diff --git a/etc/heat/policy.json b/etc/heat/policy.json
index 330b664f30..787b7c6bb3 100644
--- a/etc/heat/policy.json
+++ b/etc/heat/policy.json
@@ -94,5 +94,6 @@
     "resource_types:OS::Neutron::QoSBandwidthLimitRule": "rule:project_admin",
     "resource_types:OS::Nova::HostAggregate": "rule:project_admin",
     "resource_types:OS::Cinder::QoSSpecs": "rule:project_admin",
-    "resource_types:OS::Cinder::QoSAssociation": "rule:project_admin"
+    "resource_types:OS::Cinder::QoSAssociation": "rule:project_admin",
+    "resource_types:OS::Keystone::*": "rule:project_admin"
 }