diff --git a/vault/policies/cert-manager.hcl b/vault/policies/cert-manager.hcl
new file mode 100644
index 0000000..0db2bdf
--- /dev/null
+++ b/vault/policies/cert-manager.hcl
@@ -0,0 +1,6 @@
+path "kv/data/acme" {
+  capabilities = ["read"]
+}
+path "kv/data/namecheap" {
+  capabilities = ["read"]
+}
diff --git a/vault/policies/wallabag.hcl b/vault/policies/wallabag.hcl
new file mode 100644
index 0000000..ad87e3e
--- /dev/null
+++ b/vault/policies/wallabag.hcl
@@ -0,0 +1,3 @@
+path "kv/data/wallabag" {
+  capabilities = ["read"]
+}