diff --git a/tools/aconfig/printflags/src/main.rs b/tools/aconfig/printflags/src/main.rs
index 88fdea9..4110317 100644
--- a/tools/aconfig/printflags/src/main.rs
+++ b/tools/aconfig/printflags/src/main.rs
@@ -18,7 +18,7 @@
 
 use aconfig_protos::aconfig::Flag_state as State;
 use aconfig_protos::aconfig::Parsed_flags as ProtoParsedFlags;
-use anyhow::{bail, Result};
+use anyhow::{bail, Context, Result};
 use regex::Regex;
 use std::collections::HashMap;
 use std::process::Command;
@@ -39,6 +39,19 @@
     flags
 }
 
+fn xxd(bytes: &[u8]) -> String {
+    let n = 8.min(bytes.len());
+    let mut v = Vec::with_capacity(n);
+    for byte in bytes.iter().take(n) {
+        v.push(format!("{:02x}", byte));
+    }
+    let trailer = match bytes.len() {
+        0..=8 => "",
+        _ => " ..",
+    };
+    format!("[{}{}]", v.join(" "), trailer)
+}
+
 fn main() -> Result<()> {
     // read device_config
     let output = Command::new("/system/bin/device_config").arg("list").output()?;
@@ -60,7 +73,10 @@
             eprintln!("warning: failed to read {}", path);
             continue;
         };
-        let parsed_flags: ProtoParsedFlags = protobuf::Message::parse_from_bytes(&bytes)?;
+        let parsed_flags: ProtoParsedFlags = protobuf::Message::parse_from_bytes(&bytes)
+            .with_context(|| {
+                format!("failed to parse {} ({}, {} byte(s))", path, xxd(&bytes), bytes.len())
+            })?;
         for flag in parsed_flags.parsed_flag {
             let key = format!("{}/{}.{}", flag.namespace(), flag.package(), flag.name());
             let value = format!("{:?} + {:?} ({})", flag.permission(), flag.state(), partition);
@@ -85,7 +101,7 @@
     use super::*;
 
     #[test]
-    fn test_foo() {
+    fn test_parse_device_config() {
         let input = r#"
 namespace_one/com.foo.bar.flag_one=true
 namespace_one/com.foo.bar.flag_two=false
@@ -107,4 +123,16 @@
         let actual = parse_device_config(input);
         assert_eq!(expected, actual);
     }
+
+    #[test]
+    fn test_xxd() {
+        let input = [0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8, 0x9];
+        assert_eq!("[]", &xxd(&input[0..0]));
+        assert_eq!("[00]", &xxd(&input[0..1]));
+        assert_eq!("[00 01]", &xxd(&input[0..2]));
+        assert_eq!("[00 01 02 03 04 05 06]", &xxd(&input[0..7]));
+        assert_eq!("[00 01 02 03 04 05 06 07]", &xxd(&input[0..8]));
+        assert_eq!("[00 01 02 03 04 05 06 07 ..]", &xxd(&input[0..9]));
+        assert_eq!("[00 01 02 03 04 05 06 07 ..]", &xxd(&input));
+    }
 }
diff --git a/tools/aconfig/src/codegen_cpp.rs b/tools/aconfig/src/codegen_cpp.rs
index 5eadf2a..cf0abb9 100644
--- a/tools/aconfig/src/codegen_cpp.rs
+++ b/tools/aconfig/src/codegen_cpp.rs
@@ -365,6 +365,7 @@
 #include "com_android_aconfig_test.h"
 #include <server_configurable_flags/get_flags.h>
 #include <unordered_map>
+#include <string>
 
 namespace com::android::aconfig::test {
 
diff --git a/tools/aconfig/src/codegen_java.rs b/tools/aconfig/src/codegen_java.rs
index c4fc405..43c2ecf 100644
--- a/tools/aconfig/src/codegen_java.rs
+++ b/tools/aconfig/src/codegen_java.rs
@@ -118,21 +118,30 @@
 
     const EXPECTED_FEATUREFLAGS_COMMON_CONTENT: &str = r#"
     package com.android.aconfig.test;
+    // TODO(b/303773055): Remove the annotation after access issue is resolved.
+    import android.compat.annotation.UnsupportedAppUsage;
     /** @hide */
     public interface FeatureFlags {
         @com.android.aconfig.annotations.AssumeFalseForR8
+        @UnsupportedAppUsage
         boolean disabledRo();
+        @UnsupportedAppUsage
         boolean disabledRw();
         @com.android.aconfig.annotations.AssumeTrueForR8
+        @UnsupportedAppUsage
         boolean enabledFixedRo();
         @com.android.aconfig.annotations.AssumeTrueForR8
+        @UnsupportedAppUsage
         boolean enabledRo();
+        @UnsupportedAppUsage
         boolean enabledRw();
     }
     "#;
 
     const EXPECTED_FLAG_COMMON_CONTENT: &str = r#"
     package com.android.aconfig.test;
+    // TODO(b/303773055): Remove the annotation after access issue is resolved.
+    import android.compat.annotation.UnsupportedAppUsage;
     /** @hide */
     public final class Flags {
         /** @hide */
@@ -147,20 +156,25 @@
         public static final String FLAG_ENABLED_RW = "com.android.aconfig.test.enabled_rw";
 
         @com.android.aconfig.annotations.AssumeFalseForR8
+        @UnsupportedAppUsage
         public static boolean disabledRo() {
             return FEATURE_FLAGS.disabledRo();
         }
+        @UnsupportedAppUsage
         public static boolean disabledRw() {
             return FEATURE_FLAGS.disabledRw();
         }
         @com.android.aconfig.annotations.AssumeTrueForR8
+        @UnsupportedAppUsage
         public static boolean enabledFixedRo() {
             return FEATURE_FLAGS.enabledFixedRo();
         }
         @com.android.aconfig.annotations.AssumeTrueForR8
+        @UnsupportedAppUsage
         public static boolean enabledRo() {
             return FEATURE_FLAGS.enabledRo();
         }
+        @UnsupportedAppUsage
         public static boolean enabledRw() {
             return FEATURE_FLAGS.enabledRw();
         }
@@ -168,6 +182,8 @@
 
     const EXPECTED_FAKEFEATUREFLAGSIMPL_CONTENT: &str = r#"
     package com.android.aconfig.test;
+    // TODO(b/303773055): Remove the annotation after access issue is resolved.
+    import android.compat.annotation.UnsupportedAppUsage;
     import java.util.HashMap;
     import java.util.Map;
     /** @hide */
@@ -176,22 +192,27 @@
             resetAll();
         }
         @Override
+        @UnsupportedAppUsage
         public boolean disabledRo() {
             return getValue(Flags.FLAG_DISABLED_RO);
         }
         @Override
+        @UnsupportedAppUsage
         public boolean disabledRw() {
             return getValue(Flags.FLAG_DISABLED_RW);
         }
         @Override
+        @UnsupportedAppUsage
         public boolean enabledFixedRo() {
             return getValue(Flags.FLAG_ENABLED_FIXED_RO);
         }
         @Override
+        @UnsupportedAppUsage
         public boolean enabledRo() {
             return getValue(Flags.FLAG_ENABLED_RO);
         }
         @Override
+        @UnsupportedAppUsage
         public boolean enabledRw() {
             return getValue(Flags.FLAG_ENABLED_RW);
         }
@@ -241,14 +262,18 @@
 
         let expect_featureflagsimpl_content = r#"
         package com.android.aconfig.test;
+        // TODO(b/303773055): Remove the annotation after access issue is resolved.
+        import android.compat.annotation.UnsupportedAppUsage;
         import android.provider.DeviceConfig;
         /** @hide */
         public final class FeatureFlagsImpl implements FeatureFlags {
             @Override
+            @UnsupportedAppUsage
             public boolean disabledRo() {
                 return false;
             }
             @Override
+            @UnsupportedAppUsage
             public boolean disabledRw() {
                 return getValue(
                     "aconfig_test",
@@ -257,14 +282,17 @@
                 );
             }
             @Override
+            @UnsupportedAppUsage
             public boolean enabledFixedRo() {
                 return true;
             }
             @Override
+            @UnsupportedAppUsage
             public boolean enabledRo() {
                 return true;
             }
             @Override
+            @UnsupportedAppUsage
             public boolean enabledRw() {
                 return getValue(
                     "aconfig_test",
@@ -346,29 +374,36 @@
         "#;
         let expect_featureflagsimpl_content = r#"
         package com.android.aconfig.test;
+        // TODO(b/303773055): Remove the annotation after access issue is resolved.
+        import android.compat.annotation.UnsupportedAppUsage;
         /** @hide */
         public final class FeatureFlagsImpl implements FeatureFlags {
             @Override
+            @UnsupportedAppUsage
             public boolean disabledRo() {
                 throw new UnsupportedOperationException(
                     "Method is not implemented.");
             }
             @Override
+            @UnsupportedAppUsage
             public boolean disabledRw() {
                 throw new UnsupportedOperationException(
                     "Method is not implemented.");
             }
             @Override
+            @UnsupportedAppUsage
             public boolean enabledFixedRo() {
                 throw new UnsupportedOperationException(
                     "Method is not implemented.");
             }
             @Override
+            @UnsupportedAppUsage
             public boolean enabledRo() {
                 throw new UnsupportedOperationException(
                     "Method is not implemented.");
             }
             @Override
+            @UnsupportedAppUsage
             public boolean enabledRw() {
                 throw new UnsupportedOperationException(
                     "Method is not implemented.");
diff --git a/tools/aconfig/templates/FakeFeatureFlagsImpl.java.template b/tools/aconfig/templates/FakeFeatureFlagsImpl.java.template
index d2cea95..72a896f 100644
--- a/tools/aconfig/templates/FakeFeatureFlagsImpl.java.template
+++ b/tools/aconfig/templates/FakeFeatureFlagsImpl.java.template
@@ -1,4 +1,6 @@
 package {package_name};
+// TODO(b/303773055): Remove the annotation after access issue is resolved.
+import android.compat.annotation.UnsupportedAppUsage;
 
 import java.util.HashMap;
 import java.util.Map;
@@ -11,6 +13,7 @@
 
 {{ for item in class_elements}}
     @Override
+    @UnsupportedAppUsage
     public boolean {item.method_name}() \{
         return getValue(Flags.FLAG_{item.flag_name_constant_suffix});
     }
diff --git a/tools/aconfig/templates/FeatureFlags.java.template b/tools/aconfig/templates/FeatureFlags.java.template
index 9350d60..02305e6 100644
--- a/tools/aconfig/templates/FeatureFlags.java.template
+++ b/tools/aconfig/templates/FeatureFlags.java.template
@@ -1,4 +1,6 @@
 package {package_name};
+// TODO(b/303773055): Remove the annotation after access issue is resolved.
+import android.compat.annotation.UnsupportedAppUsage;
 
 /** @hide */
 public interface FeatureFlags \{
@@ -10,6 +12,7 @@
     @com.android.aconfig.annotations.AssumeFalseForR8
 {{ -endif- }}
 {{ endif }}
+    @UnsupportedAppUsage
     boolean {item.method_name}();
 {{ endfor }}
 }
diff --git a/tools/aconfig/templates/FeatureFlagsImpl.java.template b/tools/aconfig/templates/FeatureFlagsImpl.java.template
index 3913fa4..1620dfe 100644
--- a/tools/aconfig/templates/FeatureFlagsImpl.java.template
+++ b/tools/aconfig/templates/FeatureFlagsImpl.java.template
@@ -1,4 +1,6 @@
 package {package_name};
+// TODO(b/303773055): Remove the annotation after access issue is resolved.
+import android.compat.annotation.UnsupportedAppUsage;
 {{ if not is_test_mode }}
 {{ if is_read_write- }}
 import android.provider.DeviceConfig;
@@ -7,6 +9,7 @@
 public final class FeatureFlagsImpl implements FeatureFlags \{
 {{ for item in class_elements}}
     @Override
+    @UnsupportedAppUsage
     public boolean {item.method_name}() \{
     {{ -if item.is_read_write }}
         return getValue(
@@ -49,6 +52,7 @@
 public final class FeatureFlagsImpl implements FeatureFlags \{
 {{ for item in class_elements}}
     @Override
+    @UnsupportedAppUsage
     public boolean {item.method_name}() \{
         throw new UnsupportedOperationException(
             "Method is not implemented.");
diff --git a/tools/aconfig/templates/Flags.java.template b/tools/aconfig/templates/Flags.java.template
index 39024a8..66c4c5a 100644
--- a/tools/aconfig/templates/Flags.java.template
+++ b/tools/aconfig/templates/Flags.java.template
@@ -1,5 +1,8 @@
 package {package_name};
 
+// TODO(b/303773055): Remove the annotation after access issue is resolved.
+import android.compat.annotation.UnsupportedAppUsage;
+
 /** @hide */
 public final class Flags \{
 {{- for item in class_elements}}
@@ -14,6 +17,7 @@
     @com.android.aconfig.annotations.AssumeFalseForR8
 {{ -endif- }}
 {{ endif }}
+    @UnsupportedAppUsage
     public static boolean {item.method_name}() \{
         return FEATURE_FLAGS.{item.method_name}();
     }
diff --git a/tools/aconfig/templates/cpp_source_file.template b/tools/aconfig/templates/cpp_source_file.template
index c0e7343..5b71b31 100644
--- a/tools/aconfig/templates/cpp_source_file.template
+++ b/tools/aconfig/templates/cpp_source_file.template
@@ -4,6 +4,7 @@
 {{ endif }}
 {{ if for_test }}
 #include <unordered_map>
+#include <string>
 {{ endif }}
 
 namespace {cpp_namespace} \{