diff --git a/output/schema/schema.json b/output/schema/schema.json
index 76bb6f39e7..92ee0c6cd5 100644
--- a/output/schema/schema.json
+++ b/output/schema/schema.json
@@ -171287,7 +171287,7 @@
           "type": {
             "kind": "instance_of",
             "type": {
-              "name": "Name",
+              "name": "Names",
               "namespace": "_types"
             }
           }
@@ -171315,27 +171315,21 @@
           }
         },
         {
-          "name": "metadata",
-          "required": false,
-          "type": {
-            "kind": "user_defined_value"
-          }
-        },
-        {
-          "name": "realm",
+          "name": "realm.name",
           "required": false,
           "type": {
             "kind": "instance_of",
             "type": {
-              "name": "Realm",
-              "namespace": "security._types"
+              "name": "Name",
+              "namespace": "_types"
             }
           }
         }
       ],
-      "specLocation": "security/_types/RoleMappingRule.ts#L33-L42",
+      "specLocation": "security/_types/RoleMappingRule.ts#L34-L44",
       "variants": {
-        "kind": "container"
+        "kind": "container",
+        "nonExhaustive": true
       }
     },
     {
@@ -171617,27 +171611,6 @@
       ],
       "specLocation": "security/_types/Privileges.ts#L197-L199"
     },
-    {
-      "kind": "interface",
-      "name": {
-        "name": "Realm",
-        "namespace": "security._types"
-      },
-      "properties": [
-        {
-          "name": "name",
-          "required": true,
-          "type": {
-            "kind": "instance_of",
-            "type": {
-              "name": "Name",
-              "namespace": "_types"
-            }
-          }
-        }
-      ],
-      "specLocation": "security/_types/RoleMappingRule.ts#L44-L46"
-    },
     {
       "kind": "interface",
       "name": {
@@ -172069,7 +172042,7 @@
           }
         }
       ],
-      "specLocation": "security/_types/RoleMappingRule.ts#L23-L31",
+      "specLocation": "security/_types/RoleMappingRule.ts#L24-L32",
       "variants": {
         "kind": "container"
       }
diff --git a/output/typescript/types.ts b/output/typescript/types.ts
index 85b856f770..abb3ebbe83 100644
--- a/output/typescript/types.ts
+++ b/output/typescript/types.ts
@@ -16090,11 +16090,10 @@ export interface SecurityCreatedStatus {
 }
 
 export interface SecurityFieldRule {
-  username?: Name
+  username?: Names
   dn?: Names
   groups?: Names
-  metadata?: any
-  realm?: SecurityRealm
+  'realm.name'?: Name
 }
 
 export interface SecurityFieldSecurity {
@@ -16124,10 +16123,6 @@ export interface SecurityManageUserPrivileges {
   applications: string[]
 }
 
-export interface SecurityRealm {
-  name: Name
-}
-
 export interface SecurityRealmInfo {
   name: Name
   type: string
diff --git a/specification/security/_types/RoleMappingRule.ts b/specification/security/_types/RoleMappingRule.ts
index b373fb4eb0..85b52882a8 100644
--- a/specification/security/_types/RoleMappingRule.ts
+++ b/specification/security/_types/RoleMappingRule.ts
@@ -26,21 +26,19 @@ import { Name, Names } from '@_types/common'
 export class RoleMappingRule {
   any?: RoleMappingRule[]
   all?: RoleMappingRule[]
+  // `field` should have been defined as SingleKeyDictionary<String, ScalarValue|ScalarValue[]>
+  // However, this was initially defined as a container with a limited number of variants,
+  // and was later made non_exhaustive to limit breaking changes.
   field?: FieldRule
   except?: RoleMappingRule
 }
 
 /**
  * @variants container
+ * @non_exhaustive
  */
 export class FieldRule {
-  username?: Name
+  username?: Names
   dn?: Names
   groups?: Names
-  metadata?: UserDefinedValue
-  realm?: Realm
-}
-
-export class Realm {
-  name: Name
 }