diff --git a/releasenotes/notes/policy-in-code-3107271b0636fcea.yaml b/releasenotes/notes/policy-in-code-3107271b0636fcea.yaml
index d190caac..f0f90ac3 100644
--- a/releasenotes/notes/policy-in-code-3107271b0636fcea.yaml
+++ b/releasenotes/notes/policy-in-code-3107271b0636fcea.yaml
@@ -7,3 +7,8 @@ features:
     in detail.
 
     .. _the policy configuration guide: https://docs.openstack.org/blazar/latest/configuration/blazar-policy.html
+upgrade:
+  - |
+    The default policy for the list and get hosts API is changed. Admin and
+    its owner are allowed to call the API until Queens. From Rocky release,
+    only the admin is allowed to call the API.