diff --git a/ledger/v1/msg.proto b/ledger/v1/msg.proto
index 0b934ff..ab70fea 100644
--- a/ledger/v1/msg.proto
+++ b/ledger/v1/msg.proto
@@ -4,6 +4,43 @@ package ledger.v1;
 
 import "google/protobuf/timestamp.proto";
 
+message OperatingModeResponse {
+  // NORMAL or GL_ONLY. No automatic outage failover.
+  string mode = 1;
+  int64 revision = 2;
+  string actor_id = 3;
+  string reason = 4;
+  google.protobuf.Timestamp changed_at = 5;
+}
+
+message SetOperatingModeRequest {
+  string mode = 1;
+  int64 expected_revision = 2;
+  string actor_id = 3;
+  string reason = 4;
+  // Required when returning from GL_ONLY to NORMAL.
+  bool reconciliation_confirmed = 5;
+}
+
+message GetUserBalancesRequest {
+  string owner_type = 1;
+  string owner_id = 2;
+  optional int64 asset_id = 3;
+}
+
+message UserAssetBalance {
+  int64 asset_id = 1;
+  string available = 2;
+  string frozen = 3;
+  string total = 4;
+}
+
+message GetUserBalancesResponse {
+  string owner_type = 1;
+  string owner_id = 2;
+  repeated UserAssetBalance balances = 3;
+}
+
 enum AccountClass {
   ACCOUNT_CLASS_UNSPECIFIED = 0;
   ACCOUNT_CLASS_USER_AVAILABLE = 1;
diff --git a/ledger/v1/srv.proto b/ledger/v1/srv.proto
index c8afe1d..2043c16 100644
--- a/ledger/v1/srv.proto
+++ b/ledger/v1/srv.proto
@@ -6,6 +6,12 @@ import "base/v1/msg.proto";
 import "ledger/v1/msg.proto";
 
 service GeneralLedgerService {
+  rpc GetOperatingMode(base.v1.Empty) returns (OperatingModeResponse);
+  // Operator-only; requires x-admin-token and an optimistic revision.
+  rpc SetOperatingMode(SetOperatingModeRequest) returns (OperatingModeResponse);
+  // Trusted internal execution; requires x-admin-token and GL_ONLY mode.
+  rpc PostInternalJournal(AppendJournalRequest) returns (AppendJournalResponse);
+  rpc GetUserBalances(GetUserBalancesRequest) returns (GetUserBalancesResponse);
   rpc Health(base.v1.Empty) returns (HealthResponse);
   rpc AppendJournal(AppendJournalRequest) returns (AppendJournalResponse);
   rpc AppendTransactionEvent(AppendTransactionEventRequest) returns (AppendTransactionEventResponse);