diff --git a/glance/api/policy.py b/glance/api/policy.py
index 99d48e9e70..67ac147414 100644
--- a/glance/api/policy.py
+++ b/glance/api/policy.py
@@ -190,7 +190,6 @@ class ImageProxy(glance.domain.proxy.Image):
         return self.image.get_data(*args, **kwargs)
 
     def set_data(self, *args, **kwargs):
-        self.policy.enforce(self.context, 'upload_image', self.target)
         return self.image.set_data(*args, **kwargs)
 
 
diff --git a/glance/api/v2/image_data.py b/glance/api/v2/image_data.py
index 07b0f38271..a0f0038e10 100644
--- a/glance/api/v2/image_data.py
+++ b/glance/api/v2/image_data.py
@@ -40,16 +40,13 @@ CONF = cfg.CONF
 
 class ImageDataController(object):
     def __init__(self, db_api=None, store_api=None,
-                 policy_enforcer=None, notifier=None,
-                 gateway=None):
-        if gateway is None:
-            db_api = db_api or glance.db.get_api()
-            store_api = store_api or glance_store
-            policy = policy_enforcer or glance.api.policy.Enforcer()
-            notifier = notifier or glance.notifier.Notifier()
-            gateway = glance.gateway.Gateway(db_api, store_api,
-                                             notifier, policy)
-        self.gateway = gateway
+                 policy_enforcer=None, notifier=None):
+        db_api = db_api or glance.db.get_api()
+        store_api = store_api or glance_store
+        notifier = notifier or glance.notifier.Notifier()
+        self.policy = policy_enforcer or glance.api.policy.Enforcer()
+        self.gateway = glance.gateway.Gateway(db_api, store_api,
+                                              notifier, self.policy)
 
     def _restore(self, image_repo, image):
         """
@@ -108,6 +105,7 @@ class ImageDataController(object):
         refresher = None
         cxt = req.context
         try:
+            self.policy.enforce(cxt, 'upload_image', {})
             image = image_repo.get(image_id)
             image.status = 'saving'
             try:
diff --git a/glance/tests/unit/test_policy.py b/glance/tests/unit/test_policy.py
index da1e86403f..b48d5a08c5 100644
--- a/glance/tests/unit/test_policy.py
+++ b/glance/tests/unit/test_policy.py
@@ -407,13 +407,6 @@ class TestImagePolicy(test_utils.BaseTestCase):
         self.policy.enforce.assert_called_once_with({}, "download_image",
                                                     target)
 
-    def test_image_set_data(self):
-        self.policy.enforce.side_effect = exception.Forbidden
-        image = glance.api.policy.ImageProxy(self.image_stub, {}, self.policy)
-        self.assertRaises(exception.Forbidden, image.set_data)
-        self.policy.enforce.assert_called_once_with({}, "upload_image",
-                                                    image.target)
-
 
 class TestMemberPolicy(test_utils.BaseTestCase):
     def setUp(self):
diff --git a/glance/tests/unit/utils.py b/glance/tests/unit/utils.py
index 83636a030b..067851cd5c 100644
--- a/glance/tests/unit/utils.py
+++ b/glance/tests/unit/utils.py
@@ -109,8 +109,10 @@ class FakeDB(object):
         images = [
             {'id': UUID1, 'owner': TENANT1, 'status': 'queued',
              'locations': [{'url': '%s/%s' % (BASE_URI, UUID1),
-                            'metadata': {}, 'status': 'queued'}]},
-            {'id': UUID2, 'owner': TENANT1, 'status': 'queued'},
+                            'metadata': {}, 'status': 'queued'}],
+             'disk_format': 'raw', 'container_format': 'bare'},
+            {'id': UUID2, 'owner': TENANT1, 'status': 'queued',
+             'disk_format': 'raw', 'container_format': 'bare'},
         ]
         [simple_db.image_create(None, image) for image in images]
 
diff --git a/glance/tests/unit/v2/test_image_data_resource.py b/glance/tests/unit/v2/test_image_data_resource.py
index 4141e8f59b..f61c32a9f0 100644
--- a/glance/tests/unit/v2/test_image_data_resource.py
+++ b/glance/tests/unit/v2/test_image_data_resource.py
@@ -90,7 +90,12 @@ class FakeImageRepo(object):
 
 
 class FakeGateway(object):
-    def __init__(self, repo):
+    def __init__(self, db=None, store=None, notifier=None,
+                 policy=None, repo=None):
+        self.db = db
+        self.store = store
+        self.notifier = notifier
+        self.policy = policy
         self.repo = repo
 
     def get_repo(self, context):
@@ -103,9 +108,13 @@ class TestImagesController(base.StoreClearingUnitTest):
 
         self.config(debug=True)
         self.image_repo = FakeImageRepo()
-        self.gateway = FakeGateway(self.image_repo)
-        self.controller = glance.api.v2.image_data.ImageDataController(
-            gateway=self.gateway)
+        db = unit_test_utils.FakeDB()
+        policy = unit_test_utils.FakePolicyEnforcer()
+        notifier = unit_test_utils.FakeNotifier()
+        store = unit_test_utils.FakeStoreAPI()
+        self.controller = glance.api.v2.image_data.ImageDataController()
+        self.controller.gateway = FakeGateway(db, store, notifier, policy,
+                                              self.image_repo)
 
     def test_download(self):
         request = unit_test_utils.get_fake_request()
@@ -191,6 +200,16 @@ class TestImagesController(base.StoreClearingUnitTest):
         self.assertEqual('YYYY', image.data)
         self.assertIsNone(image.size)
 
+    @mock.patch.object(glance.api.policy.Enforcer, 'enforce')
+    def test_upload_image_forbidden(self, mock_enforce):
+        request = unit_test_utils.get_fake_request()
+        mock_enforce.side_effect = exception.Forbidden
+        self.assertRaises(webob.exc.HTTPForbidden, self.controller.upload,
+                          request, unit_test_utils.UUID2, 'YYYY', 4)
+        mock_enforce.assert_called_once_with(request.context,
+                                             "upload_image",
+                                             {})
+
     def test_upload_invalid(self):
         request = unit_test_utils.get_fake_request()
         image = FakeImage('abcd')