diff --git a/swarm-secret-client/src/client.rs b/swarm-secret-client/src/client.rs
index 74e61af8..fcd9bda1 100644
--- a/swarm-secret-client/src/client.rs
+++ b/swarm-secret-client/src/client.rs
@@ -151,6 +151,22 @@ impl SecretStore {
         vaultrs::kv2::set(&self.inner, MOUNT, path, value).await?;
         Ok(())
     }
+
+    /// Replace the ACL policy named `name` with `policy`.
+    ///
+    /// A whole-document write, not a merge: the store has no other verb, and
+    /// the caller renders the document from the current agent set anyway, so
+    /// a stanza that is gone from the render is meant to be gone from the
+    /// grant. Render the text with [`crate::policy`] rather than by hand.
+    ///
+    /// # Errors
+    /// [`Error::Vault`] when the token's own policy does not cover
+    /// `sys/policies/acl/<name>` — which is what a controller scoped to the
+    /// `hive-*` namespace gets for any other name.
+    pub async fn write_policy(&self, name: &str, policy: &str) -> Result<(), Error> {
+        vaultrs::sys::policy::set(&self.inner, name, policy).await?;
+        Ok(())
+    }
 }
 
 #[cfg(test)]