diff --git a/private/permissioncontroller_app.te b/private/permissioncontroller_app.te
index 15bb9e1..9b09ce3 100644
--- a/private/permissioncontroller_app.te
+++ b/private/permissioncontroller_app.te
@@ -3,6 +3,14 @@
 ###
 type permissioncontroller_app, domain;
 
+# Allow everything.
+# TODO(b/142672293): remove when no selinux denials are triggered for this
+# domain
+# STOPSHIP(b/142672293): monitor http://go/sedenials for any denials around
+# `permissioncontroller_app` and remove this line once we are confident about
+# this having the right set of permissions.
+userdebug_or_eng(`permissive permissioncontroller_app;')
+
 app_domain(permissioncontroller_app)
 
 # Allow interaction with gpuservice