diff --git a/acl/acl_test.go b/acl/acl_test.go
index 6872b04f13..1b83c81dec 100644
--- a/acl/acl_test.go
+++ b/acl/acl_test.go
@@ -245,6 +245,7 @@ func TestPolicyACL(t *testing.T) {
 		}
 	}
 
+	// Test the events
 	type eventcase struct {
 		inp   string
 		read  bool
@@ -369,3 +370,30 @@ func TestPolicyACL_Parent(t *testing.T) {
 		}
 	}
 }
+
+func TestPolicyACL_Keyring(t *testing.T) {
+	// Test keyring ACLs
+	type keyringcase struct {
+		inp   string
+		read  bool
+		write bool
+	}
+	keyringcases := []keyringcase{
+		{"", false, false},
+		{KeyringPolicyRead, true, false},
+		{KeyringPolicyWrite, true, true},
+		{KeyringPolicyDeny, false, false},
+	}
+	for _, c := range keyringcases {
+		acl, err := New(DenyAll(), &Policy{Keyring: c.inp})
+		if err != nil {
+			t.Fatalf("bad: %s", err)
+		}
+		if acl.KeyringRead() != c.read {
+			t.Fatalf("bad: %#v", c)
+		}
+		if acl.KeyringWrite() != c.write {
+			t.Fatalf("bad: %#v", c)
+		}
+	}
+}