Comment 3 for bug 1724239

> If trusts_delegated_roles is set to something other than [],

I don't think so. If 'trusts_delegated_roles' is specified, heat assumes that those roles are needed to operate the stack on behalf of the user and should be a subset roles of the user that creates the stack.

All these are configuration issues (including trusts not being enabled) and operators should porbably know about those when providing orchestration service to the users.