Description of problem:
Putting myself into the shoes of a customer who just deployed OSP. I'm assigning my user to different roles. I see the heat_stack_user role. I think: hey, my user needs to use heat, so I'm assigning him to the heat_stack_user role! And exactly the contrary happens. 
===>in policy.json,  the deny_stack_user is an allow rule for everyone but heat_stack_user 
 
Version-Release number of selected component (if applicable):
7

How reproducible:
all of the time

Steps to Reproduce:
1. 
2.
3.

Actual results:
heat_stack_user role is denied access to create heat stacks with a "not authorized"

Expected results:
the name is misleading. neither users nor support would see right away that this is a configuration mistake. you have to really knowwhat's happening, in order to understand what heat_stack_user role does exactly the opposite of what it sounds that it does. A name for a role however should help grasp the meaning of this role

Additional info:

http://hardysteven.blogspot.ca/2014/04/heat-auth-model-updates-part-2-stack.html

{
    "context_is_admin":  "role:admin",
    "deny_stack_user": "not role:heat_stack_user",
    "deny_everybody": "!",

    "cloudformation:ListStacks": "rule:deny_stack_user",
    "cloudformation:CreateStack": "rule:deny_stack_user",
(...)
}