diff --git a/policy_manager/variable.h b/policy_manager/variable.h
index 7dcb5b9..29fa546 100644
--- a/policy_manager/variable.h
+++ b/policy_manager/variable.h
@@ -39,6 +39,10 @@
   virtual ~Variable() {}
 
  protected:
+  // Only allow to get values through the EvaluationContext class and not
+  // directly from the variable.
+  friend class EvaluationContext;
+
   friend class PmRealRandomProviderTest;
   FRIEND_TEST(PmRealRandomProviderTest, GetRandomValues);