diff --git a/.github/policies/disallow-edits.yml b/.github/policies/disallow-edits.yml
new file mode 100644
index 00000000000..a31f15397aa
--- /dev/null
+++ b/.github/policies/disallow-edits.yml
@@ -0,0 +1,41 @@
+name: GitOps.PullRequestIssueManagement
+description: GitOps.PullRequestIssueManagement primitive
+resource: repository
+
+configuration:
+  resourceManagementConfiguration:
+    eventResponderTasks:
+      - description: Close PRs that modify files whose "source of truth" is not in this repo.
+        if:
+          - payloadType: Pull_Request
+          - isAction:
+              action: Opened
+          - or:
+              - filesMatchPattern:
+                  pattern: xml/Microsoft.Extensions*/*.xml
+                  excludedFiles: # These files use this repo as source-of-truth.
+                    - xml/Microsoft.Extensions.FileSystemGlobbing/*.xml
+                    - xml/Microsoft.Extensions.FileSystemGlobbing.Abstractions/*.xml
+                    - xml/Microsoft.Extensions.FileSystemGlobbing.Internal*/*.xml
+              - filesMatchPattern:
+                  pattern: xml/System.Composition/*.xml
+              - filesMatchPattern:
+                  pattern: xml/System.Formats.Cbor/*.xml
+              - filesMatchPattern:
+                  pattern: xml/System.Formats.Nrbf/*.xml
+              - filesMatchPattern:
+                  pattern: xml/System.Net.ServerSentEvents/*.xml
+              - filesMatchPattern:
+                  pattern: xml/System.Numerics.Tensors/*.xml
+              - filesMatchPattern:
+                  pattern: xml/System.Speech/*.xml
+              - includesModifiedFile:
+                  file: xml/System.Runtime.Serialization/ISerializationCodeDomSurrogateProvider.xml
+              - includesModifiedFile:
+                  file: xml/System.Runtime.Serialization/ImportOptions.xml
+              - includesModifiedFile:
+                  file: xml/System.Runtime.Serialization/XsdDataContractExporter.xml
+        then:
+          - addReply:
+              reply: "@${issueAuthor} This PR will be closed because it edits files whose 'source of truth' is not in the repo."
+          - closePullRequest
diff --git a/docfx.json b/docfx.json
index f646aa04317..36fc6a77226 100644
--- a/docfx.json
+++ b/docfx.json
@@ -145,6 +145,18 @@
       },
       "langs": {
         "api/**.yml": ["csharp", "vb", "fsharp", "cpp"]
+      },
+      "open_to_public_contributors": {
+        "xml/Microsoft.Extensions*/*.xml": false,
+        "xml/System.Composition/*.xml": false,
+        "xml/System.Formats.Cbor/*.xml": false,
+        "xml/System.Formats.Nrbf/*.xml": false,
+        "xml/System.Net.ServerSentEvents/*.xml": false,
+        "xml/System.Numerics.Tensors/*.xml": false,
+        "xml/System.Runtime.Serialization/ISerializationCodeDomSurrogateProvider.xml": false,
+        "xml/System.Runtime.Serialization/ImportOptions.xml": false,
+        "xml/System.Runtime.Serialization/XsdDataContractExporter.xml": false,
+        "xml/System.Speech*/*.xml": false
       }
     },
     "dest": "_site",