diff --git a/manifests/deps.pp b/manifests/deps.pp
index 0bbc2ae29..b9a5a0add 100644
--- a/manifests/deps.pp
+++ b/manifests/deps.pp
@@ -39,7 +39,7 @@ class keystone::deps {
 
   # policy config should occur in the config block also.
   Anchor['keystone::config::begin']
-  -> Openstacklib::Policy<||>
+  -> Openstacklib::Policy<| tag == 'keystone' |>
   ~> Anchor['keystone::config::end']
 
   # Support packages need to be installed in the install phase, but we don't
diff --git a/manifests/policy.pp b/manifests/policy.pp
index d9e9a6f23..93dffceda 100644
--- a/manifests/policy.pp
+++ b/manifests/policy.pp
@@ -65,6 +65,7 @@ class keystone::policy (
     file_group   => $::keystone::params::group,
     file_format  => 'yaml',
     purge_config => $purge_config,
+    tag          => 'keystone',
   }
 
   create_resources('openstacklib::policy', { $policy_path => $policy_parameters })
diff --git a/spec/classes/keystone_policy_spec.rb b/spec/classes/keystone_policy_spec.rb
index 0f35f849a..45c7eb03b 100644
--- a/spec/classes/keystone_policy_spec.rb
+++ b/spec/classes/keystone_policy_spec.rb
@@ -33,6 +33,7 @@ describe 'keystone::policy' do
           :file_group   => 'keystone',
           :file_format  => 'yaml',
           :purge_config => false,
+          :tag          => 'keystone',
         )
         is_expected.to contain_oslo__policy('keystone_config').with(
           :enforce_scope        => false,
@@ -63,6 +64,7 @@ describe 'keystone::policy' do
           :file_group   => 'keystone',
           :file_format  => 'yaml',
           :purge_config => true,
+          :tag          => 'keystone',
         )
         is_expected.to contain_oslo__policy('keystone_config').with(
           :enforce_scope        => false,