diff --git a/internal/servers/controller/handlers/accounts/account_service.go b/internal/servers/controller/handlers/accounts/account_service.go
index 93154b0a2..97a4ee252 100644
--- a/internal/servers/controller/handlers/accounts/account_service.go
+++ b/internal/servers/controller/handlers/accounts/account_service.go
@@ -93,11 +93,12 @@ type Service struct {
 
 // NewService returns a user service which handles user related requests to boundary.
 func NewService(pwRepo common.PasswordAuthRepoFactory, oidcRepo common.OidcAuthRepoFactory) (Service, error) {
+	const op = "accounts.NewService"
 	if pwRepo == nil {
-		return Service{}, fmt.Errorf("nil password repository provided")
+		return Service{}, errors.New(errors.InvalidParameter, op, "missing password repository")
 	}
 	if oidcRepo == nil {
-		return Service{}, fmt.Errorf("nil oidc repository provided")
+		return Service{}, errors.New(errors.InvalidParameter, op, "missing oidc repository provided")
 	}
 	return Service{pwRepoFn: pwRepo, oidcRepoFn: oidcRepo}, nil
 }
@@ -282,9 +283,9 @@ func (s Service) getFromRepo(ctx context.Context, id string) (*pb.Account, error
 }
 
 func (s Service) createPwInRepo(ctx context.Context, am auth.AuthMethod, item *pb.Account) (*password.Account, error) {
-	const op = "account_service.(Serivce).createPwInRepo"
+	const op = "accounts.(Service).createPwInRepo"
 	if item == nil {
-		return nil, errors.New(errors.InvalidParameter, op, "nil item")
+		return nil, errors.New(errors.InvalidParameter, op, "missing item")
 	}
 	pwAttrs := &pb.PasswordAccountAttributes{}
 	if err := handlers.StructToProto(item.GetAttributes(), pwAttrs); err != nil {
@@ -313,7 +314,7 @@ func (s Service) createPwInRepo(ctx context.Context, am auth.AuthMethod, item *p
 	}
 	out, err := repo.CreateAccount(ctx, am.GetScopeId(), a, createOpts...)
 	if err != nil {
-		return nil, fmt.Errorf("unable to create user: %w", err)
+		return nil, errors.Wrap(err, op)
 	}
 	if out == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to create user but no error returned from repository.")
@@ -322,9 +323,9 @@ func (s Service) createPwInRepo(ctx context.Context, am auth.AuthMethod, item *p
 }
 
 func (s Service) createOidcInRepo(ctx context.Context, am auth.AuthMethod, item *pb.Account) (*oidc.Account, error) {
-	const op = "account_service.(Service).createOidcInRepo"
+	const op = "accounts.(Service).createOidcInRepo"
 	if item == nil {
-		return nil, errors.New(errors.InvalidParameter, op, "nil item")
+		return nil, errors.New(errors.InvalidParameter, op, "missing item")
 	}
 	var opts []oidc.Option
 	if item.GetName() != nil {
@@ -365,16 +366,16 @@ func (s Service) createOidcInRepo(ctx context.Context, am auth.AuthMethod, item
 }
 
 func (s Service) createInRepo(ctx context.Context, am auth.AuthMethod, item *pb.Account) (*pb.Account, error) {
-	const op = "account_service.(Service).createInRepo"
+	const op = "accounts.(Service).createInRepo"
 	if item == nil {
-		return nil, errors.New(errors.InvalidParameter, op, "nil item")
+		return nil, errors.New(errors.InvalidParameter, op, "missing item")
 	}
 	var out auth.Account
 	switch auth.SubtypeFromId(am.GetPublicId()) {
 	case auth.PasswordSubtype:
 		am, err := s.createPwInRepo(ctx, am, item)
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrap(err, op)
 		}
 		if am == nil {
 			return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to create auth method but no error returned from repository.")
@@ -383,7 +384,7 @@ func (s Service) createInRepo(ctx context.Context, am auth.AuthMethod, item *pb.
 	case auth.OidcSubtype:
 		am, err := s.createOidcInRepo(ctx, am, item)
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrap(err, op)
 		}
 		if am == nil {
 			return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to create auth method but no error returned from repository.")
@@ -394,6 +395,7 @@ func (s Service) createInRepo(ctx context.Context, am auth.AuthMethod, item *pb.
 }
 
 func (s Service) updatePwInRepo(ctx context.Context, scopeId, authMethId, id string, mask []string, item *pb.Account) (*password.Account, error) {
+	const op = "accounts.(Service).updatePwInRepo"
 	u, err := toStoragePwAccount(authMethId, item)
 	if err != nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to build account for update: %v.", err)
@@ -408,7 +410,7 @@ func (s Service) updatePwInRepo(ctx context.Context, scopeId, authMethId, id str
 	}
 	repo, err := s.pwRepoFn()
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, op)
 	}
 	out, rowsUpdated, err := repo.UpdateAccount(ctx, scopeId, u, version, dbMask)
 	if err != nil {
@@ -417,7 +419,7 @@ func (s Service) updatePwInRepo(ctx context.Context, scopeId, authMethId, id str
 			return nil, handlers.InvalidArgumentErrorf("Error in provided request.",
 				map[string]string{"attributes.login_name": "Length too short."})
 		}
-		return nil, fmt.Errorf("unable to update auth method: %w", err)
+		return nil, errors.Wrap(err, op)
 	}
 	if rowsUpdated == 0 {
 		return nil, handlers.NotFoundErrorf("Account %q doesn't exist or incorrect version provided.", id)
@@ -426,7 +428,7 @@ func (s Service) updatePwInRepo(ctx context.Context, scopeId, authMethId, id str
 }
 
 func (s Service) updateOidcInRepo(ctx context.Context, scopeId, amId, id string, mask []string, item *pb.Account) (*oidc.Account, error) {
-	const op = "account_service.(Service).updateOidcInRepo"
+	const op = "accounts.(Service).updateOidcInRepo"
 	if item == nil {
 		return nil, errors.New(errors.InvalidParameter, op, "nil account.")
 	}
@@ -447,11 +449,11 @@ func (s Service) updateOidcInRepo(ctx context.Context, scopeId, amId, id string,
 	}
 	repo, err := s.oidcRepoFn()
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, op)
 	}
 	out, rowsUpdated, err := repo.UpdateAccount(ctx, scopeId, u, version, dbMask)
 	if err != nil {
-		return nil, fmt.Errorf("unable to update account: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to update account"))
 	}
 	if rowsUpdated == 0 {
 		return nil, handlers.NotFoundErrorf("Account %q doesn't exist or incorrect version provided.", id)
@@ -460,12 +462,13 @@ func (s Service) updateOidcInRepo(ctx context.Context, scopeId, amId, id string,
 }
 
 func (s Service) updateInRepo(ctx context.Context, scopeId, authMethodId string, req *pbs.UpdateAccountRequest) (*pb.Account, error) {
+	const op = "accounts.(Service).updateInRepo"
 	var out auth.Account
 	switch auth.SubtypeFromId(req.GetId()) {
 	case auth.PasswordSubtype:
 		a, err := s.updatePwInRepo(ctx, scopeId, authMethodId, req.GetId(), req.GetUpdateMask().GetPaths(), req.GetItem())
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrap(err, op)
 		}
 		if a == nil {
 			return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to update account but no error returned from repository.")
@@ -474,7 +477,7 @@ func (s Service) updateInRepo(ctx context.Context, scopeId, authMethodId string,
 	case auth.OidcSubtype:
 		a, err := s.updateOidcInRepo(ctx, scopeId, authMethodId, req.GetId(), req.GetUpdateMask().GetPaths(), req.GetItem())
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrap(err, op)
 		}
 		if a == nil {
 			return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to update account but no error returned from repository.")
@@ -485,6 +488,7 @@ func (s Service) updateInRepo(ctx context.Context, scopeId, authMethodId string,
 }
 
 func (s Service) deleteFromRepo(ctx context.Context, scopeId, id string) (bool, error) {
+	const op = "accounts.(Service).deleteFromRepo"
 	var rows int
 	var err error
 	switch auth.SubtypeFromId(id) {
@@ -505,7 +509,7 @@ func (s Service) deleteFromRepo(ctx context.Context, scopeId, id string) (bool,
 		if errors.IsNotFoundError(err) {
 			return false, nil
 		}
-		return false, fmt.Errorf("unable to delete account: %w", err)
+		return false, errors.Wrap(err, op)
 	}
 	return rows > 0, nil
 }
@@ -550,9 +554,10 @@ func (s Service) listFromRepo(ctx context.Context, authMethodId string) ([]*pb.A
 }
 
 func (s Service) changePasswordInRepo(ctx context.Context, scopeId, id string, version uint32, currentPassword, newPassword string) (*pb.Account, error) {
+	const op = "account.(Service).changePasswordInRepo"
 	repo, err := s.pwRepoFn()
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, op)
 	}
 	out, err := repo.ChangePassword(ctx, scopeId, id, currentPassword, newPassword, version)
 	if err != nil {
@@ -566,7 +571,7 @@ func (s Service) changePasswordInRepo(ctx context.Context, scopeId, id string, v
 			return nil, handlers.InvalidArgumentErrorf("Error in provided request.",
 				map[string]string{"new_password": "New password equal to current password."})
 		}
-		return nil, fmt.Errorf("unable to change password: %w", err)
+		return nil, errors.Wrap(err, op)
 	}
 	if out == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.PermissionDenied, "Failed to change password.")
@@ -575,9 +580,11 @@ func (s Service) changePasswordInRepo(ctx context.Context, scopeId, id string, v
 }
 
 func (s Service) setPasswordInRepo(ctx context.Context, scopeId, id string, version uint32, pw string) (*pb.Account, error) {
+	const op = "accounts.(Service).setPasswordInRepo"
+
 	repo, err := s.pwRepoFn()
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, op)
 	}
 	out, err := repo.SetPassword(ctx, scopeId, id, pw, version)
 	if err != nil {
@@ -588,7 +595,7 @@ func (s Service) setPasswordInRepo(ctx context.Context, scopeId, id string, vers
 			return nil, handlers.InvalidArgumentErrorf("Error in provided request.",
 				map[string]string{"password": "Password is too short."})
 		}
-		return nil, fmt.Errorf("unable to set password: %w", err)
+		return nil, errors.Wrap(err, op)
 	}
 	return toProto(out)
 }
@@ -708,7 +715,7 @@ func toProto(in auth.Account) (*pb.Account, error) {
 }
 
 func toStoragePwAccount(amId string, item *pb.Account) (*password.Account, error) {
-	const op = "account_service.toStoragePwAccount"
+	const op = "accounts.toStoragePwAccount"
 	if item == nil {
 		return nil, errors.New(errors.InvalidParameter, op, "nil account.")
 	}
@@ -742,7 +749,7 @@ func toStoragePwAccount(amId string, item *pb.Account) (*password.Account, error
 //  * All required parameters are set
 //  * There are no conflicting parameters provided
 func validateGetRequest(req *pbs.GetAccountRequest) error {
-	const op = "account_service.validateGetRequest"
+	const op = "accounts.validateGetRequest"
 	if req == nil {
 		return errors.New(errors.InvalidParameter, op, "nil request")
 	}
@@ -750,7 +757,7 @@ func validateGetRequest(req *pbs.GetAccountRequest) error {
 }
 
 func validateCreateRequest(req *pbs.CreateAccountRequest) error {
-	const op = "account_service.validateCreateRequest"
+	const op = "accounts.validateCreateRequest"
 	if req == nil {
 		return errors.New(errors.InvalidParameter, op, "nil request")
 	}
@@ -805,7 +812,7 @@ func validateCreateRequest(req *pbs.CreateAccountRequest) error {
 }
 
 func validateUpdateRequest(req *pbs.UpdateAccountRequest) error {
-	const op = "account_service.validateUpdateRequest"
+	const op = "accounts.validateUpdateRequest"
 	if req == nil {
 		return errors.New(errors.InvalidParameter, op, "nil request")
 	}
@@ -846,7 +853,7 @@ func validateUpdateRequest(req *pbs.UpdateAccountRequest) error {
 }
 
 func validateDeleteRequest(req *pbs.DeleteAccountRequest) error {
-	const op = "account_service.validateDeleteRequest"
+	const op = "accounts.validateDeleteRequest"
 	if req == nil {
 		return errors.New(errors.InvalidParameter, op, "nil request")
 	}
@@ -854,7 +861,7 @@ func validateDeleteRequest(req *pbs.DeleteAccountRequest) error {
 }
 
 func validateListRequest(req *pbs.ListAccountsRequest) error {
-	const op = "account_service.validateListRequest"
+	const op = "accounts.validateListRequest"
 	if req == nil {
 		return errors.New(errors.InvalidParameter, op, "nil request")
 	}
@@ -872,7 +879,7 @@ func validateListRequest(req *pbs.ListAccountsRequest) error {
 }
 
 func validateChangePasswordRequest(req *pbs.ChangePasswordRequest) error {
-	const op = "account_service.validateChangePasswordRequest"
+	const op = "accounts.validateChangePasswordRequest"
 	if req == nil {
 		return errors.New(errors.InvalidParameter, op, "nil request")
 	}
@@ -896,7 +903,7 @@ func validateChangePasswordRequest(req *pbs.ChangePasswordRequest) error {
 }
 
 func validateSetPasswordRequest(req *pbs.SetPasswordRequest) error {
-	const op = "account_service.validateSetPasswordRequest"
+	const op = "accounts.validateSetPasswordRequest"
 	if req == nil {
 		return errors.New(errors.InvalidParameter, op, "nil request")
 	}
diff --git a/internal/servers/controller/handlers/authmethods/authmethod_service.go b/internal/servers/controller/handlers/authmethods/authmethod_service.go
index cf34aaf35..cc17f0ce0 100644
--- a/internal/servers/controller/handlers/authmethods/authmethod_service.go
+++ b/internal/servers/controller/handlers/authmethods/authmethod_service.go
@@ -2,7 +2,6 @@ package authmethods
 
 import (
 	"context"
-	stderrors "errors"
 	"fmt"
 	"net/url"
 	"strings"
@@ -104,17 +103,18 @@ type Service struct {
 
 // NewService returns a auth method service which handles auth method related requests to boundary.
 func NewService(kms *kms.Kms, pwRepoFn common.PasswordAuthRepoFactory, oidcRepoFn common.OidcAuthRepoFactory, iamRepoFn common.IamRepoFactory, atRepoFn common.AuthTokenRepoFactory, opt ...handlers.Option) (Service, error) {
+	const op = "authmethods.NewService"
 	if kms == nil {
-		return Service{}, stderrors.New("nil kms provided")
+		return Service{}, errors.New(errors.InvalidParameter, op, "missing kms")
 	}
 	if pwRepoFn == nil {
-		return Service{}, fmt.Errorf("nil password repository provided")
+		return Service{}, errors.New(errors.InvalidParameter, op, "missing password repository")
 	}
 	if oidcRepoFn == nil {
 		return Service{}, fmt.Errorf("nil oidc repository provided")
 	}
 	if iamRepoFn == nil {
-		return Service{}, fmt.Errorf("nil iam repository provided")
+		return Service{}, errors.New(errors.InvalidParameter, op, "missing iam repository")
 	}
 	if atRepoFn == nil {
 		return Service{}, fmt.Errorf("nil auth token repository provided")
@@ -387,6 +387,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (*pb.AuthMethod, er
 }
 
 func (s Service) listFromRepo(ctx context.Context, scopeIds []string, anonUser bool) ([]*pb.AuthMethod, error) {
+	const op = "authmethods.(Service).listFromRepo"
 	oidcRepo, err := s.oidcRepoFn()
 	if err != nil {
 		return nil, err
@@ -406,16 +407,16 @@ func (s Service) listFromRepo(ctx context.Context, scopeIds []string, anonUser b
 
 	repo, err := s.pwRepoFn()
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, op)
 	}
 	pl, err := repo.ListAuthMethods(ctx, scopeIds)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, op)
 	}
 	for _, u := range pl {
 		ou, err := toAuthMethodProto(u, handlers.WithAnonymousListing(anonUser))
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrap(err, op)
 		}
 		outUl = append(outUl, ou)
 	}
@@ -423,12 +424,13 @@ func (s Service) listFromRepo(ctx context.Context, scopeIds []string, anonUser b
 }
 
 func (s Service) createInRepo(ctx context.Context, scopeId string, item *pb.AuthMethod) (*pb.AuthMethod, error) {
+	const op = "authmethods.(Service).createInRepo"
 	var out auth.AuthMethod
 	switch auth.SubtypeFromType(item.GetType()) {
 	case auth.PasswordSubtype:
 		am, err := s.createPwInRepo(ctx, scopeId, item)
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrap(err, op)
 		}
 		if am == nil {
 			return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to create auth method but no error returned from repository.")
@@ -437,7 +439,7 @@ func (s Service) createInRepo(ctx context.Context, scopeId string, item *pb.Auth
 	case auth.OidcSubtype:
 		am, err := s.createOidcInRepo(ctx, scopeId, item)
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrap(err, op)
 		}
 		if am == nil {
 			return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to create auth method but no error returned from repository.")
@@ -448,14 +450,14 @@ func (s Service) createInRepo(ctx context.Context, scopeId string, item *pb.Auth
 }
 
 func (s Service) updateInRepo(ctx context.Context, scopeId string, req *pbs.UpdateAuthMethodRequest) (*pb.AuthMethod, error) {
-	const op = "authmethod_service.(Service).updateInRepo"
+	const op = "authmethods.(Service).updateInRepo"
 	storageToWire := toAuthMethodProto
 	var out auth.AuthMethod
 	switch auth.SubtypeFromId(req.GetId()) {
 	case auth.PasswordSubtype:
 		am, err := s.updatePwInRepo(ctx, scopeId, req.GetId(), req.GetUpdateMask().GetPaths(), req.GetItem())
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrap(err, op)
 		}
 		if am == nil {
 			return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to update auth method but no error returned from repository.")
@@ -464,7 +466,7 @@ func (s Service) updateInRepo(ctx context.Context, scopeId string, req *pbs.Upda
 	case auth.OidcSubtype:
 		am, dryRun, err := s.updateOidcInRepo(ctx, scopeId, req)
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrap(err, op)
 		}
 		if am == nil {
 			return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to update auth method but no error returned from repository.")
@@ -492,20 +494,21 @@ func (s Service) updateInRepo(ctx context.Context, scopeId string, req *pbs.Upda
 }
 
 func (s Service) deleteFromRepo(ctx context.Context, scopeId, id string) (bool, error) {
+	const op = "authmethods.(Service).deleteFromRepo"
 	var rows int
 	var dErr error
 	switch auth.SubtypeFromId(id) {
 	case auth.PasswordSubtype:
 		repo, err := s.pwRepoFn()
 		if err != nil {
-			return false, err
+			return false, errors.Wrap(err, op)
 		}
 		rows, dErr = repo.DeleteAuthMethod(ctx, scopeId, id)
 
 	case auth.OidcSubtype:
 		repo, err := s.oidcRepoFn()
 		if err != nil {
-			return false, err
+			return false, errors.Wrap(err, op)
 		}
 		rows, dErr = repo.DeleteAuthMethod(ctx, id)
 	}
@@ -514,7 +517,7 @@ func (s Service) deleteFromRepo(ctx context.Context, scopeId, id string) (bool,
 		if errors.IsNotFoundError(dErr) {
 			return false, nil
 		}
-		return false, fmt.Errorf("unable to delete auth method: %w", dErr)
+		return false, errors.Wrap(dErr, op, errors.WithMsg("unable to delete auth method"))
 	}
 
 	return rows > 0, nil
@@ -722,17 +725,17 @@ func toAuthTokenProto(t *authtoken.AuthToken) *pba.AuthToken {
 //  * All required parameters are set
 //  * There are no conflicting parameters provided
 func validateGetRequest(req *pbs.GetAuthMethodRequest) error {
-	const op = "authmethod_service.validateGetRequest"
+	const op = "authmethod.validateGetRequest"
 	if req == nil {
-		return errors.New(errors.InvalidParameter, op, "nil request")
+		return errors.New(errors.InvalidParameter, op, "Missing request")
 	}
 	return handlers.ValidateGetRequest(handlers.NoopValidatorFn, req, password.AuthMethodPrefix, oidc.AuthMethodPrefix)
 }
 
 func validateCreateRequest(req *pbs.CreateAuthMethodRequest) error {
-	const op = "authmethod_service.validateCreateRequest"
+	const op = "authmethod.validateCreateRequest"
 	if req == nil {
-		return errors.New(errors.InvalidParameter, op, "nil request")
+		return errors.New(errors.InvalidParameter, op, "Missing request")
 	}
 	return handlers.ValidateCreateRequest(req.GetItem(), func() map[string]string {
 		badFields := map[string]string{}
@@ -811,9 +814,9 @@ func validateCreateRequest(req *pbs.CreateAuthMethodRequest) error {
 }
 
 func validateUpdateRequest(req *pbs.UpdateAuthMethodRequest) error {
-	const op = "authmethod_service.validateUpdateRequest"
+	const op = "authmethod.validateUpdateRequest"
 	if req == nil {
-		return errors.New(errors.InvalidParameter, op, "nil request")
+		return errors.New(errors.InvalidParameter, op, "missing request")
 	}
 	return handlers.ValidateUpdateRequest(req, req.GetItem(), func() map[string]string {
 		badFields := map[string]string{}
@@ -910,17 +913,17 @@ func validateUpdateRequest(req *pbs.UpdateAuthMethodRequest) error {
 }
 
 func validateDeleteRequest(req *pbs.DeleteAuthMethodRequest) error {
-	const op = "authmethod_service.validateDeleteRequest"
+	const op = "authmethod.validateDeleteRequest"
 	if req == nil {
-		return errors.New(errors.InvalidParameter, op, "nil request")
+		return errors.New(errors.InvalidParameter, op, "Missing request")
 	}
 	return handlers.ValidateDeleteRequest(handlers.NoopValidatorFn, req, password.AuthMethodPrefix, oidc.AuthMethodPrefix)
 }
 
 func validateListRequest(req *pbs.ListAuthMethodsRequest) error {
-	const op = "authmethod_service.validateListRequest"
+	const op = "authmethod.validateListRequest"
 	if req == nil {
-		return errors.New(errors.InvalidParameter, op, "nil request")
+		return errors.New(errors.InvalidParameter, op, "Missing request")
 	}
 	badFields := map[string]string{}
 	if !handlers.ValidId(handlers.Id(req.GetScopeId()), scope.Org.Prefix()) &&
@@ -937,9 +940,9 @@ func validateListRequest(req *pbs.ListAuthMethodsRequest) error {
 }
 
 func validateChangeStateRequest(req *pbs.ChangeStateRequest) error {
-	const op = "authmethod_service.validateChangeStateRequest"
+	const op = "authmethod.validateChangeStateRequest"
 	if req == nil {
-		return errors.New(errors.InvalidParameter, op, "nil request")
+		return errors.New(errors.InvalidParameter, op, "Missing request")
 	}
 	if st := auth.SubtypeFromId(req.GetId()); st != auth.OidcSubtype {
 		return handlers.NotFoundErrorf("This endpoint is only available for the %q Auth Method type.", auth.OidcSubtype.String())
@@ -965,9 +968,9 @@ func validateChangeStateRequest(req *pbs.ChangeStateRequest) error {
 }
 
 func validateAuthenticateRequest(req *pbs.AuthenticateRequest) error {
-	const op = "authmethod_service.validateAuthenticateRequest"
+	const op = "authmethod.validateAuthenticateRequest"
 	if req == nil {
-		return errors.New(errors.InvalidParameter, op, "nil request")
+		return errors.New(errors.InvalidParameter, op, "Missing request")
 	}
 
 	badFields := make(map[string]string)
@@ -992,9 +995,9 @@ func validateAuthenticateRequest(req *pbs.AuthenticateRequest) error {
 
 // Deprecated; remove when AuthenticateLogin is removed
 func validateAuthenticateLoginRequest(req *pbs.AuthenticateLoginRequest) error {
-	const op = "authmethod_service.validateAuthenticateLoginRequest"
+	const op = "authmethod.validateAuthenticateLoginRequest"
 	if req == nil {
-		return errors.New(errors.InvalidParameter, op, "nil request")
+		return errors.New(errors.InvalidParameter, op, "Missing request")
 	}
 	badFields := make(map[string]string)
 	if strings.TrimSpace(req.GetAuthMethodId()) == "" {
@@ -1023,13 +1026,13 @@ func validateAuthenticateLoginRequest(req *pbs.AuthenticateLoginRequest) error {
 }
 
 func (s Service) convertInternalAuthTokenToApiAuthToken(ctx context.Context, tok *authtoken.AuthToken) (*pba.AuthToken, error) {
-	const op = "authmethod_service.convertInternalAuthTokenToApiAuthToken"
+	const op = "authmethod.convertInternalAuthTokenToApiAuthToken"
 	iamRepo, err := s.iamRepoFn()
 	if err != nil {
 		return nil, err
 	}
 	if tok == nil {
-		return nil, errors.New(errors.InvalidParameter, op, "Nil auth token.")
+		return nil, errors.New(errors.InvalidParameter, op, "missing auth token.")
 	}
 	if tok.Token == "" {
 		return nil, errors.New(errors.InvalidParameter, op, "Empty token.")
@@ -1065,21 +1068,21 @@ func (s Service) convertInternalAuthTokenToApiAuthToken(ctx context.Context, tok
 }
 
 func (s Service) convertToAuthenticateResponse(ctx context.Context, req *pbs.AuthenticateRequest, authResults *auth.VerifyResults, tok *pba.AuthToken) (*pbs.AuthenticateResponse, error) {
-	const op = "authmethod_service.convertToAuthenticateResponse"
+	const op = "authmethod.convertToAuthenticateResponse"
 	if req == nil {
-		return nil, errors.New(errors.InvalidParameter, op, "Nil request.")
+		return nil, errors.New(errors.InvalidParameter, op, "Missing request.")
 	}
 	if authResults == nil {
-		return nil, errors.New(errors.InvalidParameter, op, "Nil auth results.")
+		return nil, errors.New(errors.InvalidParameter, op, "Missing auth results.")
 	}
 	if authResults.Scope == nil {
-		return nil, errors.New(errors.InvalidParameter, op, "Nil auth results scope.")
+		return nil, errors.New(errors.InvalidParameter, op, "Missing auth results scope.")
 	}
 	if authResults.Scope.Id == "" {
 		return nil, errors.New(errors.InvalidParameter, op, "Missing auth results scope ID.")
 	}
 	if tok == nil {
-		return nil, errors.New(errors.InvalidParameter, op, "Nil auth token.")
+		return nil, errors.New(errors.InvalidParameter, op, "Missing auth token.")
 	}
 	res := &perms.Resource{
 		ScopeId: authResults.Scope.Id,
diff --git a/internal/servers/controller/handlers/authtokens/authtoken_service.go b/internal/servers/controller/handlers/authtokens/authtoken_service.go
index f68ca9cfd..632b9636d 100644
--- a/internal/servers/controller/handlers/authtokens/authtoken_service.go
+++ b/internal/servers/controller/handlers/authtokens/authtoken_service.go
@@ -43,11 +43,12 @@ type Service struct {
 
 // NewService returns a user service which handles user related requests to boundary.
 func NewService(repo common.AuthTokenRepoFactory, iamRepoFn common.IamRepoFactory) (Service, error) {
+	const op = "authtoken.NewService"
 	if repo == nil {
-		return Service{}, fmt.Errorf("nil auth token repository provided")
+		return Service{}, errors.New(errors.InvalidParameter, op, "missing auth token repository")
 	}
 	if iamRepoFn == nil {
-		return Service{}, fmt.Errorf("nil iam repository provided")
+		return Service{}, errors.New(errors.InvalidParameter, op, "missing iam repository")
 	}
 	return Service{repoFn: repo, iamRepoFn: iamRepoFn}, nil
 }
@@ -143,34 +144,33 @@ func (s Service) DeleteAuthToken(ctx context.Context, req *pbs.DeleteAuthTokenRe
 }
 
 func (s Service) getFromRepo(ctx context.Context, id string) (*pb.AuthToken, error) {
+	const op = "authtokens.(Service).getFromRepo"
 	repo, err := s.repoFn()
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, op)
 	}
 	u, err := repo.LookupAuthToken(ctx, id)
-	if err != nil {
-		if errors.IsNotFoundError(err) {
-			return nil, handlers.NotFoundErrorf("AuthToken %q doesn't exist.", id)
-		}
-		return nil, fmt.Errorf("unable to lookup auth token: %w", err)
+	if err != nil && !errors.IsNotFoundError(err) {
+		return nil, errors.Wrap(err, op)
 	}
 	if u == nil {
-		return nil, handlers.NotFoundErrorf("AuthToken %q doesn't exist.", id)
+		return nil, errors.New(errors.InvalidParameter, op, fmt.Sprintf("AuthToken %q not found", id))
 	}
 	return toProto(u), nil
 }
 
 func (s Service) deleteFromRepo(ctx context.Context, id string) (bool, error) {
+	const op = "authtokens.(Service).deleteFromRepo"
 	repo, err := s.repoFn()
 	if err != nil {
-		return false, err
+		return false, errors.Wrap(err, op)
 	}
 	rows, err := repo.DeleteAuthToken(ctx, id)
 	if err != nil {
 		if errors.IsNotFoundError(err) {
 			return false, nil
 		}
-		return false, fmt.Errorf("unable to delete user: %w", err)
+		return false, errors.Wrap(err, op, errors.WithMsg("unable to delete user"))
 	}
 	return rows > 0, nil
 }
diff --git a/internal/servers/controller/handlers/groups/group_service.go b/internal/servers/controller/handlers/groups/group_service.go
index ec38a9b11..a41b0f405 100644
--- a/internal/servers/controller/handlers/groups/group_service.go
+++ b/internal/servers/controller/handlers/groups/group_service.go
@@ -60,8 +60,9 @@ type Service struct {
 
 // NewService returns a group service which handles group related requests to boundary.
 func NewService(repo common.IamRepoFactory) (Service, error) {
+	const op = "groups.NewService"
 	if repo == nil {
-		return Service{}, fmt.Errorf("nil iam repository provided")
+		return Service{}, errors.New(errors.InvalidParameter, op, "missing iam repository")
 	}
 	return Service{repoFn: repo}, nil
 }
@@ -247,24 +248,23 @@ func (s Service) RemoveGroupMembers(ctx context.Context, req *pbs.RemoveGroupMem
 }
 
 func (s Service) getFromRepo(ctx context.Context, id string) (*pb.Group, error) {
+	const op = "groups.(Service).getFromRepo"
 	repo, err := s.repoFn()
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, op)
 	}
 	g, m, err := repo.LookupGroup(ctx, id)
-	if err != nil {
-		if errors.IsNotFoundError(err) {
-			return nil, handlers.NotFoundErrorf("Group %q doesn't exist.", id)
-		}
-		return nil, fmt.Errorf("unable to get group: %w", err)
+	if err != nil && !errors.IsNotFoundError(err) {
+		return nil, errors.Wrap(err, op)
 	}
 	if g == nil {
-		return nil, handlers.NotFoundErrorf("Group %q doesn't exist.", id)
+		return nil, errors.New(errors.InvalidParameter, op, fmt.Sprintf("group %q not found", id))
 	}
 	return toProto(g, m), nil
 }
 
 func (s Service) createInRepo(ctx context.Context, scopeId string, item *pb.Group) (*pb.Group, error) {
+	const op = "groups.(Service).createInRepo"
 	var opts []iam.Option
 	if item.GetName() != nil {
 		opts = append(opts, iam.WithName(item.GetName().GetValue()))
@@ -278,11 +278,11 @@ func (s Service) createInRepo(ctx context.Context, scopeId string, item *pb.Grou
 	}
 	repo, err := s.repoFn()
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, op)
 	}
 	out, err := repo.CreateGroup(ctx, u)
 	if err != nil {
-		return nil, fmt.Errorf("unable to create group: %w", err)
+		return nil, errors.Wrap(err, op)
 	}
 	if out == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to create group but no error returned from repository.")
@@ -291,6 +291,7 @@ func (s Service) createInRepo(ctx context.Context, scopeId string, item *pb.Grou
 }
 
 func (s Service) updateInRepo(ctx context.Context, scopeId, id string, mask []string, item *pb.Group) (*pb.Group, error) {
+	const op = "groups.(Service).updateInRepo"
 	var opts []iam.Option
 	if desc := item.GetDescription(); desc != nil {
 		opts = append(opts, iam.WithDescription(desc.GetValue()))
@@ -310,11 +311,11 @@ func (s Service) updateInRepo(ctx context.Context, scopeId, id string, mask []st
 	}
 	repo, err := s.repoFn()
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, op)
 	}
 	out, m, rowsUpdated, err := repo.UpdateGroup(ctx, g, version, dbMask)
 	if err != nil {
-		return nil, fmt.Errorf("unable to update group: %w", err)
+		return nil, errors.Wrap(err, op)
 	}
 	if rowsUpdated == 0 {
 		return nil, handlers.NotFoundErrorf("Group %q doesn't exist or incorrect version provided.", id)
@@ -323,6 +324,7 @@ func (s Service) updateInRepo(ctx context.Context, scopeId, id string, mask []st
 }
 
 func (s Service) deleteFromRepo(ctx context.Context, id string) (bool, error) {
+	const op = "groups.(Service).deleteFromRepo"
 	repo, err := s.repoFn()
 	if err != nil {
 		return false, err
@@ -332,19 +334,20 @@ func (s Service) deleteFromRepo(ctx context.Context, id string) (bool, error) {
 		if errors.IsNotFoundError(err) {
 			return false, nil
 		}
-		return false, fmt.Errorf("unable to delete group: %w", err)
+		return false, errors.Wrap(err, op, errors.WithMsg("unable to delete group"))
 	}
 	return rows > 0, nil
 }
 
 func (s Service) listFromRepo(ctx context.Context, scopeIds []string) ([]*pb.Group, error) {
+	const op = "groups.(Service).listFromRepo"
 	repo, err := s.repoFn()
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, op)
 	}
 	gl, err := repo.ListGroups(ctx, scopeIds)
 	if err != nil {
-		return nil, fmt.Errorf("unable to list groups: %w", err)
+		return nil, errors.Wrap(err, op)
 	}
 	var outGl []*pb.Group
 	for _, g := range gl {
@@ -354,9 +357,10 @@ func (s Service) listFromRepo(ctx context.Context, scopeIds []string) ([]*pb.Gro
 }
 
 func (s Service) addMembersInRepo(ctx context.Context, groupId string, userIds []string, version uint32) (*pb.Group, error) {
+	const op = "groups.(Service).addMembersInRepo"
 	repo, err := s.repoFn()
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, op)
 	}
 	_, err = repo.AddGroupMembers(ctx, groupId, version, strutil.RemoveDuplicates(userIds, false))
 	if err != nil {
@@ -365,7 +369,7 @@ func (s Service) addMembersInRepo(ctx context.Context, groupId string, userIds [
 	}
 	out, m, err := repo.LookupGroup(ctx, groupId)
 	if err != nil {
-		return nil, fmt.Errorf("unable to look up group after adding members: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to look up group after adding memebers"))
 	}
 	if out == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup group after adding member to it.")
@@ -374,9 +378,10 @@ func (s Service) addMembersInRepo(ctx context.Context, groupId string, userIds [
 }
 
 func (s Service) setMembersInRepo(ctx context.Context, groupId string, userIds []string, version uint32) (*pb.Group, error) {
+	const op = "groups.(Service).setMembersInRepo"
 	repo, err := s.repoFn()
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, op)
 	}
 	_, _, err = repo.SetGroupMembers(ctx, groupId, version, strutil.RemoveDuplicates(userIds, false))
 	if err != nil {
@@ -385,7 +390,7 @@ func (s Service) setMembersInRepo(ctx context.Context, groupId string, userIds [
 	}
 	out, m, err := repo.LookupGroup(ctx, groupId)
 	if err != nil {
-		return nil, fmt.Errorf("unable to look up group after setting members: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to look up group after setting members"))
 	}
 	if out == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup group after setting members for it.")
@@ -394,9 +399,10 @@ func (s Service) setMembersInRepo(ctx context.Context, groupId string, userIds [
 }
 
 func (s Service) removeMembersInRepo(ctx context.Context, groupId string, userIds []string, version uint32) (*pb.Group, error) {
+	const op = "groups.(Service).removeMembersInRepo"
 	repo, err := s.repoFn()
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, op)
 	}
 	_, err = repo.DeleteGroupMembers(ctx, groupId, version, strutil.RemoveDuplicates(userIds, false))
 	if err != nil {
@@ -405,7 +411,7 @@ func (s Service) removeMembersInRepo(ctx context.Context, groupId string, userId
 	}
 	out, m, err := repo.LookupGroup(ctx, groupId)
 	if err != nil {
-		return nil, fmt.Errorf("unable to look up group after removing members: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to look up group after removing members"))
 	}
 	if out == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup group after removing members from it.")
diff --git a/internal/servers/controller/handlers/host_catalogs/host_catalog_service.go b/internal/servers/controller/handlers/host_catalogs/host_catalog_service.go
index 748b75b46..f58c37a49 100644
--- a/internal/servers/controller/handlers/host_catalogs/host_catalog_service.go
+++ b/internal/servers/controller/handlers/host_catalogs/host_catalog_service.go
@@ -96,11 +96,12 @@ func populateCollectionAuthorizedActions(ctx context.Context,
 // NewService returns a host catalog Service which handles host catalog related requests to boundary and uses the provided
 // repositories for storage and retrieval.
 func NewService(repoFn common.StaticRepoFactory, iamRepoFn common.IamRepoFactory) (Service, error) {
+	const op = "host_catalogs.NewService"
 	if repoFn == nil {
-		return Service{}, fmt.Errorf("nil static repository provided")
+		return Service{}, errors.New(errors.InvalidParameter, op, "missing static repository")
 	}
 	if iamRepoFn == nil {
-		return Service{}, fmt.Errorf("nil iam repository provided")
+		return Service{}, errors.New(errors.InvalidParameter, op, "missing iam repository")
 	}
 	return Service{staticRepoFn: repoFn, iamRepoFn: iamRepoFn}, nil
 }
@@ -276,6 +277,7 @@ func (s Service) listFromRepo(ctx context.Context, scopeIds []string) ([]*pb.Hos
 }
 
 func (s Service) createInRepo(ctx context.Context, projId string, item *pb.HostCatalog) (*pb.HostCatalog, error) {
+	const op = "host_catalogs.(Servivce).createInRepo"
 	var opts []static.Option
 	if item.GetName() != nil {
 		opts = append(opts, static.WithName(item.GetName().GetValue()))
@@ -285,23 +287,15 @@ func (s Service) createInRepo(ctx context.Context, projId string, item *pb.HostC
 	}
 	h, err := static.NewHostCatalog(projId, opts...)
 	if err != nil {
-		if e := errors.Convert(err); e != nil {
-			// This is a domain error, push this error through so the error interceptor can interpret it correctly.
-			return nil, e
-		}
-		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to build host catalog for creation: %v.", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to build host catalog for creation"))
 	}
 	repo, err := s.staticRepoFn()
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, op)
 	}
 	out, err := repo.CreateCatalog(ctx, h)
 	if err != nil {
-		if e := errors.Convert(err); e != nil {
-			// This is a domain error, push this error through so the error interceptor can interpret it correctly.
-			return nil, e
-		}
-		return nil, fmt.Errorf("unable to create host catalog: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to create host catalog"))
 	}
 	if out == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to create host catalog but no error returned from repository.")
@@ -310,6 +304,7 @@ func (s Service) createInRepo(ctx context.Context, projId string, item *pb.HostC
 }
 
 func (s Service) updateInRepo(ctx context.Context, projId, id string, mask []string, item *pb.HostCatalog) (*pb.HostCatalog, error) {
+	const op = "service.(Service).updateInRepo"
 	var opts []static.Option
 	if desc := item.GetDescription(); desc != nil {
 		opts = append(opts, static.WithDescription(desc.GetValue()))
@@ -320,11 +315,7 @@ func (s Service) updateInRepo(ctx context.Context, projId, id string, mask []str
 	version := item.GetVersion()
 	h, err := static.NewHostCatalog(projId, opts...)
 	if err != nil {
-		if e := errors.Convert(err); e != nil {
-			// This is a domain error, push this error through so the error interceptor can interpret it correctly.
-			return nil, e
-		}
-		return nil, fmt.Errorf("unable to build host catalog for update: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to build host catalog for update"))
 	}
 	h.PublicId = id
 	dbMask := maskManager.Translate(mask)
@@ -333,15 +324,11 @@ func (s Service) updateInRepo(ctx context.Context, projId, id string, mask []str
 	}
 	repo, err := s.staticRepoFn()
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, op)
 	}
 	out, rowsUpdated, err := repo.UpdateCatalog(ctx, h, version, dbMask)
 	if err != nil {
-		if e := errors.Convert(err); e != nil {
-			// This is a domain error, push this error through so the error interceptor can interpret it correctly.
-			return nil, e
-		}
-		return nil, fmt.Errorf("unable to update host catalog: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to update host catalog"))
 	}
 	if rowsUpdated == 0 {
 		return nil, handlers.NotFoundErrorf("Host Catalog %q doesn't exist or incorrect version provided.", id)
@@ -350,17 +337,14 @@ func (s Service) updateInRepo(ctx context.Context, projId, id string, mask []str
 }
 
 func (s Service) deleteFromRepo(ctx context.Context, id string) (bool, error) {
+	const op = "service.(Service).deleteFromRepo"
 	repo, err := s.staticRepoFn()
 	if err != nil {
-		return false, err
+		return false, errors.Wrap(err, op)
 	}
 	rows, err := repo.DeleteCatalog(ctx, id)
 	if err != nil {
-		if e := errors.Convert(err); e != nil {
-			// This is a domain error, push this error through so the error interceptor can interpret it correctly.
-			return false, e
-		}
-		return false, fmt.Errorf("unable to delete host: %w", err)
+		return false, errors.Wrap(err, op, errors.WithMsg("unable to delete host"))
 	}
 	return rows > 0, nil
 }
diff --git a/internal/servers/controller/handlers/host_sets/host_set_service.go b/internal/servers/controller/handlers/host_sets/host_set_service.go
index bc9b829fb..b8240fa17 100644
--- a/internal/servers/controller/handlers/host_sets/host_set_service.go
+++ b/internal/servers/controller/handlers/host_sets/host_set_service.go
@@ -61,8 +61,9 @@ var _ pbs.HostSetServiceServer = Service{}
 // NewService returns a host set Service which handles host set related requests to boundary and uses the provided
 // repositories for storage and retrieval.
 func NewService(repoFn common.StaticRepoFactory) (Service, error) {
+	const op = "host_sets.NewService"
 	if repoFn == nil {
-		return Service{}, fmt.Errorf("nil static repository provided")
+		return Service{}, errors.New(errors.InvalidParameter, op, "missing static repository")
 	}
 	return Service{staticRepoFn: repoFn}, nil
 }
@@ -245,6 +246,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (*pb.HostSet, error
 }
 
 func (s Service) createInRepo(ctx context.Context, scopeId, catalogId string, item *pb.HostSet) (*pb.HostSet, error) {
+	const op = "host_sets.(Service).createInRepo"
 	var opts []static.Option
 	if item.GetName() != nil {
 		opts = append(opts, static.WithName(item.GetName().GetValue()))
@@ -254,11 +256,7 @@ func (s Service) createInRepo(ctx context.Context, scopeId, catalogId string, it
 	}
 	h, err := static.NewHostSet(catalogId, opts...)
 	if err != nil {
-		if e := errors.Convert(err); e != nil {
-			// This is a domain error, push this error through so the error interceptor can interpret it correctly.
-			return nil, e
-		}
-		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to build host set for creation: %v.", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("Unable to build host set for creation"))
 	}
 	repo, err := s.staticRepoFn()
 	if err != nil {
@@ -266,11 +264,7 @@ func (s Service) createInRepo(ctx context.Context, scopeId, catalogId string, it
 	}
 	out, err := repo.CreateSet(ctx, scopeId, h)
 	if err != nil {
-		if e := errors.Convert(err); e != nil {
-			// This is a domain error, push this error through so the error interceptor can interpret it correctly.
-			return nil, e
-		}
-		return nil, fmt.Errorf("unable to create host set: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to create host set"))
 	}
 	if out == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to create host set but no error returned from repository.")
@@ -279,6 +273,7 @@ func (s Service) createInRepo(ctx context.Context, scopeId, catalogId string, it
 }
 
 func (s Service) updateInRepo(ctx context.Context, scopeId, catalogId, id string, mask []string, item *pb.HostSet) (*pb.HostSet, error) {
+	const op = "host_sets.(Service).updateInRepo"
 	var opts []static.Option
 	if desc := item.GetDescription(); desc != nil {
 		opts = append(opts, static.WithDescription(desc.GetValue()))
@@ -288,11 +283,7 @@ func (s Service) updateInRepo(ctx context.Context, scopeId, catalogId, id string
 	}
 	h, err := static.NewHostSet(catalogId, opts...)
 	if err != nil {
-		if e := errors.Convert(err); e != nil {
-			// This is a domain error, push this error through so the error interceptor can interpret it correctly.
-			return nil, e
-		}
-		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to build host set for update: %v.", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("Unable to build host set for update"))
 	}
 	h.PublicId = id
 	dbMask := maskManager.Translate(mask)
@@ -305,11 +296,7 @@ func (s Service) updateInRepo(ctx context.Context, scopeId, catalogId, id string
 	}
 	out, m, rowsUpdated, err := repo.UpdateSet(ctx, scopeId, h, item.GetVersion(), dbMask)
 	if err != nil {
-		if e := errors.Convert(err); e != nil {
-			// This is a domain error, push this error through so the error interceptor can interpret it correctly.
-			return nil, e
-		}
-		return nil, fmt.Errorf("unable to update host set: %w.", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to update host set"))
 	}
 	if rowsUpdated == 0 {
 		return nil, handlers.NotFoundErrorf("Host Set %q doesn't exist or incorrect version provided.", id)
@@ -318,17 +305,14 @@ func (s Service) updateInRepo(ctx context.Context, scopeId, catalogId, id string
 }
 
 func (s Service) deleteFromRepo(ctx context.Context, scopeId, id string) (bool, error) {
+	const op = "host_sets.(Service).deleteFromRepo"
 	repo, err := s.staticRepoFn()
 	if err != nil {
 		return false, err
 	}
 	rows, err := repo.DeleteSet(ctx, scopeId, id)
 	if err != nil {
-		if e := errors.Convert(err); e != nil {
-			// This is a domain error, push this error through so the error interceptor can interpret it correctly.
-			return false, e
-		}
-		return false, fmt.Errorf("unable to delete host: %w", err)
+		return false, errors.Wrap(err, op, errors.WithMsg("unable to delete host"))
 	}
 	return rows > 0, nil
 }
@@ -350,25 +334,18 @@ func (s Service) listFromRepo(ctx context.Context, catalogId string) ([]*pb.Host
 }
 
 func (s Service) addInRepo(ctx context.Context, scopeId, setId string, hostIds []string, version uint32) (*pb.HostSet, error) {
+	const op = "host_sets.(Service).addInRepo"
 	repo, err := s.staticRepoFn()
 	if err != nil {
 		return nil, err
 	}
 	_, err = repo.AddSetMembers(ctx, scopeId, setId, version, strutil.RemoveDuplicates(hostIds, false))
 	if err != nil {
-		if e := errors.Convert(err); e != nil {
-			// This is a domain error, push this error through so the error interceptor can interpret it correctly.
-			return nil, e
-		}
-		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to add hosts to host set: %v.", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("Unable to add hosts to host set"))
 	}
 	out, m, err := repo.LookupSet(ctx, setId)
 	if err != nil {
-		if e := errors.Convert(err); e != nil {
-			// This is a domain error, push this error through so the error interceptor can interpret it correctly.
-			return nil, e
-		}
-		return nil, fmt.Errorf("unable to look up host set after adding hosts: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to look up host set after adding hosts"))
 	}
 	if out == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup host set after adding hosts to it.")
@@ -377,26 +354,19 @@ func (s Service) addInRepo(ctx context.Context, scopeId, setId string, hostIds [
 }
 
 func (s Service) setInRepo(ctx context.Context, scopeId, setId string, hostIds []string, version uint32) (*pb.HostSet, error) {
+	const op = "host_sets.(Service).setInRepo"
 	repo, err := s.staticRepoFn()
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, op)
 	}
 	_, _, err = repo.SetSetMembers(ctx, scopeId, setId, version, strutil.RemoveDuplicates(hostIds, false))
 	if err != nil {
-		if e := errors.Convert(err); e != nil {
-			// This is a domain error, push this error through so the error interceptor can interpret it correctly.
-			return nil, e
-		}
-		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to set hosts in host set: %v.", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("Unable to set hosts in host set"))
 	}
 
 	out, m, err := repo.LookupSet(ctx, setId)
 	if err != nil {
-		if e := errors.Convert(err); e != nil {
-			// This is a domain error, push this error through so the error interceptor can interpret it correctly.
-			return nil, e
-		}
-		return nil, fmt.Errorf("unable to look up host set after setting hosts: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to look up host set after setting hosts"))
 	}
 	if out == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup host set after setting hosts for it.")
@@ -405,25 +375,18 @@ func (s Service) setInRepo(ctx context.Context, scopeId, setId string, hostIds [
 }
 
 func (s Service) removeInRepo(ctx context.Context, scopeId, setId string, hostIds []string, version uint32) (*pb.HostSet, error) {
+	const op = "host_sets.(Service).removeInRepo"
 	repo, err := s.staticRepoFn()
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, op)
 	}
 	_, err = repo.DeleteSetMembers(ctx, scopeId, setId, version, strutil.RemoveDuplicates(hostIds, false))
 	if err != nil {
-		if e := errors.Convert(err); e != nil {
-			// This is a domain error, push this error through so the error interceptor can interpret it correctly.
-			return nil, e
-		}
-		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to remove hosts from host set: %v.", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("Unable to remove hosts from host set"))
 	}
 	out, m, err := repo.LookupSet(ctx, setId)
 	if err != nil {
-		if e := errors.Convert(err); e != nil {
-			// This is a domain error, push this error through so the error interceptor can interpret it correctly.
-			return nil, e
-		}
-		return nil, fmt.Errorf("unable to look up host set: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to look up host set"))
 	}
 	if out == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup host set after removing hosts from it.")
diff --git a/internal/servers/controller/handlers/hosts/host_service.go b/internal/servers/controller/handlers/hosts/host_service.go
index 651f7fc5d..49052ec65 100644
--- a/internal/servers/controller/handlers/hosts/host_service.go
+++ b/internal/servers/controller/handlers/hosts/host_service.go
@@ -59,8 +59,9 @@ var _ pbs.HostServiceServer = Service{}
 // NewService returns a host Service which handles host related requests to boundary and uses the provided
 // repositories for storage and retrieval.
 func NewService(repoFn common.StaticRepoFactory) (Service, error) {
+	const op = "hosts.NewService"
 	if repoFn == nil {
-		return Service{}, fmt.Errorf("nil static repository provided")
+		return Service{}, errors.New(errors.InvalidParameter, op, "missing static repository")
 	}
 	return Service{staticRepoFn: repoFn}, nil
 }
@@ -189,6 +190,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (*pb.Host, error) {
 }
 
 func (s Service) createInRepo(ctx context.Context, scopeId, catalogId string, item *pb.Host) (*pb.Host, error) {
+	const op = "hosts.(Service).createInRepo"
 	ha := &pb.StaticHostAttributes{}
 	if err := handlers.StructToProto(item.GetAttributes(), ha); err != nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Failed converting attributes to subtype proto: %s", err)
@@ -205,24 +207,16 @@ func (s Service) createInRepo(ctx context.Context, scopeId, catalogId string, it
 	}
 	h, err := static.NewHost(catalogId, opts...)
 	if err != nil {
-		if e := errors.Convert(err); e != nil {
-			// This is a domain error, push this error through so the error interceptor can interpret it correctly.
-			return nil, e
-		}
-		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to build host for creation: %v.", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("Unable to build host for creation"))
 	}
 
 	repo, err := s.staticRepoFn()
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, op)
 	}
 	out, err := repo.CreateHost(ctx, scopeId, h)
 	if err != nil {
-		if e := errors.Convert(err); e != nil {
-			// This is a domain error, push this error through so the error interceptor can interpret it correctly.
-			return nil, e
-		}
-		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to create host: %v.", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("Unable to create host"))
 	}
 	if out == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to create host but no error returned from repository.")
@@ -231,6 +225,7 @@ func (s Service) createInRepo(ctx context.Context, scopeId, catalogId string, it
 }
 
 func (s Service) updateInRepo(ctx context.Context, scopeId, catalogId, id string, mask []string, item *pb.Host) (*pb.Host, error) {
+	const op = "hosts.(Service).updateInRepo"
 	ha := &pb.StaticHostAttributes{}
 	if err := handlers.StructToProto(item.GetAttributes(), ha); err != nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Failed converting attributes to subtype proto: %s", err)
@@ -247,11 +242,7 @@ func (s Service) updateInRepo(ctx context.Context, scopeId, catalogId, id string
 	}
 	h, err := static.NewHost(catalogId, opts...)
 	if err != nil {
-		if e := errors.Convert(err); e != nil {
-			// This is a domain error, push this error through so the error interceptor can interpret it correctly.
-			return nil, e
-		}
-		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to build host for update: %v.", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("Unable to build host for update"))
 	}
 	h.PublicId = id
 	dbMask := maskManager.Translate(mask)
@@ -264,11 +255,7 @@ func (s Service) updateInRepo(ctx context.Context, scopeId, catalogId, id string
 	}
 	out, rowsUpdated, err := repo.UpdateHost(ctx, scopeId, h, item.GetVersion(), dbMask)
 	if err != nil {
-		if e := errors.Convert(err); e != nil {
-			// This is a domain error, push this error through so the error interceptor can interpret it correctly.
-			return nil, e
-		}
-		return nil, fmt.Errorf("unable to update host: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to update host"))
 	}
 	if rowsUpdated == 0 {
 		return nil, handlers.NotFoundErrorf("Host %q doesn't exist or incorrect version provided.", id)
@@ -277,17 +264,14 @@ func (s Service) updateInRepo(ctx context.Context, scopeId, catalogId, id string
 }
 
 func (s Service) deleteFromRepo(ctx context.Context, scopeId, id string) (bool, error) {
+	const op = "hosts.(Service).deleteFromRepo"
 	repo, err := s.staticRepoFn()
 	if err != nil {
 		return false, err
 	}
 	rows, err := repo.DeleteHost(ctx, scopeId, id)
 	if err != nil {
-		if e := errors.Convert(err); e != nil {
-			// This is a domain error, push this error through so the error interceptor can interpret it correctly.
-			return false, e
-		}
-		return false, fmt.Errorf("unable to delete host: %w", err)
+		return false, errors.Wrap(err, op, errors.WithMsg("unable to delete host"))
 	}
 	return rows > 0, nil
 }
diff --git a/internal/servers/controller/handlers/mask_manager.go b/internal/servers/controller/handlers/mask_manager.go
index 5f0ab6b84..2e56f920d 100644
--- a/internal/servers/controller/handlers/mask_manager.go
+++ b/internal/servers/controller/handlers/mask_manager.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/hashicorp/boundary/internal/errors"
 	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/reflect/protoreflect"
 	"google.golang.org/protobuf/types/descriptorpb"
@@ -17,6 +18,7 @@ type MaskManager map[string]string
 // protos assuming they are both using the mask_mapping custom option.  Error is returned if no mappings are
 // found or if one of the passed protos has a mapping that doesn't reciprocate.
 func NewMaskManager(dest protoreflect.ProtoMessage, src ...protoreflect.ProtoMessage) (MaskManager, error) {
+	const op = "handlers.NewMaskManager"
 	srcToDest, err := mapFromProto(src...)
 	if err != nil {
 		return nil, err
@@ -30,7 +32,7 @@ func NewMaskManager(dest protoreflect.ProtoMessage, src ...protoreflect.ProtoMes
 	for k, v := range srcToDest {
 		ov, ok := destToSrc[v]
 		if !ok || ov != k {
-			return nil, fmt.Errorf("mapping src field %q maps to %q, dest %q maps to %q", k, v, v, ov)
+			return nil, errors.New(errors.Encode, op, fmt.Sprintf("mapping src field %q maps to %q, dest %q maps to %q", k, v, v, ov))
 		}
 		result[k] = v
 	}
@@ -38,18 +40,19 @@ func NewMaskManager(dest protoreflect.ProtoMessage, src ...protoreflect.ProtoMes
 	// Now check to make sure there aren't any dangling dest mappings.
 	for k, v := range destToSrc {
 		if ov, ok := srcToDest[v]; !ok || ov != k {
-			return nil, fmt.Errorf("mapping dest field %q maps to %q, src %q maps to %q", k, v, v, ov)
+			return nil, errors.New(errors.Encode, op, fmt.Sprintf("mapping src field %q maps to %q, dest %q maps to %q", k, v, v, ov))
 		}
 	}
 
 	if len(result) == 0 {
-		return nil, fmt.Errorf("size of mask mapping is 0")
+		return nil, errors.New(errors.InvalidParameter, op, "mask mapping generated is zero")
 	}
 
 	return result, nil
 }
 
 func mapFromProto(ps ...protoreflect.ProtoMessage) (map[string]string, error) {
+	const op = "handlers.mapFromProto"
 	mapping := make(map[string]string)
 	for _, p := range ps {
 		m := p.ProtoReflect()
@@ -59,7 +62,7 @@ func mapFromProto(ps ...protoreflect.ProtoMessage) (map[string]string, error) {
 			opts := f.Options().(*descriptorpb.FieldOptions)
 			if nameMap := proto.GetExtension(opts, pb.E_MaskMapping).(*pb.MaskMapping); !proto.Equal(nameMap, &pb.MaskMapping{}) && nameMap != nil {
 				if _, ok := mapping[nameMap.GetThis()]; ok {
-					return nil, fmt.Errorf("duplicate mapping from field %q with the mapping key %q", f.Name(), nameMap.GetThis())
+					return nil, errors.New(errors.InvalidParameter, op, fmt.Sprintf("duplicate mapping from field %q with the mapping key %q", f.Name(), nameMap.GetThis()))
 				}
 				mapping[nameMap.GetThis()] = nameMap.GetThat()
 			}
diff --git a/internal/servers/controller/handlers/roles/role_service.go b/internal/servers/controller/handlers/roles/role_service.go
index b5c4e6ee2..0451eb689 100644
--- a/internal/servers/controller/handlers/roles/role_service.go
+++ b/internal/servers/controller/handlers/roles/role_service.go
@@ -63,8 +63,9 @@ type Service struct {
 
 // NewService returns a role service which handles role related requests to boundary.
 func NewService(repo common.IamRepoFactory) (Service, error) {
+	const op = "roles.NewService"
 	if repo == nil {
-		return Service{}, fmt.Errorf("nil iam repository provided")
+		return Service{}, errors.New(errors.InvalidParameter, op, "missing iam repository")
 	}
 	return Service{repoFn: repo}, nil
 }
@@ -323,6 +324,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (*pb.Role, error) {
 }
 
 func (s Service) createInRepo(ctx context.Context, scopeId string, item *pb.Role) (*pb.Role, error) {
+	const op = "roles.(Service).createInRepo"
 	var opts []iam.Option
 	if item.GetName() != nil {
 		opts = append(opts, iam.WithName(item.GetName().GetValue()))
@@ -343,7 +345,7 @@ func (s Service) createInRepo(ctx context.Context, scopeId string, item *pb.Role
 	}
 	out, err := repo.CreateRole(ctx, u)
 	if err != nil {
-		return nil, fmt.Errorf("unable to create role: %w", err)
+		return nil, errors.Wrap(err, op)
 	}
 	if out == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to create role but no error returned from repository.")
@@ -352,6 +354,7 @@ func (s Service) createInRepo(ctx context.Context, scopeId string, item *pb.Role
 }
 
 func (s Service) updateInRepo(ctx context.Context, scopeId, id string, mask []string, item *pb.Role) (*pb.Role, error) {
+	const op = "roles.(Service).updateInRepo"
 	var opts []iam.Option
 	if desc := item.GetDescription(); desc != nil {
 		opts = append(opts, iam.WithDescription(desc.GetValue()))
@@ -379,7 +382,7 @@ func (s Service) updateInRepo(ctx context.Context, scopeId, id string, mask []st
 	}
 	out, pr, gr, rowsUpdated, err := repo.UpdateRole(ctx, u, version, dbMask)
 	if err != nil {
-		return nil, fmt.Errorf("unable to update role: %w", err)
+		return nil, errors.Wrap(err, op)
 	}
 	if rowsUpdated == 0 {
 		return nil, handlers.NotFoundErrorf("Role %q doesn't exist or incorrect version provided.", id)
@@ -388,6 +391,7 @@ func (s Service) updateInRepo(ctx context.Context, scopeId, id string, mask []st
 }
 
 func (s Service) deleteFromRepo(ctx context.Context, id string) (bool, error) {
+	const op = "roles.(Service).deleteFromRepo"
 	repo, err := s.repoFn()
 	if err != nil {
 		return false, err
@@ -397,7 +401,7 @@ func (s Service) deleteFromRepo(ctx context.Context, id string) (bool, error) {
 		if errors.IsNotFoundError(err) {
 			return false, nil
 		}
-		return false, fmt.Errorf("unable to delete role: %w", err)
+		return false, errors.Wrap(err, op, errors.WithMsg("unable to delete role"))
 	}
 	return rows > 0, nil
 }
@@ -420,6 +424,7 @@ func (s Service) listFromRepo(ctx context.Context, scopeIds []string) ([]*pb.Rol
 }
 
 func (s Service) addPrinciplesInRepo(ctx context.Context, roleId string, principalIds []string, version uint32) (*pb.Role, error) {
+	const op = "roles.(Service).addPrincpleInRepo"
 	repo, err := s.repoFn()
 	if err != nil {
 		return nil, err
@@ -431,7 +436,7 @@ func (s Service) addPrinciplesInRepo(ctx context.Context, roleId string, princip
 	}
 	out, pr, roleGrants, err := repo.LookupRole(ctx, roleId)
 	if err != nil {
-		return nil, fmt.Errorf("unable to look up role after adding principals: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to look up role after adding principals"))
 	}
 	if out == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup role after adding principals to it.")
@@ -440,6 +445,7 @@ func (s Service) addPrinciplesInRepo(ctx context.Context, roleId string, princip
 }
 
 func (s Service) setPrinciplesInRepo(ctx context.Context, roleId string, principalIds []string, version uint32) (*pb.Role, error) {
+	const op = "roles.(Service).setPrinciplesInRepo"
 	repo, err := s.repoFn()
 	if err != nil {
 		return nil, err
@@ -451,7 +457,7 @@ func (s Service) setPrinciplesInRepo(ctx context.Context, roleId string, princip
 	}
 	out, pr, roleGrants, err := repo.LookupRole(ctx, roleId)
 	if err != nil {
-		return nil, fmt.Errorf("unable to look up role after setting principals: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to look up role after setting principals"))
 	}
 	if out == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup role after setting principals for it.")
@@ -460,6 +466,7 @@ func (s Service) setPrinciplesInRepo(ctx context.Context, roleId string, princip
 }
 
 func (s Service) removePrinciplesInRepo(ctx context.Context, roleId string, principalIds []string, version uint32) (*pb.Role, error) {
+	const op = "roles.(Service).removePrinciplesInRepo"
 	repo, err := s.repoFn()
 	if err != nil {
 		return nil, err
@@ -471,7 +478,7 @@ func (s Service) removePrinciplesInRepo(ctx context.Context, roleId string, prin
 	}
 	out, pr, roleGrants, err := repo.LookupRole(ctx, roleId)
 	if err != nil {
-		return nil, fmt.Errorf("unable to look up role after removing principals: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to look up role after removing principals"))
 	}
 	if out == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup role after removing principals from it.")
@@ -480,6 +487,7 @@ func (s Service) removePrinciplesInRepo(ctx context.Context, roleId string, prin
 }
 
 func (s Service) addGrantsInRepo(ctx context.Context, roleId string, grants []string, version uint32) (*pb.Role, error) {
+	const op = "service.(Service).addGrantsInRepo"
 	repo, err := s.repoFn()
 	if err != nil {
 		return nil, err
@@ -491,7 +499,7 @@ func (s Service) addGrantsInRepo(ctx context.Context, roleId string, grants []st
 	}
 	out, pr, roleGrants, err := repo.LookupRole(ctx, roleId)
 	if err != nil {
-		return nil, fmt.Errorf("unable to look up role after adding grants: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to look up role after adding grants"))
 	}
 	if out == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup role after adding grants to it.")
@@ -500,6 +508,7 @@ func (s Service) addGrantsInRepo(ctx context.Context, roleId string, grants []st
 }
 
 func (s Service) setGrantsInRepo(ctx context.Context, roleId string, grants []string, version uint32) (*pb.Role, error) {
+	const op = "roles.(Service).setGrantsInRepo"
 	repo, err := s.repoFn()
 	if err != nil {
 		return nil, err
@@ -515,7 +524,7 @@ func (s Service) setGrantsInRepo(ctx context.Context, roleId string, grants []st
 	}
 	out, pr, roleGrants, err := repo.LookupRole(ctx, roleId)
 	if err != nil {
-		return nil, fmt.Errorf("unable to look up role after setting grants: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to look up role after setting grants"))
 	}
 	if out == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup role after setting grants on it.")
@@ -524,6 +533,7 @@ func (s Service) setGrantsInRepo(ctx context.Context, roleId string, grants []st
 }
 
 func (s Service) removeGrantsInRepo(ctx context.Context, roleId string, grants []string, version uint32) (*pb.Role, error) {
+	const op = "roles.(Service).removeGrantsInRepo"
 	repo, err := s.repoFn()
 	if err != nil {
 		return nil, err
@@ -535,7 +545,7 @@ func (s Service) removeGrantsInRepo(ctx context.Context, roleId string, grants [
 	}
 	out, pr, roleGrants, err := repo.LookupRole(ctx, roleId)
 	if err != nil {
-		return nil, fmt.Errorf("unable to look up role after removing grants: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("uable to look up role after removing grant"))
 	}
 	if out == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup role after removing grants from it.")
diff --git a/internal/servers/controller/handlers/scopes/scope_service.go b/internal/servers/controller/handlers/scopes/scope_service.go
index af5ef4cfb..5547011c5 100644
--- a/internal/servers/controller/handlers/scopes/scope_service.go
+++ b/internal/servers/controller/handlers/scopes/scope_service.go
@@ -9,6 +9,7 @@ import (
 	"github.com/hashicorp/boundary/internal/auth"
 	"github.com/hashicorp/boundary/internal/auth/oidc"
 	"github.com/hashicorp/boundary/internal/auth/password"
+	"github.com/hashicorp/boundary/internal/errors"
 	pb "github.com/hashicorp/boundary/internal/gen/controller/api/resources/scopes"
 	pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
 	"github.com/hashicorp/boundary/internal/iam"
@@ -86,8 +87,9 @@ type Service struct {
 
 // NewService returns a project service which handles project related requests to boundary.
 func NewService(repo common.IamRepoFactory) (Service, error) {
+	const op = "scopes.(Service).NewService"
 	if repo == nil {
-		return Service{}, fmt.Errorf("nil iam repository provided")
+		return Service{}, errors.New(errors.InvalidParameter, op, "missing iam repository")
 	}
 	return Service{repoFn: repo}, nil
 }
@@ -286,6 +288,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (*pb.Scope, error)
 }
 
 func (s Service) createInRepo(ctx context.Context, authResults auth.VerifyResults, req *pbs.CreateScopeRequest) (*pb.Scope, error) {
+	const op = "scopes.(Service).createInRepo"
 	item := req.GetItem()
 	var opts []iam.Option
 	if item.GetName() != nil {
@@ -315,7 +318,7 @@ func (s Service) createInRepo(ctx context.Context, authResults auth.VerifyResult
 	}
 	out, err := repo.CreateScope(ctx, iamScope, authResults.UserId, opts...)
 	if err != nil {
-		return nil, fmt.Errorf("unable to create scope: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to create scope"))
 	}
 	if out == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to create scope but no error returned from repository.")
@@ -324,6 +327,7 @@ func (s Service) createInRepo(ctx context.Context, authResults auth.VerifyResult
 }
 
 func (s Service) updateInRepo(ctx context.Context, parentScope *pb.ScopeInfo, scopeId string, mask []string, item *pb.Scope) (*pb.Scope, error) {
+	const op = "scope.(Service).updateInRepo"
 	var opts []iam.Option
 	var scopeDesc, scopeName, scopePrimaryAuthMethodId string
 	if desc := item.GetDescription(); desc != nil {
@@ -374,7 +378,7 @@ func (s Service) updateInRepo(ctx context.Context, parentScope *pb.ScopeInfo, sc
 	}
 	out, rowsUpdated, err := repo.UpdateScope(ctx, iamScope, version, dbMask)
 	if err != nil {
-		return nil, fmt.Errorf("unable to update project: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to update project"))
 	}
 	if rowsUpdated == 0 {
 		return nil, handlers.NotFoundErrorf("Scope %q doesn't exist or incorrect version provided.", scopeId)
@@ -383,13 +387,14 @@ func (s Service) updateInRepo(ctx context.Context, parentScope *pb.ScopeInfo, sc
 }
 
 func (s Service) deleteFromRepo(ctx context.Context, scopeId string) (bool, error) {
+	const op = "scope.(Service).deleteFromRepo"
 	repo, err := s.repoFn()
 	if err != nil {
 		return false, err
 	}
 	rows, err := repo.DeleteScope(ctx, scopeId)
 	if err != nil {
-		return false, fmt.Errorf("unable to delete scope: %w", err)
+		return false, errors.Wrap(err, op, errors.WithMsg("unable to delete scope"))
 	}
 	return rows > 0, nil
 }
diff --git a/internal/servers/controller/handlers/sessions/session_service.go b/internal/servers/controller/handlers/sessions/session_service.go
index f10a78b00..88692d4bf 100644
--- a/internal/servers/controller/handlers/sessions/session_service.go
+++ b/internal/servers/controller/handlers/sessions/session_service.go
@@ -47,11 +47,12 @@ type Service struct {
 
 // NewService returns a session service which handles session related requests to boundary.
 func NewService(repoFn common.SessionRepoFactory, iamRepoFn common.IamRepoFactory) (Service, error) {
+	const op = "sessions.NewService"
 	if repoFn == nil {
-		return Service{}, fmt.Errorf("nil session repository provided")
+		return Service{}, errors.New(errors.InvalidParameter, op, "missing session repository")
 	}
 	if iamRepoFn == nil {
-		return Service{}, fmt.Errorf("nil iam repository provided")
+		return Service{}, errors.New(errors.InvalidParameter, op, "missing iam repository")
 	}
 	return Service{repoFn: repoFn, iamRepoFn: iamRepoFn}, nil
 }
@@ -235,13 +236,14 @@ func (s Service) listFromRepo(ctx context.Context, opts ...session.Option) ([]*p
 }
 
 func (s Service) cancelInRepo(ctx context.Context, id string, version uint32) (*pb.Session, error) {
+	const op = "sessions.(Service).cancelInRepo"
 	repo, err := s.repoFn()
 	if err != nil {
 		return nil, err
 	}
 	out, err := repo.CancelSession(ctx, id, version)
 	if err != nil {
-		return nil, fmt.Errorf("unable to update session: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to update session"))
 	}
 	return toProto(out), nil
 }
diff --git a/internal/servers/controller/handlers/targets/target_service.go b/internal/servers/controller/handlers/targets/target_service.go
index 63d35b877..de3d6e4bc 100644
--- a/internal/servers/controller/handlers/targets/target_service.go
+++ b/internal/servers/controller/handlers/targets/target_service.go
@@ -88,20 +88,21 @@ func NewService(
 	serversRepoFn common.ServersRepoFactory,
 	sessionRepoFn common.SessionRepoFactory,
 	staticHostRepoFn common.StaticRepoFactory) (Service, error) {
+	const op = "targets.NewService"
 	if repoFn == nil {
-		return Service{}, fmt.Errorf("nil target repository provided")
+		return Service{}, errors.New(errors.InvalidParameter, op, "missing target repository")
 	}
 	if iamRepoFn == nil {
-		return Service{}, fmt.Errorf("nil iam repository provided")
+		return Service{}, errors.New(errors.InvalidParameter, op, "missing iam repository")
 	}
 	if serversRepoFn == nil {
-		return Service{}, fmt.Errorf("nil servers repository provided")
+		return Service{}, errors.New(errors.InvalidParameter, op, "missing servers repository")
 	}
 	if sessionRepoFn == nil {
-		return Service{}, fmt.Errorf("nil session repository provided")
+		return Service{}, errors.New(errors.InvalidParameter, op, "missing session repository")
 	}
 	if staticHostRepoFn == nil {
-		return Service{}, fmt.Errorf("nil static host repository provided")
+		return Service{}, errors.New(errors.InvalidParameter, op, "missing static host repository")
 	}
 	return Service{
 		repoFn:           repoFn,
@@ -295,6 +296,7 @@ func (s Service) RemoveTargetHostSets(ctx context.Context, req *pbs.RemoveTarget
 }
 
 func (s Service) AuthorizeSession(ctx context.Context, req *pbs.AuthorizeSessionRequest) (*pbs.AuthorizeSessionResponse, error) {
+	const op = "targets.(Service).AuthorizeSession"
 	if err := validateAuthorizeSessionRequest(req); err != nil {
 		return nil, err
 	}
@@ -496,7 +498,7 @@ HostSetIterationLoop:
 	case host.StaticSubtype:
 		h, err := staticHostRepo.LookupHost(ctx, chosenId.hostId)
 		if err != nil {
-			return nil, fmt.Errorf("error looking up host: %w", err)
+			return nil, errors.New(errors.InvalidParameter, op, "errors looking up host")
 		}
 		endpointHost = h.Address
 		if endpointHost == "" {
@@ -590,6 +592,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (*pb.Target, error)
 }
 
 func (s Service) createInRepo(ctx context.Context, item *pb.Target) (*pb.Target, error) {
+	const op = "targets.(Service).createInRepo"
 	opts := []target.Option{target.WithName(item.GetName().GetValue())}
 	if item.GetDescription() != nil {
 		opts = append(opts, target.WithDescription(item.GetDescription().GetValue()))
@@ -620,7 +623,7 @@ func (s Service) createInRepo(ctx context.Context, item *pb.Target) (*pb.Target,
 	}
 	out, m, err := repo.CreateTcpTarget(ctx, u)
 	if err != nil {
-		return nil, fmt.Errorf("unable to create target: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to create target"))
 	}
 	if out == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to create target but no error returned from repository.")
@@ -629,6 +632,7 @@ func (s Service) createInRepo(ctx context.Context, item *pb.Target) (*pb.Target,
 }
 
 func (s Service) updateInRepo(ctx context.Context, scopeId, id string, mask []string, item *pb.Target) (*pb.Target, error) {
+	const op = "targets.(Service).updateInRepo"
 	var opts []target.Option
 	if desc := item.GetDescription(); desc != nil {
 		opts = append(opts, target.WithDescription(desc.GetValue()))
@@ -668,7 +672,7 @@ func (s Service) updateInRepo(ctx context.Context, scopeId, id string, mask []st
 	}
 	out, m, rowsUpdated, err := repo.UpdateTcpTarget(ctx, u, version, dbMask)
 	if err != nil {
-		return nil, fmt.Errorf("unable to update target: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to update target"))
 	}
 	if rowsUpdated == 0 {
 		return nil, handlers.NotFoundErrorf("Target %q not found or incorrect version provided.", id)
@@ -677,6 +681,7 @@ func (s Service) updateInRepo(ctx context.Context, scopeId, id string, mask []st
 }
 
 func (s Service) deleteFromRepo(ctx context.Context, id string) (bool, error) {
+	const op = "targets.(Service).deleteFromRepo"
 	repo, err := s.repoFn()
 	if err != nil {
 		return false, err
@@ -686,7 +691,7 @@ func (s Service) deleteFromRepo(ctx context.Context, id string) (bool, error) {
 		if errors.IsNotFoundError(err) {
 			return false, nil
 		}
-		return false, fmt.Errorf("unable to delete target: %w", err)
+		return false, errors.Wrap(err, op, errors.WithMsg("unable to delete target"))
 	}
 	return rows > 0, nil
 }
@@ -728,6 +733,7 @@ func (s Service) addInRepo(ctx context.Context, targetId string, hostSetId []str
 }
 
 func (s Service) setInRepo(ctx context.Context, targetId string, hostSetIds []string, version uint32) (*pb.Target, error) {
+	const op = "targets.(Service).setInRepo"
 	repo, err := s.repoFn()
 	if err != nil {
 		return nil, err
@@ -740,7 +746,7 @@ func (s Service) setInRepo(ctx context.Context, targetId string, hostSetIds []st
 
 	out, m, err := repo.LookupTarget(ctx, targetId)
 	if err != nil {
-		return nil, fmt.Errorf("unable to look up target after setting host sets: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to look up target after setting host sets"))
 	}
 	if out == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup target after setting host sets for it.")
@@ -749,6 +755,7 @@ func (s Service) setInRepo(ctx context.Context, targetId string, hostSetIds []st
 }
 
 func (s Service) removeInRepo(ctx context.Context, targetId string, hostSetIds []string, version uint32) (*pb.Target, error) {
+	const op = "targets.(Service).removeInRepo"
 	repo, err := s.repoFn()
 	if err != nil {
 		return nil, err
@@ -760,7 +767,7 @@ func (s Service) removeInRepo(ctx context.Context, targetId string, hostSetIds [
 	}
 	out, m, err := repo.LookupTarget(ctx, targetId)
 	if err != nil {
-		return nil, fmt.Errorf("unable to look up target after removing host sets: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to look up target after removing host sets"))
 	}
 	if out == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup target after removing host sets from it.")
diff --git a/internal/servers/controller/handlers/users/user_service.go b/internal/servers/controller/handlers/users/user_service.go
index db213c97c..909f83afd 100644
--- a/internal/servers/controller/handlers/users/user_service.go
+++ b/internal/servers/controller/handlers/users/user_service.go
@@ -62,8 +62,9 @@ type Service struct {
 
 // NewService returns a user service which handles user related requests to boundary.
 func NewService(repo common.IamRepoFactory) (Service, error) {
+	const op = "users.NewService"
 	if repo == nil {
-		return Service{}, fmt.Errorf("nil iam repository provided")
+		return Service{}, errors.New(errors.InvalidParameter, op, "missing iam repository")
 	}
 	return Service{repoFn: repo}, nil
 }
@@ -267,6 +268,7 @@ func (s Service) getFromRepo(ctx context.Context, id string) (*pb.User, error) {
 }
 
 func (s Service) createInRepo(ctx context.Context, orgId string, item *pb.User) (*pb.User, error) {
+	const op = "users.(Service).createInRepo"
 	var opts []iam.Option
 	if item.GetName() != nil {
 		opts = append(opts, iam.WithName(item.GetName().GetValue()))
@@ -284,7 +286,7 @@ func (s Service) createInRepo(ctx context.Context, orgId string, item *pb.User)
 	}
 	out, err := repo.CreateUser(ctx, u)
 	if err != nil {
-		return nil, fmt.Errorf("unable to create user: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to create user"))
 	}
 	if out == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to create user but no error returned from repository.")
@@ -293,6 +295,7 @@ func (s Service) createInRepo(ctx context.Context, orgId string, item *pb.User)
 }
 
 func (s Service) updateInRepo(ctx context.Context, orgId, id string, mask []string, item *pb.User) (*pb.User, error) {
+	const op = "users.(Service).updateInRepo"
 	var opts []iam.Option
 	if desc := item.GetDescription(); desc != nil {
 		opts = append(opts, iam.WithDescription(desc.GetValue()))
@@ -316,7 +319,7 @@ func (s Service) updateInRepo(ctx context.Context, orgId, id string, mask []stri
 	}
 	out, accts, rowsUpdated, err := repo.UpdateUser(ctx, u, version, dbMask)
 	if err != nil {
-		return nil, fmt.Errorf("unable to update user: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to update user"))
 	}
 	if rowsUpdated == 0 {
 		return nil, handlers.NotFoundErrorf("User %q doesn't exist or incorrect version provided.", id)
@@ -325,6 +328,7 @@ func (s Service) updateInRepo(ctx context.Context, orgId, id string, mask []stri
 }
 
 func (s Service) deleteFromRepo(ctx context.Context, id string) (bool, error) {
+	const op = "users.(Service).deleteFromRepo"
 	repo, err := s.repoFn()
 	if err != nil {
 		return false, err
@@ -334,7 +338,7 @@ func (s Service) deleteFromRepo(ctx context.Context, id string) (bool, error) {
 		if errors.IsNotFoundError(err) {
 			return false, nil
 		}
-		return false, fmt.Errorf("unable to delete user: %w", err)
+		return false, errors.Wrap(err, op, errors.WithMsg("unable to delete user"))
 	}
 	return rows > 0, nil
 }
@@ -356,6 +360,7 @@ func (s Service) listFromRepo(ctx context.Context, scopeIds []string) ([]*pb.Use
 }
 
 func (s Service) addInRepo(ctx context.Context, userId string, accountIds []string, version uint32) (*pb.User, error) {
+	const op = "users.(Service).addInRepo"
 	repo, err := s.repoFn()
 	if err != nil {
 		return nil, err
@@ -366,7 +371,7 @@ func (s Service) addInRepo(ctx context.Context, userId string, accountIds []stri
 	}
 	out, accts, err := repo.LookupUser(ctx, userId)
 	if err != nil {
-		return nil, fmt.Errorf("unable to look up user after adding accounts: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to look up user after adding accounts"))
 	}
 	if out == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup user after adding accounts to it.")
@@ -375,6 +380,7 @@ func (s Service) addInRepo(ctx context.Context, userId string, accountIds []stri
 }
 
 func (s Service) setInRepo(ctx context.Context, userId string, accountIds []string, version uint32) (*pb.User, error) {
+	const op = "users.(Service).setInRepo"
 	repo, err := s.repoFn()
 	if err != nil {
 		return nil, err
@@ -385,7 +391,7 @@ func (s Service) setInRepo(ctx context.Context, userId string, accountIds []stri
 	}
 	out, accts, err := repo.LookupUser(ctx, userId)
 	if err != nil {
-		return nil, fmt.Errorf("unable to look up user after setting accounts: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to look up user after setting accounts"))
 	}
 	if out == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup user after setting accounts for it.")
@@ -394,6 +400,7 @@ func (s Service) setInRepo(ctx context.Context, userId string, accountIds []stri
 }
 
 func (s Service) removeInRepo(ctx context.Context, userId string, accountIds []string, version uint32) (*pb.User, error) {
+	const op = "users.(Service).removeInRepo"
 	repo, err := s.repoFn()
 	if err != nil {
 		return nil, err
@@ -404,7 +411,7 @@ func (s Service) removeInRepo(ctx context.Context, userId string, accountIds []s
 	}
 	out, accts, err := repo.LookupUser(ctx, userId)
 	if err != nil {
-		return nil, fmt.Errorf("unable to look up user after removing accounts: %w", err)
+		return nil, errors.Wrap(err, op, errors.WithMsg("unable to look up user after removing accounts"))
 	}
 	if out == nil {
 		return nil, handlers.ApiErrorWithCodeAndMessage(codes.Internal, "Unable to lookup user after removing accounts from it.")