diff --git a/policy/github.com/vex-generation-toolset/java-callgraph/source-policy.json b/policy/github.com/vex-generation-toolset/java-callgraph/source-policy.json
new file mode 100644
index 0000000..81f7a05
--- /dev/null
+++ b/policy/github.com/vex-generation-toolset/java-callgraph/source-policy.json
@@ -0,0 +1,14 @@
+{
+  "canonical_repo": "https://github.com/vex-generation-toolset/java-callgraph.git",
+  "protected_branches": [
+    {
+      "since": "2025-11-12T16:10:09.331Z",
+      "name": "main",
+      "target_slsa_source_level": "SLSA_SOURCE_LEVEL_3"
+    }
+  ],
+  "protected_tag": {
+    "since": "2025-11-12T16:10:09.331Z",
+    "tag_hygiene": true
+  }
+}
\ No newline at end of file