diff --git a/cre/capabilities/compute/confidentialworkflow/v1alpha/client.proto b/cre/capabilities/compute/confidentialworkflow/v1alpha/client.proto
index a6ee0921..667db2d6 100644
--- a/cre/capabilities/compute/confidentialworkflow/v1alpha/client.proto
+++ b/cre/capabilities/compute/confidentialworkflow/v1alpha/client.proto
@@ -2,6 +2,8 @@ syntax = "proto3";
 
 package capabilities.compute.confidentialworkflow.v1alpha;
 
+import "google/protobuf/empty.proto";
+import "sdk/v1alpha/sdk.proto";
 import "tools/generator/v1alpha/cre_metadata.proto";
 
 message SecretIdentifier {
@@ -19,9 +21,8 @@ message WorkflowExecution {
   string binary_url = 2;
   // binary_hash is the expected SHA-256 hash of the WASM binary, for integrity verification.
   bytes binary_hash = 3;
-  // execute_request is a serialized sdk.v1alpha.ExecuteRequest proto.
   // Contains either a subscribe request or a trigger execution request.
-  bytes execute_request = 4;
+  sdk.v1alpha.ExecuteRequest execute_request = 4;
   // owner is the on-chain owner address of the workflow (hex, 0x-prefixed).
   // Used by the enclave for runtime secret fetching from VaultDON.
   string owner = 5;
@@ -31,6 +32,8 @@ message WorkflowExecution {
   // org_id is the organization identifier for the workflow owner.
   // Used by the enclave when fetching secrets from VaultDON with org-based ownership.
   string org_id = 7;
+  // requirements to run this workflow
+  sdk.v1alpha.Requirements requirements = 8;
 }
 
 // ConfidentialWorkflowRequest is the input provided to the confidential workflows capability.
@@ -43,7 +46,11 @@ message ConfidentialWorkflowRequest {
 // ConfidentialWorkflowResponse is the output from the confidential workflows capability.
 message ConfidentialWorkflowResponse {
   // execution_result is a serialized sdk.v1alpha.ExecutionResult proto.
-  bytes execution_result = 1;
+  sdk.v1alpha.ExecutionResult execution_result = 1;
+}
+
+message ProvidedTeesResponse {
+  repeated sdk.v1alpha.TeeTypeAndRegions tee = 1;
 }
 
 service Client {
@@ -53,4 +60,5 @@ service Client {
   };
 
   rpc Execute(ConfidentialWorkflowRequest) returns (ConfidentialWorkflowResponse);
+  rpc ProvidedTees(google.protobuf.Empty) returns (ProvidedTeesResponse);
 }
diff --git a/cre/capabilities/networking/confidentialhttp/v1alpha/client.proto b/cre/capabilities/networking/confidentialhttp/v1alpha/client.proto
index 9feec6f0..298de68b 100644
--- a/cre/capabilities/networking/confidentialhttp/v1alpha/client.proto
+++ b/cre/capabilities/networking/confidentialhttp/v1alpha/client.proto
@@ -66,6 +66,7 @@ service Client {
   option (tools.generator.v1alpha.capability) = {
     mode: MODE_DON
     capability_id: "confidential-http@1.0.0-alpha"
+    additional_environments: [ADDITIONAL_ENVIRONMENTS_TEE]
   };
 
   rpc SendRequest(ConfidentialHTTPRequest) returns (HTTPResponse);
diff --git a/cre/capabilities/networking/http/v1alpha/client.proto b/cre/capabilities/networking/http/v1alpha/client.proto
index a42e23bd..e395570d 100644
--- a/cre/capabilities/networking/http/v1alpha/client.proto
+++ b/cre/capabilities/networking/http/v1alpha/client.proto
@@ -37,6 +37,7 @@ service Client {
   option (tools.generator.v1alpha.capability) = {
     mode: MODE_NODE
     capability_id: "http-actions@1.0.0-alpha"
+    additional_environments: [ADDITIONAL_ENVIRONMENTS_TEE]
   };
   rpc SendRequest(Request) returns (Response);
 }
diff --git a/cre/go/installer/pkg/embedded_gen.go b/cre/go/installer/pkg/embedded_gen.go
index 07af5298..e9c1afb4 100755
--- a/cre/go/installer/pkg/embedded_gen.go
+++ b/cre/go/installer/pkg/embedded_gen.go
@@ -1059,6 +1059,8 @@ const computeConfidentialworkflowV1alphaClientEmbedded = `syntax = "proto3";
 
 package capabilities.compute.confidentialworkflow.v1alpha;
 
+import "google/protobuf/empty.proto";
+import "sdk/v1alpha/sdk.proto";
 import "tools/generator/v1alpha/cre_metadata.proto";
 
 message SecretIdentifier {
@@ -1076,9 +1078,8 @@ message WorkflowExecution {
   string binary_url = 2;
   // binary_hash is the expected SHA-256 hash of the WASM binary, for integrity verification.
   bytes binary_hash = 3;
-  // execute_request is a serialized sdk.v1alpha.ExecuteRequest proto.
   // Contains either a subscribe request or a trigger execution request.
-  bytes execute_request = 4;
+  sdk.v1alpha.ExecuteRequest execute_request = 4;
   // owner is the on-chain owner address of the workflow (hex, 0x-prefixed).
   // Used by the enclave for runtime secret fetching from VaultDON.
   string owner = 5;
@@ -1088,6 +1089,8 @@ message WorkflowExecution {
   // org_id is the organization identifier for the workflow owner.
   // Used by the enclave when fetching secrets from VaultDON with org-based ownership.
   string org_id = 7;
+  // requirements to run this workflow
+  sdk.v1alpha.Requirements requirements = 8;
 }
 
 // ConfidentialWorkflowRequest is the input provided to the confidential workflows capability.
@@ -1100,7 +1103,11 @@ message ConfidentialWorkflowRequest {
 // ConfidentialWorkflowResponse is the output from the confidential workflows capability.
 message ConfidentialWorkflowResponse {
   // execution_result is a serialized sdk.v1alpha.ExecutionResult proto.
-  bytes execution_result = 1;
+  sdk.v1alpha.ExecutionResult execution_result = 1;
+}
+
+message ProvidedTeesResponse {
+  repeated sdk.v1alpha.TeeTypeAndRegions tee = 1;
 }
 
 service Client {
@@ -1110,6 +1117,7 @@ service Client {
   };
 
   rpc Execute(ConfidentialWorkflowRequest) returns (ConfidentialWorkflowResponse);
+  rpc ProvidedTees(google.protobuf.Empty) returns (ProvidedTeesResponse);
 }
 `
 
@@ -1357,6 +1365,7 @@ service Client {
   option (tools.generator.v1alpha.capability) = {
     mode: MODE_DON
     capability_id: "confidential-http@1.0.0-alpha"
+    additional_environments: [ADDITIONAL_ENVIRONMENTS_TEE]
   };
 
   rpc SendRequest(ConfidentialHTTPRequest) returns (HTTPResponse);
@@ -1402,6 +1411,7 @@ service Client {
   option (tools.generator.v1alpha.capability) = {
     mode: MODE_NODE
     capability_id: "http-actions@1.0.0-alpha"
+    additional_environments: [ADDITIONAL_ENVIRONMENTS_TEE]
   };
   rpc SendRequest(Request) returns (Response);
 }
@@ -1562,6 +1572,17 @@ message TriggerSubscription {
   string id = 1;
   google.protobuf.Any payload = 2;
   string method = 3;
+  Requirements requirements = 4;
+}
+
+enum TeeType {
+  TEE_TYPE_UNSPECIFIED = 0;
+  TEE_TYPE_AWS_NITRO = 1;
+}
+
+message TeeTypeAndRegions {
+  TeeType type = 1;
+  repeated string regions = 3;
 }
 
 message TriggerSubscriptionRequest {
@@ -1573,6 +1594,25 @@ message Trigger {
   google.protobuf.Any payload = 2;
 }
 
+message Regions {
+  repeated string regions = 1;
+}
+
+message TeeTypesAndRegions {
+  repeated TeeTypeAndRegions tee_type_and_regions = 1;
+}
+
+message Tee {
+  oneof item {
+    Regions any_regions = 1;
+    TeeTypesAndRegions tee_types_and_regions = 2;
+  }
+}
+
+message Requirements {
+  Tee tee = 1;
+}
+
 message AwaitCapabilitiesRequest {
   repeated int32 ids = 1;
 }
@@ -1837,10 +1877,16 @@ message Label {
   }
 }
 
+enum AdditionalEnironments {
+  ADDITIONAL_ENVIRONMENTS_UNSPECIFIED = 0;
+  ADDITIONAL_ENVIRONMENTS_TEE = 1;
+}
+
 message CapabilityMetadata {
   sdk.v1alpha.Mode mode = 1;
   string capability_id = 2;
   map<string, Label> labels = 3;
+  repeated AdditionalEnironments additional_environments = 4;
 }
 
 extend google.protobuf.ServiceOptions {
diff --git a/cre/go/sdk/sdk.pb.go b/cre/go/sdk/sdk.pb.go
index 3ab84306..383abf8f 100644
--- a/cre/go/sdk/sdk.pb.go
+++ b/cre/go/sdk/sdk.pb.go
@@ -128,6 +128,52 @@ func (Mode) EnumDescriptor() ([]byte, []int) {
 	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{1}
 }
 
+type TeeType int32
+
+const (
+	TeeType_TEE_TYPE_UNSPECIFIED TeeType = 0
+	TeeType_TEE_TYPE_AWS_NITRO   TeeType = 1
+)
+
+// Enum value maps for TeeType.
+var (
+	TeeType_name = map[int32]string{
+		0: "TEE_TYPE_UNSPECIFIED",
+		1: "TEE_TYPE_AWS_NITRO",
+	}
+	TeeType_value = map[string]int32{
+		"TEE_TYPE_UNSPECIFIED": 0,
+		"TEE_TYPE_AWS_NITRO":   1,
+	}
+)
+
+func (x TeeType) Enum() *TeeType {
+	p := new(TeeType)
+	*p = x
+	return p
+}
+
+func (x TeeType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (TeeType) Descriptor() protoreflect.EnumDescriptor {
+	return file_sdk_v1alpha_sdk_proto_enumTypes[2].Descriptor()
+}
+
+func (TeeType) Type() protoreflect.EnumType {
+	return &file_sdk_v1alpha_sdk_proto_enumTypes[2]
+}
+
+func (x TeeType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use TeeType.Descriptor instead.
+func (TeeType) EnumDescriptor() ([]byte, []int) {
+	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{2}
+}
+
 type SimpleConsensusInputs struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// Types that are valid to be assigned to Observation:
@@ -703,6 +749,7 @@ type TriggerSubscription struct {
 	Id            string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
 	Payload       *anypb.Any             `protobuf:"bytes,2,opt,name=payload,proto3" json:"payload,omitempty"`
 	Method        string                 `protobuf:"bytes,3,opt,name=method,proto3" json:"method,omitempty"`
+	Requirements  *Requirements          `protobuf:"bytes,4,opt,name=requirements,proto3" json:"requirements,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -758,6 +805,65 @@ func (x *TriggerSubscription) GetMethod() string {
 	return ""
 }
 
+func (x *TriggerSubscription) GetRequirements() *Requirements {
+	if x != nil {
+		return x.Requirements
+	}
+	return nil
+}
+
+type TeeTypeAndRegions struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Type          TeeType                `protobuf:"varint,1,opt,name=type,proto3,enum=sdk.v1alpha.TeeType" json:"type,omitempty"`
+	Regions       []string               `protobuf:"bytes,3,rep,name=regions,proto3" json:"regions,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *TeeTypeAndRegions) Reset() {
+	*x = TeeTypeAndRegions{}
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TeeTypeAndRegions) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TeeTypeAndRegions) ProtoMessage() {}
+
+func (x *TeeTypeAndRegions) ProtoReflect() protoreflect.Message {
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[9]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TeeTypeAndRegions.ProtoReflect.Descriptor instead.
+func (*TeeTypeAndRegions) Descriptor() ([]byte, []int) {
+	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *TeeTypeAndRegions) GetType() TeeType {
+	if x != nil {
+		return x.Type
+	}
+	return TeeType_TEE_TYPE_UNSPECIFIED
+}
+
+func (x *TeeTypeAndRegions) GetRegions() []string {
+	if x != nil {
+		return x.Regions
+	}
+	return nil
+}
+
 type TriggerSubscriptionRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Subscriptions []*TriggerSubscription `protobuf:"bytes,1,rep,name=subscriptions,proto3" json:"subscriptions,omitempty"`
@@ -767,7 +873,7 @@ type TriggerSubscriptionRequest struct {
 
 func (x *TriggerSubscriptionRequest) Reset() {
 	*x = TriggerSubscriptionRequest{}
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[9]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[10]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -779,7 +885,7 @@ func (x *TriggerSubscriptionRequest) String() string {
 func (*TriggerSubscriptionRequest) ProtoMessage() {}
 
 func (x *TriggerSubscriptionRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[9]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[10]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -792,7 +898,7 @@ func (x *TriggerSubscriptionRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TriggerSubscriptionRequest.ProtoReflect.Descriptor instead.
 func (*TriggerSubscriptionRequest) Descriptor() ([]byte, []int) {
-	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{9}
+	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *TriggerSubscriptionRequest) GetSubscriptions() []*TriggerSubscription {
@@ -812,7 +918,7 @@ type Trigger struct {
 
 func (x *Trigger) Reset() {
 	*x = Trigger{}
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[10]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[11]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -824,7 +930,7 @@ func (x *Trigger) String() string {
 func (*Trigger) ProtoMessage() {}
 
 func (x *Trigger) ProtoReflect() protoreflect.Message {
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[10]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[11]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -837,7 +943,7 @@ func (x *Trigger) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Trigger.ProtoReflect.Descriptor instead.
 func (*Trigger) Descriptor() ([]byte, []int) {
-	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{10}
+	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *Trigger) GetId() uint64 {
@@ -854,6 +960,220 @@ func (x *Trigger) GetPayload() *anypb.Any {
 	return nil
 }
 
+type Regions struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Regions       []string               `protobuf:"bytes,1,rep,name=regions,proto3" json:"regions,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Regions) Reset() {
+	*x = Regions{}
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[12]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Regions) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Regions) ProtoMessage() {}
+
+func (x *Regions) ProtoReflect() protoreflect.Message {
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[12]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Regions.ProtoReflect.Descriptor instead.
+func (*Regions) Descriptor() ([]byte, []int) {
+	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *Regions) GetRegions() []string {
+	if x != nil {
+		return x.Regions
+	}
+	return nil
+}
+
+type TeeTypesAndRegions struct {
+	state             protoimpl.MessageState `protogen:"open.v1"`
+	TeeTypeAndRegions []*TeeTypeAndRegions   `protobuf:"bytes,1,rep,name=tee_type_and_regions,json=teeTypeAndRegions,proto3" json:"tee_type_and_regions,omitempty"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
+}
+
+func (x *TeeTypesAndRegions) Reset() {
+	*x = TeeTypesAndRegions{}
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[13]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *TeeTypesAndRegions) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TeeTypesAndRegions) ProtoMessage() {}
+
+func (x *TeeTypesAndRegions) ProtoReflect() protoreflect.Message {
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[13]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TeeTypesAndRegions.ProtoReflect.Descriptor instead.
+func (*TeeTypesAndRegions) Descriptor() ([]byte, []int) {
+	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{13}
+}
+
+func (x *TeeTypesAndRegions) GetTeeTypeAndRegions() []*TeeTypeAndRegions {
+	if x != nil {
+		return x.TeeTypeAndRegions
+	}
+	return nil
+}
+
+type Tee struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Types that are valid to be assigned to Item:
+	//
+	//	*Tee_AnyRegions
+	//	*Tee_TeeTypesAndRegions
+	Item          isTee_Item `protobuf_oneof:"item"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Tee) Reset() {
+	*x = Tee{}
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[14]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Tee) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Tee) ProtoMessage() {}
+
+func (x *Tee) ProtoReflect() protoreflect.Message {
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[14]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Tee.ProtoReflect.Descriptor instead.
+func (*Tee) Descriptor() ([]byte, []int) {
+	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{14}
+}
+
+func (x *Tee) GetItem() isTee_Item {
+	if x != nil {
+		return x.Item
+	}
+	return nil
+}
+
+func (x *Tee) GetAnyRegions() *Regions {
+	if x != nil {
+		if x, ok := x.Item.(*Tee_AnyRegions); ok {
+			return x.AnyRegions
+		}
+	}
+	return nil
+}
+
+func (x *Tee) GetTeeTypesAndRegions() *TeeTypesAndRegions {
+	if x != nil {
+		if x, ok := x.Item.(*Tee_TeeTypesAndRegions); ok {
+			return x.TeeTypesAndRegions
+		}
+	}
+	return nil
+}
+
+type isTee_Item interface {
+	isTee_Item()
+}
+
+type Tee_AnyRegions struct {
+	AnyRegions *Regions `protobuf:"bytes,1,opt,name=any_regions,json=anyRegions,proto3,oneof"`
+}
+
+type Tee_TeeTypesAndRegions struct {
+	TeeTypesAndRegions *TeeTypesAndRegions `protobuf:"bytes,2,opt,name=tee_types_and_regions,json=teeTypesAndRegions,proto3,oneof"`
+}
+
+func (*Tee_AnyRegions) isTee_Item() {}
+
+func (*Tee_TeeTypesAndRegions) isTee_Item() {}
+
+type Requirements struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Tee           *Tee                   `protobuf:"bytes,1,opt,name=tee,proto3" json:"tee,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Requirements) Reset() {
+	*x = Requirements{}
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[15]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Requirements) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Requirements) ProtoMessage() {}
+
+func (x *Requirements) ProtoReflect() protoreflect.Message {
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[15]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Requirements.ProtoReflect.Descriptor instead.
+func (*Requirements) Descriptor() ([]byte, []int) {
+	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{15}
+}
+
+func (x *Requirements) GetTee() *Tee {
+	if x != nil {
+		return x.Tee
+	}
+	return nil
+}
+
 type AwaitCapabilitiesRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Ids           []int32                `protobuf:"varint,1,rep,packed,name=ids,proto3" json:"ids,omitempty"`
@@ -863,7 +1183,7 @@ type AwaitCapabilitiesRequest struct {
 
 func (x *AwaitCapabilitiesRequest) Reset() {
 	*x = AwaitCapabilitiesRequest{}
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[11]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[16]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -875,7 +1195,7 @@ func (x *AwaitCapabilitiesRequest) String() string {
 func (*AwaitCapabilitiesRequest) ProtoMessage() {}
 
 func (x *AwaitCapabilitiesRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[11]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[16]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -888,7 +1208,7 @@ func (x *AwaitCapabilitiesRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AwaitCapabilitiesRequest.ProtoReflect.Descriptor instead.
 func (*AwaitCapabilitiesRequest) Descriptor() ([]byte, []int) {
-	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{11}
+	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *AwaitCapabilitiesRequest) GetIds() []int32 {
@@ -907,7 +1227,7 @@ type AwaitCapabilitiesResponse struct {
 
 func (x *AwaitCapabilitiesResponse) Reset() {
 	*x = AwaitCapabilitiesResponse{}
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[12]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[17]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -919,7 +1239,7 @@ func (x *AwaitCapabilitiesResponse) String() string {
 func (*AwaitCapabilitiesResponse) ProtoMessage() {}
 
 func (x *AwaitCapabilitiesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[12]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[17]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -932,7 +1252,7 @@ func (x *AwaitCapabilitiesResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AwaitCapabilitiesResponse.ProtoReflect.Descriptor instead.
 func (*AwaitCapabilitiesResponse) Descriptor() ([]byte, []int) {
-	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{12}
+	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{17}
 }
 
 func (x *AwaitCapabilitiesResponse) GetResponses() map[int32]*CapabilityResponse {
@@ -957,7 +1277,7 @@ type ExecuteRequest struct {
 
 func (x *ExecuteRequest) Reset() {
 	*x = ExecuteRequest{}
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[13]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[18]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -969,7 +1289,7 @@ func (x *ExecuteRequest) String() string {
 func (*ExecuteRequest) ProtoMessage() {}
 
 func (x *ExecuteRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[13]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[18]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -982,7 +1302,7 @@ func (x *ExecuteRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ExecuteRequest.ProtoReflect.Descriptor instead.
 func (*ExecuteRequest) Descriptor() ([]byte, []int) {
-	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{13}
+	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{18}
 }
 
 func (x *ExecuteRequest) GetConfig() []byte {
@@ -1054,7 +1374,7 @@ type ExecutionResult struct {
 
 func (x *ExecutionResult) Reset() {
 	*x = ExecutionResult{}
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[14]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1066,7 +1386,7 @@ func (x *ExecutionResult) String() string {
 func (*ExecutionResult) ProtoMessage() {}
 
 func (x *ExecutionResult) ProtoReflect() protoreflect.Message {
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[14]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1079,7 +1399,7 @@ func (x *ExecutionResult) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ExecutionResult.ProtoReflect.Descriptor instead.
 func (*ExecutionResult) Descriptor() ([]byte, []int) {
-	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{14}
+	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{19}
 }
 
 func (x *ExecutionResult) GetResult() isExecutionResult_Result {
@@ -1148,7 +1468,7 @@ type GetSecretsRequest struct {
 
 func (x *GetSecretsRequest) Reset() {
 	*x = GetSecretsRequest{}
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[15]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1160,7 +1480,7 @@ func (x *GetSecretsRequest) String() string {
 func (*GetSecretsRequest) ProtoMessage() {}
 
 func (x *GetSecretsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[15]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1173,7 +1493,7 @@ func (x *GetSecretsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetSecretsRequest.ProtoReflect.Descriptor instead.
 func (*GetSecretsRequest) Descriptor() ([]byte, []int) {
-	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{15}
+	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{20}
 }
 
 func (x *GetSecretsRequest) GetRequests() []*SecretRequest {
@@ -1199,7 +1519,7 @@ type AwaitSecretsRequest struct {
 
 func (x *AwaitSecretsRequest) Reset() {
 	*x = AwaitSecretsRequest{}
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[16]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[21]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1211,7 +1531,7 @@ func (x *AwaitSecretsRequest) String() string {
 func (*AwaitSecretsRequest) ProtoMessage() {}
 
 func (x *AwaitSecretsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[16]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[21]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1224,7 +1544,7 @@ func (x *AwaitSecretsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AwaitSecretsRequest.ProtoReflect.Descriptor instead.
 func (*AwaitSecretsRequest) Descriptor() ([]byte, []int) {
-	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{16}
+	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{21}
 }
 
 func (x *AwaitSecretsRequest) GetIds() []int32 {
@@ -1243,7 +1563,7 @@ type AwaitSecretsResponse struct {
 
 func (x *AwaitSecretsResponse) Reset() {
 	*x = AwaitSecretsResponse{}
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[17]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[22]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1255,7 +1575,7 @@ func (x *AwaitSecretsResponse) String() string {
 func (*AwaitSecretsResponse) ProtoMessage() {}
 
 func (x *AwaitSecretsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[17]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[22]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1268,7 +1588,7 @@ func (x *AwaitSecretsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AwaitSecretsResponse.ProtoReflect.Descriptor instead.
 func (*AwaitSecretsResponse) Descriptor() ([]byte, []int) {
-	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{17}
+	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{22}
 }
 
 func (x *AwaitSecretsResponse) GetResponses() map[int32]*SecretResponses {
@@ -1288,7 +1608,7 @@ type SecretRequest struct {
 
 func (x *SecretRequest) Reset() {
 	*x = SecretRequest{}
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[18]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[23]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1300,7 +1620,7 @@ func (x *SecretRequest) String() string {
 func (*SecretRequest) ProtoMessage() {}
 
 func (x *SecretRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[18]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[23]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1313,7 +1633,7 @@ func (x *SecretRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SecretRequest.ProtoReflect.Descriptor instead.
 func (*SecretRequest) Descriptor() ([]byte, []int) {
-	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{18}
+	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{23}
 }
 
 func (x *SecretRequest) GetId() string {
@@ -1342,7 +1662,7 @@ type Secret struct {
 
 func (x *Secret) Reset() {
 	*x = Secret{}
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[19]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[24]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1354,7 +1674,7 @@ func (x *Secret) String() string {
 func (*Secret) ProtoMessage() {}
 
 func (x *Secret) ProtoReflect() protoreflect.Message {
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[19]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[24]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1367,7 +1687,7 @@ func (x *Secret) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Secret.ProtoReflect.Descriptor instead.
 func (*Secret) Descriptor() ([]byte, []int) {
-	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{19}
+	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{24}
 }
 
 func (x *Secret) GetId() string {
@@ -1410,7 +1730,7 @@ type SecretError struct {
 
 func (x *SecretError) Reset() {
 	*x = SecretError{}
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[20]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[25]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1422,7 +1742,7 @@ func (x *SecretError) String() string {
 func (*SecretError) ProtoMessage() {}
 
 func (x *SecretError) ProtoReflect() protoreflect.Message {
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[20]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[25]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1435,7 +1755,7 @@ func (x *SecretError) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SecretError.ProtoReflect.Descriptor instead.
 func (*SecretError) Descriptor() ([]byte, []int) {
-	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{20}
+	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{25}
 }
 
 func (x *SecretError) GetId() string {
@@ -1479,7 +1799,7 @@ type SecretResponse struct {
 
 func (x *SecretResponse) Reset() {
 	*x = SecretResponse{}
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[21]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[26]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1491,7 +1811,7 @@ func (x *SecretResponse) String() string {
 func (*SecretResponse) ProtoMessage() {}
 
 func (x *SecretResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[21]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[26]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1504,7 +1824,7 @@ func (x *SecretResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SecretResponse.ProtoReflect.Descriptor instead.
 func (*SecretResponse) Descriptor() ([]byte, []int) {
-	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{21}
+	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{26}
 }
 
 func (x *SecretResponse) GetResponse() isSecretResponse_Response {
@@ -1557,7 +1877,7 @@ type SecretResponses struct {
 
 func (x *SecretResponses) Reset() {
 	*x = SecretResponses{}
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[22]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[27]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1569,7 +1889,7 @@ func (x *SecretResponses) String() string {
 func (*SecretResponses) ProtoMessage() {}
 
 func (x *SecretResponses) ProtoReflect() protoreflect.Message {
-	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[22]
+	mi := &file_sdk_v1alpha_sdk_proto_msgTypes[27]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1582,7 +1902,7 @@ func (x *SecretResponses) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SecretResponses.ProtoReflect.Descriptor instead.
 func (*SecretResponses) Descriptor() ([]byte, []int) {
-	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{22}
+	return file_sdk_v1alpha_sdk_proto_rawDescGZIP(), []int{27}
 }
 
 func (x *SecretResponses) GetResponses() []*SecretResponse {
@@ -1639,16 +1959,31 @@ const file_sdk_v1alpha_sdk_proto_rawDesc = "" +
 	"\apayload\x18\x01 \x01(\v2\x14.google.protobuf.AnyH\x00R\apayload\x12\x16\n" +
 	"\x05error\x18\x02 \x01(\tH\x00R\x05errorB\n" +
 	"\n" +
-	"\bresponse\"m\n" +
+	"\bresponse\"\xac\x01\n" +
 	"\x13TriggerSubscription\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x12.\n" +
 	"\apayload\x18\x02 \x01(\v2\x14.google.protobuf.AnyR\apayload\x12\x16\n" +
-	"\x06method\x18\x03 \x01(\tR\x06method\"d\n" +
+	"\x06method\x18\x03 \x01(\tR\x06method\x12=\n" +
+	"\frequirements\x18\x04 \x01(\v2\x19.sdk.v1alpha.RequirementsR\frequirements\"W\n" +
+	"\x11TeeTypeAndRegions\x12(\n" +
+	"\x04type\x18\x01 \x01(\x0e2\x14.sdk.v1alpha.TeeTypeR\x04type\x12\x18\n" +
+	"\aregions\x18\x03 \x03(\tR\aregions\"d\n" +
 	"\x1aTriggerSubscriptionRequest\x12F\n" +
 	"\rsubscriptions\x18\x01 \x03(\v2 .sdk.v1alpha.TriggerSubscriptionR\rsubscriptions\"I\n" +
 	"\aTrigger\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\x04R\x02id\x12.\n" +
-	"\apayload\x18\x02 \x01(\v2\x14.google.protobuf.AnyR\apayload\",\n" +
+	"\apayload\x18\x02 \x01(\v2\x14.google.protobuf.AnyR\apayload\"#\n" +
+	"\aRegions\x12\x18\n" +
+	"\aregions\x18\x01 \x03(\tR\aregions\"e\n" +
+	"\x12TeeTypesAndRegions\x12O\n" +
+	"\x14tee_type_and_regions\x18\x01 \x03(\v2\x1e.sdk.v1alpha.TeeTypeAndRegionsR\x11teeTypeAndRegions\"\x9c\x01\n" +
+	"\x03Tee\x127\n" +
+	"\vany_regions\x18\x01 \x01(\v2\x14.sdk.v1alpha.RegionsH\x00R\n" +
+	"anyRegions\x12T\n" +
+	"\x15tee_types_and_regions\x18\x02 \x01(\v2\x1f.sdk.v1alpha.TeeTypesAndRegionsH\x00R\x12teeTypesAndRegionsB\x06\n" +
+	"\x04item\"2\n" +
+	"\fRequirements\x12\"\n" +
+	"\x03tee\x18\x01 \x01(\v2\x10.sdk.v1alpha.TeeR\x03tee\",\n" +
 	"\x18AwaitCapabilitiesRequest\x12\x10\n" +
 	"\x03ids\x18\x01 \x03(\x05R\x03ids\"\xcf\x01\n" +
 	"\x19AwaitCapabilitiesResponse\x12S\n" +
@@ -1707,7 +2042,10 @@ const file_sdk_v1alpha_sdk_proto_rawDesc = "" +
 	"\x04Mode\x12\x14\n" +
 	"\x10MODE_UNSPECIFIED\x10\x00\x12\f\n" +
 	"\bMODE_DON\x10\x01\x12\r\n" +
-	"\tMODE_NODE\x10\x02b\x06proto3"
+	"\tMODE_NODE\x10\x02*;\n" +
+	"\aTeeType\x12\x18\n" +
+	"\x14TEE_TYPE_UNSPECIFIED\x10\x00\x12\x16\n" +
+	"\x12TEE_TYPE_AWS_NITRO\x10\x01b\x06proto3"
 
 var (
 	file_sdk_v1alpha_sdk_proto_rawDescOnce sync.Once
@@ -1721,72 +2059,84 @@ func file_sdk_v1alpha_sdk_proto_rawDescGZIP() []byte {
 	return file_sdk_v1alpha_sdk_proto_rawDescData
 }
 
-var file_sdk_v1alpha_sdk_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
-var file_sdk_v1alpha_sdk_proto_msgTypes = make([]protoimpl.MessageInfo, 26)
+var file_sdk_v1alpha_sdk_proto_enumTypes = make([]protoimpl.EnumInfo, 3)
+var file_sdk_v1alpha_sdk_proto_msgTypes = make([]protoimpl.MessageInfo, 31)
 var file_sdk_v1alpha_sdk_proto_goTypes = []any{
 	(AggregationType)(0),               // 0: sdk.v1alpha.AggregationType
 	(Mode)(0),                          // 1: sdk.v1alpha.Mode
-	(*SimpleConsensusInputs)(nil),      // 2: sdk.v1alpha.SimpleConsensusInputs
-	(*FieldsMap)(nil),                  // 3: sdk.v1alpha.FieldsMap
-	(*ConsensusDescriptor)(nil),        // 4: sdk.v1alpha.ConsensusDescriptor
-	(*ReportRequest)(nil),              // 5: sdk.v1alpha.ReportRequest
-	(*ReportResponse)(nil),             // 6: sdk.v1alpha.ReportResponse
-	(*AttributedSignature)(nil),        // 7: sdk.v1alpha.AttributedSignature
-	(*CapabilityRequest)(nil),          // 8: sdk.v1alpha.CapabilityRequest
-	(*CapabilityResponse)(nil),         // 9: sdk.v1alpha.CapabilityResponse
-	(*TriggerSubscription)(nil),        // 10: sdk.v1alpha.TriggerSubscription
-	(*TriggerSubscriptionRequest)(nil), // 11: sdk.v1alpha.TriggerSubscriptionRequest
-	(*Trigger)(nil),                    // 12: sdk.v1alpha.Trigger
-	(*AwaitCapabilitiesRequest)(nil),   // 13: sdk.v1alpha.AwaitCapabilitiesRequest
-	(*AwaitCapabilitiesResponse)(nil),  // 14: sdk.v1alpha.AwaitCapabilitiesResponse
-	(*ExecuteRequest)(nil),             // 15: sdk.v1alpha.ExecuteRequest
-	(*ExecutionResult)(nil),            // 16: sdk.v1alpha.ExecutionResult
-	(*GetSecretsRequest)(nil),          // 17: sdk.v1alpha.GetSecretsRequest
-	(*AwaitSecretsRequest)(nil),        // 18: sdk.v1alpha.AwaitSecretsRequest
-	(*AwaitSecretsResponse)(nil),       // 19: sdk.v1alpha.AwaitSecretsResponse
-	(*SecretRequest)(nil),              // 20: sdk.v1alpha.SecretRequest
-	(*Secret)(nil),                     // 21: sdk.v1alpha.Secret
-	(*SecretError)(nil),                // 22: sdk.v1alpha.SecretError
-	(*SecretResponse)(nil),             // 23: sdk.v1alpha.SecretResponse
-	(*SecretResponses)(nil),            // 24: sdk.v1alpha.SecretResponses
-	nil,                                // 25: sdk.v1alpha.FieldsMap.FieldsEntry
-	nil,                                // 26: sdk.v1alpha.AwaitCapabilitiesResponse.ResponsesEntry
-	nil,                                // 27: sdk.v1alpha.AwaitSecretsResponse.ResponsesEntry
-	(*pb.Value)(nil),                   // 28: values.v1.Value
-	(*anypb.Any)(nil),                  // 29: google.protobuf.Any
-	(*emptypb.Empty)(nil),              // 30: google.protobuf.Empty
+	(TeeType)(0),                       // 2: sdk.v1alpha.TeeType
+	(*SimpleConsensusInputs)(nil),      // 3: sdk.v1alpha.SimpleConsensusInputs
+	(*FieldsMap)(nil),                  // 4: sdk.v1alpha.FieldsMap
+	(*ConsensusDescriptor)(nil),        // 5: sdk.v1alpha.ConsensusDescriptor
+	(*ReportRequest)(nil),              // 6: sdk.v1alpha.ReportRequest
+	(*ReportResponse)(nil),             // 7: sdk.v1alpha.ReportResponse
+	(*AttributedSignature)(nil),        // 8: sdk.v1alpha.AttributedSignature
+	(*CapabilityRequest)(nil),          // 9: sdk.v1alpha.CapabilityRequest
+	(*CapabilityResponse)(nil),         // 10: sdk.v1alpha.CapabilityResponse
+	(*TriggerSubscription)(nil),        // 11: sdk.v1alpha.TriggerSubscription
+	(*TeeTypeAndRegions)(nil),          // 12: sdk.v1alpha.TeeTypeAndRegions
+	(*TriggerSubscriptionRequest)(nil), // 13: sdk.v1alpha.TriggerSubscriptionRequest
+	(*Trigger)(nil),                    // 14: sdk.v1alpha.Trigger
+	(*Regions)(nil),                    // 15: sdk.v1alpha.Regions
+	(*TeeTypesAndRegions)(nil),         // 16: sdk.v1alpha.TeeTypesAndRegions
+	(*Tee)(nil),                        // 17: sdk.v1alpha.Tee
+	(*Requirements)(nil),               // 18: sdk.v1alpha.Requirements
+	(*AwaitCapabilitiesRequest)(nil),   // 19: sdk.v1alpha.AwaitCapabilitiesRequest
+	(*AwaitCapabilitiesResponse)(nil),  // 20: sdk.v1alpha.AwaitCapabilitiesResponse
+	(*ExecuteRequest)(nil),             // 21: sdk.v1alpha.ExecuteRequest
+	(*ExecutionResult)(nil),            // 22: sdk.v1alpha.ExecutionResult
+	(*GetSecretsRequest)(nil),          // 23: sdk.v1alpha.GetSecretsRequest
+	(*AwaitSecretsRequest)(nil),        // 24: sdk.v1alpha.AwaitSecretsRequest
+	(*AwaitSecretsResponse)(nil),       // 25: sdk.v1alpha.AwaitSecretsResponse
+	(*SecretRequest)(nil),              // 26: sdk.v1alpha.SecretRequest
+	(*Secret)(nil),                     // 27: sdk.v1alpha.Secret
+	(*SecretError)(nil),                // 28: sdk.v1alpha.SecretError
+	(*SecretResponse)(nil),             // 29: sdk.v1alpha.SecretResponse
+	(*SecretResponses)(nil),            // 30: sdk.v1alpha.SecretResponses
+	nil,                                // 31: sdk.v1alpha.FieldsMap.FieldsEntry
+	nil,                                // 32: sdk.v1alpha.AwaitCapabilitiesResponse.ResponsesEntry
+	nil,                                // 33: sdk.v1alpha.AwaitSecretsResponse.ResponsesEntry
+	(*pb.Value)(nil),                   // 34: values.v1.Value
+	(*anypb.Any)(nil),                  // 35: google.protobuf.Any
+	(*emptypb.Empty)(nil),              // 36: google.protobuf.Empty
 }
 var file_sdk_v1alpha_sdk_proto_depIdxs = []int32{
-	28, // 0: sdk.v1alpha.SimpleConsensusInputs.value:type_name -> values.v1.Value
-	4,  // 1: sdk.v1alpha.SimpleConsensusInputs.descriptors:type_name -> sdk.v1alpha.ConsensusDescriptor
-	28, // 2: sdk.v1alpha.SimpleConsensusInputs.default:type_name -> values.v1.Value
-	25, // 3: sdk.v1alpha.FieldsMap.fields:type_name -> sdk.v1alpha.FieldsMap.FieldsEntry
+	34, // 0: sdk.v1alpha.SimpleConsensusInputs.value:type_name -> values.v1.Value
+	5,  // 1: sdk.v1alpha.SimpleConsensusInputs.descriptors:type_name -> sdk.v1alpha.ConsensusDescriptor
+	34, // 2: sdk.v1alpha.SimpleConsensusInputs.default:type_name -> values.v1.Value
+	31, // 3: sdk.v1alpha.FieldsMap.fields:type_name -> sdk.v1alpha.FieldsMap.FieldsEntry
 	0,  // 4: sdk.v1alpha.ConsensusDescriptor.aggregation:type_name -> sdk.v1alpha.AggregationType
-	3,  // 5: sdk.v1alpha.ConsensusDescriptor.fields_map:type_name -> sdk.v1alpha.FieldsMap
-	7,  // 6: sdk.v1alpha.ReportResponse.sigs:type_name -> sdk.v1alpha.AttributedSignature
-	29, // 7: sdk.v1alpha.CapabilityRequest.payload:type_name -> google.protobuf.Any
-	29, // 8: sdk.v1alpha.CapabilityResponse.payload:type_name -> google.protobuf.Any
-	29, // 9: sdk.v1alpha.TriggerSubscription.payload:type_name -> google.protobuf.Any
-	10, // 10: sdk.v1alpha.TriggerSubscriptionRequest.subscriptions:type_name -> sdk.v1alpha.TriggerSubscription
-	29, // 11: sdk.v1alpha.Trigger.payload:type_name -> google.protobuf.Any
-	26, // 12: sdk.v1alpha.AwaitCapabilitiesResponse.responses:type_name -> sdk.v1alpha.AwaitCapabilitiesResponse.ResponsesEntry
-	30, // 13: sdk.v1alpha.ExecuteRequest.subscribe:type_name -> google.protobuf.Empty
-	12, // 14: sdk.v1alpha.ExecuteRequest.trigger:type_name -> sdk.v1alpha.Trigger
-	28, // 15: sdk.v1alpha.ExecutionResult.value:type_name -> values.v1.Value
-	11, // 16: sdk.v1alpha.ExecutionResult.trigger_subscriptions:type_name -> sdk.v1alpha.TriggerSubscriptionRequest
-	20, // 17: sdk.v1alpha.GetSecretsRequest.requests:type_name -> sdk.v1alpha.SecretRequest
-	27, // 18: sdk.v1alpha.AwaitSecretsResponse.responses:type_name -> sdk.v1alpha.AwaitSecretsResponse.ResponsesEntry
-	21, // 19: sdk.v1alpha.SecretResponse.secret:type_name -> sdk.v1alpha.Secret
-	22, // 20: sdk.v1alpha.SecretResponse.error:type_name -> sdk.v1alpha.SecretError
-	23, // 21: sdk.v1alpha.SecretResponses.responses:type_name -> sdk.v1alpha.SecretResponse
-	4,  // 22: sdk.v1alpha.FieldsMap.FieldsEntry.value:type_name -> sdk.v1alpha.ConsensusDescriptor
-	9,  // 23: sdk.v1alpha.AwaitCapabilitiesResponse.ResponsesEntry.value:type_name -> sdk.v1alpha.CapabilityResponse
-	24, // 24: sdk.v1alpha.AwaitSecretsResponse.ResponsesEntry.value:type_name -> sdk.v1alpha.SecretResponses
-	25, // [25:25] is the sub-list for method output_type
-	25, // [25:25] is the sub-list for method input_type
-	25, // [25:25] is the sub-list for extension type_name
-	25, // [25:25] is the sub-list for extension extendee
-	0,  // [0:25] is the sub-list for field type_name
+	4,  // 5: sdk.v1alpha.ConsensusDescriptor.fields_map:type_name -> sdk.v1alpha.FieldsMap
+	8,  // 6: sdk.v1alpha.ReportResponse.sigs:type_name -> sdk.v1alpha.AttributedSignature
+	35, // 7: sdk.v1alpha.CapabilityRequest.payload:type_name -> google.protobuf.Any
+	35, // 8: sdk.v1alpha.CapabilityResponse.payload:type_name -> google.protobuf.Any
+	35, // 9: sdk.v1alpha.TriggerSubscription.payload:type_name -> google.protobuf.Any
+	18, // 10: sdk.v1alpha.TriggerSubscription.requirements:type_name -> sdk.v1alpha.Requirements
+	2,  // 11: sdk.v1alpha.TeeTypeAndRegions.type:type_name -> sdk.v1alpha.TeeType
+	11, // 12: sdk.v1alpha.TriggerSubscriptionRequest.subscriptions:type_name -> sdk.v1alpha.TriggerSubscription
+	35, // 13: sdk.v1alpha.Trigger.payload:type_name -> google.protobuf.Any
+	12, // 14: sdk.v1alpha.TeeTypesAndRegions.tee_type_and_regions:type_name -> sdk.v1alpha.TeeTypeAndRegions
+	15, // 15: sdk.v1alpha.Tee.any_regions:type_name -> sdk.v1alpha.Regions
+	16, // 16: sdk.v1alpha.Tee.tee_types_and_regions:type_name -> sdk.v1alpha.TeeTypesAndRegions
+	17, // 17: sdk.v1alpha.Requirements.tee:type_name -> sdk.v1alpha.Tee
+	32, // 18: sdk.v1alpha.AwaitCapabilitiesResponse.responses:type_name -> sdk.v1alpha.AwaitCapabilitiesResponse.ResponsesEntry
+	36, // 19: sdk.v1alpha.ExecuteRequest.subscribe:type_name -> google.protobuf.Empty
+	14, // 20: sdk.v1alpha.ExecuteRequest.trigger:type_name -> sdk.v1alpha.Trigger
+	34, // 21: sdk.v1alpha.ExecutionResult.value:type_name -> values.v1.Value
+	13, // 22: sdk.v1alpha.ExecutionResult.trigger_subscriptions:type_name -> sdk.v1alpha.TriggerSubscriptionRequest
+	26, // 23: sdk.v1alpha.GetSecretsRequest.requests:type_name -> sdk.v1alpha.SecretRequest
+	33, // 24: sdk.v1alpha.AwaitSecretsResponse.responses:type_name -> sdk.v1alpha.AwaitSecretsResponse.ResponsesEntry
+	27, // 25: sdk.v1alpha.SecretResponse.secret:type_name -> sdk.v1alpha.Secret
+	28, // 26: sdk.v1alpha.SecretResponse.error:type_name -> sdk.v1alpha.SecretError
+	29, // 27: sdk.v1alpha.SecretResponses.responses:type_name -> sdk.v1alpha.SecretResponse
+	5,  // 28: sdk.v1alpha.FieldsMap.FieldsEntry.value:type_name -> sdk.v1alpha.ConsensusDescriptor
+	10, // 29: sdk.v1alpha.AwaitCapabilitiesResponse.ResponsesEntry.value:type_name -> sdk.v1alpha.CapabilityResponse
+	30, // 30: sdk.v1alpha.AwaitSecretsResponse.ResponsesEntry.value:type_name -> sdk.v1alpha.SecretResponses
+	31, // [31:31] is the sub-list for method output_type
+	31, // [31:31] is the sub-list for method input_type
+	31, // [31:31] is the sub-list for extension type_name
+	31, // [31:31] is the sub-list for extension extendee
+	0,  // [0:31] is the sub-list for field type_name
 }
 
 func init() { file_sdk_v1alpha_sdk_proto_init() }
@@ -1806,16 +2156,20 @@ func file_sdk_v1alpha_sdk_proto_init() {
 		(*CapabilityResponse_Payload)(nil),
 		(*CapabilityResponse_Error)(nil),
 	}
-	file_sdk_v1alpha_sdk_proto_msgTypes[13].OneofWrappers = []any{
+	file_sdk_v1alpha_sdk_proto_msgTypes[14].OneofWrappers = []any{
+		(*Tee_AnyRegions)(nil),
+		(*Tee_TeeTypesAndRegions)(nil),
+	}
+	file_sdk_v1alpha_sdk_proto_msgTypes[18].OneofWrappers = []any{
 		(*ExecuteRequest_Subscribe)(nil),
 		(*ExecuteRequest_Trigger)(nil),
 	}
-	file_sdk_v1alpha_sdk_proto_msgTypes[14].OneofWrappers = []any{
+	file_sdk_v1alpha_sdk_proto_msgTypes[19].OneofWrappers = []any{
 		(*ExecutionResult_Value)(nil),
 		(*ExecutionResult_Error)(nil),
 		(*ExecutionResult_TriggerSubscriptions)(nil),
 	}
-	file_sdk_v1alpha_sdk_proto_msgTypes[21].OneofWrappers = []any{
+	file_sdk_v1alpha_sdk_proto_msgTypes[26].OneofWrappers = []any{
 		(*SecretResponse_Secret)(nil),
 		(*SecretResponse_Error)(nil),
 	}
@@ -1824,8 +2178,8 @@ func file_sdk_v1alpha_sdk_proto_init() {
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_sdk_v1alpha_sdk_proto_rawDesc), len(file_sdk_v1alpha_sdk_proto_rawDesc)),
-			NumEnums:      2,
-			NumMessages:   26,
+			NumEnums:      3,
+			NumMessages:   31,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/cre/go/tools/generator/cre_metadata.pb.go b/cre/go/tools/generator/cre_metadata.pb.go
index 7026ea3f..d8c0a476 100644
--- a/cre/go/tools/generator/cre_metadata.pb.go
+++ b/cre/go/tools/generator/cre_metadata.pb.go
@@ -23,6 +23,52 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
+type AdditionalEnironments int32
+
+const (
+	AdditionalEnironments_ADDITIONAL_ENVIRONMENTS_UNSPECIFIED AdditionalEnironments = 0
+	AdditionalEnironments_ADDITIONAL_ENVIRONMENTS_TEE         AdditionalEnironments = 1
+)
+
+// Enum value maps for AdditionalEnironments.
+var (
+	AdditionalEnironments_name = map[int32]string{
+		0: "ADDITIONAL_ENVIRONMENTS_UNSPECIFIED",
+		1: "ADDITIONAL_ENVIRONMENTS_TEE",
+	}
+	AdditionalEnironments_value = map[string]int32{
+		"ADDITIONAL_ENVIRONMENTS_UNSPECIFIED": 0,
+		"ADDITIONAL_ENVIRONMENTS_TEE":         1,
+	}
+)
+
+func (x AdditionalEnironments) Enum() *AdditionalEnironments {
+	p := new(AdditionalEnironments)
+	*p = x
+	return p
+}
+
+func (x AdditionalEnironments) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (AdditionalEnironments) Descriptor() protoreflect.EnumDescriptor {
+	return file_tools_generator_v1alpha_cre_metadata_proto_enumTypes[0].Descriptor()
+}
+
+func (AdditionalEnironments) Type() protoreflect.EnumType {
+	return &file_tools_generator_v1alpha_cre_metadata_proto_enumTypes[0]
+}
+
+func (x AdditionalEnironments) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use AdditionalEnironments.Descriptor instead.
+func (AdditionalEnironments) EnumDescriptor() ([]byte, []int) {
+	return file_tools_generator_v1alpha_cre_metadata_proto_rawDescGZIP(), []int{0}
+}
+
 type StringLabel struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Defaults      map[string]string      `protobuf:"bytes,1,rep,name=defaults,proto3" json:"defaults,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
@@ -374,12 +420,13 @@ func (*Label_Uint32Label) isLabel_Kind() {}
 func (*Label_Int32Label) isLabel_Kind() {}
 
 type CapabilityMetadata struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	Mode          sdk.Mode               `protobuf:"varint,1,opt,name=mode,proto3,enum=sdk.v1alpha.Mode" json:"mode,omitempty"`
-	CapabilityId  string                 `protobuf:"bytes,2,opt,name=capability_id,json=capabilityId,proto3" json:"capability_id,omitempty"`
-	Labels        map[string]*Label      `protobuf:"bytes,3,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+	state                  protoimpl.MessageState  `protogen:"open.v1"`
+	Mode                   sdk.Mode                `protobuf:"varint,1,opt,name=mode,proto3,enum=sdk.v1alpha.Mode" json:"mode,omitempty"`
+	CapabilityId           string                  `protobuf:"bytes,2,opt,name=capability_id,json=capabilityId,proto3" json:"capability_id,omitempty"`
+	Labels                 map[string]*Label       `protobuf:"bytes,3,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	AdditionalEnvironments []AdditionalEnironments `protobuf:"varint,4,rep,packed,name=additional_environments,json=additionalEnvironments,proto3,enum=tools.generator.v1alpha.AdditionalEnironments" json:"additional_environments,omitempty"`
+	unknownFields          protoimpl.UnknownFields
+	sizeCache              protoimpl.SizeCache
 }
 
 func (x *CapabilityMetadata) Reset() {
@@ -433,6 +480,13 @@ func (x *CapabilityMetadata) GetLabels() map[string]*Label {
 	return nil
 }
 
+func (x *CapabilityMetadata) GetAdditionalEnvironments() []AdditionalEnironments {
+	if x != nil {
+		return x.AdditionalEnvironments
+	}
+	return nil
+}
+
 type CapabilityMethodMetadata struct {
 	state           protoimpl.MessageState `protogen:"open.v1"`
 	MapToUntypedApi bool                   `protobuf:"varint,1,opt,name=map_to_untyped_api,json=mapToUntypedApi,proto3" json:"map_to_untyped_api,omitempty"`
@@ -548,16 +602,20 @@ const file_tools_generator_v1alpha_cre_metadata_proto_rawDesc = "" +
 	"\fuint32_label\x18\x04 \x01(\v2$.tools.generator.v1alpha.Uint32LabelH\x00R\vuint32Label\x12F\n" +
 	"\vint32_label\x18\x05 \x01(\v2#.tools.generator.v1alpha.Int32LabelH\x00R\n" +
 	"int32LabelB\x06\n" +
-	"\x04kind\"\x8c\x02\n" +
+	"\x04kind\"\xf5\x02\n" +
 	"\x12CapabilityMetadata\x12%\n" +
 	"\x04mode\x18\x01 \x01(\x0e2\x11.sdk.v1alpha.ModeR\x04mode\x12#\n" +
 	"\rcapability_id\x18\x02 \x01(\tR\fcapabilityId\x12O\n" +
-	"\x06labels\x18\x03 \x03(\v27.tools.generator.v1alpha.CapabilityMetadata.LabelsEntryR\x06labels\x1aY\n" +
+	"\x06labels\x18\x03 \x03(\v27.tools.generator.v1alpha.CapabilityMetadata.LabelsEntryR\x06labels\x12g\n" +
+	"\x17additional_environments\x18\x04 \x03(\x0e2..tools.generator.v1alpha.AdditionalEnironmentsR\x16additionalEnvironments\x1aY\n" +
 	"\vLabelsEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x124\n" +
 	"\x05value\x18\x02 \x01(\v2\x1e.tools.generator.v1alpha.LabelR\x05value:\x028\x01\"G\n" +
 	"\x18CapabilityMethodMetadata\x12+\n" +
-	"\x12map_to_untyped_api\x18\x01 \x01(\bR\x0fmapToUntypedApi:n\n" +
+	"\x12map_to_untyped_api\x18\x01 \x01(\bR\x0fmapToUntypedApi*a\n" +
+	"\x15AdditionalEnironments\x12'\n" +
+	"#ADDITIONAL_ENVIRONMENTS_UNSPECIFIED\x10\x00\x12\x1f\n" +
+	"\x1bADDITIONAL_ENVIRONMENTS_TEE\x10\x01:n\n" +
 	"\n" +
 	"capability\x12\x1f.google.protobuf.ServiceOptions\x18І\x03 \x01(\v2+.tools.generator.v1alpha.CapabilityMetadataR\n" +
 	"capability:k\n" +
@@ -575,49 +633,52 @@ func file_tools_generator_v1alpha_cre_metadata_proto_rawDescGZIP() []byte {
 	return file_tools_generator_v1alpha_cre_metadata_proto_rawDescData
 }
 
+var file_tools_generator_v1alpha_cre_metadata_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
 var file_tools_generator_v1alpha_cre_metadata_proto_msgTypes = make([]protoimpl.MessageInfo, 14)
 var file_tools_generator_v1alpha_cre_metadata_proto_goTypes = []any{
-	(*StringLabel)(nil),                 // 0: tools.generator.v1alpha.StringLabel
-	(*Uint64Label)(nil),                 // 1: tools.generator.v1alpha.Uint64Label
-	(*Uint32Label)(nil),                 // 2: tools.generator.v1alpha.Uint32Label
-	(*Int64Label)(nil),                  // 3: tools.generator.v1alpha.Int64Label
-	(*Int32Label)(nil),                  // 4: tools.generator.v1alpha.Int32Label
-	(*Label)(nil),                       // 5: tools.generator.v1alpha.Label
-	(*CapabilityMetadata)(nil),          // 6: tools.generator.v1alpha.CapabilityMetadata
-	(*CapabilityMethodMetadata)(nil),    // 7: tools.generator.v1alpha.CapabilityMethodMetadata
-	nil,                                 // 8: tools.generator.v1alpha.StringLabel.DefaultsEntry
-	nil,                                 // 9: tools.generator.v1alpha.Uint64Label.DefaultsEntry
-	nil,                                 // 10: tools.generator.v1alpha.Uint32Label.DefaultsEntry
-	nil,                                 // 11: tools.generator.v1alpha.Int64Label.DefaultsEntry
-	nil,                                 // 12: tools.generator.v1alpha.Int32Label.DefaultsEntry
-	nil,                                 // 13: tools.generator.v1alpha.CapabilityMetadata.LabelsEntry
-	(sdk.Mode)(0),                       // 14: sdk.v1alpha.Mode
-	(*descriptorpb.ServiceOptions)(nil), // 15: google.protobuf.ServiceOptions
-	(*descriptorpb.MethodOptions)(nil),  // 16: google.protobuf.MethodOptions
+	(AdditionalEnironments)(0),          // 0: tools.generator.v1alpha.AdditionalEnironments
+	(*StringLabel)(nil),                 // 1: tools.generator.v1alpha.StringLabel
+	(*Uint64Label)(nil),                 // 2: tools.generator.v1alpha.Uint64Label
+	(*Uint32Label)(nil),                 // 3: tools.generator.v1alpha.Uint32Label
+	(*Int64Label)(nil),                  // 4: tools.generator.v1alpha.Int64Label
+	(*Int32Label)(nil),                  // 5: tools.generator.v1alpha.Int32Label
+	(*Label)(nil),                       // 6: tools.generator.v1alpha.Label
+	(*CapabilityMetadata)(nil),          // 7: tools.generator.v1alpha.CapabilityMetadata
+	(*CapabilityMethodMetadata)(nil),    // 8: tools.generator.v1alpha.CapabilityMethodMetadata
+	nil,                                 // 9: tools.generator.v1alpha.StringLabel.DefaultsEntry
+	nil,                                 // 10: tools.generator.v1alpha.Uint64Label.DefaultsEntry
+	nil,                                 // 11: tools.generator.v1alpha.Uint32Label.DefaultsEntry
+	nil,                                 // 12: tools.generator.v1alpha.Int64Label.DefaultsEntry
+	nil,                                 // 13: tools.generator.v1alpha.Int32Label.DefaultsEntry
+	nil,                                 // 14: tools.generator.v1alpha.CapabilityMetadata.LabelsEntry
+	(sdk.Mode)(0),                       // 15: sdk.v1alpha.Mode
+	(*descriptorpb.ServiceOptions)(nil), // 16: google.protobuf.ServiceOptions
+	(*descriptorpb.MethodOptions)(nil),  // 17: google.protobuf.MethodOptions
 }
 var file_tools_generator_v1alpha_cre_metadata_proto_depIdxs = []int32{
-	8,  // 0: tools.generator.v1alpha.StringLabel.defaults:type_name -> tools.generator.v1alpha.StringLabel.DefaultsEntry
-	9,  // 1: tools.generator.v1alpha.Uint64Label.defaults:type_name -> tools.generator.v1alpha.Uint64Label.DefaultsEntry
-	10, // 2: tools.generator.v1alpha.Uint32Label.defaults:type_name -> tools.generator.v1alpha.Uint32Label.DefaultsEntry
-	11, // 3: tools.generator.v1alpha.Int64Label.defaults:type_name -> tools.generator.v1alpha.Int64Label.DefaultsEntry
-	12, // 4: tools.generator.v1alpha.Int32Label.defaults:type_name -> tools.generator.v1alpha.Int32Label.DefaultsEntry
-	0,  // 5: tools.generator.v1alpha.Label.string_label:type_name -> tools.generator.v1alpha.StringLabel
-	1,  // 6: tools.generator.v1alpha.Label.uint64_label:type_name -> tools.generator.v1alpha.Uint64Label
-	3,  // 7: tools.generator.v1alpha.Label.int64_label:type_name -> tools.generator.v1alpha.Int64Label
-	2,  // 8: tools.generator.v1alpha.Label.uint32_label:type_name -> tools.generator.v1alpha.Uint32Label
-	4,  // 9: tools.generator.v1alpha.Label.int32_label:type_name -> tools.generator.v1alpha.Int32Label
-	14, // 10: tools.generator.v1alpha.CapabilityMetadata.mode:type_name -> sdk.v1alpha.Mode
-	13, // 11: tools.generator.v1alpha.CapabilityMetadata.labels:type_name -> tools.generator.v1alpha.CapabilityMetadata.LabelsEntry
-	5,  // 12: tools.generator.v1alpha.CapabilityMetadata.LabelsEntry.value:type_name -> tools.generator.v1alpha.Label
-	15, // 13: tools.generator.v1alpha.capability:extendee -> google.protobuf.ServiceOptions
-	16, // 14: tools.generator.v1alpha.method:extendee -> google.protobuf.MethodOptions
-	6,  // 15: tools.generator.v1alpha.capability:type_name -> tools.generator.v1alpha.CapabilityMetadata
-	7,  // 16: tools.generator.v1alpha.method:type_name -> tools.generator.v1alpha.CapabilityMethodMetadata
-	17, // [17:17] is the sub-list for method output_type
-	17, // [17:17] is the sub-list for method input_type
-	15, // [15:17] is the sub-list for extension type_name
-	13, // [13:15] is the sub-list for extension extendee
-	0,  // [0:13] is the sub-list for field type_name
+	9,  // 0: tools.generator.v1alpha.StringLabel.defaults:type_name -> tools.generator.v1alpha.StringLabel.DefaultsEntry
+	10, // 1: tools.generator.v1alpha.Uint64Label.defaults:type_name -> tools.generator.v1alpha.Uint64Label.DefaultsEntry
+	11, // 2: tools.generator.v1alpha.Uint32Label.defaults:type_name -> tools.generator.v1alpha.Uint32Label.DefaultsEntry
+	12, // 3: tools.generator.v1alpha.Int64Label.defaults:type_name -> tools.generator.v1alpha.Int64Label.DefaultsEntry
+	13, // 4: tools.generator.v1alpha.Int32Label.defaults:type_name -> tools.generator.v1alpha.Int32Label.DefaultsEntry
+	1,  // 5: tools.generator.v1alpha.Label.string_label:type_name -> tools.generator.v1alpha.StringLabel
+	2,  // 6: tools.generator.v1alpha.Label.uint64_label:type_name -> tools.generator.v1alpha.Uint64Label
+	4,  // 7: tools.generator.v1alpha.Label.int64_label:type_name -> tools.generator.v1alpha.Int64Label
+	3,  // 8: tools.generator.v1alpha.Label.uint32_label:type_name -> tools.generator.v1alpha.Uint32Label
+	5,  // 9: tools.generator.v1alpha.Label.int32_label:type_name -> tools.generator.v1alpha.Int32Label
+	15, // 10: tools.generator.v1alpha.CapabilityMetadata.mode:type_name -> sdk.v1alpha.Mode
+	14, // 11: tools.generator.v1alpha.CapabilityMetadata.labels:type_name -> tools.generator.v1alpha.CapabilityMetadata.LabelsEntry
+	0,  // 12: tools.generator.v1alpha.CapabilityMetadata.additional_environments:type_name -> tools.generator.v1alpha.AdditionalEnironments
+	6,  // 13: tools.generator.v1alpha.CapabilityMetadata.LabelsEntry.value:type_name -> tools.generator.v1alpha.Label
+	16, // 14: tools.generator.v1alpha.capability:extendee -> google.protobuf.ServiceOptions
+	17, // 15: tools.generator.v1alpha.method:extendee -> google.protobuf.MethodOptions
+	7,  // 16: tools.generator.v1alpha.capability:type_name -> tools.generator.v1alpha.CapabilityMetadata
+	8,  // 17: tools.generator.v1alpha.method:type_name -> tools.generator.v1alpha.CapabilityMethodMetadata
+	18, // [18:18] is the sub-list for method output_type
+	18, // [18:18] is the sub-list for method input_type
+	16, // [16:18] is the sub-list for extension type_name
+	14, // [14:16] is the sub-list for extension extendee
+	0,  // [0:14] is the sub-list for field type_name
 }
 
 func init() { file_tools_generator_v1alpha_cre_metadata_proto_init() }
@@ -637,13 +698,14 @@ func file_tools_generator_v1alpha_cre_metadata_proto_init() {
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_tools_generator_v1alpha_cre_metadata_proto_rawDesc), len(file_tools_generator_v1alpha_cre_metadata_proto_rawDesc)),
-			NumEnums:      0,
+			NumEnums:      1,
 			NumMessages:   14,
 			NumExtensions: 2,
 			NumServices:   0,
 		},
 		GoTypes:           file_tools_generator_v1alpha_cre_metadata_proto_goTypes,
 		DependencyIndexes: file_tools_generator_v1alpha_cre_metadata_proto_depIdxs,
+		EnumInfos:         file_tools_generator_v1alpha_cre_metadata_proto_enumTypes,
 		MessageInfos:      file_tools_generator_v1alpha_cre_metadata_proto_msgTypes,
 		ExtensionInfos:    file_tools_generator_v1alpha_cre_metadata_proto_extTypes,
 	}.Build()
diff --git a/cre/sdk/v1alpha/sdk.proto b/cre/sdk/v1alpha/sdk.proto
index 4be81f5e..bfa6c715 100644
--- a/cre/sdk/v1alpha/sdk.proto
+++ b/cre/sdk/v1alpha/sdk.proto
@@ -78,6 +78,17 @@ message TriggerSubscription {
   string id = 1;
   google.protobuf.Any payload = 2;
   string method = 3;
+  Requirements requirements = 4;
+}
+
+enum TeeType {
+  TEE_TYPE_UNSPECIFIED = 0;
+  TEE_TYPE_AWS_NITRO = 1;
+}
+
+message TeeTypeAndRegions {
+  TeeType type = 1;
+  repeated string regions = 3;
 }
 
 message TriggerSubscriptionRequest {
@@ -89,6 +100,25 @@ message Trigger {
   google.protobuf.Any payload = 2;
 }
 
+message Regions {
+  repeated string regions = 1;
+}
+
+message TeeTypesAndRegions {
+  repeated TeeTypeAndRegions tee_type_and_regions = 1;
+}
+
+message Tee {
+  oneof item {
+    Regions any_regions = 1;
+    TeeTypesAndRegions tee_types_and_regions = 2;
+  }
+}
+
+message Requirements {
+  Tee tee = 1;
+}
+
 message AwaitCapabilitiesRequest {
   repeated int32 ids = 1;
 }
diff --git a/cre/tools/generator/v1alpha/cre_metadata.proto b/cre/tools/generator/v1alpha/cre_metadata.proto
index cc947db8..4ebf167b 100644
--- a/cre/tools/generator/v1alpha/cre_metadata.proto
+++ b/cre/tools/generator/v1alpha/cre_metadata.proto
@@ -35,10 +35,16 @@ message Label {
   }
 }
 
+enum AdditionalEnironments {
+  ADDITIONAL_ENVIRONMENTS_UNSPECIFIED = 0;
+  ADDITIONAL_ENVIRONMENTS_TEE = 1;
+}
+
 message CapabilityMetadata {
   sdk.v1alpha.Mode mode = 1;
   string capability_id = 2;
   map<string, Label> labels = 3;
+  repeated AdditionalEnironments additional_environments = 4;
 }
 
 extend google.protobuf.ServiceOptions {