Comment 3 for bug 1630434

Yes, I believe that the domain admin actually has the admin role on the domain.

The admin_on_domain_filter rule only works when scope.domain.id is given. However, what I wanted to query is the assignments on the project (by specifying scope.project.id).