diff --git a/profiles/base/accounts/group/policy-readers b/profiles/base/accounts/group/policy-readers
new file mode 100644
index 0000000..cef4769
--- /dev/null
+++ b/profiles/base/accounts/group/policy-readers
@@ -0,0 +1,4 @@
+# Members have read access to the device policy in /var/lib/whitelist.
+group:policy-readers
+gid:303
+users:chronos,u2f