diff --git a/pkg/ape/chainbase/boltdb.go b/pkg/ape/chainbase/boltdb.go
index 1047ad42..4e15050b 100644
--- a/pkg/ape/chainbase/boltdb.go
+++ b/pkg/ape/chainbase/boltdb.go
@@ -115,6 +115,10 @@ func getTargetBucket(tx *bbolt.Tx, name chain.Name, target policyengine.Target)
 		return nil, fmt.Errorf("%w: %w: %c", policyengine.ErrChainNotFound, ErrTargetTypeBucketNotFound, target.Type)
 	}
 
+	if target.Type == policyengine.Namespace && target.Name == "" {
+		target.Name = "root"
+	}
+
 	rbucket := typeBucket.Bucket([]byte(target.Name))
 	if rbucket == nil {
 		return nil, fmt.Errorf("%w: %w: %s", policyengine.ErrChainNotFound, ErrTargetNameBucketNotFound, target.Name)
@@ -146,6 +150,10 @@ func getTargetBucketCreateIfEmpty(tx *bbolt.Tx, name chain.Name, target policyen
 		}
 	}
 
+	if target.Type == policyengine.Namespace && target.Name == "" {
+		target.Name = "root"
+	}
+
 	rbucket := typeBucket.Bucket([]byte(target.Name))
 	if rbucket == nil {
 		var err error
diff --git a/pkg/services/control/server/policy_engine.go b/pkg/services/control/server/policy_engine.go
index bc85c435..6bf60074 100644
--- a/pkg/services/control/server/policy_engine.go
+++ b/pkg/services/control/server/policy_engine.go
@@ -18,12 +18,7 @@ func apeTarget(chainTarget *control.ChainTarget) (engine.Target, error) {
 	case control.ChainTarget_CONTAINER:
 		return engine.ContainerTarget(chainTarget.GetName()), nil
 	case control.ChainTarget_NAMESPACE:
-		namespace := chainTarget.GetName()
-		// If namespace is empty, we take it for root namespace.
-		if namespace == "" {
-			namespace = "root"
-		}
-		return engine.NamespaceTarget(namespace), nil
+		return engine.NamespaceTarget(chainTarget.GetName()), nil
 	default:
 	}
 	return engine.Target{}, status.Error(codes.InvalidArgument,