diff --git a/management/server/http/policies_handler.go b/management/server/http/policies_handler.go
index ca256a183..eff9092d4 100644
--- a/management/server/http/policies_handler.go
+++ b/management/server/http/policies_handler.go
@@ -128,7 +128,7 @@ func (h *Policies) savePolicy(w http.ResponseWriter, r *http.Request, accountID
 		Description: req.Description,
 	}
 	for _, rule := range req.Rules {
-		ruleID := policyID // TODO: when policy can contain multiple rules, need refactor
+		var ruleID string
 		if rule.Id != nil {
 			ruleID = *rule.Id
 		}
diff --git a/management/server/policy.go b/management/server/policy.go
index 693ae2872..2d3abc3f1 100644
--- a/management/server/policy.go
+++ b/management/server/policy.go
@@ -532,7 +532,7 @@ func validatePolicy(ctx context.Context, transaction Store, accountID string, po
 	for i, rule := range policy.Rules {
 		ruleCopy := rule.Copy()
 		if ruleCopy.ID == "" {
-			ruleCopy.ID = xid.New().String()
+			ruleCopy.ID = policy.ID // TODO: when policy can contain multiple rules, need refactor
 			ruleCopy.PolicyID = policy.ID
 		}