or buffer.
+                 * @function decode
+                 * @memberof google.protobuf.Timestamp
+                 * @static
+                 * @param {$protobuf.Reader|Uint8Array} reader Reader or buffer to decode from
+                 * @param {number} [length] Message length if known beforehand
+                 * @returns {google.protobuf.Timestamp} Timestamp
+                 * @throws {Error} If the payload is not a reader or valid buffer
+                 * @throws {$protobuf.util.ProtocolError} If required fields are missing
+                 */
+                Timestamp.decode = function decode(reader, length) {
+                    if (!(reader instanceof $Reader))
+                        reader = $Reader.create(reader);
+                    var end = length === undefined ? reader.len : reader.pos + length, message = new $root.google.protobuf.Timestamp();
+                    while (reader.pos < end) {
+                        var tag = reader.uint32();
+                        switch (tag >>> 3) {
+                        case 1: {
+                                message.seconds = reader.int64();
+                                break;
+                            }
+                        case 2: {
+                                message.nanos = reader.int32();
+                                break;
+                            }
+                        default:
+                            reader.skipType(tag & 7);
+                            break;
+                        }
+                    }
+                    return message;
+                };
+    
+                /**
+                 * Decodes a Timestamp message from the specified reader or buffer, length delimited.
+                 * @function decodeDelimited
+                 * @memberof google.protobuf.Timestamp
+                 * @static
+                 * @param {$protobuf.Reader|Uint8Array} reader Reader or buffer to decode from
+                 * @returns {google.protobuf.Timestamp} Timestamp
+                 * @throws {Error} If the payload is not a reader or valid buffer
+                 * @throws {$protobuf.util.ProtocolError} If required fields are missing
+                 */
+                Timestamp.decodeDelimited = function decodeDelimited(reader) {
+                    if (!(reader instanceof $Reader))
+                        reader = new $Reader(reader);
+                    return this.decode(reader, reader.uint32());
+                };
+    
+                /**
+                 * Verifies a Timestamp message.
+                 * @function verify
+                 * @memberof google.protobuf.Timestamp
+                 * @static
+                 * @param {Object.<string,*>} message Plain object to verify
+                 * @returns {string|null} `null` if valid, otherwise the reason why it is not
+                 */
+                Timestamp.verify = function verify(message) {
+                    if (typeof message !== "object" || message === null)
+                        return "object expected";
+                    if (message.seconds != null && message.hasOwnProperty("seconds"))
+                        if (!$util.isInteger(message.seconds) && !(message.seconds && $util.isInteger(message.seconds.low) && $util.isInteger(message.seconds.high)))
+                            return "seconds: integer|Long expected";
+                    if (message.nanos != null && message.hasOwnProperty("nanos"))
+                        if (!$util.isInteger(message.nanos))
+                            return "nanos: integer expected";
+                    return null;
+                };
+    
+                /**
+                 * Creates a Timestamp message from a plain object. Also converts values to their respective internal types.
+                 * @function fromObject
+                 * @memberof google.protobuf.Timestamp
+                 * @static
+                 * @param {Object.<string,*>} object Plain object
+                 * @returns {google.protobuf.Timestamp} Timestamp
+                 */
+                Timestamp.fromObject = function fromObject(object) {
+                    if (object instanceof $root.google.protobuf.Timestamp)
+                        return object;
+                    var message = new $root.google.protobuf.Timestamp();
+                    if (object.seconds != null)
+                        if ($util.Long)
+                            (message.seconds = $util.Long.fromValue(object.seconds)).unsigned = false;
+                        else if (typeof object.seconds === "string")
+                            message.seconds = parseInt(object.seconds, 10);
+                        else if (typeof object.seconds === "number")
+                            message.seconds = object.seconds;
+                        else if (typeof object.seconds === "object")
+                            message.seconds = new $util.LongBits(object.seconds.low >>> 0, object.seconds.high >>> 0).toNumber();
+                    if (object.nanos != null)
+                        message.nanos = object.nanos | 0;
+                    return message;
+                };
+    
+                /**
+                 * Creates a plain object from a Timestamp message. Also converts values to other types if specified.
+                 * @function toObject
+                 * @memberof google.protobuf.Timestamp
+                 * @static
+                 * @param {google.protobuf.Timestamp} message Timestamp
+                 * @param {$protobuf.IConversionOptions} [options] Conversion options
+                 * @returns {Object.<string,*>} Plain object
+                 */
+                Timestamp.toObject = function toObject(message, options) {
+                    if (!options)
+                        options = {};
+                    var object = {};
+                    if (options.defaults) {
+                        if ($util.Long) {
+                            var long = new $util.Long(0, 0, false);
+                            object.seconds = options.longs === String ? long.toString() : options.longs === Number ? long.toNumber() : long;
+                        } else
+                            object.seconds = options.longs === String ? "0" : 0;
+                        object.nanos = 0;
+                    }
+                    if (message.seconds != null && message.hasOwnProperty("seconds"))
+                        if (typeof message.seconds === "number")
+                            object.seconds = options.longs === String ? String(message.seconds) : message.seconds;
+                        else
+                            object.seconds = options.longs === String ? $util.Long.prototype.toString.call(message.seconds) : options.longs === Number ? new $util.LongBits(message.seconds.low >>> 0, message.seconds.high >>> 0).toNumber() : message.seconds;
+                    if (message.nanos != null && message.hasOwnProperty("nanos"))
+                        object.nanos = message.nanos;
+                    return object;
+                };
+    
+                /**
+                 * Converts this Timestamp to JSON.
+                 * @function toJSON
+                 * @memberof google.protobuf.Timestamp
+                 * @instance
+                 * @returns {Object.<string,*>} JSON object
+                 */
+                Timestamp.prototype.toJSON = function toJSON() {
+                    return this.constructor.toObject(this, $protobuf.util.toJSONOptions);
+                };
+    
+                /**
+                 * Gets the default type url for Timestamp
+                 * @function getTypeUrl
+                 * @memberof google.protobuf.Timestamp
+                 * @static
+                 * @param {string} [typeUrlPrefix] your custom typeUrlPrefix(default "type.googleapis.com")
+                 * @returns {string} The default type url
+                 */
+                Timestamp.getTypeUrl = function getTypeUrl(typeUrlPrefix) {
+                    if (typeUrlPrefix === undefined) {
+                        typeUrlPrefix = "type.googleapis.com";
+                    }
+                    return typeUrlPrefix + "/google.protobuf.Timestamp";
+                };
+    
+                return Timestamp;
+            })();
+    
             protobuf.Empty = (function() {
     
                 /**
@@ -15842,25 +16140,25 @@
                 return Empty;
             })();
     
-            protobuf.Timestamp = (function() {
+            protobuf.FieldMask = (function() {
     
                 /**
-                 * Properties of a Timestamp.
+                 * Properties of a FieldMask.
                  * @memberof google.protobuf
-                 * @interface ITimestamp
-                 * @property {number|Long|null} [seconds] Timestamp seconds
-                 * @property {number|null} [nanos] Timestamp nanos
+                 * @interface IFieldMask
+                 * @property {Array.<string>|null} [paths] FieldMask paths
                  */
     
                 /**
-                 * Constructs a new Timestamp.
+                 * Constructs a new FieldMask.
                  * @memberof google.protobuf
-                 * @classdesc Represents a Timestamp.
-                 * @implements ITimestamp
+                 * @classdesc Represents a FieldMask.
+                 * @implements IFieldMask
                  * @constructor
-                 * @param {google.protobuf.ITimestamp=} [properties] Properties to set
+                 * @param {google.protobuf.IFieldMask=} [properties] Properties to set
                  */
-                function Timestamp(properties) {
+                function FieldMask(properties) {
+                    this.paths = [];
                     if (properties)
                         for (var keys = Object.keys(properties), i = 0; i < keys.length; ++i)
                             if (properties[keys[i]] != null)
@@ -15868,89 +16166,78 @@
                 }
     
                 /**
-                 * Timestamp seconds.
-                 * @member {number|Long} seconds
-                 * @memberof google.protobuf.Timestamp
+                 * FieldMask paths.
+                 * @member {Array.<string>} paths
+                 * @memberof google.protobuf.FieldMask
                  * @instance
                  */
-                Timestamp.prototype.seconds = $util.Long ? $util.Long.fromBits(0,0,false) : 0;
+                FieldMask.prototype.paths = $util.emptyArray;
     
                 /**
-                 * Timestamp nanos.
-                 * @member {number} nanos
-                 * @memberof google.protobuf.Timestamp
-                 * @instance
-                 */
-                Timestamp.prototype.nanos = 0;
-    
-                /**
-                 * Creates a new Timestamp instance using the specified properties.
+                 * Creates a new FieldMask instance using the specified properties.
                  * @function create
-                 * @memberof google.protobuf.Timestamp
+                 * @memberof google.protobuf.FieldMask
                  * @static
-                 * @param {google.protobuf.ITimestamp=} [properties] Properties to set
-                 * @returns {google.protobuf.Timestamp} Timestamp instance
+                 * @param {google.protobuf.IFieldMask=} [properties] Properties to set
+                 * @returns {google.protobuf.FieldMask} FieldMask instance
                  */
-                Timestamp.create = function create(properties) {
-                    return new Timestamp(properties);
+                FieldMask.create = function create(properties) {
+                    return new FieldMask(properties);
                 };
     
                 /**
-                 * Encodes the specified Timestamp message. Does not implicitly {@link google.protobuf.Timestamp.verify|verify} messages.
+                 * Encodes the specified FieldMask message. Does not implicitly {@link google.protobuf.FieldMask.verify|verify} messages.
                  * @function encode
-                 * @memberof google.protobuf.Timestamp
+                 * @memberof google.protobuf.FieldMask
                  * @static
-                 * @param {google.protobuf.ITimestamp} message Timestamp message or plain object to encode
+                 * @param {google.protobuf.IFieldMask} message FieldMask message or plain object to encode
                  * @param {$protobuf.Writer} [writer] Writer to encode to
                  * @returns {$protobuf.Writer} Writer
                  */
-                Timestamp.encode = function encode(message, writer) {
+                FieldMask.encode = function encode(message, writer) {
                     if (!writer)
                         writer = $Writer.create();
-                    if (message.seconds != null && Object.hasOwnProperty.call(message, "seconds"))
-                        writer.uint32(/* id 1, wireType 0 =*/8).int64(message.seconds);
-                    if (message.nanos != null && Object.hasOwnProperty.call(message, "nanos"))
-                        writer.uint32(/* id 2, wireType 0 =*/16).int32(message.nanos);
+                    if (message.paths != null && message.paths.length)
+                        for (var i = 0; i < message.paths.length; ++i)
+                            writer.uint32(/* id 1, wireType 2 =*/10).string(message.paths[i]);
                     return writer;
                 };
     
                 /**
-                 * Encodes the specified Timestamp message, length delimited. Does not implicitly {@link google.protobuf.Timestamp.verify|verify} messages.
+                 * Encodes the specified FieldMask message, length delimited. Does not implicitly {@link google.protobuf.FieldMask.verify|verify} messages.
                  * @function encodeDelimited
-                 * @memberof google.protobuf.Timestamp
+                 * @memberof google.protobuf.FieldMask
                  * @static
-                 * @param {google.protobuf.ITimestamp} message Timestamp message or plain object to encode
+                 * @param {google.protobuf.IFieldMask} message FieldMask message or plain object to encode
                  * @param {$protobuf.Writer} [writer] Writer to encode to
                  * @returns {$protobuf.Writer} Writer
                  */
-                Timestamp.encodeDelimited = function encodeDelimited(message, writer) {
+                FieldMask.encodeDelimited = function encodeDelimited(message, writer) {
                     return this.encode(message, writer).ldelim();
                 };
     
                 /**
-                 * Decodes a Timestamp message from the specified reader or buffer.
+                 * Decodes a FieldMask message from the specified reader or buffer.
                  * @function decode
-                 * @memberof google.protobuf.Timestamp
+                 * @memberof google.protobuf.FieldMask
                  * @static
                  * @param {$protobuf.Reader|Uint8Array} reader Reader or buffer to decode from
                  * @param {number} [length] Message length if known beforehand
-                 * @returns {google.protobuf.Timestamp} Timestamp
+                 * @returns {google.protobuf.FieldMask} FieldMask
                  * @throws {Error} If the payload is not a reader or valid buffer
                  * @throws {$protobuf.util.ProtocolError} If required fields are missing
                  */
-                Timestamp.decode = function decode(reader, length) {
+                FieldMask.decode = function decode(reader, length) {
                     if (!(reader instanceof $Reader))
                         reader = $Reader.create(reader);
-                    var end = length === undefined ? reader.len : reader.pos + length, message = new $root.google.protobuf.Timestamp();
+                    var end = length === undefined ? reader.len : reader.pos + length, message = new $root.google.protobuf.FieldMask();
                     while (reader.pos < end) {
                         var tag = reader.uint32();
                         switch (tag >>> 3) {
                         case 1: {
-                                message.seconds = reader.int64();
-                                break;
-                            }
-                        case 2: {
-                                message.nanos = reader.int32();
+                                if (!(message.paths && message.paths.length))
+                                    message.paths = [];
+                                message.paths.push(reader.string());
                                 break;
                             }
                         default:
@@ -15962,125 +16249,114 @@
                 };
     
                 /**
-                 * Decodes a Timestamp message from the specified reader or buffer, length delimited.
+                 * Decodes a FieldMask message from the specified reader or buffer, length delimited.
                  * @function decodeDelimited
-                 * @memberof google.protobuf.Timestamp
+                 * @memberof google.protobuf.FieldMask
                  * @static
                  * @param {$protobuf.Reader|Uint8Array} reader Reader or buffer to decode from
-                 * @returns {google.protobuf.Timestamp} Timestamp
+                 * @returns {google.protobuf.FieldMask} FieldMask
                  * @throws {Error} If the payload is not a reader or valid buffer
                  * @throws {$protobuf.util.ProtocolError} If required fields are missing
                  */
-                Timestamp.decodeDelimited = function decodeDelimited(reader) {
+                FieldMask.decodeDelimited = function decodeDelimited(reader) {
                     if (!(reader instanceof $Reader))
                         reader = new $Reader(reader);
                     return this.decode(reader, reader.uint32());
                 };
     
                 /**
-                 * Verifies a Timestamp message.
+                 * Verifies a FieldMask message.
                  * @function verify
-                 * @memberof google.protobuf.Timestamp
+                 * @memberof google.protobuf.FieldMask
                  * @static
                  * @param {Object.<string,*>} message Plain object to verify
                  * @returns {string|null} `null` if valid, otherwise the reason why it is not
                  */
-                Timestamp.verify = function verify(message) {
+                FieldMask.verify = function verify(message) {
                     if (typeof message !== "object" || message === null)
                         return "object expected";
-                    if (message.seconds != null && message.hasOwnProperty("seconds"))
-                        if (!$util.isInteger(message.seconds) && !(message.seconds && $util.isInteger(message.seconds.low) && $util.isInteger(message.seconds.high)))
-                            return "seconds: integer|Long expected";
-                    if (message.nanos != null && message.hasOwnProperty("nanos"))
-                        if (!$util.isInteger(message.nanos))
-                            return "nanos: integer expected";
+                    if (message.paths != null && message.hasOwnProperty("paths")) {
+                        if (!Array.isArray(message.paths))
+                            return "paths: array expected";
+                        for (var i = 0; i < message.paths.length; ++i)
+                            if (!$util.isString(message.paths[i]))
+                                return "paths: string[] expected";
+                    }
                     return null;
                 };
     
                 /**
-                 * Creates a Timestamp message from a plain object. Also converts values to their respective internal types.
+                 * Creates a FieldMask message from a plain object. Also converts values to their respective internal types.
                  * @function fromObject
-                 * @memberof google.protobuf.Timestamp
+                 * @memberof google.protobuf.FieldMask
                  * @static
                  * @param {Object.<string,*>} object Plain object
-                 * @returns {google.protobuf.Timestamp} Timestamp
+                 * @returns {google.protobuf.FieldMask} FieldMask
                  */
-                Timestamp.fromObject = function fromObject(object) {
-                    if (object instanceof $root.google.protobuf.Timestamp)
+                FieldMask.fromObject = function fromObject(object) {
+                    if (object instanceof $root.google.protobuf.FieldMask)
                         return object;
-                    var message = new $root.google.protobuf.Timestamp();
-                    if (object.seconds != null)
-                        if ($util.Long)
-                            (message.seconds = $util.Long.fromValue(object.seconds)).unsigned = false;
-                        else if (typeof object.seconds === "string")
-                            message.seconds = parseInt(object.seconds, 10);
-                        else if (typeof object.seconds === "number")
-                            message.seconds = object.seconds;
-                        else if (typeof object.seconds === "object")
-                            message.seconds = new $util.LongBits(object.seconds.low >>> 0, object.seconds.high >>> 0).toNumber();
-                    if (object.nanos != null)
-                        message.nanos = object.nanos | 0;
+                    var message = new $root.google.protobuf.FieldMask();
+                    if (object.paths) {
+                        if (!Array.isArray(object.paths))
+                            throw TypeError(".google.protobuf.FieldMask.paths: array expected");
+                        message.paths = [];
+                        for (var i = 0; i < object.paths.length; ++i)
+                            message.paths[i] = String(object.paths[i]);
+                    }
                     return message;
                 };
     
                 /**
-                 * Creates a plain object from a Timestamp message. Also converts values to other types if specified.
+                 * Creates a plain object from a FieldMask message. Also converts values to other types if specified.
                  * @function toObject
-                 * @memberof google.protobuf.Timestamp
+                 * @memberof google.protobuf.FieldMask
                  * @static
-                 * @param {google.protobuf.Timestamp} message Timestamp
+                 * @param {google.protobuf.FieldMask} message FieldMask
                  * @param {$protobuf.IConversionOptions} [options] Conversion options
                  * @returns {Object.<string,*>} Plain object
                  */
-                Timestamp.toObject = function toObject(message, options) {
+                FieldMask.toObject = function toObject(message, options) {
                     if (!options)
                         options = {};
                     var object = {};
-                    if (options.defaults) {
-                        if ($util.Long) {
-                            var long = new $util.Long(0, 0, false);
-                            object.seconds = options.longs === String ? long.toString() : options.longs === Number ? long.toNumber() : long;
-                        } else
-                            object.seconds = options.longs === String ? "0" : 0;
-                        object.nanos = 0;
+                    if (options.arrays || options.defaults)
+                        object.paths = [];
+                    if (message.paths && message.paths.length) {
+                        object.paths = [];
+                        for (var j = 0; j < message.paths.length; ++j)
+                            object.paths[j] = message.paths[j];
                     }
-                    if (message.seconds != null && message.hasOwnProperty("seconds"))
-                        if (typeof message.seconds === "number")
-                            object.seconds = options.longs === String ? String(message.seconds) : message.seconds;
-                        else
-                            object.seconds = options.longs === String ? $util.Long.prototype.toString.call(message.seconds) : options.longs === Number ? new $util.LongBits(message.seconds.low >>> 0, message.seconds.high >>> 0).toNumber() : message.seconds;
-                    if (message.nanos != null && message.hasOwnProperty("nanos"))
-                        object.nanos = message.nanos;
                     return object;
                 };
     
                 /**
-                 * Converts this Timestamp to JSON.
+                 * Converts this FieldMask to JSON.
                  * @function toJSON
-                 * @memberof google.protobuf.Timestamp
+                 * @memberof google.protobuf.FieldMask
                  * @instance
                  * @returns {Object.<string,*>} JSON object
                  */
-                Timestamp.prototype.toJSON = function toJSON() {
+                FieldMask.prototype.toJSON = function toJSON() {
                     return this.constructor.toObject(this, $protobuf.util.toJSONOptions);
                 };
     
                 /**
-                 * Gets the default type url for Timestamp
+                 * Gets the default type url for FieldMask
                  * @function getTypeUrl
-                 * @memberof google.protobuf.Timestamp
+                 * @memberof google.protobuf.FieldMask
                  * @static
                  * @param {string} [typeUrlPrefix] your custom typeUrlPrefix(default "type.googleapis.com")
                  * @returns {string} The default type url
                  */
-                Timestamp.getTypeUrl = function getTypeUrl(typeUrlPrefix) {
+                FieldMask.getTypeUrl = function getTypeUrl(typeUrlPrefix) {
                     if (typeUrlPrefix === undefined) {
                         typeUrlPrefix = "type.googleapis.com";
                     }
-                    return typeUrlPrefix + "/google.protobuf.Timestamp";
+                    return typeUrlPrefix + "/google.protobuf.FieldMask";
                 };
     
-                return Timestamp;
+                return FieldMask;
             })();
     
             return protobuf;
diff --git a/packages/google-cloud-orgpolicy/protos/protos.json b/packages/google-cloud-orgpolicy/protos/protos.json
index d0a5f664f4a..6c9afe05b36 100644
--- a/packages/google-cloud-orgpolicy/protos/protos.json
+++ b/packages/google-cloud-orgpolicy/protos/protos.json
@@ -314,6 +314,10 @@
                           "options": {
                             "deprecated": true
                           }
+                        },
+                        "dryRunSpec": {
+                          "type": "PolicySpec",
+                          "id": 4
                         }
                       }
                     },
@@ -526,6 +530,10 @@
                           "options": {
                             "(google.api.field_behavior)": "REQUIRED"
                           }
+                        },
+                        "updateMask": {
+                          "type": "google.protobuf.FieldMask",
+                          "id": 3
                         }
                       }
                     },
@@ -1688,9 +1696,6 @@
                 }
               }
             },
-            "Empty": {
-              "fields": {}
-            },
             "Timestamp": {
               "fields": {
                 "seconds": {
@@ -1702,6 +1707,18 @@
                   "id": 2
                 }
               }
+            },
+            "Empty": {
+              "fields": {}
+            },
+            "FieldMask": {
+              "fields": {
+                "paths": {
+                  "rule": "repeated",
+                  "type": "string",
+                  "id": 1
+                }
+              }
             }
           }
         },
diff --git a/packages/google-cloud-orgpolicy/samples/generated/v2/org_policy.create_policy.js b/packages/google-cloud-orgpolicy/samples/generated/v2/org_policy.create_policy.js
index 9f37abfccc4..9332ceeffea 100644
--- a/packages/google-cloud-orgpolicy/samples/generated/v2/org_policy.create_policy.js
+++ b/packages/google-cloud-orgpolicy/samples/generated/v2/org_policy.create_policy.js
@@ -29,8 +29,8 @@ function main(parent, policy) {
    * TODO(developer): Uncomment these variables before running the sample.
    */
   /**
-   *  Required. The Cloud resource that will parent the new Policy. Must be in one of the
-   *  following forms:
+   *  Required. The Cloud resource that will parent the new Policy. Must be in
+   *  one of the following forms:
    *  * `projects/{project_number}`
    *  * `projects/{project_id}`
    *  * `folders/{folder_id}`
diff --git a/packages/google-cloud-orgpolicy/samples/generated/v2/org_policy.get_policy.js b/packages/google-cloud-orgpolicy/samples/generated/v2/org_policy.get_policy.js
index 53abb322cef..532fe0441f7 100644
--- a/packages/google-cloud-orgpolicy/samples/generated/v2/org_policy.get_policy.js
+++ b/packages/google-cloud-orgpolicy/samples/generated/v2/org_policy.get_policy.js
@@ -29,7 +29,8 @@ function main(name) {
    * TODO(developer): Uncomment these variables before running the sample.
    */
   /**
-   *  Required. Resource name of the policy. See `Policy` for naming requirements.
+   *  Required. Resource name of the policy. See `Policy` for naming
+   *  requirements.
    */
   // const name = 'abc123'
 
diff --git a/packages/google-cloud-orgpolicy/samples/generated/v2/org_policy.list_constraints.js b/packages/google-cloud-orgpolicy/samples/generated/v2/org_policy.list_constraints.js
index 04ed4de2bc2..c65243b9610 100644
--- a/packages/google-cloud-orgpolicy/samples/generated/v2/org_policy.list_constraints.js
+++ b/packages/google-cloud-orgpolicy/samples/generated/v2/org_policy.list_constraints.js
@@ -29,8 +29,8 @@ function main(parent) {
    * TODO(developer): Uncomment these variables before running the sample.
    */
   /**
-   *  Required. The Cloud resource that parents the constraint. Must be in one of the
-   *  following forms:
+   *  Required. The Cloud resource that parents the constraint. Must be in one of
+   *  the following forms:
    *  * `projects/{project_number}`
    *  * `projects/{project_id}`
    *  * `folders/{folder_id}`
diff --git a/packages/google-cloud-orgpolicy/samples/generated/v2/org_policy.list_policies.js b/packages/google-cloud-orgpolicy/samples/generated/v2/org_policy.list_policies.js
index ad00dd8a172..37256b96f4f 100644
--- a/packages/google-cloud-orgpolicy/samples/generated/v2/org_policy.list_policies.js
+++ b/packages/google-cloud-orgpolicy/samples/generated/v2/org_policy.list_policies.js
@@ -29,9 +29,9 @@ function main(parent) {
    * TODO(developer): Uncomment these variables before running the sample.
    */
   /**
-   *  Required. The target Cloud resource that parents the set of constraints and policies
-   *  that will be returned from this call. Must be in one of the following
-   *  forms:
+   *  Required. The target Cloud resource that parents the set of constraints and
+   *  policies that will be returned from this call. Must be in one of the
+   *  following forms:
    *  * `projects/{project_number}`
    *  * `projects/{project_id}`
    *  * `folders/{folder_id}`
diff --git a/packages/google-cloud-orgpolicy/samples/generated/v2/org_policy.update_policy.js b/packages/google-cloud-orgpolicy/samples/generated/v2/org_policy.update_policy.js
index 0a431eda521..3b91bf0d04a 100644
--- a/packages/google-cloud-orgpolicy/samples/generated/v2/org_policy.update_policy.js
+++ b/packages/google-cloud-orgpolicy/samples/generated/v2/org_policy.update_policy.js
@@ -32,6 +32,12 @@ function main(policy) {
    *  Required. `Policy` to update.
    */
   // const policy = {}
+  /**
+   *  Field mask used to specify the fields to be overwritten in the policy
+   *  by the set. The fields specified in the update_mask are relative to the
+   *  policy, not the full request.
+   */
+  // const updateMask = {}
 
   // Imports the Orgpolicy library
   const {OrgPolicyClient} = require('@google-cloud/org-policy').v2;
diff --git a/packages/google-cloud-orgpolicy/samples/generated/v2/snippet_metadata.google.cloud.orgpolicy.v2.json b/packages/google-cloud-orgpolicy/samples/generated/v2/snippet_metadata.google.cloud.orgpolicy.v2.json
index eecd4ce7022..c90066203c3 100644
--- a/packages/google-cloud-orgpolicy/samples/generated/v2/snippet_metadata.google.cloud.orgpolicy.v2.json
+++ b/packages/google-cloud-orgpolicy/samples/generated/v2/snippet_metadata.google.cloud.orgpolicy.v2.json
@@ -118,7 +118,7 @@
             "segments": [
                 {
                     "start": 25,
-                    "end": 53,
+                    "end": 54,
                     "type": "FULL"
                 }
             ],
@@ -242,7 +242,7 @@
             "segments": [
                 {
                     "start": 25,
-                    "end": 53,
+                    "end": 59,
                     "type": "FULL"
                 }
             ],
@@ -254,6 +254,10 @@
                     {
                         "name": "policy",
                         "type": ".google.cloud.orgpolicy.v2.Policy"
+                    },
+                    {
+                        "name": "update_mask",
+                        "type": ".google.protobuf.FieldMask"
                     }
                 ],
                 "resultType": ".google.cloud.orgpolicy.v2.Policy",
diff --git a/packages/google-cloud-orgpolicy/src/v2/org_policy_client.ts b/packages/google-cloud-orgpolicy/src/v2/org_policy_client.ts
index bedc3d936e7..aca2bec4c72 100644
--- a/packages/google-cloud-orgpolicy/src/v2/org_policy_client.ts
+++ b/packages/google-cloud-orgpolicy/src/v2/org_policy_client.ts
@@ -386,7 +386,8 @@ export class OrgPolicyClient {
    * @param {Object} request
    *   The request object that will be sent.
    * @param {string} request.name
-   *   Required. Resource name of the policy. See `Policy` for naming requirements.
+   *   Required. Resource name of the policy. See `Policy` for naming
+   *   requirements.
    * @param {object} [options]
    *   Call options. See {@link https://googleapis.dev/nodejs/google-gax/latest/interfaces/CallOptions.html|CallOptions} for more details.
    * @returns {Promise} - The promise which resolves to an array.
@@ -570,8 +571,8 @@ export class OrgPolicyClient {
    * @param {Object} request
    *   The request object that will be sent.
    * @param {string} request.parent
-   *   Required. The Cloud resource that will parent the new Policy. Must be in one of the
-   *   following forms:
+   *   Required. The Cloud resource that will parent the new Policy. Must be in
+   *   one of the following forms:
    *   * `projects/{project_number}`
    *   * `projects/{project_id}`
    *   * `folders/{folder_id}`
@@ -671,6 +672,10 @@ export class OrgPolicyClient {
    *   The request object that will be sent.
    * @param {google.cloud.orgpolicy.v2.Policy} request.policy
    *   Required. `Policy` to update.
+   * @param {google.protobuf.FieldMask} request.updateMask
+   *   Field mask used to specify the fields to be overwritten in the policy
+   *   by the set. The fields specified in the update_mask are relative to the
+   *   policy, not the full request.
    * @param {object} [options]
    *   Call options. See {@link https://googleapis.dev/nodejs/google-gax/latest/interfaces/CallOptions.html|CallOptions} for more details.
    * @returns {Promise} - The promise which resolves to an array.
@@ -845,8 +850,8 @@ export class OrgPolicyClient {
    * @param {Object} request
    *   The request object that will be sent.
    * @param {string} request.parent
-   *   Required. The Cloud resource that parents the constraint. Must be in one of the
-   *   following forms:
+   *   Required. The Cloud resource that parents the constraint. Must be in one of
+   *   the following forms:
    *   * `projects/{project_number}`
    *   * `projects/{project_id}`
    *   * `folders/{folder_id}`
@@ -951,8 +956,8 @@ export class OrgPolicyClient {
    * @param {Object} request
    *   The request object that will be sent.
    * @param {string} request.parent
-   *   Required. The Cloud resource that parents the constraint. Must be in one of the
-   *   following forms:
+   *   Required. The Cloud resource that parents the constraint. Must be in one of
+   *   the following forms:
    *   * `projects/{project_number}`
    *   * `projects/{project_id}`
    *   * `folders/{folder_id}`
@@ -1005,8 +1010,8 @@ export class OrgPolicyClient {
    * @param {Object} request
    *   The request object that will be sent.
    * @param {string} request.parent
-   *   Required. The Cloud resource that parents the constraint. Must be in one of the
-   *   following forms:
+   *   Required. The Cloud resource that parents the constraint. Must be in one of
+   *   the following forms:
    *   * `projects/{project_number}`
    *   * `projects/{project_id}`
    *   * `folders/{folder_id}`
@@ -1058,9 +1063,9 @@ export class OrgPolicyClient {
    * @param {Object} request
    *   The request object that will be sent.
    * @param {string} request.parent
-   *   Required. The target Cloud resource that parents the set of constraints and policies
-   *   that will be returned from this call. Must be in one of the following
-   *   forms:
+   *   Required. The target Cloud resource that parents the set of constraints and
+   *   policies that will be returned from this call. Must be in one of the
+   *   following forms:
    *   * `projects/{project_number}`
    *   * `projects/{project_id}`
    *   * `folders/{folder_id}`
@@ -1159,9 +1164,9 @@ export class OrgPolicyClient {
    * @param {Object} request
    *   The request object that will be sent.
    * @param {string} request.parent
-   *   Required. The target Cloud resource that parents the set of constraints and policies
-   *   that will be returned from this call. Must be in one of the following
-   *   forms:
+   *   Required. The target Cloud resource that parents the set of constraints and
+   *   policies that will be returned from this call. Must be in one of the
+   *   following forms:
    *   * `projects/{project_number}`
    *   * `projects/{project_id}`
    *   * `folders/{folder_id}`
@@ -1214,9 +1219,9 @@ export class OrgPolicyClient {
    * @param {Object} request
    *   The request object that will be sent.
    * @param {string} request.parent
-   *   Required. The target Cloud resource that parents the set of constraints and policies
-   *   that will be returned from this call. Must be in one of the following
-   *   forms:
+   *   Required. The target Cloud resource that parents the set of constraints and
+   *   policies that will be returned from this call. Must be in one of the
+   *   following forms:
    *   * `projects/{project_number}`
    *   * `projects/{project_id}`
    *   * `folders/{folder_id}`