diff --git a/protect/control/v1/common.proto b/protect/control/v1/common.proto
index a785e39..4419c67 100644
--- a/protect/control/v1/common.proto
+++ b/protect/control/v1/common.proto
@@ -152,7 +152,11 @@ message AnnotationSpec {
 }
 
 message DeviceReferenceSpec {
-  string name = 1;
+  string id = 1;
+}
+
+message WorkloadPciDeviceSpec {
+  string location = 1;
 }
 
 message WorkloadBlockDeviceSpec {
@@ -161,10 +165,6 @@ message WorkloadBlockDeviceSpec {
   BlockDeviceMountOptions mount_options = 3;
 }
 
-message WorkloadPciDeviceSpec {
-  string location = 1;
-}
-
 message BlockDeviceMountOptions {
   bool readonly = 1;
   string permissions = 2;
@@ -330,7 +330,7 @@ message WorkloadSpec {
   string hostname = 10;
   repeated WorkloadBlockDeviceSpec block_devices = 11;
   optional int32 oom_score_adj = 12;
-  repeated WorkloadPciDeviceSpec pci_devices = 13;
+  repeated DeviceReferenceSpec devices = 13;
 }
 
 message CgroupLimit {
@@ -506,10 +506,59 @@ message OciImageProgressIndicationCompleted {
   bool is_bytes = 3;
 }
 
-message DeviceInfo {
+message PciDeviceSpec {
+  string location = 1;
+  bool permissive = 2;
+  bool msi_translate = 3;
+  bool power_management = 4;
+  PciDeviceRdmReservePolicy rdm_reserve_policy = 5;
+}
+
+enum PciDeviceRdmReservePolicy {
+  PCI_DEVICE_RDM_RESERVE_POLICY_UNKNOWN = 0;
+  PCI_DEVICE_RDM_RESERVE_POLICY_STRICT = 1;
+  PCI_DEVICE_RDM_RESERVE_POLICY_RELAXED = 2;
+}
+
+message BlockDeviceSpec {
+  string device_path = 1;
+}
+
+message DeviceSpec {
   string name = 1;
-  bool claimed = 2;
-  string owner_zone = 3;
+  oneof device_type {
+    PciDeviceSpec pci = 2;
+    BlockDeviceSpec block = 3;
+  }
+  repeated string modules = 4;
+  repeated KernelModuleParameter module_parameters = 5;
+}
+
+enum DeviceState {
+  DEVICE_STATE_UNKNOWN = 0;
+  DEVICE_STATE_AVAILABLE = 1;
+  DEVICE_STATE_TAINTED = 2;
+  DEVICE_STATE_USED = 3;
+  DEVICE_STATE_DESTROYING = 4;
+  DEVICE_STATE_DESTROYED = 5;
+  DEVICE_STATE_CREATING = 6;
+  DEVICE_STATE_FAILED = 7;
+}
+
+message DeviceStatus {
+  DeviceState state = 1;
+  string owner_id = 2;
+  DeviceErrorStatus error_status = 3;
+}
+
+message DeviceErrorStatus {
+  string message = 1;
+}
+
+message Device {
+  string id = 1;
+  DeviceSpec spec = 2;
+  DeviceStatus status = 3;
 }
 
 message ZoneScratchDiskSpec {
diff --git a/protect/control/v1/control.proto b/protect/control/v1/control.proto
index 54efefd..b7cd082 100644
--- a/protect/control/v1/control.proto
+++ b/protect/control/v1/control.proto
@@ -9,7 +9,13 @@ service ControlService {
   rpc SnoopIdm(SnoopIdmRequest) returns (stream SnoopIdmReply);
   rpc GetHostCpuTopology(GetHostCpuTopologyRequest) returns (GetHostCpuTopologyReply);
 
+  rpc CreateDevice(CreateDeviceRequest) returns (CreateDeviceReply);
   rpc ListDevices(ListDevicesRequest) returns (ListDevicesReply);
+  rpc GetDevice(GetDeviceRequest) returns (GetDeviceReply);
+  rpc UpdateDeviceState(UpdateDeviceStateRequest) returns (UpdateDeviceStateReply);
+  rpc DestroyDevice(DestroyDeviceRequest) returns (DestroyDeviceReply);
+  rpc ResolveAndValidateDevice(ResolveAndValidateDeviceRequest) returns (ResolveAndValidateDeviceReply);
+  rpc UpdateZoneDevices(UpdateZoneDevicesRequest) returns (UpdateZoneDevicesReply);
 
   rpc CreateNetworkReservation(CreateNetworkReservationRequest) returns (CreateNetworkReservationReply);
   rpc DestroyNetworkReservation(DestroyNetworkReservationRequest) returns (DestroyNetworkReservationReply);
@@ -73,6 +79,28 @@ message GetHostStatusReply {
   optional string protect_branch = 11;
 }
 
+message UpdateDeviceStateRequest {
+  string device_id = 1;
+  DeviceState state = 2;
+}
+
+message UpdateDeviceStateReply {}
+
+message UpdateZoneDevicesRequest {
+  string zone_id = 1;
+  repeated DeviceReferenceSpec devices = 2;
+}
+
+message GetDeviceRequest {
+  string device_id = 1;
+}
+
+message GetDeviceReply {
+  Device device = 1;
+}
+
+message UpdateZoneDevicesReply {}
+
 message CreateZoneRequest {
   ZoneSpec spec = 1;
 }
@@ -398,6 +426,7 @@ message WatchEventsReply {
   oneof event {
     ZoneChangedEvent zone_changed = 1;
     WorkloadChangedEvent workload_changed = 2;
+    DeviceChangedEvent device_changed = 3;
   }
 }
 
@@ -409,6 +438,10 @@ message WorkloadChangedEvent {
   Workload workload = 1;
 }
 
+message DeviceChangedEvent {
+  Device device = 1;
+}
+
 message ReadZoneMetricsRequest {
   string zone_id = 1;
 }
@@ -480,7 +513,8 @@ message ListImagesReply {
 message ListDevicesRequest {}
 
 message ListDevicesReply {
-  repeated DeviceInfo devices = 1;
+  reserved 1;
+  repeated Device devices = 2;
 }
 
 message GetHostCpuTopologyRequest {}
@@ -617,3 +651,28 @@ message DialNetworkSocketData {
 message DialNetworkSocketReply {
   DialNetworkSocketData data = 1;
 }
+
+message CreateDeviceRequest {
+  DeviceSpec spec = 1;
+}
+
+message CreateDeviceReply {
+  string device_id = 1;
+}
+
+message DestroyDeviceRequest {
+  string device_id = 1;
+}
+
+message DestroyDeviceReply {}
+
+message ResolveAndValidateDeviceRequest {
+  oneof DeviceRequest {
+    string name = 1;
+    string location = 2;
+  }
+}
+
+message ResolveAndValidateDeviceReply {
+  string device_id = 1;
+}