diff --git a/msic/dbus-conf/org.deepin.dde.Face1.conf b/msic/dbus-conf/org.deepin.dde.Face1.conf
index 2029549..a01bf1b 100644
--- a/msic/dbus-conf/org.deepin.dde.Face1.conf
+++ b/msic/dbus-conf/org.deepin.dde.Face1.conf
@@ -10,14 +10,28 @@
     <allow own="org.deepin.dde.Face1"/>
   </policy>
 
-  <!-- Allow anyone to invoke methods on the interfaces -->
+  <!-- Default: deny all Face1 methods, allow standard dbus interfaces -->
   <policy context="default">
-    <allow send_destination="org.deepin.dde.Face1"/>
+    <allow send_destination="org.deepin.dde.Face1"
+           send_interface="org.freedesktop.DBus.Introspectable"/>
+    <allow send_destination="org.deepin.dde.Face1"
+           send_interface="org.freedesktop.DBus.Peer"/>
+    <allow send_destination="org.deepin.dde.Face1"
+           send_interface="org.freedesktop.DBus.Properties"/>
+    <deny send_destination="org.deepin.dde.Face1"
+          send_interface="org.deepin.dde.Face1"/>
+  </policy>
 
+  <!-- deepin-daemon group can call everything -->
+  <policy group="deepin-daemon">
+    <allow send_destination="org.deepin.dde.Face1"/>
+    <allow receive_sender="org.deepin.dde.Face1"/>
   </policy>
-  <policy user="deepin-daemon">
-    <allow own="org.deepin.dde.Face1"/>
-    <allow send_destination="org.deepin.dde.Face1" />
+
+  <!-- Root can call everything -->
+  <policy user="root">
+    <allow send_destination="org.deepin.dde.Face1"/>
+    <allow receive_sender="org.deepin.dde.Face1"/>
   </policy>
 
 </busconfig>