Comment 4 for bug 1437407

I agree with Guang, tweaking the policy.json won't be enough.

The problem is in the rule "domain_id:%(target.project.domain_id)s", the value won't get set before the policy is enforced.

This would involve more work to enhance the @filterprotected decorator to work for the case mentioned.