diff --git a/plugin/community.go b/plugin/community.go
new file mode 100644
index 0000000..ec29a7c
--- /dev/null
+++ b/plugin/community.go
@@ -0,0 +1,13 @@
+package plugin
+
+import (
+	"git.dev.alexdunmow.com/block/core/rbac"
+)
+
+// CoreServiceBindings provides pre-built CMS service bindings that plugins
+// can include in their ServiceRegistration with custom RBAC role mappings.
+// The CMS constructs the actual service handlers — plugins just specify which
+// services to mount and what roles apply.
+type CoreServiceBindings interface {
+	Bind(serviceName string, methodRoles map[string]rbac.Role) (ConnectServiceBinding, error)
+}
diff --git a/plugin/deps.go b/plugin/deps.go
index 2ccefb6..29d7643 100644
--- a/plugin/deps.go
+++ b/plugin/deps.go
@@ -46,6 +46,9 @@ type ServiceDeps struct {
 	// Plugin interop
 	Bridge PluginBridge
 
+	// Core RPC services — pre-built bindings for CMS-provided services
+	CoreServiceBindings CoreServiceBindings
+
 	// Extension points — typed as narrow interfaces where possible
 	JobRunner        JobRunner
 	EmbeddingService EmbeddingService