Looks like Keystone uses both Enforcer: https://github.com/openstack/keystone/blob/c4c8d0b99a0404f4dcdb2f87c48fe15ee1526197/keystone/policy/backends/rules.py#L55
and Rules: https://github.com/openstack/keystone/blob/c4c8d0b99a0404f4dcdb2f87c48fe15ee1526197/keystone/policy/backends/rules.py#L64-L65
Looks like Keystone uses both Enforcer: https:/ /github. com/openstack/ keystone/ blob/c4c8d0b99a 0404f4dcdb2f87c 48fe15ee1526197 /keystone/ policy/ backends/ rules.py# L55
and Rules: https:/ /github. com/openstack/ keystone/ blob/c4c8d0b99a 0404f4dcdb2f87c 48fe15ee1526197 /keystone/ policy/ backends/ rules.py# L64-L65