default role documentation: who can assign roles?

[Andrew Bogott]

I'm hoping that my cloud will soon be able to adopt the new default scoped role model documented at

  https://docs.openstack.org/keystone/latest/admin/service-api-protection.html

That document is good about detailing which roles can read and view existing role assignments, but I can't tell which users can or can't assign new roles. For example, if I give a user the admin role in a project, can that user add additional users to that project?

[Adam Young (ayoung)]

Are you looking to get that information for every API? It has been discussed in the past. It needs a serious spec.

[Launchpad Janitor (janitor)]

[Expired for OpenStack Identity (keystone) because there has been no activity for 60 days.]