diff --git a/etc/magnum/policy.json b/etc/magnum/policy.json
index c80c277e9b..1970a32fbb 100644
--- a/etc/magnum/policy.json
+++ b/etc/magnum/policy.json
@@ -37,6 +37,12 @@
     "rc:detail": "rule:default",
     "rc:get": "rule:default",
     "rc:get_all": "rule:default",
-    "rc:update": "rule:default"
+    "rc:update": "rule:default",
 
+    "service:create": "rule:default",
+    "service:delete": "rule:default",
+    "service:detail": "rule:default",
+    "service:get": "rule:default",
+    "service:get_all": "rule:default",
+    "service:update": "rule:default"
 }
diff --git a/magnum/api/controllers/v1/service.py b/magnum/api/controllers/v1/service.py
index 5129fe4cc1..454773930e 100644
--- a/magnum/api/controllers/v1/service.py
+++ b/magnum/api/controllers/v1/service.py
@@ -26,6 +26,7 @@ from magnum.api import expose
 from magnum.api import validation
 from magnum.common import exception
 from magnum.common import k8s_manifest
+from magnum.common import policy
 from magnum import objects
 
 
@@ -205,6 +206,7 @@ class ServicesController(rest.RestController):
                                                     sort_key=sort_key,
                                                     sort_dir=sort_dir)
 
+    @policy.enforce_wsgi("service")
     @expose.expose(ServiceCollection, types.uuid,
                    types.uuid, int, wtypes.text, wtypes.text)
     def get_all(self, service_uuid=None, marker=None, limit=None,
@@ -219,6 +221,7 @@ class ServicesController(rest.RestController):
         return self._get_services_collection(marker, limit, sort_key,
                                              sort_dir)
 
+    @policy.enforce_wsgi("service")
     @expose.expose(ServiceCollection, types.uuid,
                    types.uuid, int, wtypes.text, wtypes.text)
     def detail(self, service_uuid=None, marker=None, limit=None,
@@ -243,6 +246,7 @@ class ServicesController(rest.RestController):
                                              sort_key, sort_dir, expand,
                                              resource_url)
 
+    @policy.enforce_wsgi("service", "get")
     @expose.expose(Service, types.uuid_or_name)
     def get_one(self, service_ident):
         """Retrieve information about the given service.
@@ -253,6 +257,7 @@ class ServicesController(rest.RestController):
 
         return Service.convert_with_links(rpc_service)
 
+    @policy.enforce_wsgi("service", "create")
     @expose.expose(Service, body=Service, status_code=201)
     @validation.enforce_bay_types('kubernetes')
     def post(self, service):
@@ -275,6 +280,7 @@ class ServicesController(rest.RestController):
         pecan.response.location = link.build_url('services', new_service.uuid)
         return Service.convert_with_links(new_service)
 
+    @policy.enforce_wsgi("service", "update")
     @wsme.validate(types.uuid, [ServicePatchType])
     @expose.expose(Service, types.uuid_or_name, body=[ServicePatchType])
     def patch(self, service_ident, patch):
@@ -314,6 +320,7 @@ class ServicesController(rest.RestController):
             rpc_service.save()
         return Service.convert_with_links(rpc_service)
 
+    @policy.enforce_wsgi("service")
     @expose.expose(None, types.uuid_or_name, status_code=204)
     def delete(self, service_ident):
         """Delete a service.
diff --git a/magnum/tests/fake_policy.py b/magnum/tests/fake_policy.py
index 42248d9124..b4d0410534 100644
--- a/magnum/tests/fake_policy.py
+++ b/magnum/tests/fake_policy.py
@@ -53,7 +53,14 @@ policy_data = """
     "rc:detail": "",
     "rc:get": "",
     "rc:get_all": "",
-    "rc:update": ""
+    "rc:update": "",
+
+    "service:create": "",
+    "service:delete": "",
+    "service:detail": "",
+    "service:get": "",
+    "service:get_all": "",
+    "service:update": ""
 }
 """
 
diff --git a/magnum/tests/unit/api/controllers/v1/test_service.py b/magnum/tests/unit/api/controllers/v1/test_service.py
index 199f7dfd04..9d18c29c34 100644
--- a/magnum/tests/unit/api/controllers/v1/test_service.py
+++ b/magnum/tests/unit/api/controllers/v1/test_service.py
@@ -14,6 +14,7 @@ import datetime
 
 import mock
 from oslo_config import cfg
+from oslo_policy import policy
 from oslo_utils import timeutils
 from six.moves.urllib import parse as urlparse
 from wsme import types as wtypes
@@ -448,3 +449,50 @@ class TestDelete(api_base.FunctionalTest):
         self.assertEqual(409, response.status_int)
         self.assertEqual('application/json', response.content_type)
         self.assertTrue(response.json['error_message'])
+
+
+class TestServiceEnforcement(api_base.FunctionalTest):
+
+    def _common_policy_check(self, rule, func, *arg, **kwarg):
+        self.policy.set_rules({rule: 'project:non_fake'})
+        exc = self.assertRaises(policy.PolicyNotAuthorized,
+                                func, *arg, **kwarg)
+        self.assertTrue(exc.message.startswith(rule))
+        self.assertTrue(exc.message.endswith('disallowed by policy'))
+
+    def test_policy_disallow_get_all(self):
+        self._common_policy_check(
+            'service:get_all', self.get_json, '/services')
+
+    def test_policy_disallow_get_one(self):
+        self._common_policy_check(
+            'service:get', self.get_json, '/services/111-222-333')
+
+    def test_policy_disallow_detail(self):
+        self._common_policy_check(
+            'service:detail', self.get_json, '/services/111-222-333/detail')
+
+    def test_policy_disallow_update(self):
+        service = obj_utils.create_test_service(self.context,
+                                                desc='test service',
+                                                uuid=utils.generate_uuid())
+
+        self._common_policy_check(
+            'service:update', self.patch_json,
+            '/services/%s' % service.uuid,
+            [{'path': '/bay_uuid',
+              'value': utils.generate_uuid(),
+              'op': 'replace'}])
+
+    def test_policy_disallow_create(self):
+        pdict = apiutils.service_post_data()
+        self._common_policy_check(
+            'service:create', self.post_json, '/services', pdict)
+
+    def test_policy_disallow_delete(self):
+        service = obj_utils.create_test_service(self.context,
+                                                desc='test_service',
+                                                uuid=utils.generate_uuid())
+        self._common_policy_check(
+            'service:delete', self.delete,
+            '/services/%s' % service.uuid)