diff --git a/private/system_suspend.te b/private/system_suspend.te
index 7f343f2..217548f 100644
--- a/private/system_suspend.te
+++ b/private/system_suspend.te
@@ -3,8 +3,9 @@
 type system_suspend_exec, system_file_type, exec_type, file_type;
 init_daemon_domain(system_suspend)
 
-# To serve ISuspendControlService.aidl.
+# To serve ISuspendControlService and ISuspendControlServiceInternal.
 binder_use(system_suspend)
+add_service(system_suspend, system_suspend_control_internal_service)
 add_service(system_suspend, system_suspend_control_service)
 
 # Access to /sys/power/{ wakeup_count, state } suspend interface.
@@ -23,6 +24,15 @@
 neverallow {
     domain
     -atrace # tracing
+    -dumpstate # bug reports
+    -system_suspend # implements system_suspend_control_internal_service
+    -system_server # configures system_suspend via ISuspendControlServiceInternal
+    -traceur_app # tracing
+} system_suspend_control_internal_service:service_manager find;
+
+neverallow {
+    domain
+    -atrace # tracing
     -bluetooth # support Bluetooth activity attribution (BTAA)
     -dumpstate # bug reports
     -system_suspend # implements system_suspend_control_service