diff --git a/policy/openshell/README.md b/policy/openshell/README.md
new file mode 100644
index 0000000..071d151
--- /dev/null
+++ b/policy/openshell/README.md
@@ -0,0 +1,14 @@
+# OpenShell policy (scaffold)
+
+**Status:** Structure only — no live policy applied until **build**.
+
+## Intended contents
+
+| Path | Purpose |
+|------|---------|
+| `policy.yaml` (or equivalent) | Deny-by-default base for salon egress |
+| `overlays/` | Per-integration allowlists (Square MCP host, QBO local, channels, etc.) |
+
+Apply via platform CLIs only: `openshell policy set`, `nemohermes <name> policy-add` / `policy-remove`.
+
+See [design/mcp-integrations.md](../../design/mcp-integrations.md) and [docs/POLICY.md](../../docs/POLICY.md).