diff --git a/rules/project.lace b/rules/project.lace
index aafa17c..388766a 100644
--- a/rules/project.lace
+++ b/rules/project.lace
@@ -43,6 +43,8 @@ include global:remoteconfigchecks op_is_config
 # Okay, if we're altering the admin ref, in we go
 include global:adminchecks is_admin_ref
 
+deny "Needs a FOO" op_is_normal ![start_tree is FOO]
+
 # Now we're into branch operations.  Owners can do any normal operation
 # Normal ops are create/delete/fastforward on refs
 allow "Owners can create refs" op_is_normal is_owner