diff --git a/policies/auth/oidc/admin.yaml b/policies/auth/oidc/admin.yaml
deleted file mode 100644
index 9f04b3b..0000000
--- a/policies/auth/oidc/admin.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Allow full administration of the OIDC auth backend (mount config and login
-# roles), mirroring policies/auth/ldap/admin.yaml. sys/auth/* already covers
-# enabling the mount itself; this covers writing auth/oidc/config and
-# auth/oidc/role/*.
----
-rules:
-  - path: "auth/oidc/*"
-    capabilities:
-      - create
-      - update
-      - read
-      - delete
-      - list
-
-auth:
-  approle:
-    - tf_vault
-  k8s/au/syd1:
-    - woodpecker_terraform_vault
diff --git a/policies/identity/group/admin.yaml b/policies/identity/group/admin.yaml
deleted file mode 100644
index d077a51..0000000
--- a/policies/identity/group/admin.yaml
+++ /dev/null
@@ -1,38 +0,0 @@
-# Allow the deployer to manage external identity groups and their aliases, which
-# is how OIDC group membership (the ak_groups claim) maps onto Vault policies.
-# Both the collection endpoints and the per-id endpoints are needed: create posts
-# to identity/group, subsequent reads and updates address identity/group/id/<id>.
----
-rules:
-  - path: "identity/group"
-    capabilities:
-      - create
-      - update
-  - path: "identity/group/*"
-    capabilities:
-      - create
-      - update
-      - read
-      - delete
-      - list
-  - path: "identity/group-alias"
-    capabilities:
-      - create
-      - update
-  - path: "identity/group-alias/*"
-    capabilities:
-      - create
-      - update
-      - read
-      - delete
-      - list
-  - path: "identity/lookup/group"
-    capabilities:
-      - create
-      - update
-
-auth:
-  approle:
-    - tf_vault
-  k8s/au/syd1:
-    - woodpecker_terraform_vault