diff --git a/drush/Commands/PolicyCommands.php b/drush/Commands/PolicyCommands.php
new file mode 100644
index 0000000000..85ee907a85
--- /dev/null
+++ b/drush/Commands/PolicyCommands.php
@@ -0,0 +1,39 @@
+<?php
+
+namespace Drush\Commands;
+
+use Consolidation\AnnotatedCommand\CommandData;
+use Drush\Commands\DrushCommands;
+
+/**
+ * Edit this file to reflect your organization's needs.
+ */
+class PolicyCommands extends DrushCommands {
+
+  /**
+   * Prevent catastrophic braino. Note that this file has to be local to the
+   * machine that initiates the sql:sync command.
+   *
+   * @hook validate sql:sync
+   *
+   * @throws \Exception
+   */
+  public function sqlSyncValidate(CommandData $commandData) {
+    if ($commandData->input()->getArgument('destination') == '@prod') {
+      throw new \Exception(dt('Per !file, you may never overwrite the production database.', ['!file' => __FILE__]));
+    }
+  }
+
+  /**
+   * Limit rsync operations to production site.
+   *
+   * @hook validate core:rsync
+   *
+   * @throws \Exception
+   */
+  public function rsyncValidate(CommandData $commandData) {
+    if (preg_match("/^@prod/", $commandData->input()->getArgument('destination'))) {
+      throw new \Exception(dt('Per !file, you may never rsync to the production site.', ['!file' => __FILE__]));
+    }
+  }
+}
diff --git a/drush/drush.yml b/drush/drush.yml
new file mode 100644
index 0000000000..de78500f05
--- /dev/null
+++ b/drush/drush.yml
@@ -0,0 +1,6 @@
+#
+# A Drush configuration file
+#
+# Docs at https://github.com/drush-ops/drush/blob/master/examples/example.drush.yml
+#
+# Edit or remove this file as needed.
\ No newline at end of file
diff --git a/drush/policy.drush.inc b/drush/policy.drush.inc
deleted file mode 100644
index 64cd62d0f6..0000000000
--- a/drush/policy.drush.inc
+++ /dev/null
@@ -1,38 +0,0 @@
-<?php
-
-/*
- * Customize this file as desired. See https://github.com/drush-ops/drush/blob/8.x/examples/policy.drush.inc for documentation.
- */
-
-/**
- * Implements drush_hook_COMMAND_validate().
- *
- * Encourage folks to use `composer` instead of Drush pm commands
- */
-function drush_policy_pm_updatecode_validate() {
-  return _deny_message();
-}
-
-function drush_policy_pm_update_validate() {
-  return _deny_message();
-}
-
-function drush_policy_pm_download_validate() {
-  return _deny_message();
-}
-
-function _deny_message() {
-  if (!drush_get_option('pm-force')) {
-    $msg = 'This codebase is assembled with Composer instead of Drush. Use `composer update` and `composer require` instead of `drush pm-updatecode` and `drush pm-download`. You may override this error by using the --pm-force option.';
-    return drush_set_error('POLICY_PM_DENY', dt($msg));
-  }
-}
-
-/**
- * Implements hook_drush_help_alter().
- */
-function policy_drush_help_alter(&$command) {
-  if (in_array($command['command'], array('pm-updatecode', 'pm-update', 'pm-download'))) {
-    $command['options']['pm-force'] = 'Override site policy and allow Drush codebase management (pm-* commands)';
-  }
-}
diff --git a/drush/sites/self.site.yml b/drush/sites/self.site.yml
new file mode 100644
index 0000000000..cf57d09cf5
--- /dev/null
+++ b/drush/sites/self.site.yml
@@ -0,0 +1,14 @@
+# Edit or remove this file as needed.
+# Docs at https://github.com/drush-ops/drush/blob/master/examples/example.site.yml
+
+#prod:
+#  host: prod.domain.com
+#  user: www-admin
+#  root: /path/to/drupal
+#  uri: http://www.example.com
+#
+#stage:
+#  host: stage.domain.com
+#  user: www-admin
+#  root: /path/to/drupal
+#  uri: http://stage.example.com
\ No newline at end of file