diff --git a/devstack/lib/vmware_nsx_v b/devstack/lib/vmware_nsx_v
index cf23f5466b..cbceebea38 100644
--- a/devstack/lib/vmware_nsx_v
+++ b/devstack/lib/vmware_nsx_v
@@ -56,8 +56,7 @@ function neutron_plugin_configure_common {
     mkdir -p /$Q_PLUGIN_CONF_PATH
     cp $DEST/$Q_PLUGIN_SRC_CONF_PATH/nsx.ini.sample /$Q_PLUGIN_CONF_PATH/$Q_PLUGIN_CONF_FILENAME
     sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR/policy.d
-    cp -v $DEST/$Q_PLUGIN_SRC_CONF_PATH/policy/routers.json $NEUTRON_CONF_DIR/policy.d
-    cp -v $DEST/$Q_PLUGIN_SRC_CONF_PATH/policy/network-gateways.json $NEUTRON_CONF_DIR/policy.d
+    cp -vr $DEST/$Q_PLUGIN_SRC_CONF_PATH/policy.d $NEUTRON_CONF_DIR/policy.d
     Q_DB_NAME="neutron_nsx"
     Q_PLUGIN_CLASS="vmware_nsxv"
 }
diff --git a/devstack/lib/vmware_nsx_v3 b/devstack/lib/vmware_nsx_v3
index c400909254..3bab711207 100644
--- a/devstack/lib/vmware_nsx_v3
+++ b/devstack/lib/vmware_nsx_v3
@@ -122,8 +122,7 @@ function neutron_plugin_configure_common {
     mkdir -p /$Q_PLUGIN_CONF_PATH
     cp $DEST/$Q_PLUGIN_SRC_CONF_PATH/nsx.ini.sample /$Q_PLUGIN_CONF_PATH/$Q_PLUGIN_CONF_FILENAME
     sudo install -d -o $STACK_USER $NEUTRON_CONF_DIR/policy.d
-    cp -v $DEST/$Q_PLUGIN_SRC_CONF_PATH/policy/routers.json $NEUTRON_CONF_DIR/policy.d
-    cp -v $DEST/$Q_PLUGIN_SRC_CONF_PATH/policy/network-gateways.json $NEUTRON_CONF_DIR/policy.d
+    cp -vr $DEST/$Q_PLUGIN_SRC_CONF_PATH/policy.d $NEUTRON_CONF_DIR/policy.d
     Q_PLUGIN_CLASS="vmware_nsxv3"
 }
 
diff --git a/etc/policy.d/dynamic-routing.json b/etc/policy.d/dynamic-routing.json
new file mode 100644
index 0000000000..70d684f68c
--- /dev/null
+++ b/etc/policy.d/dynamic-routing.json
@@ -0,0 +1,15 @@
+{
+    "get_bgp_speaker": "rule:admin_only",
+    "create_bgp_speaker": "rule:admin_only",
+    "update_bgp_speaker": "rule:admin_only",
+    "delete_bgp_speaker": "rule:admin_only",
+    "get_bgp_peer": "rule:admin_only",
+    "create_bgp_peer": "rule:admin_only",
+    "update_bgp_peer": "rule:admin_only",
+    "delete_bgp_peer": "rule:admin_only",
+    "add_bgp_peer": "rule:admin_only",
+    "remove_bgp_peer": "rule:admin_only",
+    "add_gateway_network": "rule:admin_only",
+    "remove_gateway_network": "rule:admin_only",
+    "get_advertised_routes":"rule:admin_only",
+}
diff --git a/etc/policy.d/flow-classifier.json b/etc/policy.d/flow-classifier.json
new file mode 100644
index 0000000000..39ac8b707a
--- /dev/null
+++ b/etc/policy.d/flow-classifier.json
@@ -0,0 +1,7 @@
+{
+    "create_flow_classifier": "rule:admin_only",
+    "update_flow_classifier": "rule:admin_only",
+    "delete_flow_classifier": "rule:admin_only",
+    "get_flow_classifier": "rule:admin_only",
+}
+
diff --git a/etc/policy/network-gateways.json b/etc/policy.d/network-gateways.json
similarity index 100%
rename from etc/policy/network-gateways.json
rename to etc/policy.d/network-gateways.json
diff --git a/etc/policy.d/neutron-fwaas.json b/etc/policy.d/neutron-fwaas.json
new file mode 100644
index 0000000000..2e6e05b7d0
--- /dev/null
+++ b/etc/policy.d/neutron-fwaas.json
@@ -0,0 +1,50 @@
+{
+    "shared_firewalls": "field:firewalls:shared=True",
+    "shared_firewall_policies": "field:firewall_policies:shared=True",
+    "shared_firewall_rules": "field:firewall_rules:shared=True",
+
+    "create_firewall": "",
+    "update_firewall": "rule:admin_or_owner",
+    "delete_firewall": "rule:admin_or_owner",
+
+    "create_firewall:shared": "rule:admin_only",
+    "update_firewall:shared": "rule:admin_only",
+    "delete_firewall:shared": "rule:admin_only",
+
+    "get_firewall": "rule:admin_or_owner or rule:shared_firewalls",
+
+    "shared_firewall_groups": "field:firewall_groups:shared=True",
+    "shared_firewall_policies": "field:firewall_policies:shared=True",
+    "shared_firewall_rules": "field:firewall_rules:shared=True",
+
+    "create_firewall_group": "",
+    "update_firewall_group": "rule:admin_or_owner",
+    "delete_firewall_group": "rule:admin_or_owner",
+
+    "create_firewall_group:shared": "rule:admin_only",
+    "update_firewall_group:shared": "rule:admin_only",
+    "delete_firewall_group:shared": "rule:admin_only",
+
+    "get_firewall_group": "rule:admin_or_owner or rule:shared_firewall_groups",
+
+
+    "create_firewall_policy": "",
+    "update_firewall_policy": "rule:admin_or_owner",
+    "delete_firewall_policy": "rule:admin_or_owner",
+
+    "create_firewall_policy:shared": "rule:admin_only",
+    "update_firewall_policy:shared": "rule:admin_only",
+    "delete_firewall_policy:shared": "rule:admin_only",
+
+    "get_firewall_policy": "rule:admin_or_owner or rule:shared_firewall_policies",
+
+    "create_firewall_rule": "",
+    "update_firewall_rule": "rule:admin_or_owner",
+    "delete_firewall_rule": "rule:admin_or_owner",
+
+    "create_firewall_rule:shared": "rule:admin_only",
+    "update_firewall_rule:shared": "rule:admin_only",
+    "delete_firewall_rule:shared": "rule:admin_only",
+
+    "get_firewall_rule": "rule:admin_or_owner or rule:shared_firewall_rules"
+}
diff --git a/etc/policy.d/routers.json b/etc/policy.d/routers.json
new file mode 100644
index 0000000000..24ae482c75
--- /dev/null
+++ b/etc/policy.d/routers.json
@@ -0,0 +1,23 @@
+{
+    "create_router:distributed": "rule:admin_or_owner",
+    "get_router:distributed": "rule:admin_or_owner",
+    "update_router:distributed": "rule:admin_or_owner"
+
+    "get_router:ha": "rule:admin_only",
+    "create_router": "rule:regular_user",
+    "create_router:external_gateway_info:enable_snat": "rule:admin_only",
+    "create_router:distributed": "rule:admin_only",
+    "create_router:ha": "rule:admin_only",
+    "get_router": "rule:admin_or_owner",
+    "get_router:distributed": "rule:admin_only",
+    "update_router:external_gateway_info:enable_snat": "rule:admin_only",
+    "update_router:distributed": "rule:admin_only",
+    "update_router:ha": "rule:admin_only",
+    "delete_router": "rule:admin_or_owner",
+
+    "add_router_interface": "rule:admin_or_owner",
+    "remove_router_interface": "rule:admin_or_owner",
+
+    "create_router:external_gateway_info:external_fixed_ips": "rule:admin_only",
+    "update_router:external_gateway_info:external_fixed_ips": "rule:admin_only",
+}
diff --git a/etc/policy.d/security-groups.json b/etc/policy.d/security-groups.json
new file mode 100644
index 0000000000..4d5d361d1d
--- /dev/null
+++ b/etc/policy.d/security-groups.json
@@ -0,0 +1,8 @@
+{
+    "create_security_group:logging": "rule:admin_only",
+    "update_security_group:logging": "rule:admin_only",
+    "get_security_group:logging": "rule:admin_only",
+    "create_security_group:provider": "rule:admin_only",
+    "create_security_group:policy": "rule:admin_only",
+    "update_security_group:policy": "rule:admin_only",
+}
diff --git a/etc/policy.json b/etc/policy.json
index 491de020dd..5b62293926 100644
--- a/etc/policy.json
+++ b/etc/policy.json
@@ -61,43 +61,6 @@
     "update_port:provider_security_groups": "rule:admin_only",
     "delete_port": "rule:admin_or_owner or rule:context_is_advsvc",
 
-    "get_router:ha": "rule:admin_only",
-    "create_router": "rule:regular_user",
-    "create_router:external_gateway_info:enable_snat": "rule:admin_only",
-    "create_router:distributed": "rule:admin_only",
-    "create_router:ha": "rule:admin_only",
-    "get_router": "rule:admin_or_owner",
-    "get_router:distributed": "rule:admin_only",
-    "update_router:external_gateway_info:enable_snat": "rule:admin_only",
-    "update_router:distributed": "rule:admin_only",
-    "update_router:ha": "rule:admin_only",
-    "delete_router": "rule:admin_or_owner",
-
-    "add_router_interface": "rule:admin_or_owner",
-    "remove_router_interface": "rule:admin_or_owner",
-
-    "create_router:external_gateway_info:external_fixed_ips": "rule:admin_only",
-    "update_router:external_gateway_info:external_fixed_ips": "rule:admin_only",
-
-    "create_firewall": "",
-    "get_firewall": "rule:admin_or_owner",
-    "create_firewall:shared": "rule:admin_only",
-    "get_firewall:shared": "rule:admin_only",
-    "update_firewall": "rule:admin_or_owner",
-    "update_firewall:shared": "rule:admin_only",
-    "delete_firewall": "rule:admin_or_owner",
-
-    "create_firewall_policy": "",
-    "get_firewall_policy": "rule:admin_or_owner or rule:shared_firewalls",
-    "create_firewall_policy:shared": "rule:admin_or_owner",
-    "update_firewall_policy": "rule:admin_or_owner",
-    "delete_firewall_policy": "rule:admin_or_owner",
-
-    "create_firewall_rule": "",
-    "get_firewall_rule": "rule:admin_or_owner or rule:shared_firewalls",
-    "update_firewall_rule": "rule:admin_or_owner",
-    "delete_firewall_rule": "rule:admin_or_owner",
-
     "create_qos_queue": "rule:admin_only",
     "get_qos_queue": "rule:admin_only",
 
@@ -142,31 +105,4 @@
     "get_service_provider": "rule:regular_user",
     "get_lsn": "rule:admin_only",
     "create_lsn": "rule:admin_only",
-
-    "create_security_group:logging": "rule:admin_only",
-    "update_security_group:logging": "rule:admin_only",
-    "get_security_group:logging": "rule:admin_only",
-    "create_security_group:provider": "rule:admin_only",
-    "create_port:provider_security_groups": "rule:admin_only",
-    "create_security_group:policy": "rule:admin_only",
-    "update_security_group:policy": "rule:admin_only",
-
-    "create_flow_classifier": "rule:admin_only",
-    "update_flow_classifier": "rule:admin_only",
-    "delete_flow_classifier": "rule:admin_only",
-    "get_flow_classifier": "rule:admin_only",
-
-    "get_bgp_speaker": "rule:admin_only",
-    "create_bgp_speaker": "rule:admin_only",
-    "update_bgp_speaker": "rule:admin_only",
-    "delete_bgp_speaker": "rule:admin_only",
-    "get_bgp_peer": "rule:admin_only",
-    "create_bgp_peer": "rule:admin_only",
-    "update_bgp_peer": "rule:admin_only",
-    "delete_bgp_peer": "rule:admin_only",
-    "add_bgp_peer": "rule:admin_only",
-    "remove_bgp_peer": "rule:admin_only",
-    "add_gateway_network": "rule:admin_only",
-    "remove_gateway_network": "rule:admin_only",
-    "get_advertised_routes":"rule:admin_only",
 }
diff --git a/etc/policy/routers.json b/etc/policy/routers.json
deleted file mode 100644
index 48665dba83..0000000000
--- a/etc/policy/routers.json
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-    "create_router:external_gateway_info:enable_snat": "rule:admin_or_owner",
-    "create_router:distributed": "rule:admin_or_owner",
-    "get_router:distributed": "rule:admin_or_owner",
-    "update_router:external_gateway_info:enable_snat": "rule:admin_or_owner",
-    "update_router:distributed": "rule:admin_or_owner"
-}