diff --git a/common/src/types.rs b/common/src/types.rs
index 8c30a81..d82801e 100644
--- a/common/src/types.rs
+++ b/common/src/types.rs
@@ -86,6 +86,29 @@ pub struct Policy {
     pub firstrun: Firstrun,
 }
 
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, zvariant::Type)]
+pub struct PendingFlag {
+    pub required_methods: Vec<Method>,
+    pub created_unix: u64,
+    /// 0 = no deadline (matches the design doc's `deadline_hours = 0` convention).
+    /// D-Bus has no native option type, so the sentinel is the wire-friendly choice.
+    pub deadline_unix: u64,
+    pub re_enroll: bool,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, zvariant::Type)]
+pub struct Violation {
+    pub user: String,
+    pub stack: String,
+    pub reason: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, zvariant::Type)]
+pub struct PolicyApplyResult {
+    pub applied: bool,
+    pub violations: Vec<Violation>,
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -125,6 +148,26 @@ mod tests {
         assert_eq!(p, back);
     }
 
+    #[test]
+    fn pending_flag_serde() {
+        let f = PendingFlag {
+            required_methods: vec![Method::Fido2],
+            created_unix: 1_700_000_000,
+            deadline_unix: 0,
+            re_enroll: false,
+        };
+        let json = serde_json::to_string(&f).unwrap();
+        let back: PendingFlag = serde_json::from_str(&json).unwrap();
+        assert_eq!(f, back);
+    }
+
+    #[test]
+    fn policy_apply_result_ok_no_violations() {
+        let r = PolicyApplyResult { applied: true, violations: vec![] };
+        assert!(r.applied);
+        assert!(r.violations.is_empty());
+    }
+
     #[test]
     fn credential_roundtrips_via_serde() {
         let c = Credential {