I think this is covered by https://bugs.launchpad.net/keystone/+bug/1750660 and the default project policies now account for domain scope.
I think this is covered by https:/ /bugs.launchpad .net/keystone/ +bug/1750660 and the default project policies now account for domain scope.