diff --git a/backend/src/services/approval-policy/pam-access/pam-access-policy-factory.ts b/backend/src/services/approval-policy/pam-access/pam-access-policy-factory.ts
index 2e6f9990f..f338cb97b 100644
--- a/backend/src/services/approval-policy/pam-access/pam-access-policy-factory.ts
+++ b/backend/src/services/approval-policy/pam-access/pam-access-policy-factory.ts
@@ -29,7 +29,7 @@ export const pamAccessPolicyFactory: TApprovalResourceFactory<
     for (const policy of policies) {
       const p = policy as TPamAccessPolicy;
       for (const c of p.conditions.conditions) {
-        if (!c.resourceIds.some((r) => r === inputs.resourceId)) {
+        if (c.resourceIds && !c.resourceIds.some((r) => r === inputs.resourceId)) {
           // eslint-disable-next-line no-continue
           continue;
         }
diff --git a/backend/src/services/approval-policy/pam-access/pam-access-policy-schemas.ts b/backend/src/services/approval-policy/pam-access/pam-access-policy-schemas.ts
index b76b2e271..2b1e95cef 100644
--- a/backend/src/services/approval-policy/pam-access/pam-access-policy-schemas.ts
+++ b/backend/src/services/approval-policy/pam-access/pam-access-policy-schemas.ts
@@ -19,7 +19,7 @@ export const PamAccessPolicyInputsSchema = z.object({
 // Conditions
 export const PamAccessPolicyConditionsSchema = z
   .object({
-    resourceIds: z.string().uuid().array(),
+    resourceIds: z.string().uuid().array().optional(),
     accountPaths: z.string().array() // TODO(andrey): Add path & wildcard validation
   })
   .array();