diff --git a/go/vt/proto/query/query.pb.go b/go/vt/proto/query/query.pb.go
index 30d550133a..fca3d93af6 100644
--- a/go/vt/proto/query/query.pb.go
+++ b/go/vt/proto/query/query.pb.go
@@ -10,6 +10,7 @@ It is generated from these files:
 
 It has these top-level messages:
 	Target
+	VTGateCallerID
 	BindVariable
 	BoundQuery
 	Field
@@ -257,6 +258,22 @@ func (m *Target) Reset()         { *m = Target{} }
 func (m *Target) String() string { return proto.CompactTextString(m) }
 func (*Target) ProtoMessage()    {}
 
+// VTGateCallerID is sent by VTGate to VTTablet to describe the
+// caller. If possible, this enformation is secure. For instance,
+// if using unique certificates that guarantee that VTGate->VTTablet
+// traffic cannot be spoofed, then VTTablet can trust this information,
+// and VTTablet will use it for tablet ACLs, for instance.
+// Because of this security guarantee, this is different than the CallerID
+// structure, which is not secure at all, because it is provided
+// by the Vitess client.
+type VTGateCallerID struct {
+	Username string `protobuf:"bytes,1,opt,name=username" json:"username,omitempty"`
+}
+
+func (m *VTGateCallerID) Reset()         { *m = VTGateCallerID{} }
+func (m *VTGateCallerID) String() string { return proto.CompactTextString(m) }
+func (*VTGateCallerID) ProtoMessage()    {}
+
 // BindVariable represents a single bind variable in a Query
 type BindVariable struct {
 	Type BindVariable_Type `protobuf:"varint,1,opt,name=type,enum=query.BindVariable_Type" json:"type,omitempty"`
@@ -350,10 +367,11 @@ func (m *QueryResult) GetRows() []*Row {
 
 // ExecuteRequest is the payload to Execute
 type ExecuteRequest struct {
-	CallerId      *vtrpc.CallerID `protobuf:"bytes,1,opt,name=caller_id" json:"caller_id,omitempty"`
-	Target        *Target         `protobuf:"bytes,2,opt,name=target" json:"target,omitempty"`
-	Query         *BoundQuery     `protobuf:"bytes,3,opt,name=query" json:"query,omitempty"`
-	TransactionId int64           `protobuf:"varint,4,opt,name=transaction_id" json:"transaction_id,omitempty"`
+	CallerId          *vtrpc.CallerID `protobuf:"bytes,1,opt,name=caller_id" json:"caller_id,omitempty"`
+	ImmediateCallerId *VTGateCallerID `protobuf:"bytes,2,opt,name=immediate_caller_id" json:"immediate_caller_id,omitempty"`
+	Target            *Target         `protobuf:"bytes,3,opt,name=target" json:"target,omitempty"`
+	Query             *BoundQuery     `protobuf:"bytes,4,opt,name=query" json:"query,omitempty"`
+	TransactionId     int64           `protobuf:"varint,5,opt,name=transaction_id" json:"transaction_id,omitempty"`
 }
 
 func (m *ExecuteRequest) Reset()         { *m = ExecuteRequest{} }
@@ -367,6 +385,13 @@ func (m *ExecuteRequest) GetCallerId() *vtrpc.CallerID {
 	return nil
 }
 
+func (m *ExecuteRequest) GetImmediateCallerId() *VTGateCallerID {
+	if m != nil {
+		return m.ImmediateCallerId
+	}
+	return nil
+}
+
 func (m *ExecuteRequest) GetTarget() *Target {
 	if m != nil {
 		return m.Target
@@ -407,10 +432,11 @@ func (m *ExecuteResponse) GetResult() *QueryResult {
 
 // ExecuteBatchRequest is the payload to ExecuteBatch
 type ExecuteBatchRequest struct {
-	CallerId      *vtrpc.CallerID `protobuf:"bytes,1,opt,name=caller_id" json:"caller_id,omitempty"`
-	Target        *Target         `protobuf:"bytes,2,opt,name=target" json:"target,omitempty"`
-	Queries       []*BoundQuery   `protobuf:"bytes,3,rep,name=queries" json:"queries,omitempty"`
-	TransactionId int64           `protobuf:"varint,4,opt,name=transaction_id" json:"transaction_id,omitempty"`
+	CallerId          *vtrpc.CallerID `protobuf:"bytes,1,opt,name=caller_id" json:"caller_id,omitempty"`
+	ImmediateCallerId *VTGateCallerID `protobuf:"bytes,2,opt,name=immediate_caller_id" json:"immediate_caller_id,omitempty"`
+	Target            *Target         `protobuf:"bytes,3,opt,name=target" json:"target,omitempty"`
+	Queries           []*BoundQuery   `protobuf:"bytes,4,rep,name=queries" json:"queries,omitempty"`
+	TransactionId     int64           `protobuf:"varint,5,opt,name=transaction_id" json:"transaction_id,omitempty"`
 }
 
 func (m *ExecuteBatchRequest) Reset()         { *m = ExecuteBatchRequest{} }
@@ -424,6 +450,13 @@ func (m *ExecuteBatchRequest) GetCallerId() *vtrpc.CallerID {
 	return nil
 }
 
+func (m *ExecuteBatchRequest) GetImmediateCallerId() *VTGateCallerID {
+	if m != nil {
+		return m.ImmediateCallerId
+	}
+	return nil
+}
+
 func (m *ExecuteBatchRequest) GetTarget() *Target {
 	if m != nil {
 		return m.Target
@@ -464,9 +497,10 @@ func (m *ExecuteBatchResponse) GetResults() []*QueryResult {
 
 // StreamExecuteRequest is the payload to StreamExecute
 type StreamExecuteRequest struct {
-	CallerId *vtrpc.CallerID `protobuf:"bytes,1,opt,name=caller_id" json:"caller_id,omitempty"`
-	Target   *Target         `protobuf:"bytes,2,opt,name=target" json:"target,omitempty"`
-	Query    *BoundQuery     `protobuf:"bytes,3,opt,name=query" json:"query,omitempty"`
+	CallerId          *vtrpc.CallerID `protobuf:"bytes,1,opt,name=caller_id" json:"caller_id,omitempty"`
+	ImmediateCallerId *VTGateCallerID `protobuf:"bytes,2,opt,name=immediate_caller_id" json:"immediate_caller_id,omitempty"`
+	Target            *Target         `protobuf:"bytes,3,opt,name=target" json:"target,omitempty"`
+	Query             *BoundQuery     `protobuf:"bytes,4,opt,name=query" json:"query,omitempty"`
 }
 
 func (m *StreamExecuteRequest) Reset()         { *m = StreamExecuteRequest{} }
@@ -480,6 +514,13 @@ func (m *StreamExecuteRequest) GetCallerId() *vtrpc.CallerID {
 	return nil
 }
 
+func (m *StreamExecuteRequest) GetImmediateCallerId() *VTGateCallerID {
+	if m != nil {
+		return m.ImmediateCallerId
+	}
+	return nil
+}
+
 func (m *StreamExecuteRequest) GetTarget() *Target {
 	if m != nil {
 		return m.Target
@@ -520,8 +561,9 @@ func (m *StreamExecuteResponse) GetResult() *QueryResult {
 
 // BeginRequest is the payload to Begin
 type BeginRequest struct {
-	CallerId *vtrpc.CallerID `protobuf:"bytes,1,opt,name=caller_id" json:"caller_id,omitempty"`
-	Target   *Target         `protobuf:"bytes,2,opt,name=target" json:"target,omitempty"`
+	CallerId          *vtrpc.CallerID `protobuf:"bytes,1,opt,name=caller_id" json:"caller_id,omitempty"`
+	ImmediateCallerId *VTGateCallerID `protobuf:"bytes,2,opt,name=immediate_caller_id" json:"immediate_caller_id,omitempty"`
+	Target            *Target         `protobuf:"bytes,3,opt,name=target" json:"target,omitempty"`
 }
 
 func (m *BeginRequest) Reset()         { *m = BeginRequest{} }
@@ -535,6 +577,13 @@ func (m *BeginRequest) GetCallerId() *vtrpc.CallerID {
 	return nil
 }
 
+func (m *BeginRequest) GetImmediateCallerId() *VTGateCallerID {
+	if m != nil {
+		return m.ImmediateCallerId
+	}
+	return nil
+}
+
 func (m *BeginRequest) GetTarget() *Target {
 	if m != nil {
 		return m.Target
@@ -561,9 +610,10 @@ func (m *BeginResponse) GetError() *vtrpc.RPCError {
 
 // CommitRequest is the payload to Commit
 type CommitRequest struct {
-	CallerId      *vtrpc.CallerID `protobuf:"bytes,1,opt,name=caller_id" json:"caller_id,omitempty"`
-	Target        *Target         `protobuf:"bytes,2,opt,name=target" json:"target,omitempty"`
-	TransactionId int64           `protobuf:"varint,3,opt,name=transaction_id" json:"transaction_id,omitempty"`
+	CallerId          *vtrpc.CallerID `protobuf:"bytes,1,opt,name=caller_id" json:"caller_id,omitempty"`
+	ImmediateCallerId *VTGateCallerID `protobuf:"bytes,2,opt,name=immediate_caller_id" json:"immediate_caller_id,omitempty"`
+	Target            *Target         `protobuf:"bytes,3,opt,name=target" json:"target,omitempty"`
+	TransactionId     int64           `protobuf:"varint,4,opt,name=transaction_id" json:"transaction_id,omitempty"`
 }
 
 func (m *CommitRequest) Reset()         { *m = CommitRequest{} }
@@ -577,6 +627,13 @@ func (m *CommitRequest) GetCallerId() *vtrpc.CallerID {
 	return nil
 }
 
+func (m *CommitRequest) GetImmediateCallerId() *VTGateCallerID {
+	if m != nil {
+		return m.ImmediateCallerId
+	}
+	return nil
+}
+
 func (m *CommitRequest) GetTarget() *Target {
 	if m != nil {
 		return m.Target
@@ -602,9 +659,10 @@ func (m *CommitResponse) GetError() *vtrpc.RPCError {
 
 // RollbackRequest is the payload to Rollback
 type RollbackRequest struct {
-	CallerId      *vtrpc.CallerID `protobuf:"bytes,1,opt,name=caller_id" json:"caller_id,omitempty"`
-	Target        *Target         `protobuf:"bytes,2,opt,name=target" json:"target,omitempty"`
-	TransactionId int64           `protobuf:"varint,3,opt,name=transaction_id" json:"transaction_id,omitempty"`
+	CallerId          *vtrpc.CallerID `protobuf:"bytes,1,opt,name=caller_id" json:"caller_id,omitempty"`
+	ImmediateCallerId *VTGateCallerID `protobuf:"bytes,2,opt,name=immediate_caller_id" json:"immediate_caller_id,omitempty"`
+	Target            *Target         `protobuf:"bytes,3,opt,name=target" json:"target,omitempty"`
+	TransactionId     int64           `protobuf:"varint,4,opt,name=transaction_id" json:"transaction_id,omitempty"`
 }
 
 func (m *RollbackRequest) Reset()         { *m = RollbackRequest{} }
@@ -618,6 +676,13 @@ func (m *RollbackRequest) GetCallerId() *vtrpc.CallerID {
 	return nil
 }
 
+func (m *RollbackRequest) GetImmediateCallerId() *VTGateCallerID {
+	if m != nil {
+		return m.ImmediateCallerId
+	}
+	return nil
+}
+
 func (m *RollbackRequest) GetTarget() *Target {
 	if m != nil {
 		return m.Target
@@ -643,10 +708,11 @@ func (m *RollbackResponse) GetError() *vtrpc.RPCError {
 
 // SplitQueryRequest is the payload for SplitQuery
 type SplitQueryRequest struct {
-	CallerId   *vtrpc.CallerID `protobuf:"bytes,1,opt,name=caller_id" json:"caller_id,omitempty"`
-	Target     *Target         `protobuf:"bytes,2,opt,name=target" json:"target,omitempty"`
-	Query      *BoundQuery     `protobuf:"bytes,3,opt,name=query" json:"query,omitempty"`
-	SplitCount int64           `protobuf:"varint,4,opt,name=split_count" json:"split_count,omitempty"`
+	CallerId          *vtrpc.CallerID `protobuf:"bytes,1,opt,name=caller_id" json:"caller_id,omitempty"`
+	ImmediateCallerId *VTGateCallerID `protobuf:"bytes,2,opt,name=immediate_caller_id" json:"immediate_caller_id,omitempty"`
+	Target            *Target         `protobuf:"bytes,3,opt,name=target" json:"target,omitempty"`
+	Query             *BoundQuery     `protobuf:"bytes,4,opt,name=query" json:"query,omitempty"`
+	SplitCount        int64           `protobuf:"varint,5,opt,name=split_count" json:"split_count,omitempty"`
 }
 
 func (m *SplitQueryRequest) Reset()         { *m = SplitQueryRequest{} }
@@ -660,6 +726,13 @@ func (m *SplitQueryRequest) GetCallerId() *vtrpc.CallerID {
 	return nil
 }
 
+func (m *SplitQueryRequest) GetImmediateCallerId() *VTGateCallerID {
+	if m != nil {
+		return m.ImmediateCallerId
+	}
+	return nil
+}
+
 func (m *SplitQueryRequest) GetTarget() *Target {
 	if m != nil {
 		return m.Target
diff --git a/proto/query.proto b/proto/query.proto
index 09fff457e5..eb7affe2a1 100644
--- a/proto/query.proto
+++ b/proto/query.proto
@@ -16,6 +16,18 @@ message Target {
   topo.TabletType TabletType = 3;
 }
 
+// VTGateCallerID is sent by VTGate to VTTablet to describe the
+// caller. If possible, this enformation is secure. For instance,
+// if using unique certificates that guarantee that VTGate->VTTablet
+// traffic cannot be spoofed, then VTTablet can trust this information,
+// and VTTablet will use it for tablet ACLs, for instance.
+// Because of this security guarantee, this is different than the CallerID
+// structure, which is not secure at all, because it is provided
+// by the Vitess client.
+message VTGateCallerID {
+  string username = 1;
+}
+
 // BindVariable represents a single bind variable in a Query
 message BindVariable {
   enum Type {
@@ -138,9 +150,10 @@ message QueryResult {
 // ExecuteRequest is the payload to Execute
 message ExecuteRequest {
   vtrpc.CallerID caller_id = 1;
-  Target target = 2;
-  BoundQuery query = 3;
-  int64 transaction_id = 4;
+  VTGateCallerID immediate_caller_id = 2;
+  Target target = 3;
+  BoundQuery query = 4;
+  int64 transaction_id = 5;
 }
 
 // ExecuteResponse is the returned value from Execute
@@ -152,9 +165,10 @@ message ExecuteResponse {
 // ExecuteBatchRequest is the payload to ExecuteBatch
 message ExecuteBatchRequest {
   vtrpc.CallerID caller_id = 1;
-  Target target = 2;
-  repeated BoundQuery queries = 3;
-  int64 transaction_id = 4;
+  VTGateCallerID immediate_caller_id = 2;
+  Target target = 3;
+  repeated BoundQuery queries = 4;
+  int64 transaction_id = 5;
 }
 
 // ExecuteBatchResponse is the returned value from ExecuteBatch
@@ -166,8 +180,9 @@ message ExecuteBatchResponse {
 // StreamExecuteRequest is the payload to StreamExecute
 message StreamExecuteRequest {
   vtrpc.CallerID caller_id = 1;
-  Target target = 2;
-  BoundQuery query = 3;
+  VTGateCallerID immediate_caller_id = 2;
+  Target target = 3;
+  BoundQuery query = 4;
 }
 
 // StreamExecuteResponse is the returned value from StreamExecute
@@ -179,7 +194,8 @@ message StreamExecuteResponse {
 // BeginRequest is the payload to Begin
 message BeginRequest {
   vtrpc.CallerID caller_id = 1;
-  Target target = 2;
+  VTGateCallerID immediate_caller_id = 2;
+  Target target = 3;
 }
 
 // BeginResponse is the returned value from Begin
@@ -191,8 +207,9 @@ message BeginResponse {
 // CommitRequest is the payload to Commit
 message CommitRequest {
   vtrpc.CallerID caller_id = 1;
-  Target target = 2;
-  int64 transaction_id = 3;
+  VTGateCallerID immediate_caller_id = 2;
+  Target target = 3;
+  int64 transaction_id = 4;
 }
 
 // CommitResponse is the returned value from Commit
@@ -203,8 +220,9 @@ message CommitResponse {
 // RollbackRequest is the payload to Rollback
 message RollbackRequest {
   vtrpc.CallerID caller_id = 1;
-  Target target = 2;
-  int64 transaction_id = 3;
+  VTGateCallerID immediate_caller_id = 2;
+  Target target = 3;
+  int64 transaction_id = 4;
 }
 
 // RollbackResponse is the returned value from Rollback
@@ -215,9 +233,10 @@ message RollbackResponse {
 // SplitQueryRequest is the payload for SplitQuery
 message SplitQueryRequest {
   vtrpc.CallerID caller_id = 1;
-  Target target = 2;
-  BoundQuery query = 3;
-  int64 split_count = 4;
+  VTGateCallerID immediate_caller_id = 2;
+  Target target = 3;
+  BoundQuery query = 4;
+  int64 split_count = 5;
 }
 
 // QuerySplit represents one query to execute on the tablet