diff --git a/horizon/server/service.sls b/horizon/server/service.sls
index 9c13428..1c3d883 100644
--- a/horizon/server/service.sls
+++ b/horizon/server/service.sls
@@ -41,6 +41,8 @@
   - name: {{ policy.get('path', server.get('policy_files_path')) }}/{{ policy.get('name') }}
   - dataset: {{ service_policy }}
   - formatter: JSON
+  - mode: 640
+  - group: horizon
   - require:
     - file: horizon_config
 
@@ -52,6 +54,8 @@
   file.managed:
   - name: {{ policy.get('path', server.get('policy_files_path')) }}/{{ policy.get('name') }}
   - source: salt://horizon/files/policy/{{ server.version }}/{{ policy.get('name') }}
+  - mode: 640
+  - group: horizon
   - require:
     - file: horizon_config