diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index 23594b8..c2ef14c 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -189,7 +189,7 @@
   -hal_omx_hwservice
   -hal_cas_hwservice
   -hal_neuralnetworks_hwservice
-  -untrusted_app_visible_hwservice
+  -untrusted_app_visible_hwservice_violators
 }:hwservice_manager find;
 
 # Make sure that the following services are never accessible by untrusted_apps
@@ -259,7 +259,7 @@
     -hal_neuralnetworks_server
     -hal_omx_server
     -binder_in_vendor_violators # TODO(b/35870313): Remove once all violations are gone
-    -untrusted_app_visible_halserver
+    -untrusted_app_visible_halserver_violators
   }:binder { call transfer };
 ')
 
diff --git a/private/technical_debt.cil b/private/technical_debt.cil
index b04e5e0..35db2b3 100644
--- a/private/technical_debt.cil
+++ b/private/technical_debt.cil
@@ -40,3 +40,13 @@
 ; Unfortunately, we can't currently express this in module policy language:
 ;     typeattribute { appdomain -isolated_app } hal_neuralnetworks_client;
 (typeattributeset hal_neuralnetworks_client ((and (appdomain) ((not (isolated_app))))))
+
+; TODO(b/112056006): move these to mapping files when/if we implement 'versioned' attributes.
+; Rename untrusted_app_visible_* to untrusted_app_visible_*_violators.
+; Unfortunately, we can't currently express this in module policy language:
+;     typeattribute untrusted_app_visible_hwservice untrusted_app_visible_hwservice_violators;
+;     typeattribute untrusted_app_visible_halserver untrusted_app_visible_halserver_violators;
+(typeattribute untrusted_app_visible_hwservice)
+(typeattributeset untrusted_app_visible_hwservice_violators (untrusted_app_visible_hwservice))
+(typeattribute untrusted_app_visible_halserver)
+(typeattributeset untrusted_app_visible_halserver_violators (untrusted_app_visible_halserver))