From adf832258463a2e325896a143560e17c7c1c649c Mon Sep 17 00:00:00 2001
From: CEL Dev Team <cel-dev@google.com>
Date: Tue, 25 Aug 2026 23:43:48 -0700
Subject: [PATCH] Support match_path for non-repeated primitive fields, maps,
 and message.

PiperOrigin-RevId: 971054057
---
 common/legacy_value.cc                        |  54 ++++++----
 common/legacy_value.h                         |   4 +-
 eval/eval/select_step.cc                      |  73 +++++++------
 eval/public/cel_options.cc                    |   1 +
 eval/public/cel_options.h                     |  10 ++
 .../proto_message_type_adapter_test.cc        |  10 +-
 extensions/select_optimization.cc             | 102 ++++++++++--------
 runtime/runtime_options.h                     |  10 ++
 tools/proto_to_predicate.cc                   |  19 +++-
 tools/proto_to_predicate_test.cc              |  97 +++++++++++++++++
 tools/testdata/BUILD                          |   1 +
 tools/testdata/test_policy.proto              |  27 +++++
 12 files changed, 304 insertions(+), 104 deletions(-)

diff --git a/common/legacy_value.cc b/common/legacy_value.cc
index b963e5071..a08b8317a 100644
--- a/common/legacy_value.cc
+++ b/common/legacy_value.cc
@@ -74,11 +74,9 @@ using ::cel::interop_internal::TrivialTypeInfo;
 using ::google::api::expr::runtime::CelList;
 using ::google::api::expr::runtime::CelMap;
 using ::google::api::expr::runtime::CelValue;
-using ::google::api::expr::runtime::CreateCelValueFromField;
 using ::google::api::expr::runtime::GetGenericProtoTypeInfoInstance;
 using ::google::api::expr::runtime::LegacyTypeInfoApis;
 using ::google::api::expr::runtime::MessageWrapper;
-using ::google::api::expr::runtime::internal::GetGenericProtoAccessApisInstance;
 using ::google::api::expr::runtime::internal::MaybeWrapValueToMessage;
 
 absl::Status InvalidMapKeyTypeError(ValueKind kind) {
@@ -923,17 +921,26 @@ absl::Status LegacyStructValue::GetFieldByName(
     const google::protobuf::DescriptorPool* absl_nonnull descriptor_pool,
     google::protobuf::MessageFactory* absl_nonnull message_factory,
     google::protobuf::Arena* absl_nonnull arena, Value* absl_nonnull result) const {
-  auto message_wrapper = AsMessageWrapper(message_ptr_, legacy_type_info_);
   if (ABSL_PREDICT_FALSE(legacy_type_info_ == TrivialTypeInfo::GetInstance())) {
     *result = NoSuchFieldError(name);
     return absl::OkStatus();
   }
-  CEL_ASSIGN_OR_RETURN(auto cel_value,
-                       GetGenericProtoAccessApisInstance().GetField(
-                           name, message_wrapper, unboxing_options,
-                           MemoryManagerRef::Pooling(arena)));
-  CEL_RETURN_IF_ERROR(ModernValue(arena, cel_value, *result));
-  return absl::OkStatus();
+
+  ParsedMessageValue parsed_message = UnsafeParsedMessageValue(message_ptr_);
+  const auto* descriptor = parsed_message.GetDescriptor();
+  const auto* field = descriptor->FindFieldByName(name);
+  if (field == nullptr) {
+    field = descriptor->file()->pool()->FindExtensionByPrintableName(descriptor,
+                                                                     name);
+    if (field == nullptr) {
+      *result = NoSuchFieldError(name);
+      return absl::OkStatus();
+    }
+  }
+
+  return interop_internal::WrapLegacyMessageField(
+      message_ptr_, field, unboxing_options, descriptor_pool, message_factory,
+      arena, result);
 }
 
 absl::Status LegacyStructValue::GetFieldByNumber(
@@ -985,7 +992,6 @@ absl::Status LegacyStructValue::Qualify(
   if (ABSL_PREDICT_FALSE(qualifiers.empty())) {
     return absl::InvalidArgumentError("invalid select qualifier path.");
   }
-  auto message_wrapper = AsMessageWrapper(message_ptr_, legacy_type_info_);
   if (ABSL_PREDICT_FALSE(legacy_type_info_ == TrivialTypeInfo::GetInstance())) {
     absl::string_view field_name = absl::visit(
         absl::Overload(
@@ -1000,12 +1006,13 @@ absl::Status LegacyStructValue::Qualify(
     *count = -1;
     return absl::OkStatus();
   }
-  CEL_ASSIGN_OR_RETURN(auto legacy_result,
-                       GetGenericProtoAccessApisInstance().Qualify(
-                           qualifiers, message_wrapper, presence_test,
-                           MemoryManager::Pooling(arena)));
-  CEL_RETURN_IF_ERROR(ModernValue(arena, legacy_result.value, *result));
-  *count = legacy_result.qualifier_count;
+
+  ParsedMessageValue parsed_message = UnsafeParsedMessageValue(message_ptr_);
+  CEL_RETURN_IF_ERROR(parsed_message.Qualify(qualifiers, presence_test,
+                                             descriptor_pool, message_factory,
+                                             arena, result, count));
+
+  interop_internal::WrapLegacyFieldAccessResult(arena, result);
   return absl::OkStatus();
 }
 
@@ -1311,12 +1318,17 @@ const google::protobuf::Message* absl_nullable GetLegacyMessage(const Value& val
 absl::Status WrapLegacyMessageField(
     const google::protobuf::Message* absl_nonnull message,
     const google::protobuf::FieldDescriptor* absl_nonnull field_descriptor,
-    ProtoWrapperTypeOptions unboxing_option, google::protobuf::Arena* arena,
+    ProtoWrapperTypeOptions unboxing_option,
+    const google::protobuf::DescriptorPool* absl_nonnull descriptor_pool,
+    google::protobuf::MessageFactory* absl_nonnull message_factory, google::protobuf::Arena* arena,
     Value* absl_nonnull out) {
-  CEL_ASSIGN_OR_RETURN(CelValue result,
-                       CreateCelValueFromField(message, field_descriptor,
-                                               unboxing_option, arena));
-  return ModernValue(arena, result, *out);
+  ParsedMessageValue parsed_message = UnsafeParsedMessageValue(message);
+  CEL_RETURN_IF_ERROR(parsed_message.GetField(field_descriptor, unboxing_option,
+                                              descriptor_pool, message_factory,
+                                              arena, out));
+  WrapLegacyFieldAccessResult(arena, out);
+
+  return absl::OkStatus();
 }
 
 }  // namespace interop_internal
diff --git a/common/legacy_value.h b/common/legacy_value.h
index 5b7140387..a89eb0412 100644
--- a/common/legacy_value.h
+++ b/common/legacy_value.h
@@ -82,7 +82,9 @@ void WrapLegacyFieldAccessResult(google::protobuf::Arena* absl_nonnull arena,
 absl::Status WrapLegacyMessageField(
     const google::protobuf::Message* absl_nonnull message,
     const google::protobuf::FieldDescriptor* absl_nonnull field_descriptor,
-    ProtoWrapperTypeOptions unboxing_option, google::protobuf::Arena* arena,
+    ProtoWrapperTypeOptions unboxing_option,
+    const google::protobuf::DescriptorPool* absl_nonnull descriptor_pool,
+    google::protobuf::MessageFactory* absl_nonnull message_factory, google::protobuf::Arena* arena,
     Value* absl_nonnull out);
 
 absl::StatusOr<Value> FromLegacyValue(
diff --git a/eval/eval/select_step.cc b/eval/eval/select_step.cc
index a57179017..e7974496b 100644
--- a/eval/eval/select_step.cc
+++ b/eval/eval/select_step.cc
@@ -86,17 +86,22 @@ absl::Status WrappedStructGet(
     ProtoWrapperTypeOptions unboxing_option,
     const google::protobuf::DescriptorPool* absl_nonnull descriptor_pool,
     google::protobuf::MessageFactory* absl_nonnull message_factory,
-    google::protobuf::Arena* absl_nonnull arena, Value* absl_nonnull result) {
-  if (const google::protobuf::Message* message =
-          cel::interop_internal::GetLegacyMessage(target);
-      message != nullptr) {
-    CelValue::MessageWrapper message_wrapper(
-        message, &GetGenericProtoTypeInfoInstance());
-    CEL_ASSIGN_OR_RETURN(CelValue cel_value,
-                         internal::GetGenericProtoAccessApisInstance().GetField(
-                             field, message_wrapper, unboxing_option,
-                             cel::MemoryManagerRef::Pooling(arena)));
-    return cel::ModernValue(arena, cel_value, *result);
+    google::protobuf::Arena* absl_nonnull arena,
+    bool enable_use_new_field_select_implementation,
+    Value* absl_nonnull result) {
+  if (!enable_use_new_field_select_implementation) {
+    if (const google::protobuf::Message* message =
+            cel::interop_internal::GetLegacyMessage(target);
+        message != nullptr) {
+      CelValue::MessageWrapper message_wrapper(
+          message, &GetGenericProtoTypeInfoInstance());
+      CEL_ASSIGN_OR_RETURN(
+          CelValue cel_value,
+          internal::GetGenericProtoAccessApisInstance().GetField(
+              field, message_wrapper, unboxing_option,
+              cel::MemoryManagerRef::Pooling(arena)));
+      return cel::ModernValue(arena, cel_value, *result);
+    }
   }
   return target.GetStruct().GetFieldByName(
       field, unboxing_option, descriptor_pool, message_factory, arena, result);
@@ -132,7 +137,9 @@ absl::Status PerformGet(const Value& target, absl::string_view field,
                         ProtoWrapperTypeOptions unboxing_option,
                         const google::protobuf::DescriptorPool* descriptor_pool,
                         google::protobuf::MessageFactory* message_factory,
-                        google::protobuf::Arena* arena, Value& result) {
+                        google::protobuf::Arena* arena,
+                        bool enable_use_new_field_select_implementation,
+                        Value& result) {
   switch (target.kind()) {
     case ValueKind::kMap: {
       auto status = target.GetMap().Get(field_value, descriptor_pool,
@@ -143,9 +150,9 @@ absl::Status PerformGet(const Value& target, absl::string_view field,
       return absl::OkStatus();
     }
     case ValueKind::kStruct: {
-      auto status =
-          WrappedStructGet(target, field, unboxing_option, descriptor_pool,
-                           message_factory, arena, &result);
+      auto status = WrappedStructGet(
+          target, field, unboxing_option, descriptor_pool, message_factory,
+          arena, enable_use_new_field_select_implementation, &result);
       if (!status.ok()) {
         result = ErrorValue(std::move(status));
       }
@@ -161,7 +168,9 @@ absl::Status PerformOptionalGet(const Value& target, absl::string_view field,
                                 ProtoWrapperTypeOptions unboxing_option,
                                 const google::protobuf::DescriptorPool* descriptor_pool,
                                 google::protobuf::MessageFactory* message_factory,
-                                google::protobuf::Arena* arena, Value& result) {
+                                google::protobuf::Arena* arena,
+                                bool enable_use_new_field_select_implementation,
+                                Value& result) {
   switch (target.kind()) {
     case ValueKind::kMap: {
       CEL_ASSIGN_OR_RETURN(
@@ -182,9 +191,9 @@ absl::Status PerformOptionalGet(const Value& target, absl::string_view field,
         result = OptionalValue::None();
         return absl::OkStatus();
       }
-      CEL_RETURN_IF_ERROR(WrappedStructGet(target, field, unboxing_option,
-                                           descriptor_pool, message_factory,
-                                           arena, &result));
+      CEL_RETURN_IF_ERROR(WrappedStructGet(
+          target, field, unboxing_option, descriptor_pool, message_factory,
+          arena, enable_use_new_field_select_implementation, &result));
 
       ABSL_DCHECK(!result.IsUnknown());
       result = OptionalValue::Of(std::move(result), arena);
@@ -247,7 +256,7 @@ absl::Status SelectStep::Evaluate(ExecutionFrame* frame) const {
     optional_arg = arg.GetOptional();
   }
 
-  if (!(optional_arg || arg->Is<MapValue>() || arg->Is<StructValue>())) {
+  if (!(optional_arg || arg.IsMap() || arg.IsStruct())) {
     frame->value_stack().PopAndPush(cel::ErrorValue(InvalidSelectTargetError()),
                                     std::move(result_trail));
     return absl::OkStatus();
@@ -290,7 +299,8 @@ absl::Status SelectStep::Evaluate(ExecutionFrame* frame) const {
     optional_arg->Value(&value);
     auto status = PerformOptionalGet(
         value, field_, field_value_, unboxing_option_, frame->descriptor_pool(),
-        frame->message_factory(), frame->arena(), result);
+        frame->message_factory(), frame->arena(),
+        frame->options().enable_use_new_field_select_implementation, result);
     if (!status.ok()) {
       result = ErrorValue(std::move(status));
     }
@@ -300,7 +310,8 @@ absl::Status SelectStep::Evaluate(ExecutionFrame* frame) const {
 
   CEL_RETURN_IF_ERROR(PerformGet(
       arg, field_, field_value_, unboxing_option_, frame->descriptor_pool(),
-      frame->message_factory(), frame->arena(), result));
+      frame->message_factory(), frame->arena(),
+      frame->options().enable_use_new_field_select_implementation, result));
   frame->value_stack().PopAndPush(std::move(result), std::move(result_trail));
   return absl::OkStatus();
 }
@@ -380,19 +391,20 @@ class DirectSelectStep : public DirectExpressionStep {
       }
       Value value;
       optional_arg->Value(&value);
-      auto status =
-          PerformOptionalGet(value, field_, field_value_, unboxing_option_,
-                             frame.descriptor_pool(), frame.message_factory(),
-                             frame.arena(), result);
+      auto status = PerformOptionalGet(
+          value, field_, field_value_, unboxing_option_,
+          frame.descriptor_pool(), frame.message_factory(), frame.arena(),
+          frame.options().enable_use_new_field_select_implementation, result);
       if (!status.ok()) {
         result = ErrorValue(std::move(status));
       }
       return absl::OkStatus();
     }
 
-    return PerformGet(result, field_, field_value_, unboxing_option_,
-                      frame.descriptor_pool(), frame.message_factory(),
-                      frame.arena(), result);
+    return PerformGet(
+        result, field_, field_value_, unboxing_option_, frame.descriptor_pool(),
+        frame.message_factory(), frame.arena(),
+        frame.options().enable_use_new_field_select_implementation, result);
   }
 
  private:
@@ -495,7 +507,8 @@ absl::Status ProtoSelectStep::EvaluateLegacyMessageGetField(
     return absl::OkStatus();
   }
   return cel::interop_internal::WrapLegacyMessageField(
-      legacy_message, field_descriptor_, unboxing_option_, frame->arena(),
+      legacy_message, field_descriptor_, unboxing_option_,
+      frame->descriptor_pool(), frame->message_factory(), frame->arena(),
       &frame->value_stack().Peek());
 }
 
diff --git a/eval/public/cel_options.cc b/eval/public/cel_options.cc
index 93b67ad35..100ef5e01 100644
--- a/eval/public/cel_options.cc
+++ b/eval/public/cel_options.cc
@@ -45,6 +45,7 @@ cel::RuntimeOptions ConvertToRuntimeOptions(const InterpreterOptions& options) {
       options.enable_fast_builtins,
       options.enable_precision_preserving_double_format,
       options.enable_typed_field_access,
+      options.enable_use_new_field_select_implementation,
   };
 }
 
diff --git a/eval/public/cel_options.h b/eval/public/cel_options.h
index 001990431..b0d9e6db0 100644
--- a/eval/public/cel_options.h
+++ b/eval/public/cel_options.h
@@ -223,6 +223,16 @@ struct InterpreterOptions {
   // path for field access when the type is known at plan time, instead of using
   // the generic field access implementation.
   bool enable_typed_field_access = false;
+
+  // Temporary flag to gate using a new field selection implementation for
+  // protos.
+  //
+  // For the cel::Runtime APIs, this is a no-op.
+  //
+  // For google::api::expr::runtime::CelExpression, this will enable updated
+  // implementations for field access on protobuf messages, aligned with the
+  // cel::Value implementation.
+  bool enable_use_new_field_select_implementation = false;
 };
 // LINT.ThenChange(//depot/google3/runtime/runtime_options.h)
 
diff --git a/eval/public/structs/proto_message_type_adapter_test.cc b/eval/public/structs/proto_message_type_adapter_test.cc
index 529052025..b44c17062 100644
--- a/eval/public/structs/proto_message_type_adapter_test.cc
+++ b/eval/public/structs/proto_message_type_adapter_test.cc
@@ -1188,10 +1188,12 @@ TEST(ProtoMesssageTypeAdapter, InteropFieldAccess) {
       message.GetDescriptor()->FindFieldByName("string_value");
   ASSERT_NE(field, nullptr);
   cel::Value field_value;
-  ASSERT_THAT(cel::interop_internal::WrapLegacyMessageField(
-                  &message, field, ProtoWrapperTypeOptions::kUnsetNull, &arena,
-                  &field_value),
-              IsOk());
+  ASSERT_THAT(
+      cel::interop_internal::WrapLegacyMessageField(
+          &message, field, ProtoWrapperTypeOptions::kUnsetNull,
+          google::protobuf::DescriptorPool::generated_pool(),
+          google::protobuf::MessageFactory::generated_factory(), &arena, &field_value),
+      IsOk());
 
   EXPECT_THAT(field_value, cel::test::StringValueIs("hello"));
 }
diff --git a/extensions/select_optimization.cc b/extensions/select_optimization.cc
index 83ea6abc6..4dcd7d594 100644
--- a/extensions/select_optimization.cc
+++ b/extensions/select_optimization.cc
@@ -276,26 +276,29 @@ absl::StatusOr<Value> MapKeyFromQualifier(const AttributeQualifier& qual,
   }
 }
 
-// Helper for StructValue::GetFieldByName. Used for opting out of old reflection
-// implementation.
+// // Helper for StructValue::GetFieldByName. Used for opting out of old
+// reflection implementation.
 absl::StatusOr<Value> WrappedStructGet(
     const Value& target, absl::string_view field,
     const google::protobuf::DescriptorPool* absl_nonnull descriptor_pool,
     google::protobuf::MessageFactory* absl_nonnull message_factory,
-    google::protobuf::Arena* absl_nonnull arena) {
-  if (const google::protobuf::Message* message =
-          cel::interop_internal::GetLegacyMessage(target);
-      message != nullptr) {
-    CelValue::MessageWrapper message_wrapper(
-        message, &GetGenericProtoTypeInfoInstance());
-    CEL_ASSIGN_OR_RETURN(
-        CelValue cel_value,
-        GetGenericProtoAccessApisInstance().GetField(
-            field, message_wrapper, ProtoWrapperTypeOptions::kUnsetProtoDefault,
-            MemoryManagerRef::Pooling(arena)));
-    Value result;
-    CEL_RETURN_IF_ERROR(cel::ModernValue(arena, cel_value, result));
-    return result;
+    google::protobuf::Arena* absl_nonnull arena,
+    bool enable_use_new_field_select_implementation) {
+  if (!enable_use_new_field_select_implementation) {
+    if (const google::protobuf::Message* message =
+            cel::interop_internal::GetLegacyMessage(target);
+        message != nullptr) {
+      CelValue::MessageWrapper message_wrapper(
+          message, &GetGenericProtoTypeInfoInstance());
+      CEL_ASSIGN_OR_RETURN(CelValue cel_value,
+                           GetGenericProtoAccessApisInstance().GetField(
+                               field, message_wrapper,
+                               ProtoWrapperTypeOptions::kUnsetProtoDefault,
+                               MemoryManagerRef::Pooling(arena)));
+      Value result;
+      CEL_RETURN_IF_ERROR(cel::ModernValue(arena, cel_value, result));
+      return result;
+    }
   }
   return target.GetStruct().GetFieldByName(field, descriptor_pool,
                                            message_factory, arena);
@@ -308,20 +311,23 @@ absl::StatusOr<std::pair<Value, int>> WrappedStructQualify(
     absl::Span<const SelectQualifier> qualifiers, bool presence_test,
     const google::protobuf::DescriptorPool* absl_nonnull descriptor_pool,
     google::protobuf::MessageFactory* absl_nonnull message_factory,
-    google::protobuf::Arena* absl_nonnull arena) {
-  if (const google::protobuf::Message* message =
-          cel::interop_internal::GetLegacyMessage(struct_value);
-      message != nullptr) {
-    CelValue::MessageWrapper message_wrapper(
-        message, &GetGenericProtoTypeInfoInstance());
-    CEL_ASSIGN_OR_RETURN(auto legacy_result,
-                         GetGenericProtoAccessApisInstance().Qualify(
-                             qualifiers, message_wrapper, presence_test,
-                             MemoryManagerRef::Pooling(arena)));
-    Value result;
-    CEL_RETURN_IF_ERROR(cel::ModernValue(arena, legacy_result.value, result));
-    return std::pair<Value, int>{std::move(result),
-                                 legacy_result.qualifier_count};
+    google::protobuf::Arena* absl_nonnull arena,
+    bool enable_use_new_field_select_implementation) {
+  if (!enable_use_new_field_select_implementation) {
+    if (const google::protobuf::Message* message =
+            cel::interop_internal::GetLegacyMessage(struct_value);
+        message != nullptr) {
+      CelValue::MessageWrapper message_wrapper(
+          message, &GetGenericProtoTypeInfoInstance());
+      CEL_ASSIGN_OR_RETURN(auto legacy_result,
+                           GetGenericProtoAccessApisInstance().Qualify(
+                               qualifiers, message_wrapper, presence_test,
+                               MemoryManagerRef::Pooling(arena)));
+      Value result;
+      CEL_RETURN_IF_ERROR(cel::ModernValue(arena, legacy_result.value, result));
+      return std::pair<Value, int>{std::move(result),
+                                   legacy_result.qualifier_count};
+    }
   }
   return struct_value.Qualify(qualifiers, presence_test, descriptor_pool,
                               message_factory, arena);
@@ -331,7 +337,8 @@ absl::StatusOr<Value> ApplyQualifier(
     const Value& operand, const SelectQualifier& qualifier,
     const google::protobuf::DescriptorPool* absl_nonnull descriptor_pool,
     google::protobuf::MessageFactory* absl_nonnull message_factory,
-    google::protobuf::Arena* absl_nonnull arena) {
+    google::protobuf::Arena* absl_nonnull arena,
+    bool enable_use_new_field_select_implementation) {
   return absl::visit(
       absl::Overload(
           [&](const FieldSpecifier& field_specifier) -> absl::StatusOr<Value> {
@@ -341,7 +348,8 @@ absl::StatusOr<Value> ApplyQualifier(
                       "<select>"));
             }
             return WrappedStructGet(operand, field_specifier.name,
-                                    descriptor_pool, message_factory, arena);
+                                    descriptor_pool, message_factory, arena,
+                                    enable_use_new_field_select_implementation);
           },
           [&](const AttributeQualifier& qualifier) -> absl::StatusOr<Value> {
             if (operand.Is<ListValue>()) {
@@ -371,15 +379,17 @@ absl::StatusOr<Value> FallbackSelect(
     bool presence_test,
     const google::protobuf::DescriptorPool* absl_nonnull descriptor_pool,
     google::protobuf::MessageFactory* absl_nonnull message_factory,
-    google::protobuf::Arena* absl_nonnull arena) {
+    google::protobuf::Arena* absl_nonnull arena,
+    bool enable_use_new_field_select_implementation) {
   const Value* elem = &root;
   Value result;
 
   for (const auto& instruction :
        select_path.subspan(0, select_path.size() - 1)) {
-    CEL_ASSIGN_OR_RETURN(result,
-                         ApplyQualifier(*elem, instruction, descriptor_pool,
-                                        message_factory, arena));
+    CEL_ASSIGN_OR_RETURN(
+        result,
+        ApplyQualifier(*elem, instruction, descriptor_pool, message_factory,
+                       arena, enable_use_new_field_select_implementation));
     if (result->Is<ErrorValue>()) {
       return result;
     }
@@ -417,7 +427,8 @@ absl::StatusOr<Value> FallbackSelect(
   }
 
   return ApplyQualifier(*elem, last_instruction, descriptor_pool,
-                        message_factory, arena);
+                        message_factory, arena,
+                        enable_use_new_field_select_implementation);
 }
 
 absl::StatusOr<std::vector<SelectQualifier>> SelectInstructionsFromCall(
@@ -692,15 +703,17 @@ absl::StatusOr<Value> OptimizedSelectImpl::ApplySelect(
   auto value_or =
       (options_.force_fallback_implementation)
           ? absl::UnimplementedError("Forced fallback impl")
-          : WrappedStructQualify(struct_value, select_path_, presence_test_,
-                                 frame.descriptor_pool(),
-                                 frame.message_factory(), frame.arena());
+          : WrappedStructQualify(
+                struct_value, select_path_, presence_test_,
+                frame.descriptor_pool(), frame.message_factory(), frame.arena(),
+                frame.options().enable_use_new_field_select_implementation);
 
   if (!value_or.ok()) {
     if (value_or.status().code() == absl::StatusCode::kUnimplemented) {
-      return FallbackSelect(struct_value, select_path_, presence_test_,
-                            frame.descriptor_pool(), frame.message_factory(),
-                            frame.arena());
+      return FallbackSelect(
+          struct_value, select_path_, presence_test_, frame.descriptor_pool(),
+          frame.message_factory(), frame.arena(),
+          frame.options().enable_use_new_field_select_implementation);
     }
 
     return value_or.status();
@@ -714,7 +727,8 @@ absl::StatusOr<Value> OptimizedSelectImpl::ApplySelect(
       value_or->first,
       absl::MakeConstSpan(select_path_).subspan(value_or->second),
       presence_test_, frame.descriptor_pool(), frame.message_factory(),
-      frame.arena());
+      frame.arena(),
+      frame.options().enable_use_new_field_select_implementation);
 }
 
 AttributeTrail OptimizedSelectImpl::GetAttributeTrail(
diff --git a/runtime/runtime_options.h b/runtime/runtime_options.h
index 072daf26c..245b8d52c 100644
--- a/runtime/runtime_options.h
+++ b/runtime/runtime_options.h
@@ -201,6 +201,16 @@ struct RuntimeOptions {
   // not what the planner expected (e.g. a map that was declared as a proto or
   // a different message with matching field names).
   bool enable_typed_field_access = false;
+
+  // Temporary flag to gate using a new field selection implementation for
+  // protos.
+  //
+  // For the cel::Runtime APIs, this is a no-op.
+  //
+  // For google::api::expr::runtime::CelExpression, this will enable updated
+  // implementations for field access on protobuf messages, aligned with the
+  // cel::Value implementation.
+  bool enable_use_new_field_select_implementation = false;
 };
 // LINT.ThenChange(//depot/google3/eval/public/cel_options.h)
 
diff --git a/tools/proto_to_predicate.cc b/tools/proto_to_predicate.cc
index 8c89ee2f0..01f35fd05 100644
--- a/tools/proto_to_predicate.cc
+++ b/tools/proto_to_predicate.cc
@@ -103,6 +103,17 @@ class ProtoToPredicateBuilder final : private ExprFactory {
     }
     return e;
   }
+
+  // Returns either the path specified by the "match_path" annotation,
+  // or the default path derived from the field name.
+  Expr GetFieldPath(const Expr& base_expr,
+                    const ::google::protobuf::FieldDescriptor* field) {
+    std::string match_path_val = GetMatchPath(field);
+    if (!match_path_val.empty()) {
+      return ParseAndBuildPath(match_path_val);
+    }
+    return NewSelect(NextId(), base_expr, field->name());
+  }
   ExprId NextId() { return id_++; }
 
   // ---------------------------------------------------------------------------
@@ -246,7 +257,7 @@ class ProtoToPredicateBuilder final : private ExprFactory {
     const FieldDescriptor* const value_field =
         field->message_type()->FindFieldByName("value");
 
-    Expr map_path = NewSelect(NextId(), base_expr, field->name());
+    Expr map_path = GetFieldPath(base_expr, field);
 
     struct MapEntry {
       const Message* message;
@@ -355,7 +366,7 @@ class ProtoToPredicateBuilder final : private ExprFactory {
         const Message& sub_message =
             reflection->GetRepeatedMessage(message, field, i);
         std::vector<Expr> sub_predicates;
-        Expr sub_base = NewSelect(NextId(), base_expr, field->name());
+        Expr sub_base = GetFieldPath(base_expr, field);
         CEL_RETURN_IF_ERROR(Walk(sub_message, sub_base, sub_predicates));
         message_asts.push_back(LogicalAnd(sub_predicates));
       }
@@ -426,11 +437,11 @@ class ProtoToPredicateBuilder final : private ExprFactory {
         }
       } else if (field->cpp_type() == FieldDescriptor::CPPTYPE_MESSAGE) {
         const Message& sub_message = reflection->GetMessage(message, field);
-        Expr field_path = NewSelect(NextId(), base_expr, field->name());
+        Expr field_path = GetFieldPath(base_expr, field);
         CEL_RETURN_IF_ERROR(Walk(sub_message, field_path, predicates));
       } else {
         // Primitive field: base_expr.field == <value>
-        Expr field_path = NewSelect(NextId(), base_expr, field->name());
+        Expr field_path = GetFieldPath(base_expr, field);
         predicates.push_back(
             ConstructEquality(std::move(field_path),
                               PrimitiveToExpr(message, reflection, field)));
diff --git a/tools/proto_to_predicate_test.cc b/tools/proto_to_predicate_test.cc
index 80ad140c7..2e7b94f6f 100644
--- a/tools/proto_to_predicate_test.cc
+++ b/tools/proto_to_predicate_test.cc
@@ -549,6 +549,103 @@ INSTANTIATE_TEST_SUITE_P(
             .json_input = R"({ "destinations": [ { "tool": { } } ] })",
             .expected_unparsed = "true",
         },
+        PolicyTestCase{
+            .name = "AnnotatedSingularFieldInMessage",
+            .json_input =
+                R"({ "destinations": [ {
+                     "agent": {
+                       "id": "agent-007",
+                       "location": "us-central1"
+                     }
+                   } ] })",
+            .expected_unparsed = "dest.agent.name == \"agent-007\" && "
+                                 "custom.agent.location == \"us-central1\"",
+        },
+        PolicyTestCase{
+            .name = "AnnotatedOneofPrimitiveField",
+            .json_input =
+                R"({ "destinations": [ {
+                     "ip": "192.168.1.1"
+                   } ] })",
+            .expected_unparsed = "custom.ip == \"192.168.1.1\"",
+        },
+        PolicyTestCase{
+            .name = "AnnotatedMapFieldPrimitive",
+            .json_input =
+                R"({ "destinations": [ {
+                     "tool": {
+                       "annotated_labels": {
+                         "cluster": "us-central1"
+                       }
+                     }
+                   } ] })",
+            .expected_unparsed =
+                "\"cluster\" in custom.labels && "
+                "custom.labels[\"cluster\"] == \"us-central1\"",
+        },
+        PolicyTestCase{
+            .name = "AnnotatedMapFieldMessage",
+            .json_input =
+                R"({ "destinations": [ {
+                     "tool": {
+                       "annotated_role_members": {
+                         "admin": {
+                           "all_users": true,
+                           "principals": ["alice_user"],
+                           "leader": "alice",
+                           "leaders": ["bob"]
+                         }
+                       }
+                     }
+                   } ] })",
+            .expected_unparsed =
+                "\"admin\" in custom.role_members && "
+                "\"alice_user\" in custom.role_members[\"admin\"].principals "
+                "&& "
+                "custom.role_members[\"admin\"].all_users == true && "
+                "custom.member.leader == \"alice\" && "
+                "custom.member.leaders in [\"bob\"]",
+        },
+        PolicyTestCase{
+            .name = "AnnotatedMessageField",
+            .json_input =
+                R"({ "destinations": [ {
+                     "tool": {
+                       "annotated_annotations": {
+                         "read_only_hint": true
+                       }
+                     }
+                   } ] })",
+            .expected_unparsed =
+                "custom.tool_annotations.read_only_hint == true",
+        },
+        PolicyTestCase{
+            .name = "AnnotatedRepeatedMessageFieldSingle",
+            .json_input =
+                R"({ "destinations": [ {
+                     "tool": {
+                       "backup_agents": [
+                         { "id": "agent-007" }
+                       ]
+                     }
+                   } ] })",
+            .expected_unparsed = "custom.backup_agents.name == \"agent-007\"",
+        },
+        PolicyTestCase{
+            .name = "AnnotatedRepeatedMessageFieldMultiple",
+            .json_input =
+                R"({ "destinations": [ {
+                     "tool": {
+                       "backup_agents": [
+                         { "id": "agent-007" },
+                         { "id": "agent-008" }
+                       ]
+                     }
+                   } ] })",
+            .expected_unparsed =
+                "custom.backup_agents.name == \"agent-007\" || "
+                "custom.backup_agents.name == \"agent-008\"",
+        },
         PolicyTestCase{
             .name = "MapEquality",
             .json_input =
diff --git a/tools/testdata/BUILD b/tools/testdata/BUILD
index f9d8ea4b9..956a13eaf 100644
--- a/tools/testdata/BUILD
+++ b/tools/testdata/BUILD
@@ -32,6 +32,7 @@ proto_library(
     name = "test_policy_proto",
     srcs = ["test_policy.proto"],
     visibility = ["//tools:__subpackages__"],
+    deps = ["@com_google_protobuf//:descriptor_proto"],
 )
 
 cc_proto_library(
diff --git a/tools/testdata/test_policy.proto b/tools/testdata/test_policy.proto
index b5d424c04..0b7c370ce 100644
--- a/tools/testdata/test_policy.proto
+++ b/tools/testdata/test_policy.proto
@@ -19,11 +19,18 @@ edition = "2023";
 
 package cel.cpp.tools;
 
+import "net/proto2/proto/descriptor.proto";
+
 option cc_enable_arenas = true;
 
+extend proto2.FieldOptions {
+  string match_path = 51074;
+}
+
 // Represents the targeted client agent.
 message Agent {
   string name = 1 [json_name = "id"];
+  string location = 2 [(match_path) = "custom.agent.location"];
 }
 
 // Specifies additional metadata tool annotations.
@@ -40,6 +47,10 @@ message Members {
   bool all_users = 3;
 
   bool all_authenticated_users = 4;
+
+  string leader = 5 [(match_path) = "custom.member.leader"];
+
+  repeated string leaders = 6 [(match_path) = "custom.member.leaders"];
 }
 
 // Represents a metadata tool block.
@@ -56,6 +67,21 @@ message Tool {
 
   // A map with string keys representing roles and Member instances as values.
   map<string, Members> role_members = 4;
+
+  // A map with string keys representing roles and Member instances as values,
+  // annotated with a match_path.
+  map<string, Members> annotated_role_members = 5
+      [(match_path) = "custom.role_members"];
+
+  // A string-to-string map, annotated with a match_path.
+  map<string, string> annotated_labels = 6 [(match_path) = "custom.labels"];
+
+  // A non-repeated message field, annotated with a match_path.
+  ToolAnnotations annotated_annotations = 7
+      [(match_path) = "custom.tool_annotations"];
+
+  // A repeated message field, annotated with a match_path.
+  repeated Agent backup_agents = 8 [(match_path) = "custom.backup_agents"];
 }
 
 // Represents a policy mapping destination block.
@@ -63,6 +89,7 @@ message Target {
   oneof kind {
     Agent agent = 1;
     Tool tool = 2;
+    string ip = 3 [(match_path) = "custom.ip"];
   }
 }