diff --git a/policies/kv/service/vault/au/syd1/secret_backend/ghp/config_write.yaml b/policies/kv/service/vault/au/syd1/secret_backend/ghp/config_write.yaml
new file mode 100644
index 0000000..578143b
--- /dev/null
+++ b/policies/kv/service/vault/au/syd1/secret_backend/ghp/config_write.yaml
@@ -0,0 +1,24 @@
+# Allow the agents AppRole to seed the ghp secrets engine's admin credentials.
+# The ghp engine (managed by the tf_vault deployer) reads its ghpsvc_ service
+# token from admin_token at ghp/config creation time; that key is currently
+# unseeded, so the master apply aborts on the ghp data-source read. This grants
+# the agents AppRole scoped write here so an agent can seed the value. Deployer
+# read is already granted via policies/kv/service/vault/secret_backends_read.yaml,
+# so this only adds the write side for the agents identity.
+---
+rules:
+  # Seed value: admin_token (a ghpsvc_ service token). create/update to seed,
+  # read so the agent can verify what it wrote. No delete (least privilege).
+  - path: "kv/data/service/vault/au/syd1/secret_backend/ghp/config"
+    capabilities:
+      - create
+      - update
+      - read
+  # vault_kv_secret_v2 also reads the kv-v2 metadata path on every plan/apply.
+  - path: "kv/metadata/service/vault/au/syd1/secret_backend/ghp/config"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - agents