diff --git a/polaris-core/src/main/java/org/apache/polaris/core/policy/PredefinedPolicyTypes.java b/polaris-core/src/main/java/org/apache/polaris/core/policy/PredefinedPolicyTypes.java
index 6cb86eb52f..40128f979b 100644
--- a/polaris-core/src/main/java/org/apache/polaris/core/policy/PredefinedPolicyTypes.java
+++ b/polaris-core/src/main/java/org/apache/polaris/core/policy/PredefinedPolicyTypes.java
@@ -88,7 +88,7 @@ public boolean isInheritable() {
    */
   @JsonCreator
   public static @Nullable PredefinedPolicyTypes fromCode(int code) {
-    if (code >= REVERSE_CODE_MAPPING_ARRAY.length) {
+    if (code < 0 || code >= REVERSE_CODE_MAPPING_ARRAY.length) {
       return null;
     }
 
diff --git a/polaris-core/src/test/java/org/apache/polaris/core/policy/PolicyTypeTest.java b/polaris-core/src/test/java/org/apache/polaris/core/policy/PolicyTypeTest.java
index 40cc2d6164..d120d32482 100644
--- a/polaris-core/src/test/java/org/apache/polaris/core/policy/PolicyTypeTest.java
+++ b/polaris-core/src/test/java/org/apache/polaris/core/policy/PolicyTypeTest.java
@@ -18,8 +18,11 @@
  */
 package org.apache.polaris.core.policy;
 
+import static org.assertj.core.api.Assertions.assertThat;
+
 import java.util.stream.Stream;
 import org.assertj.core.api.Assertions;
+import org.junit.jupiter.api.Test;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.Arguments;
 import org.junit.jupiter.params.provider.MethodSource;
@@ -53,4 +56,14 @@ public void testPredefinedPolicyTypeFromName(int code, String name, boolean isIn
     Assertions.assertThat(policyType.getName()).isEqualTo(name);
     Assertions.assertThat(policyType.isInheritable()).isEqualTo(isInheritable);
   }
+
+  @Test
+  void fromCodeReturnsNullForNegative() {
+    assertThat(PolicyType.fromCode(-1)).isNull();
+  }
+
+  @Test
+  void fromNameReturnsNullForUnknown() {
+    assertThat(PolicyType.fromName("__unknown__")).isNull();
+  }
 }