From f72a1ab338129fef1c87bfdf9a4331c953d9ce25 Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Tue, 21 Jul 2026 12:53:01 +0200
Subject: [PATCH 1/6] global-functions: $ScriptInstallUpdate: support setting
 policy

---
 global-functions.rsc | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/global-functions.rsc b/global-functions.rsc
index ad981137..83a69335 100644
--- a/global-functions.rsc
+++ b/global-functions.rsc
@@ -1385,6 +1385,12 @@
          $ScriptVal->"name" ~ ("^(global-functions\\.d|mod)/.")) do={
       :set ReloadGlobal true;
     }
+
+    :local RequirePolicy ([ $ParseKeyValueStore [ $Grep $SourceNew ("\23 requires policy, ") ] ]->"policy");
+    :if ([ :len $RequirePolicy ] > 0 && $RequirePolicy != [ :tostr ($ScriptVal->"policy") ]) do={
+      $LogPrintOnce info $0 ("Updating policy for script: " . $ScriptVal->"name");
+      /system/script/set policy=[ :toarray delimiter=";" $RequirePolicy ] $Script;
+    }
   }
 
   :if ($ReloadGlobal = true) do={

From f11b1c66dad9610074ed4b60b7dc48531a2192f9 Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Tue, 21 Jul 2026 13:03:54 +0200
Subject: [PATCH 2/6] mode-button: require and set policy

---
 mode-button.rsc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mode-button.rsc b/mode-button.rsc
index 0870930b..bfe47ff5 100644
--- a/mode-button.rsc
+++ b/mode-button.rsc
@@ -5,6 +5,7 @@
 #
 # requires RouterOS, version=7.22
 # requires device-mode, scheduler
+# requires policy, policy=read;write
 #
 # act on multiple mode and reset button presses
 # https://rsc.eworm.de/doc/mode-button.md

From 90d0cd6c2e976dcf05008da1084a9feaa952f50b Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Tue, 21 Jul 2026 17:53:49 +0200
Subject: [PATCH 3/6] Revert "mode-button: require and set policy"

This reverts commit f11b1c66dad9610074ed4b60b7dc48531a2192f9.
---
 mode-button.rsc | 1 -
 1 file changed, 1 deletion(-)

diff --git a/mode-button.rsc b/mode-button.rsc
index bfe47ff5..0870930b 100644
--- a/mode-button.rsc
+++ b/mode-button.rsc
@@ -5,7 +5,6 @@
 #
 # requires RouterOS, version=7.22
 # requires device-mode, scheduler
-# requires policy, policy=read;write
 #
 # act on multiple mode and reset button presses
 # https://rsc.eworm.de/doc/mode-button.md

From d7703ef8027700da4b2ced09f8e22d2a2573264c Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Tue, 21 Jul 2026 12:53:01 +0200
Subject: [PATCH 4/6] global-functions: $ScriptInstallUpdate: support setting
 policy

---
 global-functions.rsc | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/global-functions.rsc b/global-functions.rsc
index ad981137..cd18cd6f 100644
--- a/global-functions.rsc
+++ b/global-functions.rsc
@@ -1377,8 +1377,14 @@
       :continue;
     }
 
+    :local RequirePolicy ([ $ParseKeyValueStore [ $Grep $SourceNew ("\23 requires policy, ") ] ]->"policy");
+    :if ([ :len $RequirePolicy ] > 0) do={
+      :set ($ScriptVal->"policy") [ :toarray delimiter=";" $RequirePolicy ];
+      $LogPrintOnce debug $0 ("New policy for script '" . $ScriptVal->"name" . "': " . $RequirePolicy);
+    }
+
     $LogPrint info $0 ("Updating script: " . $ScriptVal->"name");
-    /system/script/set owner=($ScriptVal->"name") \
+    /system/script/set owner=($ScriptVal->"name") policy=($ScriptVal->"policy") \
         source=[ $IfThenElse ($ScriptUpdatesCRLF = true) $SourceCRLF $SourceNew ] $Script;
     :if ($ScriptVal->"name" = "global-config" || \
          $ScriptVal->"name" = "global-functions" || \

From 015f793d9e93515225e767c5092eeaab8ea66fe1 Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Tue, 21 Jul 2026 13:03:54 +0200
Subject: [PATCH 5/6] mode-button: require and set policy

---
 mode-button.rsc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mode-button.rsc b/mode-button.rsc
index 0870930b..bfe47ff5 100644
--- a/mode-button.rsc
+++ b/mode-button.rsc
@@ -5,6 +5,7 @@
 #
 # requires RouterOS, version=7.22
 # requires device-mode, scheduler
+# requires policy, policy=read;write
 #
 # act on multiple mode and reset button presses
 # https://rsc.eworm.de/doc/mode-button.md

From f653b119ef012d09b77607bba724c330c4746cfa Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Tue, 21 Jul 2026 17:53:49 +0200
Subject: [PATCH 6/6] Revert "mode-button: require and set policy"

This reverts commit f11b1c66dad9610074ed4b60b7dc48531a2192f9.
---
 mode-button.rsc | 1 -
 1 file changed, 1 deletion(-)

diff --git a/mode-button.rsc b/mode-button.rsc
index bfe47ff5..0870930b 100644
--- a/mode-button.rsc
+++ b/mode-button.rsc
@@ -5,7 +5,6 @@
 #
 # requires RouterOS, version=7.22
 # requires device-mode, scheduler
-# requires policy, policy=read;write
 #
 # act on multiple mode and reset button presses
 # https://rsc.eworm.de/doc/mode-button.md