Comment 15 for bug 1466694

I agree with the points raised by Sam. For example at CERN we have more than 2300 tenants and it is not a solution to scope the heat operations for every support case that we have.

Also using os-tenant-name implies that the admin user needs to have access to the user tenant.

We are using the cli (like in nova) to do these operations and some solution around the policy.json would be appreciated.
I saw from the ML thread that the keystone folks have a workaround for his...