diff --git a/metropolis/proto/api/management.proto b/metropolis/proto/api/management.proto
index ae7dd8d..bbd81f8 100644
--- a/metropolis/proto/api/management.proto
+++ b/metropolis/proto/api/management.proto
@@ -25,4 +25,4 @@
 message GetRegisterTicketResponse {
     // Opaque bytes that comprise the RegisterTicket.
     bytes ticket = 1;
-}
\ No newline at end of file
+}
diff --git a/metropolis/proto/common/common.proto b/metropolis/proto/common/common.proto
index 859b609..5a49520 100644
--- a/metropolis/proto/common/common.proto
+++ b/metropolis/proto/common/common.proto
@@ -93,3 +93,45 @@
     // services off.
     CLUSTER_STATE_SPLIT = 6;
 }
+
+// NodeStatus contains all fields self-reported by nodes. This data is
+// inherently less trusted than other data available about a node, as it can be
+// updated to any value by each node individually, including compromised nodes.
+message NodeStatus {
+    // external_address is the IP address that the node expects management,
+    // cluster and user traffic to arrive at (ie. the address on which it is
+    // listening for gRPC, and role-specific services like etcd and
+    // Kubernetes).
+    string external_address = 1;
+}
+
+// The Cluster Directory is information about the network addressing of nodes
+// in a cluster. It is a serialized snapshot of some of the state within the
+// etcd cluster, and can be used by external processes (like a node Registering
+// into the cluster) to know how to reach this cluster over the network. It can
+// be thought of as a phonebook, or a static name/address configuration that
+// could live in /etc/hosts.
+//
+// The directory explicitly doesn't carry any information about the cluster's
+// identity or security - these should be configured and checked by higher
+// level configuration and processes. The directory can be stored and
+// transmitted in cleartext and without an integrity checks (like saved to the
+// EFI system partition across reboots) and any malicious change to it will
+// cause no more than a denial of service against the consumer of this
+// directory. This is because all nodes contacted must present a valid cluster
+// identity/certificate before they are trusted by the consumers of this
+// directory.
+message ClusterDirectory {
+    message Node {
+        bytes public_key = 1;
+        message Address {
+            string host = 1;
+        };
+        repeated Address addesses = 2;
+    };
+    repeated Node nodes = 1;
+}
+
+message ClusterIdentity {
+    bytes ca_fingerprint = 1;
+}
diff --git a/metropolis/proto/ext/authorization.proto b/metropolis/proto/ext/authorization.proto
index 2988010..42beb88 100644
--- a/metropolis/proto/ext/authorization.proto
+++ b/metropolis/proto/ext/authorization.proto
@@ -21,6 +21,7 @@
     PERMISSION_UNSPECIFIED = 0;
     PERMISSION_GET_REGISTER_TICKET = 1;
     PERMISSION_READ_CLUSTER_STATUS = 2;
+    PERMISSION_UPDATE_NODE_SELF = 3;
 }
 
 // Authorization policy for an RPC method. This message/API does not have the