diff --git a/docs/admin/authorization.md b/docs/admin/authorization.md
index 3b521b5df1..ed8652fe47 100644
--- a/docs/admin/authorization.md
+++ b/docs/admin/authorization.md
@@ -147,7 +147,7 @@ kube-system full privilege to the API, you would add this line to your policy
 file:
 
 ```json
-{"apiVersion":"abac.authorization.kubernetes.io/v1beta1","kind":"Policy","user":"system:serviceaccount:kube-system:default","namespace":"*","resource":"*","apiGroup":"*"}
+{"apiVersion":"abac.authorization.kubernetes.io/v1beta1","kind":"Policy","spec":{"user":"system:serviceaccount:kube-system:default","namespace":"*","resource":"*","apiGroup":"*"}}
 ```
 
 The apiserver will need to be restarted to pickup the new policy lines.