Comment 1 for bug 2051244

Depending on whether Cinder should make use of the native CoW upload of an image from volume (https://review.opendev.org/c/openstack/cinder/+/809523) the caps might need further adjustments in this regard.

This should then be least privilege (read: "only allow creating new images, not changing or deleting existing ones").