diff --git a/private/app.te b/private/app.te
index 2fddb444f90c48ec31f25b8a3e15daadcd7235af..4c5cb380d05afdd600abc1c2861380cbec0b3688 100644
--- a/private/app.te
+++ b/private/app.te
@@ -270,9 +270,6 @@ auditallow { appdomain userdebug_or_eng(`-su') } ion_device:chr_file { write app
 # TODO(b/36375899) replace with hal_client_domain for mediacodec (hal_omx)
 get_prop({ appdomain -isolated_app }, hwservicemanager_prop);
 
-# Allow app to access the graphic allocator HAL
-binder_call({ appdomain -isolated_app }, hal_graphics_allocator)
-
 # Allow app access to mediacodec (IOMX HAL)
 binder_call({ appdomain -isolated_app }, mediacodec)
 
diff --git a/private/system_server.te b/private/system_server.te
index 0f0dcdc5582001815d6e18dbbe9bac85c7e5a18d..404a253aac026039fdb7219e9040eda6596eac65 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -175,7 +175,7 @@ hal_client_domain(system_server, hal_contexthub)
 hal_client_domain(system_server, hal_fingerprint)
 binder_call(system_server, hal_gnss)
 hal_client_domain(system_server, hal_gnss)
-binder_call(system_server, hal_graphics_allocator)
+hal_client_domain(system_server, hal_graphics_allocator)
 binder_call(system_server, hal_ir)
 hal_client_domain(system_server, hal_ir)
 binder_call(system_server, hal_light)
@@ -627,7 +627,6 @@ allow system_server preloads_media_file:dir { r_dir_perms write remove_name rmdi
 
 r_dir_file(system_server, cgroup)
 allow system_server ion_device:chr_file r_file_perms;
-allow system_server hal_graphics_allocator:fd use;
 
 r_dir_file(system_server, proc)
 r_dir_file(system_server, proc_meminfo)
diff --git a/private/technical_debt.cil b/private/technical_debt.cil
index abc21a7581b272255138271c24672ffe1332c5e5..e95e555a6ccdc7a11e3fc051a9d4290f5c8e6eee 100644
--- a/private/technical_debt.cil
+++ b/private/technical_debt.cil
@@ -12,6 +12,11 @@
 (typeattributeset hal_allocator_client ((and (appdomain) ((not (isolated_app))))))
 (typeattributeset halclientdomain (hal_allocator_client))
 
+; Apps, except isolated apps, are clients of Graphics Allocator HAL
+; Unfortunately, we can't currently express this in module policy language:
+;     typeattribute { appdomain -isolated_app } hal_graphics_allocator_client;
+(typeattributeset hal_graphics_allocator_client ((and (appdomain) ((not (isolated_app))))))
+
 ; Domains hosting Camera HAL implementations are clients of Allocator HAL
 ; Unfortunately, we can't currently express this in module policy language:
 ;     typeattribute hal_camera hal_allocator_client;