diff --git a/Cargo.lock b/Cargo.lock
index e61e1603..fca0e094 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -7031,6 +7031,7 @@ dependencies = [
  "tower",
  "tracing",
  "tracing-subscriber",
+ "trait-variant",
  "tui-canvas-validation-core",
  "unicode-width 0.2.2",
  "url",
@@ -8542,6 +8543,17 @@ dependencies = [
  "tracing-log",
 ]
 
+[[package]]
+name = "trait-variant"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b19a4867a870f6edc4c283f2b455804b1879c0baf0e642f26b03ed8ee262d9d3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "try-lock"
 version = "0.2.5"
diff --git a/common/proto/auth.proto b/common/proto/auth.proto
index 54f3009d..befbaba4 100644
--- a/common/proto/auth.proto
+++ b/common/proto/auth.proto
@@ -35,7 +35,7 @@ service AuthService {
   rpc ListRolePermissions(ListRolePermissionsRequest) returns (RolePermissions);
   rpc ListGrantableObjects(ListGrantableObjectsRequest) returns (ListGrantableObjectsResponse);
 
-  // Support diagnostics. Requires read on diagnostics:internal-errors.
+  // Diagnostic browsing is admin-only; authenticated UUID lookup follows role restrictions.
   rpc ListInternalErrors(ListInternalErrorsRequest) returns (ListInternalErrorsResponse);
   rpc GetInternalError(GetInternalErrorRequest) returns (InternalError);
 
diff --git a/common/src/proto/descriptor.bin b/common/src/proto/descriptor.bin
index 73ece688..8b4cc9f1 100644
Binary files a/common/src/proto/descriptor.bin and b/common/src/proto/descriptor.bin differ
diff --git a/common/src/proto/komp_ac.auth.rs b/common/src/proto/komp_ac.auth.rs
index 054a6d27..d8126fbb 100644
--- a/common/src/proto/komp_ac.auth.rs
+++ b/common/src/proto/komp_ac.auth.rs
@@ -846,7 +846,7 @@ pub mod auth_service_client {
                 );
             self.inner.unary(req, path, codec).await
         }
-        /// Support diagnostics. Requires read on diagnostics:internal-errors.
+        /// Diagnostic browsing is admin-only; authenticated UUID lookup follows role restrictions.
         pub async fn list_internal_errors(
             &mut self,
             request: impl tonic::IntoRequest<super::ListInternalErrorsRequest>,
@@ -1070,7 +1070,7 @@ pub mod auth_service_server {
             tonic::Response<super::ListGrantableObjectsResponse>,
             tonic::Status,
         >;
-        /// Support diagnostics. Requires read on diagnostics:internal-errors.
+        /// Diagnostic browsing is admin-only; authenticated UUID lookup follows role restrictions.
         async fn list_internal_errors(
             &self,
             request: tonic::Request<super::ListInternalErrorsRequest>,
diff --git a/server b/server
index 7f652545..b5c854f8 160000
--- a/server
+++ b/server
@@ -1 +1 @@
-Subproject commit 7f652545a467db5f6b889d4549195011e8b62ee8
+Subproject commit b5c854f8aa21ac969ecb6608eeb56e531784a514