diff --git a/private/odsign.te b/private/odsign.te
index 0b2f187..3297af7 100644
--- a/private/odsign.te
+++ b/private/odsign.te
@@ -44,9 +44,9 @@
 allow odsign apex_art_data_file:dir { rw_dir_perms rmdir rename };
 allow odsign apex_art_data_file:file { rw_file_perms unlink };
 
-# For CompOS pending key files
-allow odsign apex_compos_data_file:dir { getattr search write remove_name };
-allow odsign apex_compos_data_file:file { r_file_perms unlink };
+# For CompOS instance & key files
+allow odsign apex_compos_data_file:dir rw_dir_perms;
+allow odsign apex_compos_data_file:file { r_file_perms unlink rename };
 
 # Run odrefresh to refresh ART artifacts
 domain_auto_trans(odsign, odrefresh_exec, odrefresh)