diff --git a/src/README.md b/src/README.md
index 337ac9b..5b1d628 100644
--- a/src/README.md
+++ b/src/README.md
@@ -34,6 +34,48 @@ For Queens and later, the nameservers config value must be set:
 
     juju config designate nameservers="ns1.example.com. ns2.example.com."
 
+# Policy Overrides
+
+This feature allows for policy overrides using the `policy.d` directory.  This
+is an **advanced** feature and the policies that the OpenStack service supports
+should be clearly and unambiguously understood before trying to override, or
+add to, the default policies that the service uses.  The charm also has some
+policy defaults.  They should also be understood before being overridden.
+
+> **Caution**: It is possible to break the system (for tenants and other
+  services) if policies are incorrectly applied to the service.
+
+Policy overrides are YAML files that contain rules that will add to, or
+override, existing policy rules in the service.  The `policy.d` directory is
+a place to put the YAML override files.  This charm owns the
+`/etc/keystone/policy.d` directory, and as such, any manual changes to it will
+be overwritten on charm upgrades.
+
+Overrides are provided to the charm using a Juju resource called
+`policyd-override`.  The resource is a ZIP file.  This file, say
+`overrides.zip`, is attached to the charm by:
+
+
+    juju attach-resource designate policyd-override=overrides.zip
+
+The policy override is enabled in the charm using:
+
+    juju config designate use-policyd-override=true
+
+When `use-policyd-override` is `True` the status line of the charm will be
+prefixed with `PO:` indicating that policies have been overridden.  If the
+installation of the policy override YAML files failed for any reason then the
+status line will be prefixed with `PO (broken):`.  The log file for the charm
+will indicate the reason.  No policy override files are installed if the `PO
+(broken):` is shown.  The status line indicates that the overrides are broken,
+not that the policy for the service has failed. The policy will be the defaults
+for the charm and service.
+
+Policy overrides on one service may affect the functionality of another
+service. Therefore, it may be necessary to provide policy overrides for
+multiple service charms to achieve a consistent set of policies across the
+OpenStack system.  The charms for the other services that may need overrides
+should be checked to ensure that they support overrides before proceeding.
 
 # Bugs
 
diff --git a/src/config.yaml b/src/config.yaml
index b347d47..c2d70b0 100644
--- a/src/config.yaml
+++ b/src/config.yaml
@@ -81,3 +81,11 @@ options:
       Default SOA expire value in seconds to specify how long a
       secondary will still treat its copy of the zone data as valid if
       it can't contact the primary.
+  use-policyd-override:
+    type: boolean
+    default: False
+    description: |
+      If True then use the resource file named 'policyd-override' to install
+      override YAML files in the service's policy.d directory.  The resource
+      file should be a ZIP file containing at least one yaml file with a .yaml
+      or .yml extension.  If False then remove the overrides.
diff --git a/src/lib/charm/openstack/designate.py b/src/lib/charm/openstack/designate.py
index 12c52c4..93f0874 100644
--- a/src/lib/charm/openstack/designate.py
+++ b/src/lib/charm/openstack/designate.py
@@ -22,6 +22,7 @@ import charmhelpers.contrib.openstack.utils as ch_utils
 import charms_openstack.adapters as openstack_adapters
 import charms_openstack.charm as openstack_charm
 import charms_openstack.ip as os_ip
+import charms_openstack.plugins as ch_plugins
 import charmhelpers.core.decorators as decorators
 import charmhelpers.core.hookenv as hookenv
 import charmhelpers.core.host as host
@@ -295,7 +296,9 @@ class DesignateAdapters(openstack_adapters.OpenStackAPIRelationAdapters):
     }
 
 
-class DesignateCharm(openstack_charm.HAOpenStackCharm):
+# note plugin comes first to override the config_changed method as a mixin
+class DesignateCharm(ch_plugins.PolicydOverridePlugin,
+                     openstack_charm.HAOpenStackCharm):
     """Designate charm"""
 
     name = 'designate'
@@ -353,6 +356,9 @@ class DesignateCharm(openstack_charm.HAOpenStackCharm):
 
     group = 'designate'
 
+    # policyd override constants
+    policyd_service_name = 'designate'
+
     def __init__(self, release=None, **kwargs):
         """Custom initialiser for class
         If no release is passed, then the charm determines the release from the
diff --git a/src/metadata.yaml b/src/metadata.yaml
index bbd4925..d38c0a6 100644
--- a/src/metadata.yaml
+++ b/src/metadata.yaml
@@ -34,3 +34,8 @@ requires:
 peers:
   cluster:
     interface: openstack-ha
+resources:
+  policyd-override:
+    type: file
+    filename: policyd-override.zip
+    description: The policy.d overrides file
diff --git a/src/reactive/designate_handlers.py b/src/reactive/designate_handlers.py
index 98362e5..21dea8f 100644
--- a/src/reactive/designate_handlers.py
+++ b/src/reactive/designate_handlers.py
@@ -48,8 +48,10 @@ def check_dns_slaves():
     accordingly.  Note, that hooks run BEFORE the reactive handlers so this
     should happen first during a hook.
     """
-    if hookenv.config('dns-slaves'):
-        with charm.provide_charm_instance() as instance:
+    with charm.provide_charm_instance() as instance:
+        # ensure policy.d overrides are picked up
+        instance.config_changed()
+        if hookenv.config('dns-slaves'):
             if not instance.options.invalid_pool_config():
                 reactive.set_state('dns-slaves-config-valid')
                 return