diff --git a/agent/structs/acl_templated_policy.go b/agent/structs/acl_templated_policy.go
index 868126b2385..26774fbd356 100644
--- a/agent/structs/acl_templated_policy.go
+++ b/agent/structs/acl_templated_policy.go
@@ -43,6 +43,7 @@ const (
 	ACLTemplatedPolicyNomadClientID = "00000000-0000-0000-0000-000000000009"
 	ACLTemplatedPolicyAllowServiceID = "00000000-0000-0000-0000-000000000010"
 	ACLTemplatedPolicyAllowPathID    = "00000000-0000-0000-0000-000000000011"
+	ACLTemplatedPolicyEnableAgentID  = "00000000-0000-0000-0000-000000000012"
 
 	ACLTemplatedPolicyServiceDescription     = "Gives the token or role permissions to register a service and discover services in the Consul catalog. It also gives the specified service's sidecar proxy the permission to discover and route traffic to other services."
 	ACLTemplatedPolicyNodeDescription        = "Gives the token or role permissions for a register an agent/node into the catalog. A node is typically a consul agent but can also be a physical server, cloud instance or a container."
@@ -52,6 +53,7 @@ const (
 	ACLTemplatedPolicyNomadClientDescription = "Gives the token or role permissions required for integration with a nomad client."
 	ACLTemplatedPolicyAllowServiceDescription = "Grants write access to a service prefix"
 	ACLTemplatedPolicyAllowPathDescription    = "Grants write access to a key prefix"
+	ACLTemplatedPolicyEnableAgentDescription  = "Grants write access to agent and node prefixes"
 
 	ACLTemplatedPolicyNoRequiredVariablesSchema = "" // catch-all schema for all templated policy that don't require a schema
 )
@@ -126,6 +128,13 @@ var (
 			Template:     ACLTemplatedPolicyAllowPath,
 			Description:  ACLTemplatedPolicyAllowPathDescription,
 		},
+		api.ACLTemplatedPolicyEnableAgentName: {
+			TemplateID:   ACLTemplatedPolicyEnableAgentID,
+			TemplateName: api.ACLTemplatedPolicyEnableAgentName,
+			Schema:       ACLTemplatedPolicyServiceSchema,
+			Template:     ACLTemplatedPolicyEnableAgent,
+			Description:  ACLTemplatedPolicyEnableAgentDescription,
+		},
 	}
 )
 
diff --git a/agent/structs/acl_templated_policy_ce.go b/agent/structs/acl_templated_policy_ce.go
index f3379c08eb4..bc76d2f58de 100644
--- a/agent/structs/acl_templated_policy_ce.go
+++ b/agent/structs/acl_templated_policy_ce.go
@@ -31,6 +31,9 @@ var ACLTemplatedPolicyAllowService string
 //go:embed acltemplatedpolicy/policies/ce/allow_path.hcl
 var ACLTemplatedPolicyAllowPath string
 
+//go:embed acltemplatedpolicy/policies/ce/enable_agent.hcl
+var ACLTemplatedPolicyEnableAgent string
+
 func (t *ACLToken) TemplatedPolicyList() []*ACLTemplatedPolicy {
 	if len(t.TemplatedPolicies) == 0 {
 		return nil
diff --git a/agent/structs/acl_templated_policy_ce_test.go b/agent/structs/acl_templated_policy_ce_test.go
index 3b51f607639..656e27169ee 100644
--- a/agent/structs/acl_templated_policy_ce_test.go
+++ b/agent/structs/acl_templated_policy_ce_test.go
@@ -140,6 +140,26 @@ service "api" {
 service_prefix "api-" {
   policy = "write"
 }
+`,
+			},
+		},
+		"criteo-enable-agent-template": {
+			templatedPolicy: &ACLTemplatedPolicy{
+				TemplateID:   ACLTemplatedPolicyEnableAgentID,
+				TemplateName: api.ACLTemplatedPolicyEnableAgentName,
+				TemplateVariables: &ACLTemplatedPolicyVariables{
+					Name: "api",
+				},
+			},
+			expectedPolicy: &ACLPolicy{
+				Description: "synthetic policy generated from templated policy: criteo/enable_agent",
+				Rules: `
+agent_prefix "api" {
+  policy = "write"
+}
+node_prefix "api" {
+  policy = "write"
+}
 `,
 			},
 		},
diff --git a/agent/structs/acltemplatedpolicy/policies/ce/enable_agent.hcl b/agent/structs/acltemplatedpolicy/policies/ce/enable_agent.hcl
new file mode 100644
index 00000000000..602d88b29a1
--- /dev/null
+++ b/agent/structs/acltemplatedpolicy/policies/ce/enable_agent.hcl
@@ -0,0 +1,7 @@
+
+agent_prefix "{{ .Name }}" {
+  policy = "write"
+}
+node_prefix "{{ .Name }}" {
+  policy = "write"
+}
diff --git a/api/acl.go b/api/acl.go
index d39b54312ff..9c8346ce75d 100644
--- a/api/acl.go
+++ b/api/acl.go
@@ -29,6 +29,7 @@ const (
 	ACLTemplatedPolicyNomadClientName = "builtin/nomad-client"
 	ACLTemplatedPolicyAllowServiceName = "criteo/allow_service"
 	ACLTemplatedPolicyAllowPathName    = "criteo/allow_path"
+	ACLTemplatedPolicyEnableAgentName  = "criteo/enable_agent"
 )
 
 type ACLLink struct {
diff --git a/version/VERSION b/version/VERSION
index 6064acd4d2b..3aa1d07f737 100644
--- a/version/VERSION
+++ b/version/VERSION
@@ -1 +1 @@
-1.22.3-criteo1
+1.22.3-criteo2