diff --git a/private/shell.te b/private/shell.te
index d613a94..6d6e06f 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -262,6 +262,7 @@
 get_prop(shell, build_attestation_prop)
 
 # Allow shell to execute oatdump.
+# TODO (b/350628688): Remove this once it's safe to do so.
 allow shell oatdump_exec:file rx_file_perms;
 
 # Allow shell access to socket for test