Comment 10 for bug 1783659

I should add that the entire context of the problem described in bug 968696 is extremely dense, even for people seasoned with the project and subject area.

That said, I tried to document the approach and reasoning behind the solution we came up with a few cycles ago (hopefully as a way to keep us on target). Those documents were merged as high-level docs in our specifications repository to make it easier for people to understand how we plan to fix these issues.

http://specs.openstack.org/openstack/keystone-specs/specs/keystone/ongoing/policy-goals.html
http://specs.openstack.org/openstack/keystone-specs/specs/keystone/ongoing/policy-security-roadmap.html