Turns out the checker looks for a : in the rules, as most of the other services are formatted like identity:create_user, but glance has no namespace.
Turns out the checker looks for a : in the rules, as most of the other services are formatted like identity: create_ user, but glance has no namespace.