diff --git a/docs/POLICY.md b/docs/POLICY.md
new file mode 100644
index 0000000..b07659b
--- /dev/null
+++ b/docs/POLICY.md
@@ -0,0 +1,16 @@
+# OpenShell policy
+
+**Status:** Outline. Policy sources under `policy/openshell/`.
+
+| Artifact | Role |
+|----------|------|
+| `policy/openshell/policy.yaml` | Base deny-by-default |
+| `policy/openshell/overlays/` | channels, square, vagaro, quickbooks, inference |
+| Generated on volume | Applied at install / connect / upgrade |
+
+**Always deny:** social publish APIs; payment/refund/payout/bill-pay.  
+**Allow when connected:** model endpoint; channel APIs; enabled SaaS hosts.
+
+Apply via `openshell policy set` and `nemohermes … policy-add` / `policy-remove` (platform-native).
+
+See [design/DESIGN_PLAN.md](../design/DESIGN_PLAN.md).