diff --git a/packages/strapi-plugin-graphql/services/Mutation.js b/packages/strapi-plugin-graphql/services/Mutation.js
index 802abeb801..4c7dc44b11 100644
--- a/packages/strapi-plugin-graphql/services/Mutation.js
+++ b/packages/strapi-plugin-graphql/services/Mutation.js
@@ -29,9 +29,6 @@ module.exports = {
       queryName = action;
     }
 
-    // Retrieve policies.
-    const policies = _.get(handler, `Mutation.${queryName}.policies`, []);
-
     // Retrieve resolverOf.
     const resolverOf = _.get(handler, `Mutation.${queryName}.resolverOf`, '');
 
@@ -158,10 +155,21 @@ module.exports = {
       );
     }
 
+    // Retrieve policies.
+    let policies = [];
+
     if (strapi.plugins['users-permissions']) {
       policies.push('plugins.users-permissions.permissions');
     }
 
+    // Retrieve policies.
+    if (_.get(handler, `Mutation.${queryName}.policies`)) {
+      policies = _.concat(
+        policies,
+        _.get(handler, `Mutation.${queryName}.policies`)
+      );
+    }
+
     // Populate policies.
     policies.forEach(policy =>
       policyUtils.get(
diff --git a/packages/strapi-plugin-graphql/services/Query.js b/packages/strapi-plugin-graphql/services/Query.js
index 2c70215086..c024a3c988 100644
--- a/packages/strapi-plugin-graphql/services/Query.js
+++ b/packages/strapi-plugin-graphql/services/Query.js
@@ -91,9 +91,6 @@ module.exports = {
         : pluralize.plural(name);
     }
 
-    // Retrieve policies.
-    const policies = _.get(handler, `Query.${queryName}.policies`, []);
-
     // Retrieve resolverOf.
     const resolverOf = _.get(handler, `Query.${queryName}.resolverOf`, '');
 
@@ -235,10 +232,20 @@ module.exports = {
       );
     }
 
+    // Retrieve policies.
+    let policies = [];
+
     if (strapi.plugins['users-permissions']) {
       policies.push('plugins.users-permissions.permissions');
     }
 
+    if (_.get(handler, `Query.${queryName}.policies`)) {
+      policies = _.concat(
+        policies,
+        _.get(handler, `Query.${queryName}.policies`)
+      );
+    }
+
     // Populate policies.
     policies.forEach(policy =>
       policyUtils.get(