Bug 1084296

I'm not sure how much we cover in terms of policy and policy changes in the documentation yet? Probably for the User Guide you are right, there is no action possible for the user. However there would be a deployer impact when installing Horizon itself. The recommendation would be to copy their cinder policy.json file to /etc/openstack-dashboard/cinder_policy.json and then the dashboard should only display buttons / allow certain actions based on whether the user is permitted to by the policy.

There's some additional, somewhat developer-centric information upstream at http://docs.openstack.org/developer/horizon/topics/policy.html .

Changing component to doc-Cloud_Administrator_Guide as this is for the deployers/adminstrators.

There is general information in the Cloud Admin guide about policy.json files for components along with examples for some of the components. 

Mentioning cinder_policy.json would be redundant.

=========
The /etc/[SERVICE_CODENAME]/policy.json file controls the tasks that users can perform for a given service. For example, /etc/nova/policy.json specifies the access policy for the Compute service, /etc/glance/policy.json specifies the access policy for the Image Service, and /etc/keystone/policy.json specifies the access policy for the Identity Service. 
=========
The guide also mentions that the COMPONENT_policy.json file must match the service /etc/COMPONENT/policy.json policy file.

Closing this as NOTABUG.

This is a bit different in the context of Horizon, as the dashboard carries duplicated policy files under /etc/openstack-dashboard/ for the other services (cinder_policy.json, keystone_policy.json, etc). The duplication is something we hope to get rid of in the future but for now there is no API for Horizon to access the other services' policy files.

Horizon uses these files to determine what actions a user is allowed to perform in the web dashboard (e.g. hiding buttons if they're not). They're only used in the context of the web dashboard and the other services would still rely on their own /etc/[SERVICE_CODENAME/policy.json to perform the check after Horizon sends them a command.

The policy files Horizon provides by default are copies of the default policy.json provided by the other projects.

Julie, 

So what I understand here is that at first, both /etc/[SERVICE_CODENAME/policy.json and /etc/openstack-dashboard/SERVICE_CODENAME_policy.json are the same but the admin can change the later based on what they want a user to be able to access. So, how about I add a note to let users know the same?

------
Note - When OpenStack is first deployed, both /etc/[SERVICE_CODENAME/policy.json and /etc/openstack-dashboard/SERVICE_CODENAME_policy.json are the same. But the admin can modify the policy.json files in /etc/openstack-dashboard to control the access based on a user's role. 
------

That sounds good to me - is this going to be in a dashboard-specific section? I wonder if it may be worthwhile adding "on the web interface" in the last sentence to clarify that this will only affect the dashboard. (If only the policy in /etc/openstack-dashboard is modified, a user would still be able to perform the action using the CLI tools.)

Changing componenet to Configuration Reference Guide.