diff --git a/policies/kv/service/authentik/write.yaml b/policies/kv/service/authentik/write.yaml
new file mode 100644
index 0000000..5f9ee36
--- /dev/null
+++ b/policies/kv/service/authentik/write.yaml
@@ -0,0 +1,32 @@
+# Let the terraform-authentik runner manage the Authentik service KV subtree as
+# IaC (vault_kv_secret_v2), starting with kv/service/authentik/agent-api-token,
+# which is currently seeded by hand.
+#
+# Scoping: the ask was to grant only *-token paths, but Vault ACL paths support
+# a trailing glob only (no infix/suffix wildcards), so the grant is the whole
+# kv/service/authentik/ subtree. That is acceptable because terraform-authentik
+# is the owner of every secret under kv/service/authentik/.
+#
+# delete is included (unlike the agents kv/kubernetes grant) so `terraform
+# destroy` and resource replacement can remove a secret and its metadata
+# cleanly; vault_kv_secret_v2 also reads the kv-v2 metadata path on every
+# plan/apply, so metadata read/list is required for the plan to succeed.
+---
+rules:
+  - path: "kv/data/service/authentik/*"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+  - path: "kv/metadata/service/authentik/*"
+    capabilities:
+      - read
+      - list
+      - delete
+
+auth:
+  approle:
+    - terraform_authentik
+  k8s/au/syd1:
+    - woodpecker_terraform_authentik