diff --git a/android/neverallow.go b/android/neverallow.go
index 8355bb3..3d1454e 100644
--- a/android/neverallow.go
+++ b/android/neverallow.go
@@ -177,7 +177,7 @@
 
 	osClass := ctx.Module().Target().Os.Class
 
-	for _, r := range neverallows {
+	for _, r := range neverallowRules(ctx.Config()) {
 		n := r.(*rule)
 		if !n.appliesToPath(dir) {
 			continue
@@ -551,3 +551,19 @@
 
 	panic("Can't handle type: " + value.Kind().String())
 }
+
+var neverallowRulesKey = NewOnceKey("neverallowRules")
+
+func neverallowRules(config Config) []Rule {
+	return config.Once(neverallowRulesKey, func() interface{} {
+		// No test rules were set by setTestNeverallowRules, use the global rules
+		return neverallows
+	}).([]Rule)
+}
+
+// Overrides the default neverallow rules for the supplied config.
+//
+// For testing only.
+func setTestNeverallowRules(config Config, testRules []Rule) {
+	config.Once(neverallowRulesKey, func() interface{} { return testRules })
+}