diff --git a/manifests/params.pp b/manifests/params.pp
index 0239778..e55f556 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -6,6 +6,7 @@ class zaqar::params {
   include ::openstacklib::defaults
 
   $client_package_name = 'python-zaqarclient'
+  $group               = 'zaqar'
 
   case $::osfamily {
     'RedHat': {
diff --git a/manifests/policy.pp b/manifests/policy.pp
index e84db3e..be7edeb 100644
--- a/manifests/policy.pp
+++ b/manifests/policy.pp
@@ -20,7 +20,7 @@
 #   Defaults to empty hash.
 #
 # [*policy_path*]
-#   (optional) Path to the nova policy.json file
+#   (optional) Path to the zaqar policy.json file
 #   Defaults to /etc/zaqar/policy.json
 #
 class zaqar::policy (
@@ -29,11 +29,14 @@ class zaqar::policy (
 ) {
 
   include ::zaqar::deps
+  include ::zaqar::params
 
   validate_hash($policies)
 
   Openstacklib::Policy::Base {
-    file_path => $policy_path,
+    file_path  => $policy_path,
+    file_user  => 'root',
+    file_group => $::zaqar::params::group,
   }
 
   create_resources('openstacklib::policy::base', $policies)
diff --git a/spec/classes/zaqar_policy_spec.rb b/spec/classes/zaqar_policy_spec.rb
index 192577c..2f110bb 100644
--- a/spec/classes/zaqar_policy_spec.rb
+++ b/spec/classes/zaqar_policy_spec.rb
@@ -17,8 +17,10 @@ describe 'zaqar::policy' do
 
     it 'set up the policies' do
       is_expected.to contain_openstacklib__policy__base('context_is_admin').with({
-        :key   => 'context_is_admin',
-        :value => 'foo:bar'
+        :key        => 'context_is_admin',
+        :value      => 'foo:bar',
+        :file_user  => 'root',
+        :file_group => 'zaqar',
       })
       is_expected.to contain_oslo__policy('zaqar_config').with(
         :policy_file => '/etc/zaqar/policy.json',