diff --git a/policies/identity/oidc/admin.yaml b/policies/identity/oidc/admin.yaml
new file mode 100644
index 0000000..7feb215
--- /dev/null
+++ b/policies/identity/oidc/admin.yaml
@@ -0,0 +1,51 @@
+# Allow the deployer to manage identity OIDC objects through the vault_identity_oidc*
+# resources, which only read, write and delete by name and never list or rotate.
+---
+rules:
+  - path: "identity/oidc/config"
+    capabilities:
+      - create
+      - read
+      - update
+  - path: "identity/oidc/key/*"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+  - path: "identity/oidc/role/*"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+  - path: "identity/oidc/client/*"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+  - path: "identity/oidc/scope/*"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+  - path: "identity/oidc/assignment/*"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+  - path: "identity/oidc/provider/*"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+
+auth:
+  approle:
+    - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault