diff --git a/repos/gems/run/driver_manager.run b/repos/gems/run/driver_manager.run
index 5a619f9854..d799f7be6b 100644
--- a/repos/gems/run/driver_manager.run
+++ b/repos/gems/run/driver_manager.run
@@ -53,9 +53,10 @@ install_config {
 			<service name="ROM" label_last="numlock_remap">
 				<parent label="numlock_remap.config"/> </service>
 			<service name="ROM" label="config"> <parent label="drivers.config"/> </service>
-			<service name="ROM" label="capslock"> <child name="dynamic_rom"/> </service>
-			<service name="ROM" label="numlock">  <child name="dynamic_rom"/> </service>
-			<service name="ROM" label="system">   <child name="dynamic_rom"/> </service>
+			<service name="ROM" label="capslock">  <child name="dynamic_rom"/> </service>
+			<service name="ROM" label="numlock">   <child name="dynamic_rom"/> </service>
+			<service name="ROM" label="system">    <child name="dynamic_rom"/> </service>
+			<service name="ROM" label="usb_policy"><child name="dynamic_rom"/> </service>
 			<service name="Timer">  <child name="timer"/> </service>
 			<service name="Report"> <child name="report_rom"/> </service>
 			<any-service> <parent/> </any-service>
@@ -118,6 +119,10 @@ puts $fd {
 </config>}
 close $fd
 
+set fd [open [run_dir]/genode/usb_policy "w"]
+puts $fd {<usb/>}
+close $fd
+
 
 #
 # Override 'drivers.config' as supplied with the 'drivers_managed-pc' pkg
diff --git a/repos/gems/run/sculpt.run b/repos/gems/run/sculpt.run
index b6b451a082..db3bd3175b 100644
--- a/repos/gems/run/sculpt.run
+++ b/repos/gems/run/sculpt.run
@@ -102,6 +102,7 @@ install_config {
 				<rom name="leitzentrale.config"  as="leitzentrale"/>
 				<rom name="drivers.config"       as="drivers"/>
 				<rom name="manual_deploy.config" as="deploy"/>
+				<rom name="usb.config"           as="usb"/>
 				<rom name="en_us.chargen"/>
 				<rom name="de.chargen"/>
 				<rom name="de_ch.chargen"/>
@@ -235,6 +236,8 @@ install_config {
 				<child name="config_fs_rom" label="managed/fb_drv"/> </service>
 			<service name="ROM" label_last="numlock_remap.config">
 				<child name="config_fs_rom" label="numlock_remap"/> </service>
+			<service name="ROM" label_last="usb_policy">
+				<child name="config_fs_rom" label="usb"/> </service>
 			<service name="ROM" label_last="numlock">  <child name="report_rom"/> </service>
 			<service name="Timer"> <child name="timer"/> </service>
 			<service name="Report"> <child name="fs_report"/> </service>
diff --git a/repos/gems/run/sculpt/usb.config b/repos/gems/run/sculpt/usb.config
new file mode 100644
index 0000000000..7d42895d9c
--- /dev/null
+++ b/repos/gems/run/sculpt/usb.config
@@ -0,0 +1,13 @@
+<!--
+  Manually maintained rules for assigning USB devices to clients.
+
+  The content is indented with two tabs because it is incorporated as is
+  into the <raw> sub node of the the USB driver configuration.
+  -->
+
+<usb>
+
+		<!-- rule for flashing the ergodox firmware
+		<policy label_suffix="teensy" vendor_id="0x16c0" product_id="0x0478"/>
+		-->
+</usb>
diff --git a/repos/gems/src/app/driver_manager/main.cc b/repos/gems/src/app/driver_manager/main.cc
index f75d229e4c..170a98d727 100644
--- a/repos/gems/src/app/driver_manager/main.cc
+++ b/repos/gems/src/app/driver_manager/main.cc
@@ -316,6 +316,7 @@ struct Driver_manager::Main : Block_devices_generator
 
 	Attached_rom_dataspace _platform    { _env, "platform_info" };
 	Attached_rom_dataspace _usb_devices { _env, "usb_devices" };
+	Attached_rom_dataspace _usb_policy  { _env, "usb_policy"  };
 	Attached_rom_dataspace _pci_devices { _env, "pci_devices" };
 	Attached_rom_dataspace _ahci_ports  { _env, "ahci_ports"  };
 	Attached_rom_dataspace _nvme_ns     { _env, "nvme_ns"     };
@@ -349,6 +350,9 @@ struct Driver_manager::Main : Block_devices_generator
 	Signal_handler<Main> _usb_devices_update_handler {
 		_env.ep(), *this, &Main::_handle_usb_devices_update };
 
+	Signal_handler<Main> _usb_policy_update_handler {
+		_env.ep(), *this, &Main::_handle_usb_devices_update };
+
 	void _handle_ahci_ports_update();
 
 	Signal_handler<Main> _ahci_ports_update_handler {
@@ -365,7 +369,7 @@ struct Driver_manager::Main : Block_devices_generator
 	};
 
 	void _generate_init_config    (Reporter &) const;
-	void _generate_usb_drv_config (Reporter &, Xml_node) const;
+	void _generate_usb_drv_config (Reporter &, Xml_node, Xml_node) const;
 	void _generate_block_devices  (Reporter &) const;
 
 	Ahci_driver::Default_label _default_block_device() const;
@@ -383,11 +387,14 @@ struct Driver_manager::Main : Block_devices_generator
 
 		_pci_devices.sigh(_pci_devices_update_handler);
 		_usb_devices.sigh(_usb_devices_update_handler);
+		_usb_policy .sigh(_usb_policy_update_handler);
 		_ahci_ports .sigh(_ahci_ports_update_handler);
 		_nvme_ns    .sigh(_nvme_ns_update_handler);
 
 		_generate_init_config(_init_config);
-		_generate_usb_drv_config(_usb_drv_config, Xml_node("<devices/>"));
+		_generate_usb_drv_config(_usb_drv_config,
+		                         Xml_node("<devices/>"),
+		                         Xml_node("<usb/>"));
 
 		_handle_pci_devices_update();
 		_handle_usb_devices_update();
@@ -494,8 +501,9 @@ void Driver_manager::Main::_handle_nvme_ns_update()
 void Driver_manager::Main::_handle_usb_devices_update()
 {
 	_usb_devices.update();
+	_usb_policy.update();
 
-	_generate_usb_drv_config(_usb_drv_config, _usb_devices.xml());
+	_generate_usb_drv_config(_usb_drv_config, _usb_devices.xml(), _usb_policy.xml());
 }
 
 
@@ -635,7 +643,8 @@ void Driver_manager::Main::_generate_block_devices(Reporter &block_devices) cons
 
 
 void Driver_manager::Main::_generate_usb_drv_config(Reporter &usb_drv_config,
-                                                    Xml_node devices) const
+                                                    Xml_node devices,
+                                                    Xml_node policy) const
 {
 	Reporter::Xml_generator xml(usb_drv_config, [&] () {
 
@@ -648,6 +657,9 @@ void Driver_manager::Main::_generate_usb_drv_config(Reporter &usb_drv_config,
 		xml.node("raw", [&] () {
 			xml.node("report", [&] () { xml.attribute("devices", true); });
 
+			/* incorporate user-managed policy */
+			xml.append(policy.content_base(), policy.content_size());
+
 			devices.for_each_sub_node("device", [&] (Xml_node device) {
 
 				typedef String<64> Label;