Comment 4 for bug 1840288

I think changing the return code is the first step, done in https://review.opendev.org/676528 (we need to change tempest too). The rest of the fix is to move all of the authorization logic into policies (https://review.opendev.org/#/q/topic:trust-policies) and then to implement system scope and default roles for the trust policies (https://launchpad.net/bugs/1818850 https://launchpad.net/bugs/1818846).