diff --git a/services/src/main/java/org/keycloak/authorization/admin/PolicyResourceService.java b/services/src/main/java/org/keycloak/authorization/admin/PolicyResourceService.java
index 003db4cb3e..faafe11875 100644
--- a/services/src/main/java/org/keycloak/authorization/admin/PolicyResourceService.java
+++ b/services/src/main/java/org/keycloak/authorization/admin/PolicyResourceService.java
@@ -70,6 +70,10 @@ public class PolicyResourceService {
     public Response update(String payload) {
         this.auth.requireManage();
 
+        if (policy == null) {
+            return Response.status(Status.NOT_FOUND).build();
+        }
+
         doUpdate(policy, payload);
 
         return Response.status(Status.CREATED).build();
@@ -102,6 +106,11 @@ public class PolicyResourceService {
     @DELETE
     public Response delete() {
         this.auth.requireManage();
+
+        if (policy == null) {
+            return Response.status(Status.NOT_FOUND).build();
+        }
+
         StoreFactory storeFactory = authorization.getStoreFactory();
         PolicyStore policyStore = storeFactory.getPolicyStore();
         PolicyProviderAdminService resource = getPolicyProviderAdminResource(policy.getType());
@@ -132,6 +141,11 @@ public class PolicyResourceService {
     @NoCache
     public Response findById() {
         this.auth.requireView();
+
+        if (policy == null) {
+            return Response.status(Status.NOT_FOUND).build();
+        }
+
         return Response.ok(toRepresentation(policy)).build();
     }
 
@@ -145,6 +159,11 @@ public class PolicyResourceService {
     @NoCache
     public Response getDependentPolicies() {
         this.auth.requireView();
+
+        if (policy == null) {
+            return Response.status(Status.NOT_FOUND).build();
+        }
+
         List<Policy> policies = authorization.getStoreFactory().getPolicyStore().findDependentPolicies(policy.getId(), resourceServer.getId());
 
         return Response.ok(policies.stream().map(policy -> {
@@ -164,6 +183,11 @@ public class PolicyResourceService {
     @NoCache
     public Response getScopes() {
         this.auth.requireView();
+
+        if (policy == null) {
+            return Response.status(Status.NOT_FOUND).build();
+        }
+
         return Response.ok(policy.getScopes().stream().map(scope -> {
             ScopeRepresentation representation = new ScopeRepresentation();
 
@@ -181,6 +205,10 @@ public class PolicyResourceService {
     public Response getResources() {
         this.auth.requireView();
 
+        if (policy == null) {
+            return Response.status(Status.NOT_FOUND).build();
+        }
+
         return Response.ok(policy.getResources().stream().map(resource -> {
             ResourceRepresentation representation = new ResourceRepresentation();
 
@@ -198,6 +226,10 @@ public class PolicyResourceService {
     public Response getAssociatedPolicies() {
         this.auth.requireView();
 
+        if (policy == null) {
+            return Response.status(Status.NOT_FOUND).build();
+        }
+
         return Response.ok(policy.getAssociatedPolicies().stream().map(policy -> {
             PolicyRepresentation representation1 = new PolicyRepresentation();
 
diff --git a/services/src/main/java/org/keycloak/authorization/admin/PolicyService.java b/services/src/main/java/org/keycloak/authorization/admin/PolicyService.java
index 3151b494c3..66a3d1abf7 100644
--- a/services/src/main/java/org/keycloak/authorization/admin/PolicyService.java
+++ b/services/src/main/java/org/keycloak/authorization/admin/PolicyService.java
@@ -72,7 +72,6 @@ public class PolicyService {
 
     @Path("{type}")
     public Object getResource(@PathParam("type") String type) {
-        this.auth.requireManage();
         PolicyProviderFactory providerFactory = authorization.getProviderFactory(type);
 
         if (providerFactory != null) {
@@ -81,10 +80,6 @@ public class PolicyService {
 
         Policy policy = authorization.getStoreFactory().getPolicyStore().findById(type, resourceServer.getId());
 
-        if (policy == null) {
-            return Response.status(Status.NOT_FOUND).build();
-        }
-
         return doCreatePolicyResource(policy);
     }