diff --git a/packages/blueprint-gatekeeper/app/policies/gatekeeper/account/create.js b/packages/blueprint-gatekeeper/app/policies/gatekeeper/account/create.js
index <HASH>..<HASH> 100644
--- a/packages/blueprint-gatekeeper/app/policies/gatekeeper/account/create.js
+++ b/packages/blueprint-gatekeeper/app/policies/gatekeeper/account/create.js
@@ -5,7 +5,21 @@ var blueprint  = require ('@onehilltech/blueprint')
   , gatekeeper = require ('../../../../lib')
   ;
 
-module.exports = Policy.any ([
-  Policy.assert ('gatekeeper.request.hasScope', gatekeeper.scope.account.create),
-  Policy.assert ('gatekeeper.isSuperUser')
+module.exports = Policy.all ([
+  /*
+   * Check the scope of the requester
+   */
+  Policy.any ([
+    Policy.assert ('gatekeeper.request.hasScope', gatekeeper.scope.account.create),
+    Policy.assert ('gatekeeper.isSuperUser')
+  ]),
+
+  /*
+   * Check the password policy. The password policy is optional. If an application
+   * wants to enable password policies, then they just need to overload this policy
+   * in their application.
+   */
+  Policy.assert ('?gatekeeper.account.password')
 ]);
+
+
Optional gatekeeper.account.password policy to enforcing password rules/policies