diff --git a/nm-wireguard-service.conf b/nm-wireguard-service.conf
index af24c59..2b00e0a 100644
--- a/nm-wireguard-service.conf
+++ b/nm-wireguard-service.conf
@@ -10,10 +10,9 @@
 		<allow own_prefix="org.freedesktop.NetworkManager.wireguard"/>
 		<allow send_destination="org.freedesktop.NetworkManager.wireguard"/>
 	</policy>
-	<!-- TODO deny per default -->
 	<policy context="default">
-		<allow own_prefix="org.freedesktop.NetworkManager.wireguard"/>
-		<allow send_destination="org.freedesktop.NetworkManager.wireguard"/>
+		<deny own_prefix="org.freedesktop.NetworkManager.wireguard"/>
+		<deny send_destination="org.freedesktop.NetworkManager.wireguard"/>
 	</policy>
 </busconfig>