diff --git a/qa/ganeti-qa.py b/qa/ganeti-qa.py
index 8c3f4596d8bb5b24afd6ddbf58320660d0cf0f3e..fb962b3af19f59a1dc0b3000950af50fee0f550f 100755
--- a/qa/ganeti-qa.py
+++ b/qa/ganeti-qa.py
@@ -499,6 +499,8 @@ def TestIPolicyPlainInstance():
   (_, old_specs) = qa_cluster.TestClusterSetISpecs({})
   node = qa_config.AcquireNode()
   try:
+    # Log of policy changes, list of tuples: (change, policy_violated)
+    history = []
     instance = qa_instance.TestInstanceAddWithPlainDisk([node])
     try:
       policyerror = [constants.CV_EINSTANCEPOLICY]
@@ -507,6 +509,7 @@ def TestIPolicyPlainInstance():
         (iminval, imaxval) = qa_instance.GetInstanceSpec(instance["name"], par)
         # Some specs must be multiple of 4
         new_spec = _BuildSpecDict(par, imaxval + 4, imaxval + 4, imaxval + 4)
+        history.append((new_spec, True))
         qa_cluster.TestClusterSetISpecs(new_spec)
         qa_cluster.AssertClusterVerify(warnings=policyerror)
         if iminval > 0:
@@ -516,12 +519,22 @@ def TestIPolicyPlainInstance():
           else:
             upper = iminval - 1
           new_spec = _BuildSpecDict(par, 0, upper, upper)
+          history.append((new_spec, True))
           qa_cluster.TestClusterSetISpecs(new_spec)
           qa_cluster.AssertClusterVerify(warnings=policyerror)
         qa_cluster.TestClusterSetISpecs(old_specs)
+        history.append((old_specs, False))
       qa_instance.TestInstanceRemove(instance)
     finally:
       qa_config.ReleaseInstance(instance)
+
+    # Now we replay the same policy changes, and we expect that the instance
+    # cannot be created for the cases where we had a policy violation above
+    for (change, failed) in history:
+      qa_cluster.TestClusterSetISpecs(change)
+      if failed:
+        qa_instance.TestInstanceAddWithPlainDisk([node], fail=True)
+      # Instance creation with no policy violation has been tested already
   finally:
     qa_config.ReleaseNode(node)
 
diff --git a/qa/qa_instance.py b/qa/qa_instance.py
index ea8a2a7bf43fa2a0caa6d7adfb677d0e2231e6c6..34ee7bdc39ccf82c5c3dfa4c515a70ca3c3dd7c6 100644
--- a/qa/qa_instance.py
+++ b/qa/qa_instance.py
@@ -63,7 +63,7 @@ def _GetGenericAddParameters(inst, force_mac=None):
   return params
 
 
-def _DiskTest(node, disk_template):
+def _DiskTest(node, disk_template, fail=False):
   instance = qa_config.AcquireInstance()
   try:
     cmd = (["gnt-instance", "add",
@@ -73,16 +73,22 @@ def _DiskTest(node, disk_template):
            _GetGenericAddParameters(instance))
     cmd.append(instance["name"])
 
-    AssertCommand(cmd)
+    AssertCommand(cmd, fail=fail)
 
-    _CheckSsconfInstanceList(instance["name"])
-    qa_config.SetInstanceTemplate(instance, disk_template)
+    if not fail:
+      _CheckSsconfInstanceList(instance["name"])
+      qa_config.SetInstanceTemplate(instance, disk_template)
 
-    return instance
+      return instance
   except:
     qa_config.ReleaseInstance(instance)
     raise
 
+  # Handle the case where creation is expected to fail
+  assert fail
+  qa_config.ReleaseInstance(instance)
+  return None
+
 
 def _GetInstanceInfo(instance):
   """Return information about the actual state of an instance.
@@ -257,11 +263,13 @@ def IsDiskReplacingSupported(instance):
   return templ == constants.DT_DRBD8
 
 
-@InstanceCheck(None, INST_UP, RETURN_VALUE)
-def TestInstanceAddWithPlainDisk(nodes):
+def TestInstanceAddWithPlainDisk(nodes, fail=False):
   """gnt-instance add -t plain"""
   assert len(nodes) == 1
-  return _DiskTest(nodes[0]["primary"], "plain")
+  instance = _DiskTest(nodes[0]["primary"], constants.DT_PLAIN, fail=fail)
+  if not fail:
+    qa_utils.RunInstanceCheck(instance, True)
+  return instance
 
 
 @InstanceCheck(None, INST_UP, RETURN_VALUE)