diff --git a/access_vectors b/access_vectors
index 43b81e9f42d682950d0a12fe2fdbaccba04e39e9..65b7e2226a9bb0d220661603062d507ad3c8fbf7 100644
--- a/access_vectors
+++ b/access_vectors
@@ -909,6 +909,7 @@ class keystore_key
 	reset_uid
 	sync_uid
 	password_uid
+	add_auth
 }
 
 class debuggerd
diff --git a/system_server.te b/system_server.te
index 36fbacead3ac63056f56316a68d3f11d4c9b908e..e967adb8b6ba52c36990aefdbdc7dd091f951930 100644
--- a/system_server.te
+++ b/system_server.te
@@ -455,6 +455,7 @@ allow system_server keystore:keystore_key {
 	reset_uid
 	sync_uid
 	password_uid
+	add_auth
 };
 
 # Allow system server to search and write to the persistent factory reset