diff --git a/api/config/appstudio.redhat.com_enterprisecontractpolicies.yaml b/api/config/appstudio.redhat.com_enterprisecontractpolicies.yaml
index e243b43..c41b1b7 100644
--- a/api/config/appstudio.redhat.com_enterprisecontractpolicies.yaml
+++ b/api/config/appstudio.redhat.com_enterprisecontractpolicies.yaml
@@ -85,6 +85,22 @@ spec:
                   items:
                     description: Source defines policies and data that are evaluated together
                     properties:
+                      config:
+                        description: Config specifies which policy rules are included, or excluded, from the provided policy source urls.
+                        properties:
+                          exclude:
+                            description: Exclude is a set of policy exclusions that, in case of failure, do not block the success of the outcome.
+                            items:
+                              type: string
+                            type: array
+                            x-kubernetes-list-type: set
+                          include:
+                            description: Include is a set of policy inclusions that are added to the policy evaluation. These take precedence over policy exclusions.
+                            items:
+                              type: string
+                            type: array
+                            x-kubernetes-list-type: set
+                        type: object
                       data:
                         description: List of go-getter style policy data source urls
                         items:
diff --git a/api/v1alpha1/enterprisecontractpolicy_types.go b/api/v1alpha1/enterprisecontractpolicy_types.go
index 38d44b6..24aba5e 100644
--- a/api/v1alpha1/enterprisecontractpolicy_types.go
+++ b/api/v1alpha1/enterprisecontractpolicy_types.go
@@ -61,9 +61,29 @@ type Source struct {
 	// +optional
 	// +kubebuilder:validation:Type:=object
 	RuleData *extv1.JSON `json:"ruleData,omitempty"`
+	// Config specifies which policy rules are included, or excluded, from the
+	// provided policy source urls.
+	// +optional
+	// +kubebuilder:validation:Type:=object
+	Config SourceConfig `json:"config,omitempty"`
+}
+
+// SourceConfig specifies config options for a policy source.
+type SourceConfig struct {
+	// Exclude is a set of policy exclusions that, in case of failure, do not block
+	// the success of the outcome.
+	// +optional
+	// +listType:=set
+	Exclude []string `json:"exclude,omitempty"`
+	// Include is a set of policy inclusions that are added to the policy evaluation.
+	// These take precedence over policy exclusions.
+	// +optional
+	// +listType:=set
+	Include []string `json:"include,omitempty"`
 }
 
-// EnterpriseContractPolicyConfiguration configuration of modifications to policy evaluation
+// EnterpriseContractPolicyConfiguration configuration of modifications to policy evaluation.
+// DEPRECATED: Use the config for a policy source instead.
 type EnterpriseContractPolicyConfiguration struct {
 	// Exclude set of policy exclusions that, in case of failure, do not block
 	// the success of the outcome.
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
index cd7cd4d..1466ea8 100644
--- a/api/v1alpha1/zz_generated.deepcopy.go
+++ b/api/v1alpha1/zz_generated.deepcopy.go
@@ -194,6 +194,7 @@ func (in *Source) DeepCopyInto(out *Source) {
 		*out = new(v1.JSON)
 		(*in).DeepCopyInto(*out)
 	}
+	in.Config.DeepCopyInto(&out.Config)
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Source.
@@ -205,3 +206,28 @@ func (in *Source) DeepCopy() *Source {
 	in.DeepCopyInto(out)
 	return out
 }
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SourceConfig) DeepCopyInto(out *SourceConfig) {
+	*out = *in
+	if in.Exclude != nil {
+		in, out := &in.Exclude, &out.Exclude
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Include != nil {
+		in, out := &in.Include, &out.Include
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SourceConfig.
+func (in *SourceConfig) DeepCopy() *SourceConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(SourceConfig)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/config/crd/bases/appstudio.redhat.com_enterprisecontractpolicies.yaml b/config/crd/bases/appstudio.redhat.com_enterprisecontractpolicies.yaml
index e243b43..c41b1b7 100644
--- a/config/crd/bases/appstudio.redhat.com_enterprisecontractpolicies.yaml
+++ b/config/crd/bases/appstudio.redhat.com_enterprisecontractpolicies.yaml
@@ -85,6 +85,22 @@ spec:
                   items:
                     description: Source defines policies and data that are evaluated together
                     properties:
+                      config:
+                        description: Config specifies which policy rules are included, or excluded, from the provided policy source urls.
+                        properties:
+                          exclude:
+                            description: Exclude is a set of policy exclusions that, in case of failure, do not block the success of the outcome.
+                            items:
+                              type: string
+                            type: array
+                            x-kubernetes-list-type: set
+                          include:
+                            description: Include is a set of policy inclusions that are added to the policy evaluation. These take precedence over policy exclusions.
+                            items:
+                              type: string
+                            type: array
+                            x-kubernetes-list-type: set
+                        type: object
                       data:
                         description: List of go-getter style policy data source urls
                         items:
diff --git a/docs/modules/ROOT/examples/k8s-example.yaml b/docs/modules/ROOT/examples/k8s-example.yaml
index 741285f..614da15 100644
--- a/docs/modules/ROOT/examples/k8s-example.yaml
+++ b/docs/modules/ROOT/examples/k8s-example.yaml
@@ -11,7 +11,8 @@ spec:
     - room_temperature
   description: ACME & co policy
   sources:
-  - data:
+  - config: {}
+    data:
     - git::https://github.com/acme/ec-policy.git//data?ref=prod
     name: simple
     policy:
diff --git a/docs/modules/ROOT/examples/spec-example.json b/docs/modules/ROOT/examples/spec-example.json
index 0ea635f..35daf79 100644
--- a/docs/modules/ROOT/examples/spec-example.json
+++ b/docs/modules/ROOT/examples/spec-example.json
@@ -8,7 +8,8 @@
       ],
       "data": [
         "git::https://github.com/acme/ec-policy.git//data?ref=prod"
-      ]
+      ],
+      "config": {}
     }
   ],
   "configuration": {
diff --git a/docs/modules/ROOT/pages/reference.adoc b/docs/modules/ROOT/pages/reference.adoc
index f582091..73e37b8 100644
--- a/docs/modules/ROOT/pages/reference.adoc
+++ b/docs/modules/ROOT/pages/reference.adoc
@@ -44,7 +44,7 @@ Appears In: xref:{anchor_prefix}-github-com-enterprise-contract-enterprise-contr
 [id="{anchor_prefix}-github-com-enterprise-contract-enterprise-contract-controller-api-v1alpha1-enterprisecontractpolicyconfiguration"]
 === EnterpriseContractPolicyConfiguration
 
-EnterpriseContractPolicyConfiguration configuration of modifications to policy evaluation
+EnterpriseContractPolicyConfiguration configuration of modifications to policy evaluation. DEPRECATED: Use the config for a policy source instead.
 
 [quote]
 Appears In: xref:{anchor_prefix}-github-com-enterprise-contract-enterprise-contract-controller-api-v1alpha1-enterprisecontractpolicyspec[$$EnterpriseContractPolicySpec$$]
@@ -133,6 +133,23 @@ Appears In: xref:{anchor_prefix}-github-com-enterprise-contract-enterprise-contr
 | *`policy`* __string array__ | List of go-getter style policy source urls
 | *`data`* __string array__ | List of go-getter style policy data source urls
 | *`ruleData`* __JSON__ | Arbitrary rule data that will be visible to policy rules
+| *`config`* __xref:{anchor_prefix}-github-com-enterprise-contract-enterprise-contract-controller-api-v1alpha1-sourceconfig[$$SourceConfig$$]__ | Config specifies which policy rules are included, or excluded, from the provided policy source urls.
+|===
+
+
+[id="{anchor_prefix}-github-com-enterprise-contract-enterprise-contract-controller-api-v1alpha1-sourceconfig"]
+=== SourceConfig
+
+SourceConfig specifies config options for a policy source.
+
+[quote]
+Appears In: xref:{anchor_prefix}-github-com-enterprise-contract-enterprise-contract-controller-api-v1alpha1-source[$$Source$$]
+
+[cols="25a,75a", options="header"]
+|===
+| Field | Description
+| *`exclude`* __string array__ | Exclude is a set of policy exclusions that, in case of failure, do not block the success of the outcome.
+| *`include`* __string array__ | Include is a set of policy inclusions that are added to the policy evaluation. These take precedence over policy exclusions.
 |===