diff --git a/config/schema/password_policy.schema.yml b/config/schema/password_policy.schema.yml
index 9e0c395..c0b569e 100644
--- a/config/schema/password_policy.schema.yml
+++ b/config/schema/password_policy.schema.yml
@@ -20,9 +20,9 @@ password_policy.password_policy.*:
     policy_constraints:
       type: sequence
       label: 'Constraints'
-    sequence:
-      type: password_policy.constraint.plugin.[id]
-      label: 'Constraint'
+      sequence:
+        type: password_policy.constraint.plugin.[id]
+        label: 'Constraint'
     show_policy_table:
       type: boolean
       label: 'Show policy table'
diff --git a/password_policy.module b/password_policy.module
index e2f3b31..2ecee83 100644
--- a/password_policy.module
+++ b/password_policy.module
@@ -48,7 +48,7 @@ function password_policy_form_user_form_alter(&$form, &$form_state) {
   }
 
   // Check whether the policy validation should run.
-  if (_password_policy_validation_should_run()) {
+  if (\Drupal::service('plugin.manager.password_policy.password_constraint')->shouldRun()) {
     $form['#validate'][] = '_password_policy_user_profile_form_validate';
   }
 
@@ -102,32 +102,6 @@ function _password_policy_show_policy() {
   return $show_password_policy_status;
 }
 
-/**
- * Determine if there is a role within any given policy for the current user.
- *
- * @return bool
- *   TRUE if the current user has a role captured in a policy, FALSE otherwise.
- */
-function _password_policy_validation_should_run() {
-  $account = \Drupal::currentUser();
-  $config = \Drupal::config('user.settings');
-  $run_validation = TRUE;
-
-  if ($account->isAnonymous() && $config->get('verify_mail')) {
-    $run_validation = FALSE;
-  }
-
-  if ($run_validation) {
-    $user_roles = $account->getRoles();
-    $role_applies = \Drupal::service('entity.query')->get('password_policy')
-      ->condition('roles.*', $user_roles, 'IN')
-      ->execute();
-    $run_validation = !empty($role_applies);
-  }
-
-  return $run_validation;
-}
-
 /**
  * Custom callback to update the password confirm element.
  *
diff --git a/password_policy.permissions.yml b/password_policy.permissions.yml
index 4141a7a..83b1233 100644
--- a/password_policy.permissions.yml
+++ b/password_policy.permissions.yml
@@ -1,3 +1,6 @@
 manage password reset:
   title: 'Manage password reset'
   description: 'Be able to manually override user password reset dates.'
+bypass password policies:
+  title: 'Bypass password policies'
+  description: "Be able to bypass password policies. Users with this permission will not have enforced password policies."
diff --git a/src/PasswordConstraintPluginManager.php b/src/PasswordConstraintPluginManager.php
index 03be101..9721576 100644
--- a/src/PasswordConstraintPluginManager.php
+++ b/src/PasswordConstraintPluginManager.php
@@ -28,4 +28,30 @@ class PasswordConstraintPluginManager extends DefaultPluginManager {
     $this->setCacheBackend($cache_backend, 'password_policy_constraint');
   }
 
+  /**
+   * Determine if there is a role within any given policy for the current user.
+   *
+   * @return bool
+   *   TRUE if the current user has a role captured in a policy, FALSE otherwise.
+   */
+  public function shouldRun() {
+    $account = \Drupal::currentUser();
+    $config = \Drupal::config('user.settings');
+    $run_validation = TRUE;
+
+    if ($account->isAnonymous() && $config->get('verify_mail')) {
+      $run_validation = FALSE;
+    }
+
+    if ($run_validation) {
+      $user_roles = $account->getRoles();
+      $role_applies = \Drupal::service('entity.query')->get('password_policy')
+        ->condition('roles.*', $user_roles, 'IN')
+        ->execute();
+      $run_validation = !empty($role_applies);
+    }
+
+    return $run_validation;
+  }
+
 }