Users created to support software deployments can view all resources in a stack

[Clint Byrum]

When using OS::Heat::AccessPolicy, one can restrict the access of a created user to a subset of resources. This helps to isolate security risks and prevent mistakes in configuration, as one compromise or misconfiguration of a particular resource will not yield access to a different, potentially more critical resource.

However, with OS::Heat::StructuredDeployment (and indeed, all deployments), the user created has unfettered access to read all of the resource metadata in the stack.

[Clint Byrum (clint-fewbar)]

Never mind.. I missed where the access controls are registered.