gistfile1.txt

--- policy.json 2013-05-22 04:29:47.939198317 +0000
+++ policy.json.dpkg-dist       2013-05-20 05:02:36.000000000 +0000
@@ -1,5 +1,9 @@
 {
     "admin_required": [["role:admin"], ["is_admin:1"]],
+    "owner" : [["user_id:%(user_id)s"]],
+    "admin_or_owner": [["rule:admin_required"], ["rule:owner"]],
+
+    "default": [["rule:admin_required"]],

     "identity:get_service": [["rule:admin_required"]],
     "identity:list_services": [["rule:admin_required"]],
@@ -21,15 +25,15 @@

     "identity:get_project": [["rule:admin_required"]],
     "identity:list_projects": [["rule:admin_required"]],
-    "identity:list_user_projects": [["rule:admin_required"], ["user_id:%(user_id)s"]],
-    "identity:create_project": [["rule:admin_required"]],
+    "identity:list_user_projects": [["rule:admin_or_owner"]],
+    "identity:create_project": [["rule:admin_or_owner"]],
     "identity:update_project": [["rule:admin_required"]],
     "identity:delete_project": [["rule:admin_required"]],

     "identity:get_user": [["rule:admin_required"]],
     "identity:list_users": [["rule:admin_required"]],
     "identity:create_user": [["rule:admin_required"]],
-    "identity:update_user": [["rule:admin_required"]],
+    "identity:update_user": [["rule:admin_or_owner"]],
     "identity:delete_user": [["rule:admin_required"]],

     "identity:get_group": [["rule:admin_required"]],
@@ -68,5 +72,14 @@
     "identity:check_token": [["rule:admin_required"]],
     "identity:validate_token": [["rule:admin_required"]],
     "identity:revocation_list": [["rule:admin_required"]],
-    "identity:revoke_token": [["rule:admin_required"], ["user_id:%(user_id)s"]]
+    "identity:revoke_token": [["rule:admin_required"],
+                              ["user_id:%(user_id)s"]],
+
+    "identity:create_trust": [["user_id:%(trust.trustor_user_id)s"]],
+    "identity:get_trust": [["rule:admin_or_owner"]],
+    "identity:list_trusts": [["@"]],
+    "identity:list_roles_for_trust": [["@"]],
+    "identity:check_role_for_trust": [["@"]],
+    "identity:get_role_for_trust": [["@"]],
+    "identity:delete_trust": [["@"]]
 }