diff --git a/src/gam/__init__.py b/src/gam/__init__.py
index 38f8bd2c..078979e1 100755
--- a/src/gam/__init__.py
+++ b/src/gam/__init__.py
@@ -10556,7 +10556,12 @@ Continue to authorization by entering a 'c'
   else:
     i = 0
     for a_scope in scopesList:
-      selectedScopes[i] = ' ' if a_scope.get('offByDefault', False) else '*'
+      if a_scope.get('offByDefault'):
+        selectedScopes[i] = ' '
+      elif a_scope.get('roByDefault'):
+        selectedScopes[i] = 'R'
+      else:
+        selectedScopes[i] = '*'
       i += 1
   prompt = f'\nPlease enter 0-{numScopes-1}[a|r] or {"|".join(OAUTH2_CMDS)}: '
   while True:
diff --git a/src/gam/gamlib/glapi.py b/src/gam/gamlib/glapi.py
index 9cb70e40..1ea6b378 100644
--- a/src/gam/gamlib/glapi.py
+++ b/src/gam/gamlib/glapi.py
@@ -368,8 +368,9 @@ _CLIENT_SCOPES = [
    'scope': 'https://www.googleapis.com/auth/cloud-identity.orgunits'},
   {'name': 'Cloud Identity - Policy',
    'api': CLOUDIDENTITY_POLICY,
-   'subscopes': [],
-   'scope': 'https://www.googleapis.com/auth/cloud-identity.policies.readonly'
+   'subscopes': READONLY,
+   'scope': 'https://www.googleapis.com/auth/cloud-identity.policies',
+   'roByDefault': True,
   },
   {'name': 'Cloud Identity User Invitations API',
    'api': CLOUDIDENTITY_USERINVITATIONS,
@@ -491,6 +492,7 @@ _CLIENT_SCOPES = [
   {'name': 'Site Verification API',
    'api': SITEVERIFICATION,
    'subscopes': [],
+   'offByDefault': True,
    'scope': 'https://www.googleapis.com/auth/siteverification'},
   {'name': 'Sites API',
    'api': SITES,