diff --git a/policies/kv/service/wireguard/binarylane/agents.yaml b/policies/kv/service/wireguard/binarylane/agents.yaml
new file mode 100644
index 0000000..b2b49e9
--- /dev/null
+++ b/policies/kv/service/wireguard/binarylane/agents.yaml
@@ -0,0 +1,15 @@
+# Lets the agents AppRole read the BinaryLane gateway WireGuard keypairs so they
+# can be eyaml-encrypted into puppet hiera. Read-only; terraform-binarylane owns writes.
+---
+rules:
+  - path: "kv/data/service/wireguard/binarylane/*"
+    capabilities:
+      - read
+  - path: "kv/metadata/service/wireguard/binarylane/*"
+    capabilities:
+      - read
+      - list
+
+auth:
+  approle:
+    - agents