diff --git a/pkg/extensions/monitored_system_admission.go b/pkg/extensions/monitored_system_admission.go
new file mode 100644
index 000000000..0c5a46ff5
--- /dev/null
+++ b/pkg/extensions/monitored_system_admission.go
@@ -0,0 +1,24 @@
+package extensions
+
+// MonitoredSystemAdmissionInput describes the counted-system state that a
+// commercial runtime can use to decide whether adding a candidate should be
+// admitted.
+type MonitoredSystemAdmissionInput struct {
+	Current                  int
+	Additional               int
+	Limit                    int
+	UsageAvailable           bool
+	UsageUnavailableReason   string
+	CandidateCountsTowardCap bool
+}
+
+// MonitoredSystemAdmissionDecision is the runtime admission decision returned
+// by commercial policy hooks.
+type MonitoredSystemAdmissionDecision struct {
+	Current                int
+	Additional             int
+	Limit                  int
+	UsageAvailable         bool
+	UsageUnavailableReason string
+	Exceeded               bool
+}
diff --git a/pkg/server/server.go b/pkg/server/server.go
index 1cb9caa16..8b542de8f 100644
--- a/pkg/server/server.go
+++ b/pkg/server/server.go
@@ -97,6 +97,11 @@ type BusinessHooks struct {
 	// CreateAlertAnalyzer creates the premium alert-triggered analyzer.
 	// Returns nil in OSS. Enterprise provides a concrete implementation.
 	CreateAlertAnalyzer func(deps aicontracts.AlertAnalyzerDeps) aicontracts.AlertAnalyzer
+
+	// ResolveMonitoredSystemAdmissionPolicy lets commercial runtimes own
+	// monitored-system admission policy while the public server owns inventory
+	// projection and the shared API contract.
+	ResolveMonitoredSystemAdmissionPolicy func(context.Context, extensions.MonitoredSystemAdmissionInput) extensions.MonitoredSystemAdmissionDecision
 }
 
 var (
@@ -122,7 +127,8 @@ func runtimeIdentityForBusinessHooks(h BusinessHooks) pkglicensing.RuntimeIdenti
 		h.CreateRemediationEngine != nil ||
 		h.CreateInvestigationStore != nil ||
 		h.CreateInvestigationOrchestrator != nil ||
-		h.CreateAlertAnalyzer != nil {
+		h.CreateAlertAnalyzer != nil ||
+		h.ResolveMonitoredSystemAdmissionPolicy != nil {
 		return pkglicensing.ProRuntimeIdentity()
 	}
 	return pkglicensing.CommunityRuntimeIdentity()
diff --git a/pkg/server/server_test.go b/pkg/server/server_test.go
index cf69ff4da..eee0b7ffd 100644
--- a/pkg/server/server_test.go
+++ b/pkg/server/server_test.go
@@ -55,6 +55,15 @@ func TestRuntimeIdentityForBusinessHooks(t *testing.T) {
 	if got.Build != pkglicensing.RuntimeBuildPro {
 		t.Fatalf("enterprise hooks runtime build=%q, want pro", got.Build)
 	}
+
+	got = runtimeIdentityForBusinessHooks(BusinessHooks{
+		ResolveMonitoredSystemAdmissionPolicy: func(context.Context, extensions.MonitoredSystemAdmissionInput) extensions.MonitoredSystemAdmissionDecision {
+			return extensions.MonitoredSystemAdmissionDecision{}
+		},
+	})
+	if got.Build != pkglicensing.RuntimeBuildPro {
+		t.Fatalf("commercial admission hook runtime build=%q, want pro", got.Build)
+	}
 }
 
 func TestPerformAutoImport_Success(t *testing.T) {