diff --git a/protect/control/v1/common.proto b/protect/control/v1/common.proto
index 7d5db29..bf4debd 100644
--- a/protect/control/v1/common.proto
+++ b/protect/control/v1/common.proto
@@ -5,10 +5,17 @@ package protect.control.v1;
 import "google/protobuf/struct.proto";
 import "google/protobuf/timestamp.proto";
 
+message ResourceOrigin {
+  string zone_id = 1;
+  string workload_id = 2;
+  string user_agent = 3;
+}
+
 message Zone {
   string id = 1;
   ZoneSpec spec = 2;
   ZoneStatus status = 3;
+  ResourceOrigin origin = 4;
 }
 
 message ZoneSpec {
@@ -25,6 +32,16 @@ message ZoneSpec {
   ZoneVirtualizationOptionsSpec virtualization_options = 9;
   ZoneScratchDiskSpec scratch_disk = 10;
   repeated OciImageSpec addons = 11;
+  ZoneControlApiSpec control_api = 12;
+}
+
+enum ZoneControlApiAccess {
+  ZONE_CONTROL_API_ACCESS_DENY = 0;
+  ZONE_CONTROL_API_ACCESS_ALLOW = 1;
+}
+
+message ZoneControlApiSpec {
+  ZoneControlApiAccess access = 1;
 }
 
 enum ZoneResourceAdjustmentPolicy {
@@ -386,6 +403,7 @@ message Workload {
   string id = 1;
   WorkloadSpec spec = 2;
   WorkloadStatus status = 3;
+  ResourceOrigin origin = 4;
 }
 
 enum HostCpuTopologyClass {
diff --git a/protect/control/v1/control.proto b/protect/control/v1/control.proto
index ce92150..bc958db 100644
--- a/protect/control/v1/control.proto
+++ b/protect/control/v1/control.proto
@@ -7,6 +7,7 @@ import "protect/control/v1/common.proto";
 service ControlService {
   rpc GetHostStatus(GetHostStatusRequest) returns (GetHostStatusReply);
   rpc SnoopIdm(SnoopIdmRequest) returns (stream SnoopIdmReply);
+  rpc SnoopControl(SnoopControlRequest) returns (stream SnoopControlReply);
   rpc GetHostCpuTopology(GetHostCpuTopologyRequest) returns (GetHostCpuTopologyReply);
 
   rpc ListDevices(ListDevicesRequest) returns (ListDevicesReply);
@@ -426,6 +427,30 @@ message SnoopIdmPacket {
   bytes packet = 3;
 }
 
+message SnoopControlRequest {}
+
+message SnoopControlReply {
+  repeated SnoopControlPacket packets = 1;
+  uint64 skipped = 2;
+}
+
+enum SnoopControlPacketForm {
+  SNOOP_CONTROL_PACKET_FORM_UNKNOWN = 0;
+  SNOOP_CONTROL_PACKET_FORM_REQUEST = 1;
+  SNOOP_CONTROL_PACKET_FORM_ERROR = 2;
+  SNOOP_CONTROL_PACKET_FORM_RESPONSE = 3;
+}
+
+message SnoopControlPacket {
+  uint64 id = 1;
+  ResourceOrigin origin = 2;
+  string service = 3;
+  string method = 4;
+  SnoopControlPacketForm form = 5;
+  string payload = 6;
+  bool closed = 7;
+}
+
 message PullImageRequest {
   string image = 1;
   OciImageFormat format = 2;