diff --git a/roles/koji_hub/templates/hub.conf.j2 b/roles/koji_hub/templates/hub.conf.j2
index 202f3fc..df25a09 100644
--- a/roles/koji_hub/templates/hub.conf.j2
+++ b/roles/koji_hub/templates/hub.conf.j2
@@ -70,25 +70,29 @@ DisableNotifications = False
 {% if inventory_hostname.startswith('koji') %}
 [policy]
 
-
 tag =
     has_perm secure-boot && package kernel shim grub2 fedora-release fedora-repos pesign :: allow
     package kernel shim grub2 fedora-release fedora-repos pesign :: deny
-    all :: allow
+    has_perm admin :: allow
+    tag *-candidate :: allow
+    tag *-free :: allow
+    tag *-nonfree :: allow
+    all :: deny
 
 channel =
     method createrepo :: use createrepo
     has req_channel :: req
     is_child_task :: parent
-#make sure all scratch builds are disabled
     method build && bool scratch :: use default
 
     all :: use default
 
-
-
 build_from_srpm =
     has_perm admin :: allow
     all :: deny
 
+build_from_repo_id=
+    has_perm admin :: allow
+    all :: deny
+
 {% endif %}