diff --git a/src/core/ext/filters/rbac/rbac_service_config_parser.cc b/src/core/ext/filters/rbac/rbac_service_config_parser.cc
index c5f91535161..d79bf393033 100644
--- a/src/core/ext/filters/rbac/rbac_service_config_parser.cc
+++ b/src/core/ext/filters/rbac/rbac_service_config_parser.cc
@@ -283,19 +283,29 @@ struct RbacConfig {
           std::unique_ptr<Permission> not_rule;
 
           Permission() = default;
-          Permission(const Permission& other)
-              : any(other.any),
-                header(other.header),
-                url_path(other.url_path),
-                destination_ip(other.destination_ip),
-                destination_port(other.destination_port),
-                metadata(other.metadata),
-                requested_server_name(other.requested_server_name),
-                and_rules(other.and_rules),
-                or_rules(other.or_rules),
-                not_rule(other.not_rule == nullptr
-                             ? nullptr
-                             : absl::make_unique<Permission>(*other.not_rule)) {
+          Permission(Permission&& other) noexcept
+              : any(std::move(other.any)),
+                header(std::move(other.header)),
+                url_path(std::move(other.url_path)),
+                destination_ip(std::move(other.destination_ip)),
+                destination_port(std::move(other.destination_port)),
+                metadata(std::move(other.metadata)),
+                requested_server_name(std::move(other.requested_server_name)),
+                and_rules(std::move(other.and_rules)),
+                or_rules(std::move(other.or_rules)),
+                not_rule(std::move(other.not_rule)) {}
+          Permission& operator=(Permission&& other) noexcept {
+            any = std::move(other.any);
+            header = std::move(other.header);
+            url_path = std::move(other.url_path);
+            destination_ip = std::move(other.destination_ip);
+            destination_port = std::move(other.destination_port);
+            metadata = std::move(other.metadata);
+            requested_server_name = std::move(other.requested_server_name);
+            and_rules = std::move(other.and_rules);
+            or_rules = std::move(other.or_rules);
+            not_rule = std::move(other.not_rule);
+            return *this;
           }
 
           static const JsonLoaderInterface* JsonLoader(const JsonArgs&) {
@@ -430,20 +440,32 @@ struct RbacConfig {
           std::unique_ptr<Principal> not_id;
 
           Principal() = default;
-          Principal(const Principal& other)
-              : any(other.any),
-                authenticated(other.authenticated),
-                source_ip(other.source_ip),
-                direct_remote_ip(other.direct_remote_ip),
-                remote_ip(other.remote_ip),
-                header(other.header),
-                url_path(other.url_path),
-                metadata(other.metadata),
-                and_ids(other.and_ids),
-                or_ids(other.or_ids),
-                not_id(other.not_id == nullptr
-                           ? nullptr
-                           : absl::make_unique<Principal>(*other.not_id)) {}
+          Principal(Principal&& other) noexcept
+              : any(std::move(other.any)),
+                authenticated(std::move(other.authenticated)),
+                source_ip(std::move(other.source_ip)),
+                direct_remote_ip(std::move(other.direct_remote_ip)),
+                remote_ip(std::move(other.remote_ip)),
+                header(std::move(other.header)),
+                url_path(std::move(other.url_path)),
+                metadata(std::move(other.metadata)),
+                and_ids(std::move(other.and_ids)),
+                or_ids(std::move(other.or_ids)),
+                not_id(std::move(other.not_id)) {}
+          Principal& operator=(Principal&& other) noexcept {
+            any = std::move(other.any);
+            authenticated = std::move(other.authenticated);
+            source_ip = std::move(other.source_ip);
+            direct_remote_ip = std::move(other.direct_remote_ip);
+            remote_ip = std::move(other.remote_ip);
+            header = std::move(other.header);
+            url_path = std::move(other.url_path);
+            metadata = std::move(other.metadata);
+            and_ids = std::move(other.and_ids);
+            or_ids = std::move(other.or_ids);
+            not_id = std::move(other.not_id);
+            return *this;
+          }
 
           static const JsonLoaderInterface* JsonLoader(const JsonArgs&) {
             static const auto* loader =