Comment 24 for bug 1539351

yeah, I talked to john in IRC again after that, (maybe I remember wrong due to a few month ago) , but at that time he mentioned it's something that is supposed to be done by keystone and there's an idea about policy discovery which means let keystone decide whther the user is eligible to perform the action ,so it's very unlikely nova will take this work
http://lists.openstack.org/pipermail/openstack-dev/2016-February/086118.html is something that more helpful on the conclusion of this issue

and FYI, there are some policy related spec
https://review.openstack.org/#/c/289405/
https://review.openstack.org/#/c/290155/
are the spec related to policy in Newton cycle and well discussed in summit (I didn't attend but I guess so)