Policy/Role Based Access Control

• Replace “isAdmin”

• Currently in Nova

• Belongs in Keystone

• Register for service:

• Roles
• Capabilities

• Multiple Tenants and Roles

• Policy is in Keystone

• Enforcement is on the shoulders of Glance, Nova etc