diff --git a/services/camera/libcameraservice/CameraService.cpp b/services/camera/libcameraservice/CameraService.cpp
index f0bcc0b..ea19aa2 100644
--- a/services/camera/libcameraservice/CameraService.cpp
+++ b/services/camera/libcameraservice/CameraService.cpp
@@ -872,6 +872,32 @@
         /*inout*/int& clientPid) const {
 
     int callingPid = getCallingPid();
+
+#if !defined(__BRILLO__)
+    status_t allowed = validateClientPermissionsLocked(cameraId, clientUid, clientPid);
+    if (allowed != OK) {
+        return allowed;
+    }
+#endif  // defined(__BRILLO__)
+
+    if (!mModule) {
+        ALOGE("CameraService::connect X (PID %d) rejected (camera HAL module not loaded)",
+                callingPid);
+        return -ENODEV;
+    }
+
+    if (getCameraState(cameraId) == nullptr) {
+        ALOGE("CameraService::connect X (PID %d) rejected (invalid camera ID %s)", callingPid,
+                cameraId.string());
+        return -ENODEV;
+    }
+
+    return checkIfDeviceIsUsable(cameraId);
+}
+
+status_t CameraService::validateClientPermissionsLocked(const String8& cameraId, int& clientUid,
+        int& clientPid) const {
+    int callingPid = getCallingPid();
     int callingUid = getCallingUid();
 
     // Check if we can trust clientUid
@@ -903,18 +929,7 @@
     // connected to camera service directly.
     clientPid = callingPid;
 
-    if (!mModule) {
-        ALOGE("CameraService::connect X (PID %d) rejected (camera HAL module not loaded)",
-                callingPid);
-        return -ENODEV;
-    }
-
-    if (getCameraState(cameraId) == nullptr) {
-        ALOGE("CameraService::connect X (PID %d) rejected (invalid camera ID %s)", callingPid,
-                cameraId.string());
-        return -ENODEV;
-    }
-
+    // Check device policy for this camera
     userid_t clientUserId = multiuser_get_user_id(clientUid);
 
     // Only allow clients who are being used by the current foreground device user, unless calling
@@ -926,7 +941,7 @@
         return PERMISSION_DENIED;
     }
 
-    return checkIfDeviceIsUsable(cameraId);
+    return OK;
 }
 
 status_t CameraService::checkIfDeviceIsUsable(const String8& cameraId) const {
diff --git a/services/camera/libcameraservice/CameraService.h b/services/camera/libcameraservice/CameraService.h
index 66de77f..5616838 100644
--- a/services/camera/libcameraservice/CameraService.h
+++ b/services/camera/libcameraservice/CameraService.h
@@ -490,6 +490,8 @@
     // Check if we can connect, before we acquire the service lock.
     status_t validateConnectLocked(const String8& cameraId, /*inout*/int& clientUid,
             /*inout*/int& clientPid) const;
+    status_t validateClientPermissionsLocked(const String8& cameraId, /*inout*/int& clientUid,
+            /*inout*/int& clientPid) const;
 
     // Handle active client evictions, and update service state.
     // Only call with with mServiceLock held.