diff --git a/tests/pillar/server_single.sls b/tests/pillar/server_single.sls
index 1600f46..fe4ab4e 100644
--- a/tests/pillar/server_single.sls
+++ b/tests/pillar/server_single.sls
@@ -49,3 +49,7 @@
       user: openstack
       password: password
       virtual_host: '/openstack'
+    policy:
+      deny_stack_user: 'not role:heat_stack_user'
+      'cloudformation:ValidateTemplate': 'rule:deny_stack_user'
+      'cloudformation:DescribeStackResource':