diff --git a/tyr/policy/root.rego b/tyr/policy/root.rego
new file mode 100644
index 0000000..ceae409
--- /dev/null
+++ b/tyr/policy/root.rego
@@ -0,0 +1,4 @@
+package tyr
+default allow = false
+allow { input.service == "opax-mcp"; input.action == "read" }
+allow { input.service == "ollama"; input.action == "infer"; input.model == "gemma3:4b" }