diff --git a/access_vectors b/access_vectors
index 43b81e9f4..65b7e2226 100644
--- a/access_vectors
+++ b/access_vectors
@@ -909,6 +909,7 @@ class keystore_key
 	reset_uid
 	sync_uid
 	password_uid
+	add_auth
 }
 
 class debuggerd
diff --git a/system_server.te b/system_server.te
index 36fbacead..e967adb8b 100644
--- a/system_server.te
+++ b/system_server.te
@@ -455,6 +455,7 @@ allow system_server keystore:keystore_key {
 	reset_uid
 	sync_uid
 	password_uid
+	add_auth
 };
 
 # Allow system server to search and write to the persistent factory reset