diff --git a/spinifex/gateway/policy/actions.go b/spinifex/foundation/aws/policy/actions.go
similarity index 94%
rename from spinifex/gateway/policy/actions.go
rename to spinifex/foundation/aws/policy/actions.go
index 395d0411c..74f879b4f 100644
--- a/spinifex/gateway/policy/actions.go
+++ b/spinifex/foundation/aws/policy/actions.go
@@ -1,3 +1,4 @@
+// Package policy defines shared AWS IAM action vocabulary.
 package policy
 
 // bedrockIAMFamily lists the Bedrock wire/signing service names that all
diff --git a/spinifex/gateway/policy/actions_test.go b/spinifex/foundation/aws/policy/actions_test.go
similarity index 94%
rename from spinifex/gateway/policy/actions_test.go
rename to spinifex/foundation/aws/policy/actions_test.go
index c63c23c3c..13d1baade 100644
--- a/spinifex/gateway/policy/actions_test.go
+++ b/spinifex/foundation/aws/policy/actions_test.go
@@ -1,3 +1,4 @@
+// Package policy tests the shared AWS IAM action vocabulary.
 package policy
 
 import "testing"
diff --git a/spinifex/gateway/policy/evaluator_test.go b/spinifex/foundation/aws/policy/evaluator_test.go
similarity index 98%
rename from spinifex/gateway/policy/evaluator_test.go
rename to spinifex/foundation/aws/policy/evaluator_test.go
index 4c3148545..1bdbf4f9f 100644
--- a/spinifex/gateway/policy/evaluator_test.go
+++ b/spinifex/foundation/aws/policy/evaluator_test.go
@@ -1,3 +1,4 @@
+// Package policy tests IAM evaluation against the shared AWS action vocabulary.
 package policy
 
 import (
diff --git a/spinifex/gateway/ecr_authorization.go b/spinifex/gateway/ecr_authorization.go
index 984889ef1..98c335e54 100644
--- a/spinifex/gateway/ecr_authorization.go
+++ b/spinifex/gateway/ecr_authorization.go
@@ -6,7 +6,7 @@ import (
 
 	ecrregistry "github.com/mulgadc/spinifex/spinifex/domains/ecr/registry"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	"github.com/mulgadc/spinifex/spinifex/gateway/policy"
+	"github.com/mulgadc/spinifex/spinifex/foundation/aws/policy"
 )
 
 // ecrOperationAuthorization runs after ecrAuthBridge has rehydrated and
diff --git a/spinifex/gateway/gateway.go b/spinifex/gateway/gateway.go
index b97d963dc..fb7948125 100644
--- a/spinifex/gateway/gateway.go
+++ b/spinifex/gateway/gateway.go
@@ -31,11 +31,11 @@ import (
 	awsapi "github.com/mulgadc/spinifex/spinifex/domains/ecr/awsapi"
 	ecrregistry "github.com/mulgadc/spinifex/spinifex/domains/ecr/registry"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
+	"github.com/mulgadc/spinifex/spinifex/foundation/aws/policy"
 	"github.com/mulgadc/spinifex/spinifex/foundation/telemetry"
 	gateway_bedrock "github.com/mulgadc/spinifex/spinifex/gateway/bedrock"
 	gateway_ec2_instance "github.com/mulgadc/spinifex/spinifex/gateway/ec2/instance"
 	gateway_eks "github.com/mulgadc/spinifex/spinifex/gateway/eks"
-	"github.com/mulgadc/spinifex/spinifex/gateway/policy"
 	gateway_sts "github.com/mulgadc/spinifex/spinifex/gateway/sts"
 	handlers_iam "github.com/mulgadc/spinifex/spinifex/handlers/iam"
 	handlers_ochrevector "github.com/mulgadc/spinifex/spinifex/handlers/ochrevector"
diff --git a/spinifex/gateway/rds/authz_test.go b/spinifex/gateway/rds/authz_test.go
index 4f50ea66d..c54a45379 100644
--- a/spinifex/gateway/rds/authz_test.go
+++ b/spinifex/gateway/rds/authz_test.go
@@ -6,7 +6,7 @@ import (
 
 	"github.com/mulgadc/bluebottle/pkg/iampolicy"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	"github.com/mulgadc/spinifex/spinifex/gateway/policy"
+	"github.com/mulgadc/spinifex/spinifex/foundation/aws/policy"
 	handlers_rds "github.com/mulgadc/spinifex/spinifex/handlers/rds"
 	"github.com/mulgadc/spinifex/spinifex/utils"
 	"github.com/stretchr/testify/assert"
diff --git a/tests/integration/cross_tenant_test.go b/tests/integration/cross_tenant_test.go
index 2454e3873..92a3e538b 100644
--- a/tests/integration/cross_tenant_test.go
+++ b/tests/integration/cross_tenant_test.go
@@ -21,11 +21,11 @@ import (
 	acmawsapi "github.com/mulgadc/spinifex/spinifex/domains/acm/awsapi"
 	awsapi "github.com/mulgadc/spinifex/spinifex/domains/ecr/awsapi"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
+	"github.com/mulgadc/spinifex/spinifex/foundation/aws/policy"
 	gateway_ecs "github.com/mulgadc/spinifex/spinifex/gateway/ecs"
 	gateway_eks "github.com/mulgadc/spinifex/spinifex/gateway/eks"
 	gateway_elbv2 "github.com/mulgadc/spinifex/spinifex/gateway/elbv2"
 	gateway_iam "github.com/mulgadc/spinifex/spinifex/gateway/iam"
-	"github.com/mulgadc/spinifex/spinifex/gateway/policy"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )