Methods and systems for defining and generating fine-grained access policy for authorizing software package updates are provided. The methods of defining and enforcing a package update policy include providing a package update policy file that identifies a set of software packages and users authorized to perform package updates in association with the set of software packages, and storing the policy file on computers in a managed network. When a computer in the managed network receives a request from an unprivileged user to update a software package on the computer, the computer retrieves the package update policy file and determines an authorization of the user to update the software package based on an identity of the user, an identity of the software package, and the policy file. The computer then processes the request based on the determined authorization of the user.