Comment 1 for bug 1728324

contrail-analytics-api calls VncApi.resource_list() with the user_token to get the list of objects for which the user has access to. VncApi.resource_list() returns all the objects irrespective of whether the token is valid or has rbac acl configured for the role.