diff --git a/policies/operator-custody.hcl b/policies/operator-custody.hcl
new file mode 100644
index 0000000..e6cae26
--- /dev/null
+++ b/policies/operator-custody.hcl
@@ -0,0 +1,30 @@
+# operator-custody — human operators' own credentials.
+#
+# Distinct from platform-admin on purpose. platform-admin lists the mounts an
+# administrator operates *on*; this is the one mount an administrator keeps
+# things *in*. Separating them means custody can move independently of
+# administration — which is exactly what the S6 trust stage (two-of-three
+# independent recovery control) requires, and it cannot be done later if the
+# grant is buried inside platform-admin.
+#
+# Holds: service account passwords, provider PATs, LLDAP admin bind,
+# privacyIDEA pi-admin, machine identities. See
+# net-kingdom/docs/platform-root-custody.md, "Operator Credential Custody".
+#
+# Does NOT hold, and must never: platform-root's own password, unseal shares,
+# the break-glass password. Those live in the offline packet — putting them
+# here is a circular dependency, since you would need this store to reach the
+# credential that opens it.
+
+path "operators/data/*" {
+  capabilities = ["create", "read", "update", "list"]
+}
+
+path "operators/metadata/*" {
+  capabilities = ["read", "list"]
+}
+
+# Delete is deliberately absent. A credential is retired by writing its
+# successor — KV v2 keeps the prior version, which is the history that did not
+# exist when the LLDAP predecessor was overwritten on 2026-08-27 and lost.
+# Destroying a version is a separate, deliberate act under a broader identity.