diff --git a/manifests/params.pp b/manifests/params.pp
index 83649c7..6700f80 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -8,6 +8,7 @@ class cloudkitty::params {
   $client_package_name    = 'python-cloudkittyclient'
   $api_service_name       = 'cloudkitty-api'
   $processor_service_name = 'cloudkitty-processor'
+  $group                  = 'cloudkitty'
 
   case $::osfamily {
     'RedHat': {
diff --git a/manifests/policy.pp b/manifests/policy.pp
index a2eec6f..a69d4e3 100644
--- a/manifests/policy.pp
+++ b/manifests/policy.pp
@@ -29,11 +29,14 @@ class cloudkitty::policy (
 ) {
 
   include ::cloudkitty::deps
+  include ::cloudkitty::params
 
   validate_hash($policies)
 
   Openstacklib::Policy::Base {
-    file_path => $policy_path,
+    file_path  => $policy_path,
+    file_user  => 'root',
+    file_group => $::cloudkitty::params::group,
   }
 
   create_resources('openstacklib::policy::base', $policies)
diff --git a/spec/classes/cloudkitty_policy_spec.rb b/spec/classes/cloudkitty_policy_spec.rb
index 64b76ea..dd315e5 100644
--- a/spec/classes/cloudkitty_policy_spec.rb
+++ b/spec/classes/cloudkitty_policy_spec.rb
@@ -1,7 +1,8 @@
 require 'spec_helper'
 
 describe 'cloudkitty::policy' do
-  shared_examples_for 'cloudkitty-policies' do
+
+  shared_examples_for 'cloudkitty policies' do
     let :params do
       {
         :policy_path => '/etc/cloudkitty/policy.json',
@@ -16,8 +17,10 @@ describe 'cloudkitty::policy' do
 
     it 'set up the policies' do
       is_expected.to contain_openstacklib__policy__base('context_is_admin').with({
-        :key   => 'context_is_admin',
-        :value => 'foo:bar'
+        :key        => 'context_is_admin',
+        :value      => 'foo:bar',
+        :file_user  => 'root',
+        :file_group => 'cloudkitty',
       })
       is_expected.to contain_oslo__policy('cloudkitty_config').with(
         :policy_file => '/etc/cloudkitty/policy.json',
@@ -26,14 +29,14 @@ describe 'cloudkitty::policy' do
   end
 
   on_supported_os({
-    :supported_os => OSDefaults.get_supported_os
+    :supported_os   => OSDefaults.get_supported_os
   }).each do |os,facts|
     context "on #{os}" do
       let (:facts) do
         facts.merge!(OSDefaults.get_facts())
       end
 
-      it_behaves_like 'cloudkitty-policies'
+      it_configures 'cloudkitty policies'
     end
   end
 end