Merge ~gboutry/ubuntu/+source/horizon:stable/2024.1 into ~ubuntu-openstack-dev/ubuntu/+source/horizon:stable/2024.1

[Guillaume Boutry]

[Guillaume Boutry (gboutry)]

The bug reports contains the debdiff.

Unmerged commits

41f5b5f... by Guillaume Boutry on 2025-06-16

d/chanlog: mentionned dropped patches

Signed-off-by: Guillaume Boutry <email address hidden>

	ubuntu-build:0 (build)
	ubuntu-autopkgtest:0 (build)
	cloud-archive-build:0 (build)
	cloud-archive-autopkgtest:0 (build)

1 → 4 of 4 results

First • Previous • Next • Last

85bf4cf... by Guillaume Boutry on 2025-06-16

d/p/lp2054799.patch: drop integrated patch

Signed-off-by: Guillaume Boutry <email address hidden>

927ef9d... by Guillaume Boutry on 2025-06-16

New upstream release for OpenStack Caracal. (LP: #2110279)

dfb1a73... by Guillaume Boutry on 2025-06-16

Merging upstream release 24.0.1

9eb8dee... by Guillaume Boutry on 2025-06-16

New upstream version 24.0.1

9eb5160... by James Page on 2024-09-12

New upstream version 25.0.0

06a798e... by James Page on 2024-08-08

New upstream version 25.0.0+git2024080809.d171cee3

diff --git a/AUTHORS b/AUTHORS
index 22f3602..4f99bfd 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -735,6 +735,7 @@ Tim Schnell <[e-mail]>
 Timur Sufiev <[e-mail]>
 Timur Sufiev <[e-mail]>
 Tin Lam <[e-mail]>
+Tobias Urdin <[e-mail]>
 Tobias Urdin <[e-mail]>
 Todd Willey <[e-mail]>
 Tom Fifield <[e-mail]>
@@ -979,6 +980,7 @@ utsav dusad <[e-mail]>
 utsavdusad <[e-mail]>
 veena <[e-mail]>
 venkatamahesh <[e-mail]>
+viktorkrivak <[e-mail]>
 vinay_m <[e-mail]>
 vmarkov <[e-mail]>
 wangbo <[e-mail]>
@@ -996,6 +998,7 @@ yan.haifeng <[e-mail]>
 yanghuichan <[e-mail]>
 yangyapeng <[e-mail]>
 yaraat <[e-mail]>
+yatinkarel <[e-mail]>
 yfzhao <[e-mail]>
 yong sheng gong <[e-mail]>
 yuanke wei <[e-mail]>
diff --git a/ChangeLog b/ChangeLog
index 62bd2ca..61ad329 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,28 @@
 CHANGES
 =======
 
+24.0.1
+------
+
+* Fix typo in metadef for Cinder Volume Type
+* Force scope when listing domains
+* Move deprecated since/reason to deprecated\_rule object
+* Fix generation of inventory capacities
+* Imported Translations from Zanata
+* Delete container show duplicate toast notifications
+* Fix Placement statistics display
+* Sort image source choices by name for volume
+* Fix floating IP associated to unbound port
+* Fix allowed address pair row unique ID
+* Show Created At column for backups table
+* Show availability zone for volume backups
+* Imported Translations from Zanata
+* Respect SSL settings in placement API
+* Fix Users/Groups tab list when a domain context is set
+* Imported Translations from Zanata
+* Update TOX\_CONSTRAINTS\_FILE for stable/2024.1
+* Update .gitreview for stable/2024.1
+
 24.0.0
 ------
 
diff --git a/PKG-INFO b/PKG-INFO
index b7dca79..ca6115f 100644
--- a/PKG-INFO
+++ b/PKG-INFO
@@ -1,66 +1,10 @@
-Metadata-Version: 1.2
+Metadata-Version: 2.1
 Name: horizon
-Version: 24.0.0
+Version: 24.0.1
 Summary: OpenStack Dashboard
 Home-page: https://docs.openstack.org/horizon/latest/
 Author: OpenStack
 Author-email: [e-mail]
-License: UNKNOWN
-Description: =============================
-        Horizon (OpenStack Dashboard)
-        =============================
-        
-        Horizon is a Django-based project aimed at providing a complete OpenStack
-        Dashboard along with an extensible framework for building new dashboards
-        from reusable components. The ``openstack_dashboard`` module is a reference
-        implementation of a Django site that uses the ``horizon`` app to provide
-        web-based interactions with the various OpenStack projects.
-        
-        * Project documentation: https://docs.openstack.org/horizon/latest/
-        * Release management: https://launchpad.net/horizon
-        * Blueprints and feature specifications: https://blueprints.launchpad.net/horizon
-        * Issue tracking: https://bugs.launchpad.net/horizon
-        * Release notes: https://docs.openstack.org/releasenotes/horizon/
-        
-        .. image:: https://governance.openstack.org/tc/badges/horizon.svg
-            :target: https://governance.openstack.org/tc/reference/tags/
-        
-        Using Horizon
-        =============
-        
-        See ``doc/source/install/index.rst`` about how to install Horizon
-        in your OpenStack setup. It describes the example steps and
-        has pointers for more detailed settings and configurations.
-        
-        It is also available at
-        `Installation Guide <https://docs.openstack.org/horizon/latest/install/>`_.
-        
-        Getting Started for Developers
-        ==============================
-        
-        ``doc/source/quickstart.rst`` or
-        `Quickstart Guide <https://docs.openstack.org/horizon/latest/contributor/quickstart.html>`_
-        describes how to setup Horizon development environment and start development.
-        
-        Building Contributor Documentation
-        ==================================
-        
-        This documentation is written by contributors, for contributors.
-        
-        The source is maintained in the ``doc/source`` directory using
-        `reStructuredText`_ and built by `Sphinx`_
-        
-        .. _reStructuredText: http://docutils.sourceforge.net/rst.html
-        .. _Sphinx: http://sphinx-doc.org/
-        
-        To build the docs, use::
-        
-          $ tox -e docs
-        
-        Results are in the ``doc/build/html`` directory
-        
-        
-Platform: UNKNOWN
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: OpenStack
 Classifier: Framework :: Django
@@ -77,3 +21,118 @@ Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
 Classifier: Topic :: Internet :: WWW/HTTP
 Requires-Python: >=3.8
+License-File: LICENSE
+Requires-Dist: pbr>=5.5.0
+Requires-Dist: Babel>=2.6.0
+Requires-Dist: debtcollector>=1.2.0
+Requires-Dist: Django<4.3,>=4.2
+Requires-Dist: django-compressor>=2.4.1
+Requires-Dist: django-debreach>=1.4.2
+Requires-Dist: django-pyscss>=2.0.3
+Requires-Dist: futurist>=1.2.0
+Requires-Dist: iso8601>=0.1.11
+Requires-Dist: keystoneauth1>=4.3.1
+Requires-Dist: netaddr>=0.7.18
+Requires-Dist: oslo.concurrency>=4.5.0
+Requires-Dist: oslo.config>=8.8.0
+Requires-Dist: oslo.i18n>=5.1.0
+Requires-Dist: oslo.policy>=3.11.0
+Requires-Dist: oslo.serialization>=4.3.0
+Requires-Dist: oslo.upgradecheck>=1.5.0
+Requires-Dist: oslo.utils>=4.12.0
+Requires-Dist: osprofiler>=3.4.2
+Requires-Dist: pymongo!=3.1,>=3.0.2
+Requires-Dist: pyScss>=1.4.0
+Requires-Dist: python-cinderclient>=8.0.0
+Requires-Dist: python-glanceclient>=2.8.0
+Requires-Dist: python-keystoneclient>=3.22.0
+Requires-Dist: python-neutronclient>=8.1.0
+Requires-Dist: python-novaclient>=9.1.0
+Requires-Dist: python-swiftclient>=3.2.0
+Requires-Dist: pytz>=2013.6
+Requires-Dist: PyYAML>=6.0
+Requires-Dist: requests>=2.25.1
+Requires-Dist: semantic-version>=2.3.1
+Requires-Dist: XStatic>=1.0.3
+Requires-Dist: XStatic-Angular>=1.8.2.2
+Requires-Dist: XStatic-Angular-Bootstrap>=2.2.0.0
+Requires-Dist: XStatic-Angular-FileUpload>=12.0.4.0
+Requires-Dist: XStatic-Angular-Gettext>=2.3.8.0
+Requires-Dist: XStatic-Angular-lrdragndrop>=1.0.2.2
+Requires-Dist: XStatic-Angular-Schema-Form>=0.8.13.0
+Requires-Dist: XStatic-Bootstrap-Datepicker>=1.3.1.0
+Requires-Dist: XStatic-Bootstrap-SCSS>=3.3.7.1
+Requires-Dist: XStatic-bootswatch>=3.3.7.0
+Requires-Dist: XStatic-D3>=3.5.17.0
+Requires-Dist: XStatic-Hogan>=2.0.0.2
+Requires-Dist: XStatic-Font-Awesome>=4.7.0.0
+Requires-Dist: XStatic-Jasmine>=2.4.1.1
+Requires-Dist: XStatic-jQuery>=3.5.1.1
+Requires-Dist: XStatic-JQuery-Migrate>=3
+Requires-Dist: XStatic-JQuery.quicksearch>=2.0.3.1
+Requires-Dist: XStatic-JQuery.TableSorter>=2.14.5.1
+Requires-Dist: XStatic-jquery-ui>=1.12.1.1
+Requires-Dist: XStatic-JSEncrypt>=2.3.1.1
+Requires-Dist: XStatic-mdi>=1.6.50.2
+Requires-Dist: XStatic-objectpath>=1.2.1.0
+Requires-Dist: XStatic-Rickshaw>=1.5.0.0
+Requires-Dist: XStatic-roboto-fontface>=0.5.0.0
+Requires-Dist: XStatic-smart-table>=1.4.13.2
+Requires-Dist: XStatic-Spin>=1.2.5.2
+Requires-Dist: XStatic-term.js>=0.0.7.0
+Requires-Dist: XStatic-tv4>=1.2.7.0
+Requires-Dist: enmerkar>=0.7.1
+
+=============================
+Horizon (OpenStack Dashboard)
+=============================
+
+Horizon is a Django-based project aimed at providing a complete OpenStack
+Dashboard along with an extensible framework for building new dashboards
+from reusable components. The ``openstack_dashboard`` module is a reference
+implementation of a Django site that uses the ``horizon`` app to provide
+web-based interactions with the various OpenStack projects.
+
+* Project documentation: https://docs.openstack.org/horizon/latest/
+* Release management: https://launchpad.net/horizon
+* Blueprints and feature specifications: https://blueprints.launchpad.net/horizon
+* Issue tracking: https://bugs.launchpad.net/horizon
+* Release notes: https://docs.openstack.org/releasenotes/horizon/
+
+.. image:: https://governance.openstack.org/tc/badges/horizon.svg
+    :target: https://governance.openstack.org/tc/reference/tags/
+
+Using Horizon
+=============
+
+See ``doc/source/install/index.rst`` about how to install Horizon
+in your OpenStack setup. It describes the example steps and
+has pointers for more detailed settings and configurations.
+
+It is also available at
+`Installation Guide <https://docs.openstack.org/horizon/latest/install/>`_.
+
+Getting Started for Developers
+==============================
+
+``doc/source/quickstart.rst`` or
+`Quickstart Guide <https://docs.openstack.org/horizon/latest/contributor/quickstart.html>`_
+describes how to setup Horizon development environment and start development.
+
+Building Contributor Documentation
+==================================
+
+This documentation is written by contributors, for contributors.
+
+The source is maintained in the ``doc/source`` directory using
+`reStructuredText`_ and built by `Sphinx`_
+
+.. _reStructuredText: http://docutils.sourceforge.net/rst.html
+.. _Sphinx: http://sphinx-doc.org/
+
+To build the docs, use::
+
+  $ tox -e docs
+
+Results are in the ``doc/build/html`` directory
+
diff --git a/debian/changelog b/debian/changelog
index bf2383e..d575ad6 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,9 +1,14 @@
-horizon (4:24.0.0-0ubuntu1.4) UNRELEASED; urgency=medium
+horizon (4:24.0.1-0ubuntu0.24.04.1) noble; urgency=medium
 
+  [ James Page ]
   * d/gbp.conf, .launchpad.yaml: Sync from cloud-archive-tools for
     caracal.
 
- -- James Page <[e-mail]>  Mon, 22 Jul 2024 09:38:02 +0100
+  [ Guillaume Boutry ]
+  * New upstream release for OpenStack Caracal. (LP: #2110279)
+  * d/p/lp2054799.patch: drop integrated patch
+
+ -- Guillaume Boutry <[e-mail]>  Mon, 16 Jun 2025 12:38:28 +0200
 
 horizon (4:24.0.0-0ubuntu1.3) noble; urgency=medium
 
diff --git a/debian/patches/lp2054799.patch b/debian/patches/lp2054799.patch
deleted file mode 100644
index 9317d26..0000000
--- a/debian/patches/lp2054799.patch
+++ /dev/null
@@ -1,161 +0,0 @@
-Bug-Ubuntu: https://bugs.launchpad.net/bugs/2054799
-Origin: upstream, https://opendev.org/openstack/horizon/commit/ed768ab5071307ee15f95636ea548050cb894f9e
-
-From ed768ab5071307ee15f95636ea548050cb894f9e Mon Sep 17 00:00:00 2001
-From: Zhang Hua <[e-mail]>
-Date: Tue, 27 Feb 2024 15:26:28 +0800
-Subject: [PATCH] Fix Users/Groups tab list when a domain context is set
-
-The list of users assigned to a project becomes invisible when a domain context
-is set in Horizon. If a domain context is set, the user list call should
-provide a list of users within the specified domain context, rather than users
-within the user's own domain.
-
-Groups tab of project also has the same problem.
-
-Change-Id: Ia778317acc41fe589765e6cd04c7fe8cad2360ab
-Closes-Bug: #2054799
----
- .../dashboards/identity/projects/tabs.py      | 13 ++++++---
- .../dashboards/identity/projects/tests.py     | 27 ++++++++++++-------
- 2 files changed, 26 insertions(+), 14 deletions(-)
-
-diff --git a/openstack_dashboard/dashboards/identity/projects/tabs.py b/openstack_dashboard/dashboards/identity/projects/tabs.py
-index 5899efd760..80ace64fb6 100644
---- a/openstack_dashboard/dashboards/identity/projects/tabs.py
-+++ b/openstack_dashboard/dashboards/identity/projects/tabs.py
-@@ -23,6 +23,7 @@ from openstack_dashboard.dashboards.identity.projects.groups \
-     import tables as groups_tables
- from openstack_dashboard.dashboards.identity.projects.users \
-     import tables as users_tables
-+from openstack_dashboard.utils import identity
- 
- 
- class OverviewTab(tabs.Tab):
-@@ -93,7 +94,8 @@ class UsersTab(tabs.TableTab):
-         # For keystone.user_list project_id is not passed as argument because
-         # it is ignored when using admin credentials
-         # Get all users (to be able to find user name)
--        users = api.keystone.user_list(self.request)
-+        domain_id = identity.get_domain_id_for_operation(self.request)
-+        users = api.keystone.user_list(self.request, domain=domain_id)
-         users = {user.id: user for user in users}
- 
-         # Get project_users_roles ({user_id: [role_id_1, role_id_2]})
-@@ -128,7 +130,8 @@ class UsersTab(tabs.TableTab):
-         # For keystone.group_list project_id is not passed as argument because
-         # it is ignored when using admin credentials
-         # Get all groups (to be able to find group name)
--        groups = api.keystone.group_list(self.request)
-+        domain_id = identity.get_domain_id_for_operation(self.request)
-+        groups = api.keystone.group_list(self.request, domain=domain_id)
-         group_names = {group.id: group.name for group in groups}
- 
-         # Get a dictionary {group_id: [role_id_1, role_id_2]}
-@@ -138,7 +141,8 @@ class UsersTab(tabs.TableTab):
- 
-         for group_id in project_groups_roles:
-             group_users = api.keystone.user_list(self.request,
--                                                 group=group_id)
-+                                                 group=group_id,
-+                                                 domain=domain_id)
-             group_roles_names = [
-                 role.name for role in roles
-                 if role.id in project_groups_roles[group_id]]
-@@ -202,6 +206,7 @@ class GroupsTab(tabs.TableTab):
-         project = self.tab_group.kwargs['project']
- 
-         try:
-+            domain_id = identity.get_domain_id_for_operation(self.request)
-             # Get project_groups_roles: {group_id: [role_id_1, role_id_2]}
-             project_groups_roles = api.keystone.get_project_groups_roles(
-                 self.request,
-@@ -210,7 +215,7 @@ class GroupsTab(tabs.TableTab):
-             roles = api.keystone.role_list(self.request)
-             # For keystone.group_list, we do not give the project_id because it
-             # is ignored when called with admin creds.
--            groups = api.keystone.group_list(self.request)
-+            groups = api.keystone.group_list(self.request, domain=domain_id)
-             groups = {group.id: group for group in groups}
-         except Exception:
-             exceptions.handle(self.request,
-diff --git a/openstack_dashboard/dashboards/identity/projects/tests.py b/openstack_dashboard/dashboards/identity/projects/tests.py
-index 635f981238..9fae5fd426 100644
---- a/openstack_dashboard/dashboards/identity/projects/tests.py
-+++ b/openstack_dashboard/dashboards/identity/projects/tests.py
-@@ -31,6 +31,7 @@ from openstack_dashboard.dashboards.identity.projects import workflows
- from openstack_dashboard.test import helpers as test
- from openstack_dashboard import usage
- from openstack_dashboard.usage import quotas
-+from openstack_dashboard.utils import identity
- 
- 
- INDEX_URL = reverse('horizon:identity:projects:index')
-@@ -1339,7 +1340,8 @@ class DetailProjectViewTests(test.BaseAdminViewTests):
-                                        'get_project_groups_roles',
-                                        'role_list',
-                                        'group_list'),
--                        quotas: ('enabled_quotas',)})
-+                        quotas: ('enabled_quotas',),
-+                        identity: ('get_domain_id_for_operation',)})
-     def test_detail_view_users_tab(self):
-         project = self.tenants.first()
-         domain = self.domains.first()
-@@ -1357,8 +1359,9 @@ class DetailProjectViewTests(test.BaseAdminViewTests):
-         self.mock_domain_get.return_value = domain
-         self.mock_enabled_quotas.return_value = ('instances',)
-         self.mock_role_list.return_value = self.roles.list()
-+        self.mock_get_domain_id_for_operation.return_value = domain.id
- 
--        def _user_list_side_effect(request, group=None):
-+        def _user_list_side_effect(request, group=None, domain=None):
-             if group:
-                 return self._get_users_in_group(group)
-             return users
-@@ -1408,13 +1411,14 @@ class DetailProjectViewTests(test.BaseAdminViewTests):
-                                                      domain.id)
-         self.mock_enabled_quotas.assert_called_once_with(test.IsHttpRequest())
-         self.mock_role_list.assert_called_once_with(test.IsHttpRequest())
--        self.mock_group_list.assert_called_once_with(test.IsHttpRequest())
-+        self.mock_group_list.assert_called_once_with(test.IsHttpRequest(),
-+                                                     domain="1")
-         self.mock_get_project_users_roles.assert_called_once_with(
-             test.IsHttpRequest(), project=project.id)
-         self.mock_get_project_groups_roles.assert_called_once_with(
-             test.IsHttpRequest(), project=project.id)
--        calls = [mock.call(test.IsHttpRequest()),
--                 mock.call(test.IsHttpRequest(), group="1"), ]
-+        calls = [mock.call(test.IsHttpRequest(), domain="1"),
-+                 mock.call(test.IsHttpRequest(), group="1", domain="1"), ]
- 
-         self.mock_user_list.assert_has_calls(calls)
- 
-@@ -1506,11 +1510,13 @@ class DetailProjectViewTests(test.BaseAdminViewTests):
- 
-         self.mock_tenant_get.assert_called_once_with(test.IsHttpRequest(),
-                                                      self.tenant.id)
--        self.mock_domain_get.assert_called_once_with(test.IsHttpRequest(),
--                                                     domain.id)
-+        calls = [mock.call(test.IsHttpRequest(), "1"),
-+                 mock.call(test.IsHttpRequest(), None), ]
-+        self.mock_domain_get.assert_has_calls(calls)
-         self.mock_enabled_quotas.assert_called_once_with(test.IsHttpRequest())
-         self.mock_role_list.assert_called_once_with(test.IsHttpRequest())
--        self.mock_group_list.assert_called_once_with(test.IsHttpRequest())
-+        self.mock_group_list.assert_called_once_with(test.IsHttpRequest(),
-+                                                     domain=None)
-         self.mock_get_project_groups_roles.assert_called_once_with(
-             test.IsHttpRequest(), project=project.id)
- 
-@@ -1546,8 +1552,9 @@ class DetailProjectViewTests(test.BaseAdminViewTests):
- 
-         self.mock_tenant_get.assert_called_once_with(test.IsHttpRequest(),
-                                                      self.tenant.id)
--        self.mock_domain_get.assert_called_once_with(test.IsHttpRequest(),
--                                                     domain.id)
-+        calls = [mock.call(test.IsHttpRequest(), "1"),
-+                 mock.call(test.IsHttpRequest(), None), ]
-+        self.mock_domain_get.assert_has_calls(calls)
-         self.mock_enabled_quotas.assert_called_once_with(test.IsHttpRequest())
-         self.mock_get_project_groups_roles.assert_called_once_with(
-             test.IsHttpRequest(), project=project.id)
diff --git a/debian/patches/series b/debian/patches/series
index b087504..e99cd52 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -3,4 +3,3 @@ fix-dashboard-manage.patch
 embedded-xstatic.patch
 ubuntu_settings.patch
 lp1728031.patch
-lp2054799.patch
diff --git a/doc/source/locale/en_GB/LC_MESSAGES/doc-configuration.po b/doc/source/locale/en_GB/LC_MESSAGES/doc-configuration.po
index 8d852aa..b414960 100644
--- a/doc/source/locale/en_GB/LC_MESSAGES/doc-configuration.po
+++ b/doc/source/locale/en_GB/LC_MESSAGES/doc-configuration.po
@@ -4,15 +4,16 @@
 # Andi Chandler <[e-mail]>, 2021. #zanata
 # Andi Chandler <[e-mail]>, 2022. #zanata
 # Andi Chandler <[e-mail]>, 2023. #zanata
+# Andi Chandler <[e-mail]>, 2024. #zanata
 msgid ""
 msgstr ""
-"Project-Id-Version: horizon 23.4.0.dev3\n"
+"Project-Id-Version: horizon 24.0.1.dev2\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2023-09-25 17:31+0000\n"
+"POT-Creation-Date: 2024-03-23 17:30+0000\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"PO-Revision-Date: 2023-09-09 10:45+0000\n"
+"PO-Revision-Date: 2024-04-18 12:43+0000\n"
 "Last-Translator: Andi Chandler <[e-mail]>\n"
 "Language-Team: English (United Kingdom)\n"
 "Language: en_GB\n"
@@ -966,6 +967,17 @@ msgid "DROPDOWN_MAX_ITEMS"
 msgstr "DROPDOWN_MAX_ITEMS"
 
 msgid ""
+"Decides whether the DHCP Agents column should be shown on the Admin Networks "
+"panel. Retrieving data for that column takes time, and it may be advisable "
+"to disable it on large deployments with a large number on networks to speed "
+"up displaying of that view."
+msgstr ""
+"Decides whether the DHCP Agents column should be shown on the Admin Networks "
+"panel. Retrieving data for that column takes time, and it may be advisable "
+"to disable it on large deployments with a large number on networks to speed "
+"up displaying of that view."
+
+msgid ""
 "Default DNS servers you would like to use when a subnet is created. This is "
 "only a default. Users can still choose a different list of dns servers."
 msgstr ""
@@ -989,6 +1001,9 @@ msgstr ""
 "as much as possible, and support for this is given preference over more "
 "exotic methods such as monkey patching and overrides files."
 
+msgid "Default ``True``"
+msgstr "Default ``True``"
+
 msgid "Default ``['*']``"
 msgstr "Default ``['*']``"
 
@@ -4734,6 +4749,9 @@ msgstr "physical_networks"
 msgid "segmentation_id_range"
 msgstr "segmentation_id_range"
 
+msgid "show_agents_column"
+msgstr "show_agents_column"
+
 msgid "supported_provider_types"
 msgstr "supported_provider_types"
 
diff --git a/doc/source/locale/en_GB/LC_MESSAGES/doc-contributor.po b/doc/source/locale/en_GB/LC_MESSAGES/doc-contributor.po
index f9980d7..e352181 100644
--- a/doc/source/locale/en_GB/LC_MESSAGES/doc-contributor.po
+++ b/doc/source/locale/en_GB/LC_MESSAGES/doc-contributor.po
@@ -4,15 +4,16 @@
 # Andi Chandler <[e-mail]>, 2021. #zanata
 # Andi Chandler <[e-mail]>, 2022. #zanata
 # Andi Chandler <[e-mail]>, 2023. #zanata
+# Andi Chandler <[e-mail]>, 2024. #zanata
 msgid ""
 msgstr ""
-"Project-Id-Version: horizon 23.4.1.dev25\n"
+"Project-Id-Version: horizon 24.0.1.dev2\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-02-07 17:51+0000\n"
+"POT-Creation-Date: 2024-03-23 17:30+0000\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"PO-Revision-Date: 2023-09-09 10:45+0000\n"
+"PO-Revision-Date: 2024-04-18 12:49+0000\n"
 "Last-Translator: Andi Chandler <[e-mail]>\n"
 "Language-Team: English (United Kingdom)\n"
 "Language: en_GB\n"
@@ -7305,6 +7306,9 @@ msgstr ""
 "Runs pep8, which is a tool that checks Python code style. You can read more "
 "about pep8 at https://www.python.org/dev/peps/pep-0008/"
 
+msgid "Runs the Python unit tests against Django 4.2."
+msgstr "Runs the Python unit tests against Django 4.2."
+
 msgid ""
 "Runs the Python unit tests against the current default version of Django "
 "with Python 3.7 environment. Check ``requirements.txt`` in horizon "
@@ -7314,6 +7318,9 @@ msgstr ""
 "with Python 3.7 environment. Check ``requirements.txt`` in Horizon "
 "repository to know which version of Django is actually used."
 
+msgid "Runs the Python unit tests with a Python 3.11 environment."
+msgstr "Runs the Python unit tests with a Python 3.11 environment."
+
 msgid "SCSS files"
 msgstr "SCSS files"
 
@@ -12394,6 +12401,12 @@ msgstr "panel.py"
 msgid "pep8"
 msgstr "pep8"
 
+msgid "py3-dj42"
+msgstr "py3-dj42"
+
+msgid "py311"
+msgstr "py311"
+
 msgid "py37"
 msgstr "py37"
 
diff --git a/doc/source/locale/en_GB/LC_MESSAGES/doc-install.po b/doc/source/locale/en_GB/LC_MESSAGES/doc-install.po
index ec0acea..83012ff 100644
--- a/doc/source/locale/en_GB/LC_MESSAGES/doc-install.po
+++ b/doc/source/locale/en_GB/LC_MESSAGES/doc-install.po
@@ -2,15 +2,16 @@
 # Andi Chandler <[e-mail]>, 2019. #zanata
 # Andi Chandler <[e-mail]>, 2020. #zanata
 # Andi Chandler <[e-mail]>, 2022. #zanata
+# Andi Chandler <[e-mail]>, 2024. #zanata
 msgid ""
 msgstr ""
-"Project-Id-Version: horizon 23.4.1.dev25\n"
+"Project-Id-Version: horizon 24.0.1.dev2\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2024-02-07 17:51+0000\n"
+"POT-Creation-Date: 2024-03-23 17:30+0000\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"PO-Revision-Date: 2022-05-25 09:09+0000\n"
+"PO-Revision-Date: 2024-04-18 12:43+0000\n"
 "Last-Translator: Andi Chandler <[e-mail]>\n"
 "Language-Team: English (United Kingdom)\n"
 "Language: en_GB\n"
@@ -364,6 +365,9 @@ msgstr ""
 msgid "Deployment"
 msgstr "Deployment"
 
+msgid "Django 4.2"
+msgstr "Django 4.2"
+
 msgid "Django support policy is documented at :ref:`django_support`."
 msgstr "Django support policy is documented at :ref:`django_support`."
 
@@ -582,6 +586,9 @@ msgstr ""
 "certificate connection problems, point the server IP address to a domain "
 "name, and give users access."
 
+msgid "Python 3.8 or 3.11"
+msgstr "Python 3.8 or 3.11"
+
 msgid "Python memcached module installed"
 msgstr "Python memcached module installed"
 
@@ -647,6 +654,9 @@ msgstr "Static Assets"
 msgid "System Requirements"
 msgstr "System Requirements"
 
+msgid "The Caracal release of horizon has the following dependencies."
+msgstr "The Caracal release of Horizon has the following dependencies."
+
 msgid ""
 "The ``systemctl restart`` command starts each service if not currently "
 "running."
diff --git a/horizon.egg-info/PKG-INFO b/horizon.egg-info/PKG-INFO
index b7dca79..ca6115f 100644
--- a/horizon.egg-info/PKG-INFO
+++ b/horizon.egg-info/PKG-INFO
@@ -1,66 +1,10 @@
-Metadata-Version: 1.2
+Metadata-Version: 2.1
 Name: horizon
-Version: 24.0.0
+Version: 24.0.1
 Summary: OpenStack Dashboard
 Home-page: https://docs.openstack.org/horizon/latest/
 Author: OpenStack
 Author-email: [e-mail]
-License: UNKNOWN
-Description: =============================
-        Horizon (OpenStack Dashboard)
-        =============================
-        
-        Horizon is a Django-based project aimed at providing a complete OpenStack
-        Dashboard along with an extensible framework for building new dashboards
-        from reusable components. The ``openstack_dashboard`` module is a reference
-        implementation of a Django site that uses the ``horizon`` app to provide
-        web-based interactions with the various OpenStack projects.
-        
-        * Project documentation: https://docs.openstack.org/horizon/latest/
-        * Release management: https://launchpad.net/horizon
-        * Blueprints and feature specifications: https://blueprints.launchpad.net/horizon
-        * Issue tracking: https://bugs.launchpad.net/horizon
-        * Release notes: https://docs.openstack.org/releasenotes/horizon/
-        
-        .. image:: https://governance.openstack.org/tc/badges/horizon.svg
-            :target: https://governance.openstack.org/tc/reference/tags/
-        
-        Using Horizon
-        =============
-        
-        See ``doc/source/install/index.rst`` about how to install Horizon
-        in your OpenStack setup. It describes the example steps and
-        has pointers for more detailed settings and configurations.
-        
-        It is also available at
-        `Installation Guide <https://docs.openstack.org/horizon/latest/install/>`_.
-        
-        Getting Started for Developers
-        ==============================
-        
-        ``doc/source/quickstart.rst`` or
-        `Quickstart Guide <https://docs.openstack.org/horizon/latest/contributor/quickstart.html>`_
-        describes how to setup Horizon development environment and start development.
-        
-        Building Contributor Documentation
-        ==================================
-        
-        This documentation is written by contributors, for contributors.
-        
-        The source is maintained in the ``doc/source`` directory using
-        `reStructuredText`_ and built by `Sphinx`_
-        
-        .. _reStructuredText: http://docutils.sourceforge.net/rst.html
-        .. _Sphinx: http://sphinx-doc.org/
-        
-        To build the docs, use::
-        
-          $ tox -e docs
-        
-        Results are in the ``doc/build/html`` directory
-        
-        
-Platform: UNKNOWN
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: OpenStack
 Classifier: Framework :: Django
@@ -77,3 +21,118 @@ Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
 Classifier: Topic :: Internet :: WWW/HTTP
 Requires-Python: >=3.8
+License-File: LICENSE
+Requires-Dist: pbr>=5.5.0
+Requires-Dist: Babel>=2.6.0
+Requires-Dist: debtcollector>=1.2.0
+Requires-Dist: Django<4.3,>=4.2
+Requires-Dist: django-compressor>=2.4.1
+Requires-Dist: django-debreach>=1.4.2
+Requires-Dist: django-pyscss>=2.0.3
+Requires-Dist: futurist>=1.2.0
+Requires-Dist: iso8601>=0.1.11
+Requires-Dist: keystoneauth1>=4.3.1
+Requires-Dist: netaddr>=0.7.18
+Requires-Dist: oslo.concurrency>=4.5.0
+Requires-Dist: oslo.config>=8.8.0
+Requires-Dist: oslo.i18n>=5.1.0
+Requires-Dist: oslo.policy>=3.11.0
+Requires-Dist: oslo.serialization>=4.3.0
+Requires-Dist: oslo.upgradecheck>=1.5.0
+Requires-Dist: oslo.utils>=4.12.0
+Requires-Dist: osprofiler>=3.4.2
+Requires-Dist: pymongo!=3.1,>=3.0.2
+Requires-Dist: pyScss>=1.4.0
+Requires-Dist: python-cinderclient>=8.0.0
+Requires-Dist: python-glanceclient>=2.8.0
+Requires-Dist: python-keystoneclient>=3.22.0
+Requires-Dist: python-neutronclient>=8.1.0
+Requires-Dist: python-novaclient>=9.1.0
+Requires-Dist: python-swiftclient>=3.2.0
+Requires-Dist: pytz>=2013.6
+Requires-Dist: PyYAML>=6.0
+Requires-Dist: requests>=2.25.1
+Requires-Dist: semantic-version>=2.3.1
+Requires-Dist: XStatic>=1.0.3
+Requires-Dist: XStatic-Angular>=1.8.2.2
+Requires-Dist: XStatic-Angular-Bootstrap>=2.2.0.0
+Requires-Dist: XStatic-Angular-FileUpload>=12.0.4.0
+Requires-Dist: XStatic-Angular-Gettext>=2.3.8.0
+Requires-Dist: XStatic-Angular-lrdragndrop>=1.0.2.2
+Requires-Dist: XStatic-Angular-Schema-Form>=0.8.13.0
+Requires-Dist: XStatic-Bootstrap-Datepicker>=1.3.1.0
+Requires-Dist: XStatic-Bootstrap-SCSS>=3.3.7.1
+Requires-Dist: XStatic-bootswatch>=3.3.7.0
+Requires-Dist: XStatic-D3>=3.5.17.0
+Requires-Dist: XStatic-Hogan>=2.0.0.2
+Requires-Dist: XStatic-Font-Awesome>=4.7.0.0
+Requires-Dist: XStatic-Jasmine>=2.4.1.1
+Requires-Dist: XStatic-jQuery>=3.5.1.1
+Requires-Dist: XStatic-JQuery-Migrate>=3
+Requires-Dist: XStatic-JQuery.quicksearch>=2.0.3.1
+Requires-Dist: XStatic-JQuery.TableSorter>=2.14.5.1
+Requires-Dist: XStatic-jquery-ui>=1.12.1.1
+Requires-Dist: XStatic-JSEncrypt>=2.3.1.1
+Requires-Dist: XStatic-mdi>=1.6.50.2
+Requires-Dist: XStatic-objectpath>=1.2.1.0
+Requires-Dist: XStatic-Rickshaw>=1.5.0.0
+Requires-Dist: XStatic-roboto-fontface>=0.5.0.0
+Requires-Dist: XStatic-smart-table>=1.4.13.2
+Requires-Dist: XStatic-Spin>=1.2.5.2
+Requires-Dist: XStatic-term.js>=0.0.7.0
+Requires-Dist: XStatic-tv4>=1.2.7.0
+Requires-Dist: enmerkar>=0.7.1
+
+=============================
+Horizon (OpenStack Dashboard)
+=============================
+
+Horizon is a Django-based project aimed at providing a complete OpenStack
+Dashboard along with an extensible framework for building new dashboards
+from reusable components. The ``openstack_dashboard`` module is a reference
+implementation of a Django site that uses the ``horizon`` app to provide
+web-based interactions with the various OpenStack projects.
+
+* Project documentation: https://docs.openstack.org/horizon/latest/
+* Release management: https://launchpad.net/horizon
+* Blueprints and feature specifications: https://blueprints.launchpad.net/horizon
+* Issue tracking: https://bugs.launchpad.net/horizon
+* Release notes: https://docs.openstack.org/releasenotes/horizon/
+
+.. image:: https://governance.openstack.org/tc/badges/horizon.svg
+    :target: https://governance.openstack.org/tc/reference/tags/
+
+Using Horizon
+=============
+
+See ``doc/source/install/index.rst`` about how to install Horizon
+in your OpenStack setup. It describes the example steps and
+has pointers for more detailed settings and configurations.
+
+It is also available at
+`Installation Guide <https://docs.openstack.org/horizon/latest/install/>`_.
+
+Getting Started for Developers
+==============================
+
+``doc/source/quickstart.rst`` or
+`Quickstart Guide <https://docs.openstack.org/horizon/latest/contributor/quickstart.html>`_
+describes how to setup Horizon development environment and start development.
+
+Building Contributor Documentation
+==================================
+
+This documentation is written by contributors, for contributors.
+
+The source is maintained in the ``doc/source`` directory using
+`reStructuredText`_ and built by `Sphinx`_
+
+.. _reStructuredText: http://docutils.sourceforge.net/rst.html
+.. _Sphinx: http://sphinx-doc.org/
+
+To build the docs, use::
+
+  $ tox -e docs
+
+Results are in the ``doc/build/html`` directory
+
diff --git a/horizon.egg-info/SOURCES.txt b/horizon.egg-info/SOURCES.txt
index c853f9d..e2a8f9f 100644
--- a/horizon.egg-info/SOURCES.txt
+++ b/horizon.egg-info/SOURCES.txt
@@ -2954,6 +2954,7 @@ releasenotes/notes/bug_1963652_fix_policy_for_resume-a719efb23054c708.yaml
 releasenotes/notes/change-default-image-visibility-560c3b6ab2830cdc.yaml
 releasenotes/notes/change-keystone-default-role-3f95b6af11aed63b.yaml
 releasenotes/notes/change-keystone-url-default-value-6a56397acf4f7328.yaml
+releasenotes/notes/change-metadef-for-cinder-volume-type-f65dd215d2a3ce75.yaml
 releasenotes/notes/cinder-api-v3-by-default-d6e3c12760fdf655.yaml
 releasenotes/notes/cinder-backup-cinder-messages-2127d04da3c82033.yaml
 releasenotes/notes/cinder-user-facing-messages-92cfd25492616d6d.yaml
@@ -3144,13 +3145,6 @@ releasenotes/source/yoga.rst
 releasenotes/source/zed.rst
 releasenotes/source/_static/.placeholder
 releasenotes/source/_templates/.placeholder
-releasenotes/source/locale/de/LC_MESSAGES/releasenotes.po
-releasenotes/source/locale/en_GB/LC_MESSAGES/releasenotes.po
-releasenotes/source/locale/id/LC_MESSAGES/releasenotes.po
-releasenotes/source/locale/ja/LC_MESSAGES/releasenotes.po
-releasenotes/source/locale/ko_KR/LC_MESSAGES/releasenotes.po
-releasenotes/source/locale/pt_BR/LC_MESSAGES/releasenotes.po
-releasenotes/source/locale/zh_CN/LC_MESSAGES/releasenotes.po
 roles/ensure-django/defaults/main.yaml
 roles/ensure-django/tasks/main.yaml
 roles/fetch-video-output/README.rst
diff --git a/horizon.egg-info/entry_points.txt b/horizon.egg-info/entry_points.txt
index 15c19b3..1011e3a 100644
--- a/horizon.egg-info/entry_points.txt
+++ b/horizon.egg-info/entry_points.txt
@@ -4,4 +4,3 @@ angular = horizon.utils.babel_extract_angular:extract_angular
 [oslo.config.opts]
 openstack_dashboard = openstack_dashboard.utils.config:list_options
 openstack_dashboard_integration_tests = openstack_dashboard.test.integration_tests.config:list_opts
-
diff --git a/horizon.egg-info/pbr.json b/horizon.egg-info/pbr.json
index 006b632..8a54205 100644
--- a/horizon.egg-info/pbr.json
+++ b/horizon.egg-info/pbr.json
@@ -1 +1 @@
-{"git_version": "3d9855eeb", "is_release": true}
\ No newline at end of file
+{"git_version": "a9267a60d", "is_release": true}
\ No newline at end of file
diff --git a/horizon.egg-info/requires.txt b/horizon.egg-info/requires.txt
index ab85861..29ab7f5 100644
--- a/horizon.egg-info/requires.txt
+++ b/horizon.egg-info/requires.txt
@@ -1,39 +1,10 @@
+pbr>=5.5.0
 Babel>=2.6.0
-Django<4.3,>=4.2
-PyYAML>=6.0
-XStatic-Angular-Bootstrap>=2.2.0.0
-XStatic-Angular-FileUpload>=12.0.4.0
-XStatic-Angular-Gettext>=2.3.8.0
-XStatic-Angular-Schema-Form>=0.8.13.0
-XStatic-Angular-lrdragndrop>=1.0.2.2
-XStatic-Angular>=1.8.2.2
-XStatic-Bootstrap-Datepicker>=1.3.1.0
-XStatic-Bootstrap-SCSS>=3.3.7.1
-XStatic-D3>=3.5.17.0
-XStatic-Font-Awesome>=4.7.0.0
-XStatic-Hogan>=2.0.0.2
-XStatic-JQuery-Migrate>=3
-XStatic-JQuery.TableSorter>=2.14.5.1
-XStatic-JQuery.quicksearch>=2.0.3.1
-XStatic-JSEncrypt>=2.3.1.1
-XStatic-Jasmine>=2.4.1.1
-XStatic-Rickshaw>=1.5.0.0
-XStatic-Spin>=1.2.5.2
-XStatic-bootswatch>=3.3.7.0
-XStatic-jQuery>=3.5.1.1
-XStatic-jquery-ui>=1.12.1.1
-XStatic-mdi>=1.6.50.2
-XStatic-objectpath>=1.2.1.0
-XStatic-roboto-fontface>=0.5.0.0
-XStatic-smart-table>=1.4.13.2
-XStatic-term.js>=0.0.7.0
-XStatic-tv4>=1.2.7.0
-XStatic>=1.0.3
 debtcollector>=1.2.0
+Django<4.3,>=4.2
 django-compressor>=2.4.1
 django-debreach>=1.4.2
 django-pyscss>=2.0.3
-enmerkar>=0.7.1
 futurist>=1.2.0
 iso8601>=0.1.11
 keystoneauth1>=4.3.1
@@ -46,9 +17,8 @@ oslo.serialization>=4.3.0
 oslo.upgradecheck>=1.5.0
 oslo.utils>=4.12.0
 osprofiler>=3.4.2
-pbr>=5.5.0
-pyScss>=1.4.0
 pymongo!=3.1,>=3.0.2
+pyScss>=1.4.0
 python-cinderclient>=8.0.0
 python-glanceclient>=2.8.0
 python-keystoneclient>=3.22.0
@@ -56,5 +26,35 @@ python-neutronclient>=8.1.0
 python-novaclient>=9.1.0
 python-swiftclient>=3.2.0
 pytz>=2013.6
+PyYAML>=6.0
 requests>=2.25.1
 semantic-version>=2.3.1
+XStatic>=1.0.3
+XStatic-Angular>=1.8.2.2
+XStatic-Angular-Bootstrap>=2.2.0.0
+XStatic-Angular-FileUpload>=12.0.4.0
+XStatic-Angular-Gettext>=2.3.8.0
+XStatic-Angular-lrdragndrop>=1.0.2.2
+XStatic-Angular-Schema-Form>=0.8.13.0
+XStatic-Bootstrap-Datepicker>=1.3.1.0
+XStatic-Bootstrap-SCSS>=3.3.7.1
+XStatic-bootswatch>=3.3.7.0
+XStatic-D3>=3.5.17.0
+XStatic-Hogan>=2.0.0.2
+XStatic-Font-Awesome>=4.7.0.0
+XStatic-Jasmine>=2.4.1.1
+XStatic-jQuery>=3.5.1.1
+XStatic-JQuery-Migrate>=3
+XStatic-JQuery.quicksearch>=2.0.3.1
+XStatic-JQuery.TableSorter>=2.14.5.1
+XStatic-jquery-ui>=1.12.1.1
+XStatic-JSEncrypt>=2.3.1.1
+XStatic-mdi>=1.6.50.2
+XStatic-objectpath>=1.2.1.0
+XStatic-Rickshaw>=1.5.0.0
+XStatic-roboto-fontface>=0.5.0.0
+XStatic-smart-table>=1.4.13.2
+XStatic-Spin>=1.2.5.2
+XStatic-term.js>=0.0.7.0
+XStatic-tv4>=1.2.7.0
+enmerkar>=0.7.1
diff --git a/openstack_auth/policy.py b/openstack_auth/policy.py
index 2b43ef3..30b29e4 100644
--- a/openstack_auth/policy.py
+++ b/openstack_auth/policy.py
@@ -59,8 +59,11 @@ def _get_policy_file_with_full_path(service):
 def _convert_to_ruledefault(p):
     deprecated = p.get('deprecated_rule')
     if deprecated:
-        deprecated_rule = policy.DeprecatedRule(deprecated['name'],
-                                                deprecated['check_str'])
+        deprecated_rule = policy.DeprecatedRule(
+            deprecated['name'],
+            deprecated['check_str'],
+            deprecated_reason=deprecated.get('deprecated_reason'),
+            deprecated_since=deprecated.get('deprecated_since'))
     else:
         deprecated_rule = None
 
diff --git a/openstack_dashboard/api/keystone.py b/openstack_dashboard/api/keystone.py
index 976b61c..5bb86af 100644
--- a/openstack_dashboard/api/keystone.py
+++ b/openstack_dashboard/api/keystone.py
@@ -221,7 +221,7 @@ def domain_delete(request, domain_id):
 
 @profiler.trace
 def domain_list(request):
-    manager = keystoneclient(request, admin=True).domains
+    manager = keystoneclient(request, admin=True, force_scoped=True).domains
     return manager.list()
 
 
diff --git a/openstack_dashboard/api/neutron.py b/openstack_dashboard/api/neutron.py
index 3df0e8a..2ad1ca5 100644
--- a/openstack_dashboard/api/neutron.py
+++ b/openstack_dashboard/api/neutron.py
@@ -213,7 +213,8 @@ class PortAllowedAddressPair(NeutronAPIDictWrapper):
     def __init__(self, addr_pair):
         super().__init__(addr_pair)
         # Horizon references id property for table operations
-        self.id = addr_pair['ip_address']
+        mac_addr = addr_pair['mac_address'].replace(':', '-')
+        self.id = addr_pair['ip_address'] + ":" + mac_addr
 
 
 class Router(NeutronAPIDictWrapper):
diff --git a/openstack_dashboard/api/placement.py b/openstack_dashboard/api/placement.py
index 60c07d4..f2cf5ae 100644
--- a/openstack_dashboard/api/placement.py
+++ b/openstack_dashboard/api/placement.py
@@ -10,6 +10,7 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+from django.conf import settings
 from keystoneauth1 import adapter
 from keystoneauth1 import identity
 from keystoneauth1 import session
@@ -41,7 +42,15 @@ def make_adapter(request):
         project_name=request.user.project_name,
         project_domain_name=request.user.domain_id,
     )
-    return Adapter(session.Session(auth=auth), api_version="placement 1.6")
+    verify = True
+    if settings.OPENSTACK_SSL_NO_VERIFY:
+        verify = False
+    elif settings.OPENSTACK_SSL_CACERT:
+        verify = settings.OPENSTACK_SSL_CACERT
+    return Adapter(
+        session.Session(auth=auth, verify=verify),
+        api_version="placement 1.6",
+    )
 
 
 def _get_json(request, path):
@@ -91,38 +100,55 @@ def get_providers(request):
         usages = resource_provider_usages(request, p['uuid'])
         vcpus = inventories.get('VCPU')
         pcpus = inventories.get('PCPU')
+        memory = inventories.get('MEMORY_MB')
+        disk = inventories.get('DISK_GB')
         p['inventories'] = inventories
         p['usages'] = usages
         p['aggregates'] = resource_provider_aggregates(request, p['uuid'])
         p['traits'] = resource_provider_traits(request, p['uuid'])
 
         p['vcpus_used'] = usages.get('VCPU')
-        p['vcpus_reserved'] = vcpus['reserved'] if vcpus is not None else None
+        # Reserved:
         # The actual amount of the resource that the provider can accommodate
-        p['vcpus'] = vcpus['total'] if vcpus is not None else None
+        # Total:
         # Overall capacity
-        p['vcpus_ar'] = vcpus['allocation_ratio'] \
-            if vcpus is not None else None
-        p['vcpus_capacity'] = int(vcpus['allocation_ratio'] * vcpus['total']) \
-            if vcpus is not None else None
+        if vcpus is not None:
+            p.update(vcpus_reserved=vcpus['reserved'],
+                     vcpus=vcpus['total'],
+                     vcpus_ar=vcpus['allocation_ratio'])
+            p['vcpus_capacity'] = int(p['vcpus_ar'] * p['vcpus'])
+        else:
+            p.update(vcpus_reserved=None, vcpus=None,
+                     vcpus_ar=None, vcpus_capacity=None)
 
         p['pcpus_used'] = usages.get('PCPU')
-        p['pcpus_reserved'] = pcpus['reserved'] if pcpus is not None else None
-        p['pcpus'] = pcpus['total'] if pcpus is not None else None
-        p['pcpus_ar'] = pcpus['allocation_ratio'] \
-            if pcpus is not None else None
-        p['pcpus_capacity'] = int(pcpus['allocation_ratio'] * pcpus['total']) \
-            if pcpus is not None else None
-
-        p['memory_mb_used'] = usages['MEMORY_MB']
-        p['memory_mb_reserved'] = inventories['MEMORY_MB']['reserved']
-        p['memory_mb'] = inventories['MEMORY_MB']['total']
-        p['memory_mb_ar'] = inventories['MEMORY_MB']['allocation_ratio']
-        p['memory_mb_capacity'] = p['memory_mb_ar'] * p['memory_mb']
-
-        p['disk_gb_used'] = usages['DISK_GB']
-        p['disk_gb_reserved'] = inventories['DISK_GB']['reserved']
-        p['disk_gb'] = inventories['DISK_GB']['total']
-        p['disk_gb_ar'] = inventories['DISK_GB']['allocation_ratio']
-        p['disk_gb_capacity'] = p['disk_gb_ar'] * p['disk_gb']
+        if pcpus is not None:
+            p.update(pcpus_reserved=pcpus['reserved'],
+                     pcpus=pcpus['total'],
+                     pcpus_ar=pcpus['allocation_ratio'])
+            p['pcpus_capacity'] = int(p['pcpus_ar'] * p['pcpus'])
+        else:
+            p.update(pcpus_reserved=None, pcpus=None,
+                     pcpus_ar=None, pcpus_capacity=None)
+
+        p['memory_mb_used'] = usages.get('MEMORY_MB')
+        if memory is not None:
+            p.update(memory_mb_reserved=memory['reserved'],
+                     memory_mb=memory['total'],
+                     memory_mb_ar=memory['allocation_ratio'])
+            p['memory_mb_capacity'] = p['memory_mb_ar'] * p['memory_mb']
+        else:
+            p.update(memory_mb_reserved=None, memory_mb=None,
+                     memory_mb_ar=None, memory_mb_capacity=None)
+
+        p['disk_gb_used'] = usages.get('DISK_GB')
+        if disk is not None:
+            p.update(disk_gb_reserved=disk['reserved'],
+                     disk_gb=disk['total'],
+                     disk_gb_ar=disk['allocation_ratio'])
+            p['disk_gb_capacity'] = p['disk_gb_ar'] * p['disk_gb']
+        else:
+            p.update(disk_gb_reserved=None, disk_gb=None,
+                     disk_gb_ar=None, disk_gb_capacity=None)
+
     return providers
diff --git a/openstack_dashboard/conf/default_policies/cinder.yaml b/openstack_dashboard/conf/default_policies/cinder.yaml
index 1badc61..31dda6e 100644
--- a/openstack_dashboard/conf/default_policies/cinder.yaml
+++ b/openstack_dashboard/conf/default_policies/cinder.yaml
@@ -32,11 +32,14 @@
   operations: []
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: ''
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:attachment_create
-  deprecated_since: null
   description: Create attachment.
   name: volume:attachment_create
   operations:
@@ -44,11 +47,14 @@
     path: /attachments
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:attachment_update
-  deprecated_since: null
   description: Update attachment.
   name: volume:attachment_update
   operations:
@@ -56,11 +62,14 @@
     path: /attachments/{attachment_id}
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:attachment_delete
-  deprecated_since: null
   description: Delete attachment.
   name: volume:attachment_delete
   operations:
@@ -68,11 +77,14 @@
     path: /attachments/{attachment_id}
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:attachment_complete
-  deprecated_since: null
   description: Mark a volume attachment process as completed (in-use)
   name: volume:attachment_complete
   operations:
@@ -80,11 +92,14 @@
     path: /attachments/{attachment_id}/action (os-complete)
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:multiattach_bootable_volume
-  deprecated_since: null
   description: Allow multiattach of bootable volumes.
   name: volume:multiattach_bootable_volume
   operations:
@@ -92,11 +107,14 @@
     path: /attachments
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_reader
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: message:get_all
-  deprecated_since: null
   description: List messages.
   name: message:get_all
   operations:
@@ -104,11 +122,14 @@
     path: /messages
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_reader
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: message:get
-  deprecated_since: null
   description: Show message.
   name: message:get
   operations:
@@ -116,11 +137,14 @@
     path: /messages/{message_id}
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: message:delete
-  deprecated_since: null
   description: Delete message.
   name: message:delete
   operations:
@@ -158,11 +182,14 @@
     path: /workers/cleanup
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_reader
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:get_snapshot_metadata
-  deprecated_since: null
   description: Show snapshot's metadata or one specified metadata with a given key.
   name: volume:get_snapshot_metadata
   operations:
@@ -172,11 +199,14 @@
     path: /snapshots/{snapshot_id}/metadata/{key}
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:update_snapshot_metadata
-  deprecated_since: null
   description: Update snapshot's metadata or one specified metadata with a given key.
   name: volume:update_snapshot_metadata
   operations:
@@ -186,11 +216,14 @@
     path: /snapshots/{snapshot_id}/metadata/{key}
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:delete_snapshot_metadata
-  deprecated_since: null
   description: Delete snapshot's specified metadata with a given key.
   name: volume:delete_snapshot_metadata
   operations:
@@ -198,11 +231,14 @@
     path: /snapshots/{snapshot_id}/metadata/{key}
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_reader
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:get_all_snapshots
-  deprecated_since: null
   description: List snapshots.
   name: volume:get_all_snapshots
   operations:
@@ -212,11 +248,14 @@
     path: /snapshots/detail
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_reader
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume_extension:extended_snapshot_attributes
-  deprecated_since: null
   description: List or show snapshots with extended attributes.
   name: volume_extension:extended_snapshot_attributes
   operations:
@@ -226,11 +265,14 @@
     path: /snapshots/detail
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:create_snapshot
-  deprecated_since: null
   description: Create snapshot.
   name: volume:create_snapshot
   operations:
@@ -238,11 +280,14 @@
     path: /snapshots
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_reader
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:get_snapshot
-  deprecated_since: null
   description: Show snapshot.
   name: volume:get_snapshot
   operations:
@@ -250,11 +295,14 @@
     path: /snapshots/{snapshot_id}
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:update_snapshot
-  deprecated_since: null
   description: Update snapshot.
   name: volume:update_snapshot
   operations:
@@ -262,11 +310,14 @@
     path: /snapshots/{snapshot_id}
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:delete_snapshot
-  deprecated_since: null
   description: Delete snapshot.
   name: volume:delete_snapshot
   operations:
@@ -281,11 +332,14 @@
     path: /snapshots/{snapshot_id}/action (os-reset_status)
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: ''
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: snapshot_extension:snapshot_actions:update_snapshot_status
-  deprecated_since: null
   description: Update database fields of snapshot.
   name: snapshot_extension:snapshot_actions:update_snapshot_status
   operations:
@@ -323,11 +377,14 @@
     path: /snapshots/{snapshot_id}/action (os-unmanage)
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_reader
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: backup:get_all
-  deprecated_since: null
   description: List backups.
   name: backup:get_all
   operations:
@@ -346,11 +403,14 @@
     path: /backups/detail
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: ''
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: backup:create
-  deprecated_since: null
   description: Create backup.
   name: backup:create
   operations:
@@ -358,11 +418,14 @@
     path: /backups
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_reader
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: backup:get
-  deprecated_since: null
   description: Show backup.
   name: backup:get
   operations:
@@ -370,11 +433,14 @@
     path: /backups/{backup_id}
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: backup:update
-  deprecated_since: null
   description: Update backup.
   name: backup:update
   operations:
@@ -382,11 +448,14 @@
     path: /backups/{backup_id}
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: backup:delete
-  deprecated_since: null
   description: Delete backup.
   name: backup:delete
   operations:
@@ -394,11 +463,14 @@
     path: /backups/{backup_id}
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: backup:restore
-  deprecated_since: null
   description: Restore backup.
   name: backup:restore
   operations:
@@ -434,11 +506,14 @@
     path: /backups/{backup_id}/action (os-force_delete)
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_reader
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: group:get_all
-  deprecated_since: null
   description: List groups.
   name: group:get_all
   operations:
@@ -448,11 +523,14 @@
     path: /groups/detail
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: ''
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: group:create
-  deprecated_since: null
   description: Create group.
   name: group:create
   operations:
@@ -460,11 +538,14 @@
     path: /groups
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_reader
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: group:get
-  deprecated_since: null
   description: Show group.
   name: group:get
   operations:
@@ -472,11 +553,14 @@
     path: /groups/{group_id}
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: group:update
-  deprecated_since: null
   description: Update group.
   name: group:update
   operations:
@@ -493,11 +577,12 @@
     path: /groups/detail
   scope_types: null
 - check_str: rule:admin_api
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_api
+    deprecated_reason: group:group_types_manage has been replaced by more granular
+      policies that separately govern POST, PUT, and DELETE operations.
+    deprecated_since: X
     name: group:group_types_manage
-  deprecated_since: null
   description: Create a group type.
   name: group:group_types:create
   operations:
@@ -505,11 +590,12 @@
     path: /group_types/
   scope_types: null
 - check_str: rule:admin_api
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_api
+    deprecated_reason: group:group_types_manage has been replaced by more granular
+      policies that separately govern POST, PUT, and DELETE operations.
+    deprecated_since: X
     name: group:group_types_manage
-  deprecated_since: null
   description: Update a group type.
   name: group:group_types:update
   operations:
@@ -517,11 +603,12 @@
     path: /group_types/{group_type_id}
   scope_types: null
 - check_str: rule:admin_api
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_api
+    deprecated_reason: group:group_types_manage has been replaced by more granular
+      policies that separately govern POST, PUT, and DELETE operations.
+    deprecated_since: X
     name: group:group_types_manage
-  deprecated_since: null
   description: Delete a group type.
   name: group:group_types:delete
   operations:
@@ -536,11 +623,12 @@
     path: /group_types/{group_type_id}
   scope_types: null
 - check_str: rule:admin_api
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_api
+    deprecated_reason: group:group_types_specs has been replaced by more granular
+      policies that separately govern GET, POST, PUT, and DELETE operations.
+    deprecated_since: X
     name: group:group_types_specs
-  deprecated_since: null
   description: Show a group type spec.
   name: group:group_types_specs:get
   operations:
@@ -548,11 +636,12 @@
     path: /group_types/{group_type_id}/group_specs/{g_spec_id}
   scope_types: null
 - check_str: rule:admin_api
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_api
+    deprecated_reason: group:group_types_specs has been replaced by more granular
+      policies that separately govern GET, POST, PUT, and DELETE operations.
+    deprecated_since: X
     name: group:group_types_specs
-  deprecated_since: null
   description: List group type specs.
   name: group:group_types_specs:get_all
   operations:
@@ -560,11 +649,12 @@
     path: /group_types/{group_type_id}/group_specs
   scope_types: null
 - check_str: rule:admin_api
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_api
+    deprecated_reason: group:group_types_specs has been replaced by more granular
+      policies that separately govern GET, POST, PUT, and DELETE operations.
+    deprecated_since: X
     name: group:group_types_specs
-  deprecated_since: null
   description: Create a group type spec.
   name: group:group_types_specs:create
   operations:
@@ -572,11 +662,12 @@
     path: /group_types/{group_type_id}/group_specs
   scope_types: null
 - check_str: rule:admin_api
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_api
+    deprecated_reason: group:group_types_specs has been replaced by more granular
+      policies that separately govern GET, POST, PUT, and DELETE operations.
+    deprecated_since: X
     name: group:group_types_specs
-  deprecated_since: null
   description: Update a group type spec.
   name: group:group_types_specs:update
   operations:
@@ -584,11 +675,12 @@
     path: /group_types/{group_type_id}/group_specs/{g_spec_id}
   scope_types: null
 - check_str: rule:admin_api
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_api
+    deprecated_reason: group:group_types_specs has been replaced by more granular
+      policies that separately govern GET, POST, PUT, and DELETE operations.
+    deprecated_since: X
     name: group:group_types_specs
-  deprecated_since: null
   description: Delete a group type spec.
   name: group:group_types_specs:delete
   operations:
@@ -596,11 +688,14 @@
     path: /group_types/{group_type_id}/group_specs/{g_spec_id}
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_reader
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: group:get_all_group_snapshots
-  deprecated_since: null
   description: List group snapshots.
   name: group:get_all_group_snapshots
   operations:
@@ -610,11 +705,14 @@
     path: /group_snapshots/detail
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: ''
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: group:create_group_snapshot
-  deprecated_since: null
   description: Create group snapshot.
   name: group:create_group_snapshot
   operations:
@@ -622,11 +720,14 @@
     path: /group_snapshots
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_reader
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: group:get_group_snapshot
-  deprecated_since: null
   description: Show group snapshot.
   name: group:get_group_snapshot
   operations:
@@ -634,11 +735,14 @@
     path: /group_snapshots/{group_snapshot_id}
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: group:delete_group_snapshot
-  deprecated_since: null
   description: Delete group snapshot.
   name: group:delete_group_snapshot
   operations:
@@ -646,11 +750,14 @@
     path: /group_snapshots/{group_snapshot_id}
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: group:update_group_snapshot
-  deprecated_since: null
   description: Update group snapshot.
   name: group:update_group_snapshot
   operations:
@@ -674,11 +781,14 @@
     path: /group_snapshots/{g_snapshot_id}/action (reset_status)
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: group:delete
-  deprecated_since: null
   description: Delete group.
   name: group:delete
   operations:
@@ -693,11 +803,14 @@
     path: /groups/{group_id}/action (reset_status)
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: group:enable_replication
-  deprecated_since: null
   description: Enable replication.
   name: group:enable_replication
   operations:
@@ -705,11 +818,14 @@
     path: /groups/{group_id}/action (enable_replication)
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: group:disable_replication
-  deprecated_since: null
   description: Disable replication.
   name: group:disable_replication
   operations:
@@ -717,11 +833,14 @@
     path: /groups/{group_id}/action (disable_replication)
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: group:failover_replication
-  deprecated_since: null
   description: Fail over replication.
   name: group:failover_replication
   operations:
@@ -729,11 +848,14 @@
     path: /groups/{group_id}/action (failover_replication)
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: group:list_replication_targets
-  deprecated_since: null
   description: List failover replication.
   name: group:list_replication_targets
   operations:
@@ -786,11 +908,12 @@
     path: /qos-specs/{qos_id}/delete_keys
   scope_types: null
 - check_str: rule:admin_api
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_api
+    deprecated_reason: volume_extension:quota_classes has been replaced by more granular
+      policies that separately govern GET and PUT operations.
+    deprecated_since: X
     name: volume_extension:quota_classes
-  deprecated_since: null
   description: Show project quota class.
   name: volume_extension:quota_classes:get
   operations:
@@ -798,11 +921,12 @@
     path: /os-quota-class-sets/{project_id}
   scope_types: null
 - check_str: rule:admin_api
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_api
+    deprecated_reason: volume_extension:quota_classes has been replaced by more granular
+      policies that separately govern GET and PUT operations.
+    deprecated_since: X
     name: volume_extension:quota_classes
-  deprecated_since: null
   description: Update project quota class.
   name: volume_extension:quota_classes:update
   operations:
@@ -810,11 +934,11 @@
     path: /os-quota-class-sets/{project_id}
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_reader
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: null
+    deprecated_since: null
     name: volume_extension:quotas:show
-  deprecated_since: null
   description: Show project quota (including usage and default).
   name: volume_extension:quotas:show
   operations:
@@ -901,11 +1025,14 @@
     path: /os-hosts/{host_id}
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_reader
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: limits_extension:used_limits
-  deprecated_since: null
   description: Show limits with used limit attributes.
   name: limits_extension:used_limits
   operations:
@@ -936,11 +1063,12 @@
     path: /volumes/{volume_id}/action (os-unmanage)
   scope_types: null
 - check_str: rule:admin_api
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_api
+    deprecated_reason: volume_extension:types_manage has been replaced by more granular
+      policies that separately govern POST, PUT, and DELETE operations.
+    deprecated_since: X
     name: volume_extension:types_manage
-  deprecated_since: null
   description: Create volume type.
   name: volume_extension:type_create
   operations:
@@ -948,11 +1076,12 @@
     path: /types
   scope_types: null
 - check_str: rule:admin_api
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_api
+    deprecated_reason: volume_extension:types_manage has been replaced by more granular
+      policies that separately govern POST, PUT, and DELETE operations.
+    deprecated_since: X
     name: volume_extension:types_manage
-  deprecated_since: null
   description: Update volume type.
   name: volume_extension:type_update
   operations:
@@ -960,11 +1089,12 @@
     path: /types
   scope_types: null
 - check_str: rule:admin_api
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_api
+    deprecated_reason: volume_extension:types_manage has been replaced by more granular
+      policies that separately govern POST, PUT, and DELETE operations.
+    deprecated_since: X
     name: volume_extension:types_manage
-  deprecated_since: null
   description: Delete volume type.
   name: volume_extension:type_delete
   operations:
@@ -972,11 +1102,14 @@
     path: /types
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_reader
-  deprecated_reason: null
   deprecated_rule:
     check_str: ''
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume_extension:type_get
-  deprecated_since: null
   description: Get one specific volume type.
   name: volume_extension:type_get
   operations:
@@ -984,11 +1117,14 @@
     path: /types/{type_id}
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_reader
-  deprecated_reason: null
   deprecated_rule:
     check_str: ''
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume_extension:type_get_all
-  deprecated_since: null
   description: List volume types.
   name: volume_extension:type_get_all
   operations:
@@ -996,11 +1132,14 @@
     path: /types/
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_reader
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_api
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume_extension:access_types_extra_specs
-  deprecated_since: null
   description: Include the volume type's extra_specs attribute in the volume type
     list or show requests.  The ability to make these calls is governed by other policies.
   name: volume_extension:access_types_extra_specs
@@ -1027,11 +1166,15 @@
   operations: []
   scope_types: null
 - check_str: rule:admin_api
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:volume_extension:volume_type_encryption
+    deprecated_reason: 'Reason: ''volume_extension:volume_type_encryption'' was a
+      convenience policy that allowed you to set all volume encryption type policies
+      to the same value.  We are deprecating this rule to prepare for a future release
+      in which the default values for policies that read, create/update, and delete
+      encryption types will be different from each other.'
+    deprecated_since: X
     name: volume_extension:volume_type_encryption:create
-  deprecated_since: null
   description: Create volume type encryption.
   name: volume_extension:volume_type_encryption:create
   operations:
@@ -1039,11 +1182,15 @@
     path: /types/{type_id}/encryption
   scope_types: null
 - check_str: rule:admin_api
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:volume_extension:volume_type_encryption
+    deprecated_reason: 'Reason: ''volume_extension:volume_type_encryption'' was a
+      convenience policy that allowed you to set all volume encryption type policies
+      to the same value.  We are deprecating this rule to prepare for a future release
+      in which the default values for policies that read, create/update, and delete
+      encryption types will be different from each other.'
+    deprecated_since: X
     name: volume_extension:volume_type_encryption:get
-  deprecated_since: null
   description: Show a volume type's encryption type, show an encryption specs item.
   name: volume_extension:volume_type_encryption:get
   operations:
@@ -1053,11 +1200,15 @@
     path: /types/{type_id}/encryption/{key}
   scope_types: null
 - check_str: rule:admin_api
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:volume_extension:volume_type_encryption
+    deprecated_reason: 'Reason: ''volume_extension:volume_type_encryption'' was a
+      convenience policy that allowed you to set all volume encryption type policies
+      to the same value.  We are deprecating this rule to prepare for a future release
+      in which the default values for policies that read, create/update, and delete
+      encryption types will be different from each other.'
+    deprecated_since: X
     name: volume_extension:volume_type_encryption:update
-  deprecated_since: null
   description: Update volume type encryption.
   name: volume_extension:volume_type_encryption:update
   operations:
@@ -1065,11 +1216,15 @@
     path: /types/{type_id}/encryption/{encryption_id}
   scope_types: null
 - check_str: rule:admin_api
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:volume_extension:volume_type_encryption
+    deprecated_reason: 'Reason: ''volume_extension:volume_type_encryption'' was a
+      convenience policy that allowed you to set all volume encryption type policies
+      to the same value.  We are deprecating this rule to prepare for a future release
+      in which the default values for policies that read, create/update, and delete
+      encryption types will be different from each other.'
+    deprecated_since: X
     name: volume_extension:volume_type_encryption:delete
-  deprecated_since: null
   description: Delete volume type encryption.
   name: volume_extension:volume_type_encryption:delete
   operations:
@@ -1077,11 +1232,14 @@
     path: /types/{type_id}/encryption/{encryption_id}
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume_extension:volume_type_access
-  deprecated_since: null
   description: Adds the boolean field 'os-volume-type-access:is_public' to the responses
     for these API calls.  The ability to make these calls is governed by other policies.
   name: volume_extension:volume_type_access
@@ -1108,11 +1266,13 @@
     path: /types/{type_id}/action (removeProjectAccess)
   scope_types: null
 - check_str: rule:admin_api
-  deprecated_reason: null
   deprecated_rule:
     check_str: volume_extension:volume_type_access
+    deprecated_reason: 'Reason: ''volume_extension:volume_type_access:get_all_for_type''
+      is a new policy that protects an API call formerly governed by ''volume_extension:volume_type_access'',
+      but which has been separated for finer-grained policy control.'
+    deprecated_since: X
     name: volume_extension:volume_type_access:get_all_for_type
-  deprecated_since: null
   description: List private volume type access detail, that is, list the projects
     that have access to this volume type.
   name: volume_extension:volume_type_access:get_all_for_type
@@ -1121,11 +1281,14 @@
     path: /types/{type_id}/os-volume-type-access
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:extend
-  deprecated_since: null
   description: Extend a volume.
   name: volume:extend
   operations:
@@ -1133,11 +1296,14 @@
     path: /volumes/{volume_id}/action (os-extend)
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:extend_attached_volume
-  deprecated_since: null
   description: Extend a attached volume.
   name: volume:extend_attached_volume
   operations:
@@ -1152,11 +1318,14 @@
     path: /volumes/{volume_id}/action (os-extend_volume_completion)
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:revert_to_snapshot
-  deprecated_since: null
   description: Revert a volume to a snapshot.
   name: volume:revert_to_snapshot
   operations:
@@ -1171,11 +1340,14 @@
     path: /volumes/{volume_id}/action (os-reset_status)
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:retype
-  deprecated_since: null
   description: Retype a volume.
   name: volume:retype
   operations:
@@ -1183,11 +1355,14 @@
     path: /volumes/{volume_id}/action (os-retype)
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:update_readonly_flag
-  deprecated_since: null
   description: Update a volume's readonly flag.
   name: volume:update_readonly_flag
   operations:
@@ -1209,11 +1384,14 @@
     path: /volumes/{volume_id}/action (os-volume_upload_image)
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume_extension:volume_actions:upload_image
-  deprecated_since: null
   description: Upload a volume to image.
   name: volume_extension:volume_actions:upload_image
   operations:
@@ -1242,11 +1420,14 @@
     path: /volumes/{volume_id}/action (os-migrate_volume_completion)
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume_extension:volume_actions:initialize_connection
-  deprecated_since: null
   description: Initialize volume attachment.
   name: volume_extension:volume_actions:initialize_connection
   operations:
@@ -1254,11 +1435,14 @@
     path: /volumes/{volume_id}/action (os-initialize_connection)
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume_extension:volume_actions:terminate_connection
-  deprecated_since: null
   description: Terminate volume attachment.
   name: volume_extension:volume_actions:terminate_connection
   operations:
@@ -1266,11 +1450,14 @@
     path: /volumes/{volume_id}/action (os-terminate_connection)
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume_extension:volume_actions:roll_detaching
-  deprecated_since: null
   description: Roll back volume status to 'in-use'.
   name: volume_extension:volume_actions:roll_detaching
   operations:
@@ -1278,11 +1465,14 @@
     path: /volumes/{volume_id}/action (os-roll_detaching)
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume_extension:volume_actions:reserve
-  deprecated_since: null
   description: Mark volume as reserved.
   name: volume_extension:volume_actions:reserve
   operations:
@@ -1290,11 +1480,14 @@
     path: /volumes/{volume_id}/action (os-reserve)
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume_extension:volume_actions:unreserve
-  deprecated_since: null
   description: Unmark volume as reserved.
   name: volume_extension:volume_actions:unreserve
   operations:
@@ -1302,11 +1495,14 @@
     path: /volumes/{volume_id}/action (os-unreserve)
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume_extension:volume_actions:begin_detaching
-  deprecated_since: null
   description: Begin detach volumes.
   name: volume_extension:volume_actions:begin_detaching
   operations:
@@ -1314,11 +1510,14 @@
     path: /volumes/{volume_id}/action (os-begin_detaching)
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume_extension:volume_actions:attach
-  deprecated_since: null
   description: Add attachment metadata.
   name: volume_extension:volume_actions:attach
   operations:
@@ -1326,11 +1525,14 @@
     path: /volumes/{volume_id}/action (os-attach)
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume_extension:volume_actions:detach
-  deprecated_since: null
   description: Clear attachment metadata.
   name: volume_extension:volume_actions:detach
   operations:
@@ -1352,11 +1554,14 @@
     path: /volumes/{volume_id}/action (os-reimage)
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_reader
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:get_all_transfers
-  deprecated_since: null
   description: List volume transfer.
   name: volume:get_all_transfers
   operations:
@@ -1370,11 +1575,14 @@
     path: /volume-transfers/detail
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:create_transfer
-  deprecated_since: null
   description: Create a volume transfer.
   name: volume:create_transfer
   operations:
@@ -1384,11 +1592,14 @@
     path: /volume_transfers
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_reader
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:get_transfer
-  deprecated_since: null
   description: Show one specified volume transfer.
   name: volume:get_transfer
   operations:
@@ -1398,11 +1609,14 @@
     path: /volume-transfers/{transfer_id}
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: ''
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:accept_transfer
-  deprecated_since: null
   description: Accept a volume transfer.
   name: volume:accept_transfer
   operations:
@@ -1412,11 +1626,14 @@
     path: /volume-transfers/{transfer_id}/accept
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:delete_transfer
-  deprecated_since: null
   description: Delete volume transfer.
   name: volume:delete_transfer
   operations:
@@ -1426,11 +1643,14 @@
     path: /volume-transfers/{transfer_id}
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_reader
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:get_volume_metadata
-  deprecated_since: null
   description: Show volume's metadata or one specified metadata with a given key.
   name: volume:get_volume_metadata
   operations:
@@ -1442,11 +1662,14 @@
     path: /volumes/{volume_id}/action  (os-show_image_metadata)
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:create_volume_metadata
-  deprecated_since: null
   description: Create volume metadata.
   name: volume:create_volume_metadata
   operations:
@@ -1454,11 +1677,14 @@
     path: /volumes/{volume_id}/metadata
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:update_volume_metadata
-  deprecated_since: null
   description: Replace a volume's metadata dictionary or update a single metadatum
     with a given key.
   name: volume:update_volume_metadata
@@ -1469,11 +1695,14 @@
     path: /volumes/{volume_id}/metadata/{key}
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:delete_volume_metadata
-  deprecated_since: null
   description: Delete a volume's metadatum with the given key.
   name: volume:delete_volume_metadata
   operations:
@@ -1481,11 +1710,12 @@
     path: /volumes/{volume_id}/metadata/{key}
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_reader
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: volume_extension:volume_image_metadata has been replaced by
+      more granular policies that separately govern show, set, and remove operations.
+    deprecated_since: X
     name: volume_extension:volume_image_metadata
-  deprecated_since: null
   description: Include a volume's image metadata in volume detail responses.  The
     ability to make these calls is governed by other policies.
   name: volume_extension:volume_image_metadata:show
@@ -1496,11 +1726,12 @@
     path: /volumes/{volume_id}
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: volume_extension:volume_image_metadata has been replaced by
+      more granular policies that separately govern show, set, and remove operations.
+    deprecated_since: X
     name: volume_extension:volume_image_metadata
-  deprecated_since: null
   description: Set image metadata for a volume
   name: volume_extension:volume_image_metadata:set
   operations:
@@ -1508,11 +1739,12 @@
     path: /volumes/{volume_id}/action (os-set_image_metadata)
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: volume_extension:volume_image_metadata has been replaced by
+      more granular policies that separately govern show, set, and remove operations.
+    deprecated_since: X
     name: volume_extension:volume_image_metadata
-  deprecated_since: null
   description: Remove specific image metadata from a volume
   name: volume_extension:volume_image_metadata:remove
   operations:
@@ -1530,11 +1762,14 @@
     path: /volumes/{volume_id}/action (os-attach)
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_reader
-  deprecated_reason: null
   deprecated_rule:
     check_str: ''
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume_extension:types_extra_specs:index
-  deprecated_since: null
   description: List type extra specs.
   name: volume_extension:types_extra_specs:index
   operations:
@@ -1549,11 +1784,14 @@
     path: /types/{type_id}/extra_specs
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_reader
-  deprecated_reason: null
   deprecated_rule:
     check_str: ''
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume_extension:types_extra_specs:show
-  deprecated_since: null
   description: Show one specified type extra specs.
   name: volume_extension:types_extra_specs:show
   operations:
@@ -1591,11 +1829,14 @@
     path: /types/{type_id}/extra_specs/{extra_spec_key}
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: ''
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:create
-  deprecated_since: null
   description: Create volume.
   name: volume:create
   operations:
@@ -1603,11 +1844,14 @@
     path: /volumes
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: ''
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:create_from_image
-  deprecated_since: null
   description: Create volume from image.
   name: volume:create_from_image
   operations:
@@ -1615,11 +1859,14 @@
     path: /volumes
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_reader
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:get
-  deprecated_since: null
   description: Show volume.
   name: volume:get
   operations:
@@ -1627,11 +1874,14 @@
     path: /volumes/{volume_id}
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_reader
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:get_all
-  deprecated_since: null
   description: List volumes or get summary of volumes.
   name: volume:get_all
   operations:
@@ -1643,11 +1893,14 @@
     path: /volumes/summary
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:update
-  deprecated_since: null
   description: Update volume or update a volume's bootable status.
   name: volume:update
   operations:
@@ -1657,11 +1910,14 @@
     path: /volumes/{volume_id}/action (os-set_bootable)
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:delete
-  deprecated_since: null
   description: Delete volume.
   name: volume:delete
   operations:
@@ -1685,11 +1941,14 @@
     path: /volumes/detail
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_reader
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume_extension:volume_tenant_attribute
-  deprecated_since: null
   description: List or show volume with tenant attribute.
   name: volume_extension:volume_tenant_attribute
   operations:
@@ -1708,11 +1967,14 @@
     path: /volumes/detail
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_reader
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume_extension:volume_encryption_metadata
-  deprecated_since: null
   description: Show volume's encryption metadata.
   name: volume_extension:volume_encryption_metadata
   operations:
@@ -1722,11 +1984,14 @@
     path: /volumes/{volume_id}/encryption/{encryption_key}
   scope_types: null
 - check_str: rule:xena_system_admin_or_project_member
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume:multiattach
-  deprecated_since: null
   description: Create multiattach capable volume.
   name: volume:multiattach
   operations:
@@ -1734,11 +1999,14 @@
     path: /volumes
   scope_types: null
 - check_str: rule:admin_api
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:system_or_domain_or_project_admin
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume_extension:default_set_or_update
-  deprecated_since: null
   description: Set or update default volume type.
   name: volume_extension:default_set_or_update
   operations:
@@ -1746,11 +2014,14 @@
     path: /default-types
   scope_types: null
 - check_str: rule:admin_api
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:system_or_domain_or_project_admin
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume_extension:default_get
-  deprecated_since: null
   description: Get default types.
   name: volume_extension:default_get
   operations:
@@ -1758,11 +2029,14 @@
     path: /default-types/{project-id}
   scope_types: null
 - check_str: rule:admin_api
-  deprecated_reason: null
   deprecated_rule:
     check_str: role:admin and system_scope:all
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume_extension:default_get_all
-  deprecated_since: null
   description: 'Get all default types. WARNING: Changing this might open up too much
     information regarding cloud deployment.'
   name: volume_extension:default_get_all
@@ -1771,11 +2045,14 @@
     path: /default-types/
   scope_types: null
 - check_str: rule:admin_api
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:system_or_domain_or_project_admin
+    deprecated_reason: Default policies now support the three Keystone default roles,
+      namely 'admin', 'member', and 'reader' to implement three Cinder "personas".  See
+      "Policy Personas and Permissions" in the "Cinder Service Configuration" documentation
+      (Xena release) for details.
+    deprecated_since: X
     name: volume_extension:default_unset
-  deprecated_since: null
   description: Unset default type.
   name: volume_extension:default_unset
   operations:
diff --git a/openstack_dashboard/conf/default_policies/glance.yaml b/openstack_dashboard/conf/default_policies/glance.yaml
index c3fcd62..a5ab80e 100644
--- a/openstack_dashboard/conf/default_policies/glance.yaml
+++ b/openstack_dashboard/conf/default_policies/glance.yaml
@@ -1,9 +1,13 @@
 - check_str: ''
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:context_is_admin
+    deprecated_reason: In order to allow operators to accept the default policies
+      from code by not defining them in the policy file, while still working with
+      old policy files that rely on the ``default`` rule for policies that are not
+      specified in the policy file, the ``default`` rule must now be explicitly set
+      to ``"role:admin"`` when that is the desired default for unspecified rules.
+    deprecated_since: Ussuri
     name: default
-  deprecated_since: null
   description: Defines the default rule used for policies that historically had an
     empty policy in the supplied policy.json file.
   name: default
@@ -16,11 +20,15 @@
   scope_types: null
 - check_str: rule:context_is_admin or (role:member and project_id:%(project_id)s and
     project_id:%(owner)s)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:default
+    deprecated_reason: '
+
+      The image API now supports roles.
+
+      '
+    deprecated_since: W
     name: add_image
-  deprecated_since: null
   description: Create new image
   name: add_image
   operations:
@@ -29,11 +37,15 @@
   scope_types:
   - project
 - check_str: rule:context_is_admin or (role:member and project_id:%(project_id)s)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:default
+    deprecated_reason: '
+
+      The image API now supports roles.
+
+      '
+    deprecated_since: W
     name: delete_image
-  deprecated_since: null
   description: Deletes the image
   name: delete_image
   operations:
@@ -44,11 +56,15 @@
 - check_str: rule:context_is_admin or (role:reader and (project_id:%(project_id)s
     or project_id:%(member_id)s or 'community':%(visibility)s or 'public':%(visibility)s
     or 'shared':%(visibility)s))
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:default
+    deprecated_reason: '
+
+      The image API now supports roles.
+
+      '
+    deprecated_since: W
     name: get_image
-  deprecated_since: null
   description: Get specified image
   name: get_image
   operations:
@@ -57,11 +73,15 @@
   scope_types:
   - project
 - check_str: rule:context_is_admin or (role:reader and project_id:%(project_id)s)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:default
+    deprecated_reason: '
+
+      The image API now supports roles.
+
+      '
+    deprecated_since: W
     name: get_images
-  deprecated_since: null
   description: Get all available images
   name: get_images
   operations:
@@ -70,11 +90,15 @@
   scope_types:
   - project
 - check_str: rule:context_is_admin or (role:member and project_id:%(project_id)s)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:default
+    deprecated_reason: '
+
+      The image API now supports roles.
+
+      '
+    deprecated_since: W
     name: modify_image
-  deprecated_since: null
   description: Updates given image
   name: modify_image
   operations:
@@ -91,11 +115,15 @@
   scope_types:
   - project
 - check_str: rule:context_is_admin or (role:member and project_id:%(project_id)s)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:default
+    deprecated_reason: '
+
+      The image API now supports roles.
+
+      '
+    deprecated_since: W
     name: communitize_image
-  deprecated_since: null
   description: Communitize given image
   name: communitize_image
   operations:
@@ -106,11 +134,15 @@
 - check_str: rule:context_is_admin or (role:member and (project_id:%(project_id)s
     or project_id:%(member_id)s or 'community':%(visibility)s or 'public':%(visibility)s
     or 'shared':%(visibility)s))
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:default
+    deprecated_reason: '
+
+      The image API now supports roles.
+
+      '
+    deprecated_since: W
     name: download_image
-  deprecated_since: null
   description: Downloads given image
   name: download_image
   operations:
@@ -119,11 +151,15 @@
   scope_types:
   - project
 - check_str: rule:context_is_admin or (role:member and project_id:%(project_id)s)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:default
+    deprecated_reason: '
+
+      The image API now supports roles.
+
+      '
+    deprecated_since: W
     name: upload_image
-  deprecated_since: null
   description: Uploads data to specified image
   name: upload_image
   operations:
@@ -132,11 +168,15 @@
   scope_types:
   - project
 - check_str: rule:context_is_admin
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:default
+    deprecated_reason: '
+
+      The image API now supports roles.
+
+      '
+    deprecated_since: W
     name: delete_image_location
-  deprecated_since: null
   description: Deletes the location of given image
   name: delete_image_location
   operations:
@@ -145,11 +185,15 @@
   scope_types:
   - project
 - check_str: rule:context_is_admin or (role:reader and project_id:%(project_id)s)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:default
+    deprecated_reason: '
+
+      The image API now supports roles.
+
+      '
+    deprecated_since: W
     name: get_image_location
-  deprecated_since: null
   description: Reads the location of the image
   name: get_image_location
   operations:
@@ -158,11 +202,15 @@
   scope_types:
   - project
 - check_str: rule:context_is_admin or (role:member and project_id:%(project_id)s)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:default
+    deprecated_reason: '
+
+      The image API now supports roles.
+
+      '
+    deprecated_since: W
     name: set_image_location
-  deprecated_since: null
   description: Sets location URI to given image
   name: set_image_location
   operations:
@@ -171,11 +219,15 @@
   scope_types:
   - project
 - check_str: rule:context_is_admin or (role:member and project_id:%(project_id)s)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:default
+    deprecated_reason: '
+
+      The image API now supports roles.
+
+      '
+    deprecated_since: W
     name: add_member
-  deprecated_since: null
   description: Create image member
   name: add_member
   operations:
@@ -184,11 +236,15 @@
   scope_types:
   - project
 - check_str: rule:context_is_admin or (role:member and project_id:%(project_id)s)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:default
+    deprecated_reason: '
+
+      The image API now supports roles.
+
+      '
+    deprecated_since: W
     name: delete_member
-  deprecated_since: null
   description: Delete image member
   name: delete_member
   operations:
@@ -198,11 +254,15 @@
   - project
 - check_str: rule:context_is_admin or role:reader and (project_id:%(project_id)s or
     project_id:%(member_id)s)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:default
+    deprecated_reason: '
+
+      The image API now supports roles.
+
+      '
+    deprecated_since: W
     name: get_member
-  deprecated_since: null
   description: Show image member details
   name: get_member
   operations:
@@ -212,11 +272,15 @@
   - project
 - check_str: rule:context_is_admin or role:reader and (project_id:%(project_id)s or
     project_id:%(member_id)s)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:default
+    deprecated_reason: '
+
+      The image API now supports roles.
+
+      '
+    deprecated_since: W
     name: get_members
-  deprecated_since: null
   description: List image members
   name: get_members
   operations:
@@ -225,11 +289,15 @@
   scope_types:
   - project
 - check_str: rule:context_is_admin or (role:member and project_id:%(member_id)s)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:default
+    deprecated_reason: '
+
+      The image API now supports roles.
+
+      '
+    deprecated_since: W
     name: modify_member
-  deprecated_since: null
   description: Update image member
   name: modify_member
   operations:
@@ -244,11 +312,15 @@
   scope_types:
   - project
 - check_str: rule:context_is_admin or (role:member and project_id:%(project_id)s)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:default
+    deprecated_reason: '
+
+      The image API now supports roles.
+
+      '
+    deprecated_since: W
     name: deactivate
-  deprecated_since: null
   description: Deactivate image
   name: deactivate
   operations:
@@ -257,11 +329,15 @@
   scope_types:
   - project
 - check_str: rule:context_is_admin or (role:member and project_id:%(project_id)s)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:default
+    deprecated_reason: '
+
+      The image API now supports roles.
+
+      '
+    deprecated_since: W
     name: reactivate
-  deprecated_since: null
   description: Reactivate image
   name: reactivate
   operations:
@@ -278,11 +354,21 @@
   scope_types:
   - project
 - check_str: rule:default
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:default
+    deprecated_reason: '
+
+      From Xena we are enforcing policy checks in the API and policy layer where
+
+      task policies were enforcing will be removed. Since task APIs are already
+
+      deprecated and `tasks_api_access` is checked for each API at API layer,
+
+      there will be no benefit of other having other task related policies.
+
+      '
+    deprecated_since: X
     name: get_task
-  deprecated_since: null
   description: 'Get an image task.
 
 
@@ -306,11 +392,21 @@
   scope_types:
   - project
 - check_str: rule:default
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:default
+    deprecated_reason: '
+
+      From Xena we are enforcing policy checks in the API and policy layer where
+
+      task policies were enforcing will be removed. Since task APIs are already
+
+      deprecated and `tasks_api_access` is checked for each API at API layer,
+
+      there will be no benefit of other having other task related policies.
+
+      '
+    deprecated_since: X
     name: get_tasks
-  deprecated_since: null
   description: 'List tasks for all images.
 
 
@@ -334,11 +430,21 @@
   scope_types:
   - project
 - check_str: rule:default
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:default
+    deprecated_reason: '
+
+      From Xena we are enforcing policy checks in the API and policy layer where
+
+      task policies were enforcing will be removed. Since task APIs are already
+
+      deprecated and `tasks_api_access` is checked for each API at API layer,
+
+      there will be no benefit of other having other task related policies.
+
+      '
+    deprecated_since: X
     name: add_task
-  deprecated_since: null
   description: 'List tasks for all images.
 
 
@@ -412,11 +518,15 @@
   scope_types: null
 - check_str: rule:context_is_admin or (role:reader and (project_id:%(project_id)s
     or 'public':%(visibility)s))
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:metadef_default
+    deprecated_reason: '
+
+      The metadata API now supports project scope and default roles.
+
+      '
+    deprecated_since: X
     name: get_metadef_namespace
-  deprecated_since: null
   description: Get a specific namespace.
   name: get_metadef_namespace
   operations:
@@ -425,11 +535,15 @@
   scope_types:
   - project
 - check_str: rule:context_is_admin or (role:reader and project_id:%(project_id)s)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:metadef_default
+    deprecated_reason: '
+
+      The metadata API now supports project scope and default roles.
+
+      '
+    deprecated_since: X
     name: get_metadef_namespaces
-  deprecated_since: null
   description: List namespace.
   name: get_metadef_namespaces
   operations:
@@ -463,11 +577,15 @@
   - project
 - check_str: rule:context_is_admin or (role:reader and (project_id:%(project_id)s
     or 'public':%(visibility)s))
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:metadef_default
+    deprecated_reason: '
+
+      The metadata API now supports project scope and default roles.
+
+      '
+    deprecated_since: X
     name: get_metadef_object
-  deprecated_since: null
   description: Get a specific object from a namespace.
   name: get_metadef_object
   operations:
@@ -477,11 +595,15 @@
   - project
 - check_str: rule:context_is_admin or (role:reader and (project_id:%(project_id)s
     or 'public':%(visibility)s))
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:metadef_default
+    deprecated_reason: '
+
+      The metadata API now supports project scope and default roles.
+
+      '
+    deprecated_since: X
     name: get_metadef_objects
-  deprecated_since: null
   description: Get objects from a namespace.
   name: get_metadef_objects
   operations:
@@ -515,11 +637,15 @@
   - project
 - check_str: rule:context_is_admin or (role:reader and (project_id:%(project_id)s
     or 'public':%(visibility)s))
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:metadef_default
+    deprecated_reason: '
+
+      The metadata API now supports project scope and default roles.
+
+      '
+    deprecated_since: X
     name: list_metadef_resource_types
-  deprecated_since: null
   description: List meta definition resource types.
   name: list_metadef_resource_types
   operations:
@@ -529,11 +655,15 @@
   - project
 - check_str: rule:context_is_admin or (role:reader and (project_id:%(project_id)s
     or 'public':%(visibility)s))
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:metadef_default
+    deprecated_reason: '
+
+      The metadata API now supports project scope and default roles.
+
+      '
+    deprecated_since: X
     name: get_metadef_resource_type
-  deprecated_since: null
   description: Get meta definition resource types associations.
   name: get_metadef_resource_type
   operations:
@@ -559,11 +689,15 @@
   - project
 - check_str: rule:context_is_admin or (role:reader and (project_id:%(project_id)s
     or 'public':%(visibility)s))
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:metadef_default
+    deprecated_reason: '
+
+      The metadata API now supports project scope and default roles.
+
+      '
+    deprecated_since: X
     name: get_metadef_property
-  deprecated_since: null
   description: Get a specific meta definition property.
   name: get_metadef_property
   operations:
@@ -573,11 +707,15 @@
   - project
 - check_str: rule:context_is_admin or (role:reader and (project_id:%(project_id)s
     or 'public':%(visibility)s))
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:metadef_default
+    deprecated_reason: '
+
+      The metadata API now supports project scope and default roles.
+
+      '
+    deprecated_since: X
     name: get_metadef_properties
-  deprecated_since: null
   description: List meta definition properties.
   name: get_metadef_properties
   operations:
@@ -611,11 +749,15 @@
   - project
 - check_str: rule:context_is_admin or (role:reader and (project_id:%(project_id)s
     or 'public':%(visibility)s))
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:metadef_default
+    deprecated_reason: '
+
+      The metadata API now supports project scope and default roles.
+
+      '
+    deprecated_since: X
     name: get_metadef_tag
-  deprecated_since: null
   description: Get tag definition.
   name: get_metadef_tag
   operations:
@@ -625,11 +767,15 @@
   - project
 - check_str: rule:context_is_admin or (role:reader and (project_id:%(project_id)s
     or 'public':%(visibility)s))
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:metadef_default
+    deprecated_reason: '
+
+      The metadata API now supports project scope and default roles.
+
+      '
+    deprecated_since: X
     name: get_metadef_tags
-  deprecated_since: null
   description: List tag definitions.
   name: get_metadef_tags
   operations:
@@ -678,11 +824,15 @@
   scope_types:
   - project
 - check_str: rule:context_is_admin
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:manage_image_cache
+    deprecated_reason: '
+
+      The image API now supports roles.
+
+      '
+    deprecated_since: X
     name: cache_image
-  deprecated_since: null
   description: Queue image for caching
   name: cache_image
   operations:
@@ -691,11 +841,15 @@
   scope_types:
   - project
 - check_str: rule:context_is_admin
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:manage_image_cache
+    deprecated_reason: '
+
+      The image API now supports roles.
+
+      '
+    deprecated_since: X
     name: cache_list
-  deprecated_since: null
   description: List cache status
   name: cache_list
   operations:
@@ -704,11 +858,15 @@
   scope_types:
   - project
 - check_str: rule:context_is_admin
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:manage_image_cache
+    deprecated_reason: '
+
+      The image API now supports roles.
+
+      '
+    deprecated_since: X
     name: cache_delete
-  deprecated_since: null
   description: Delete image(s) from cache and/or queue
   name: cache_delete
   operations:
diff --git a/openstack_dashboard/conf/default_policies/keystone.yaml b/openstack_dashboard/conf/default_policies/keystone.yaml
index aa3a3af..d2f1965 100644
--- a/openstack_dashboard/conf/default_policies/keystone.yaml
+++ b/openstack_dashboard/conf/default_policies/keystone.yaml
@@ -118,11 +118,12 @@
   scope_types:
   - project
 - check_str: (role:reader and system_scope:all) or rule:owner
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: The application credential API is now aware of system scope
+      and default roles.
+    deprecated_since: T
     name: identity:get_application_credential
-  deprecated_since: null
   description: Show application credential details.
   name: identity:get_application_credential
   operations:
@@ -134,11 +135,12 @@
   - system
   - project
 - check_str: (role:reader and system_scope:all) or rule:owner
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: The application credential API is now aware of system scope
+      and default roles.
+    deprecated_since: T
     name: identity:list_application_credentials
-  deprecated_since: null
   description: List application credentials for a user.
   name: identity:list_application_credentials
   operations:
@@ -158,11 +160,12 @@
   scope_types:
   - project
 - check_str: (role:admin and system_scope:all) or rule:owner
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: The application credential API is now aware of system scope
+      and default roles.
+    deprecated_since: T
     name: identity:delete_application_credential
-  deprecated_since: null
   description: Delete an application credential.
   name: identity:delete_application_credential
   operations:
@@ -208,11 +211,12 @@
     path: /v3/auth/system
   scope_types: null
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The OAUTH1 consumer API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:get_consumer
-  deprecated_since: null
   description: Show OAUTH1 consumer details.
   name: identity:get_consumer
   operations:
@@ -222,11 +226,12 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The OAUTH1 consumer API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:list_consumers
-  deprecated_since: null
   description: List OAUTH1 consumers.
   name: identity:list_consumers
   operations:
@@ -236,11 +241,12 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The OAUTH1 consumer API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:create_consumer
-  deprecated_since: null
   description: Create OAUTH1 consumer.
   name: identity:create_consumer
   operations:
@@ -250,11 +256,12 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The OAUTH1 consumer API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:update_consumer
-  deprecated_since: null
   description: Update OAUTH1 consumer.
   name: identity:update_consumer
   operations:
@@ -264,11 +271,12 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The OAUTH1 consumer API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:delete_consumer
-  deprecated_since: null
   description: Delete OAUTH1 consumer.
   name: identity:delete_consumer
   operations:
@@ -278,11 +286,12 @@
   - system
   - project
 - check_str: (role:reader and system_scope:all) or user_id:%(target.credential.user_id)s
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The credential API is now aware of system scope and default
+      roles.
+    deprecated_since: S
     name: identity:get_credential
-  deprecated_since: null
   description: Show credentials details.
   name: identity:get_credential
   operations:
@@ -292,11 +301,12 @@
   - system
   - project
 - check_str: (role:reader and system_scope:all) or user_id:%(target.credential.user_id)s
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The credential API is now aware of system scope and default
+      roles.
+    deprecated_since: S
     name: identity:list_credentials
-  deprecated_since: null
   description: List credentials.
   name: identity:list_credentials
   operations:
@@ -306,11 +316,12 @@
   - system
   - project
 - check_str: (role:admin and system_scope:all) or user_id:%(target.credential.user_id)s
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The credential API is now aware of system scope and default
+      roles.
+    deprecated_since: S
     name: identity:create_credential
-  deprecated_since: null
   description: Create credential.
   name: identity:create_credential
   operations:
@@ -320,11 +331,12 @@
   - system
   - project
 - check_str: (role:admin and system_scope:all) or user_id:%(target.credential.user_id)s
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The credential API is now aware of system scope and default
+      roles.
+    deprecated_since: S
     name: identity:update_credential
-  deprecated_since: null
   description: Update credential.
   name: identity:update_credential
   operations:
@@ -334,11 +346,12 @@
   - system
   - project
 - check_str: (role:admin and system_scope:all) or user_id:%(target.credential.user_id)s
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The credential API is now aware of system scope and default
+      roles.
+    deprecated_since: S
     name: identity:delete_credential
-  deprecated_since: null
   description: Delete credential.
   name: identity:delete_credential
   operations:
@@ -349,11 +362,11 @@
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all) or token.domain.id:%(target.domain.id)s
     or token.project.domain.id:%(target.domain.id)s
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required or token.project.domain.id:%(target.domain.id)s
+    deprecated_reason: The domain API is now aware of system scope and default roles.
+    deprecated_since: S
     name: identity:get_domain
-  deprecated_since: null
   description: Show domain details.
   name: identity:get_domain
   operations:
@@ -365,11 +378,11 @@
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all) or (role:reader
     and domain_id:%(target.domain.id)s)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The domain API is now aware of system scope and default roles.
+    deprecated_since: S
     name: identity:list_domains
-  deprecated_since: null
   description: List domains.
   name: identity:list_domains
   operations:
@@ -380,11 +393,11 @@
   - domain
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The domain API is now aware of system scope and default roles.
+    deprecated_since: S
     name: identity:create_domain
-  deprecated_since: null
   description: Create domain.
   name: identity:create_domain
   operations:
@@ -394,11 +407,11 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The domain API is now aware of system scope and default roles.
+    deprecated_since: S
     name: identity:update_domain
-  deprecated_since: null
   description: Update domain.
   name: identity:update_domain
   operations:
@@ -408,11 +421,11 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The domain API is now aware of system scope and default roles.
+    deprecated_since: S
     name: identity:delete_domain
-  deprecated_since: null
   description: Delete domain.
   name: identity:delete_domain
   operations:
@@ -422,11 +435,12 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The domain config API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:create_domain_config
-  deprecated_since: null
   description: Create domain configuration.
   name: identity:create_domain_config
   operations:
@@ -436,11 +450,12 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The domain config API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:get_domain_config
-  deprecated_since: null
   description: Get the entire domain configuration for a domain, an option group within
     a domain, or a specific configuration option within a group for a domain.
   name: identity:get_domain_config
@@ -478,11 +493,12 @@
   - domain
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The domain config API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:update_domain_config
-  deprecated_since: null
   description: Update domain configuration for either a domain, specific group or
     a specific option in a group.
   name: identity:update_domain_config
@@ -497,11 +513,12 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The domain config API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:delete_domain_config
-  deprecated_since: null
   description: Delete domain configuration for either a domain, specific group or
     a specific option in a group.
   name: identity:delete_domain_config
@@ -516,11 +533,12 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The domain config API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:get_domain_config_default
-  deprecated_since: null
   description: Get domain configuration default for either a domain, specific group
     or a specific option in a group.
   name: identity:get_domain_config_default
@@ -541,11 +559,12 @@
   - system
   - project
 - check_str: (role:reader and system_scope:all) or user_id:%(target.credential.user_id)s
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required or (rule:owner and user_id:%(target.credential.user_id)s)
+    deprecated_reason: The EC2 credential API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:ec2_get_credential
-  deprecated_since: null
   description: Show ec2 credential details.
   name: identity:ec2_get_credential
   operations:
@@ -555,11 +574,12 @@
   - system
   - project
 - check_str: (role:reader and system_scope:all) or rule:owner
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: The EC2 credential API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:ec2_list_credentials
-  deprecated_since: null
   description: List ec2 credentials.
   name: identity:ec2_list_credentials
   operations:
@@ -569,11 +589,12 @@
   - system
   - project
 - check_str: (role:admin and system_scope:all) or rule:owner
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: The EC2 credential API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:ec2_create_credential
-  deprecated_since: null
   description: Create ec2 credential.
   name: identity:ec2_create_credential
   operations:
@@ -583,11 +604,12 @@
   - system
   - project
 - check_str: (role:admin and system_scope:all) or user_id:%(target.credential.user_id)s
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required or (rule:owner and user_id:%(target.credential.user_id)s)
+    deprecated_reason: The EC2 credential API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:ec2_delete_credential
-  deprecated_since: null
   description: Delete ec2 credential.
   name: identity:ec2_delete_credential
   operations:
@@ -597,11 +619,11 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The endpoint API is now aware of system scope and default roles.
+    deprecated_since: S
     name: identity:get_endpoint
-  deprecated_since: null
   description: Show endpoint details.
   name: identity:get_endpoint
   operations:
@@ -611,11 +633,11 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The endpoint API is now aware of system scope and default roles.
+    deprecated_since: S
     name: identity:list_endpoints
-  deprecated_since: null
   description: List endpoints.
   name: identity:list_endpoints
   operations:
@@ -625,11 +647,11 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The endpoint API is now aware of system scope and default roles.
+    deprecated_since: S
     name: identity:create_endpoint
-  deprecated_since: null
   description: Create endpoint.
   name: identity:create_endpoint
   operations:
@@ -639,11 +661,11 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The endpoint API is now aware of system scope and default roles.
+    deprecated_since: S
     name: identity:update_endpoint
-  deprecated_since: null
   description: Update endpoint.
   name: identity:update_endpoint
   operations:
@@ -653,11 +675,11 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The endpoint API is now aware of system scope and default roles.
+    deprecated_since: S
     name: identity:delete_endpoint
-  deprecated_since: null
   description: Delete endpoint.
   name: identity:delete_endpoint
   operations:
@@ -667,11 +689,12 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The endpoint groups API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:create_endpoint_group
-  deprecated_since: null
   description: Create endpoint group.
   name: identity:create_endpoint_group
   operations:
@@ -681,11 +704,12 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The endpoint groups API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:list_endpoint_groups
-  deprecated_since: null
   description: List endpoint groups.
   name: identity:list_endpoint_groups
   operations:
@@ -695,11 +719,12 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The endpoint groups API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:get_endpoint_group
-  deprecated_since: null
   description: Get endpoint group.
   name: identity:get_endpoint_group
   operations:
@@ -711,11 +736,12 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The endpoint groups API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:update_endpoint_group
-  deprecated_since: null
   description: Update endpoint group.
   name: identity:update_endpoint_group
   operations:
@@ -725,11 +751,12 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The endpoint groups API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:delete_endpoint_group
-  deprecated_since: null
   description: Delete endpoint group.
   name: identity:delete_endpoint_group
   operations:
@@ -739,11 +766,12 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The endpoint groups API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:list_projects_associated_with_endpoint_group
-  deprecated_since: null
   description: List all projects associated with a specific endpoint group.
   name: identity:list_projects_associated_with_endpoint_group
   operations:
@@ -753,11 +781,12 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The endpoint groups API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:list_endpoints_associated_with_endpoint_group
-  deprecated_since: null
   description: List all endpoints associated with an endpoint group.
   name: identity:list_endpoints_associated_with_endpoint_group
   operations:
@@ -767,11 +796,12 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The endpoint groups API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:get_endpoint_group_in_project
-  deprecated_since: null
   description: Check if an endpoint group is associated with a project.
   name: identity:get_endpoint_group_in_project
   operations:
@@ -783,11 +813,12 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The endpoint groups API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:list_endpoint_groups_for_project
-  deprecated_since: null
   description: List endpoint groups associated with a specific project.
   name: identity:list_endpoint_groups_for_project
   operations:
@@ -797,11 +828,12 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The endpoint groups API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:add_endpoint_group_to_project
-  deprecated_since: null
   description: Allow a project to access an endpoint group.
   name: identity:add_endpoint_group_to_project
   operations:
@@ -811,11 +843,12 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The endpoint groups API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:remove_endpoint_group_from_project
-  deprecated_since: null
   description: Remove endpoint group from project.
   name: identity:remove_endpoint_group_from_project
   operations:
@@ -830,11 +863,12 @@
     or (role:reader and domain_id:%(target.group.domain_id)s and domain_id:%(target.project.domain_id)s)
     or (role:reader and domain_id:%(target.group.domain_id)s and domain_id:%(target.domain.id)s))
     and (domain_id:%(target.role.domain_id)s or None:%(target.role.domain_id)s))
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The assignment API is now aware of system scope and default
+      roles.
+    deprecated_since: S
     name: identity:check_grant
-  deprecated_since: null
   description: Check a role grant between a target and an actor. A target can be either
     a domain or a project. An actor can be either a user or a group. These terms also
     apply to the OS-INHERIT APIs, where grants on the target are inherited to all
@@ -882,11 +916,12 @@
     or (role:reader and domain_id:%(target.user.domain_id)s and domain_id:%(target.domain.id)s)
     or (role:reader and domain_id:%(target.group.domain_id)s and domain_id:%(target.project.domain_id)s)
     or (role:reader and domain_id:%(target.group.domain_id)s and domain_id:%(target.domain.id)s))
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The assignment API is now aware of system scope and default
+      roles.
+    deprecated_since: S
     name: identity:list_grants
-  deprecated_since: null
   description: List roles granted to an actor on a target. A target can be either
     a domain or a project. An actor can be either a user or a group. For the OS-INHERIT
     APIs, it is possible to list inherited role grants for actors on domains, where
@@ -923,11 +958,12 @@
     and domain_id:%(target.project.domain_id)s) or (role:admin and domain_id:%(target.group.domain_id)s
     and domain_id:%(target.domain.id)s)) and (domain_id:%(target.role.domain_id)s
     or None:%(target.role.domain_id)s)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The assignment API is now aware of system scope and default
+      roles.
+    deprecated_since: S
     name: identity:create_grant
-  deprecated_since: null
   description: Create a role grant between a target and an actor. A target can be
     either a domain or a project. An actor can be either a user or a group. These
     terms also apply to the OS-INHERIT APIs, where grants on the target are inherited
@@ -960,11 +996,12 @@
     and domain_id:%(target.project.domain_id)s) or (role:admin and domain_id:%(target.group.domain_id)s
     and domain_id:%(target.domain.id)s)) and (domain_id:%(target.role.domain_id)s
     or None:%(target.role.domain_id)s)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The assignment API is now aware of system scope and default
+      roles.
+    deprecated_since: S
     name: identity:revoke_grant
-  deprecated_since: null
   description: Revoke a role grant between a target and an actor. A target can be
     either a domain or a project. An actor can be either a user or a group. These
     terms also apply to the OS-INHERIT APIs, where grants on the target are inherited
@@ -994,11 +1031,12 @@
   - domain
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The assignment API is now aware of system scope and default
+      roles.
+    deprecated_since: S
     name: identity:list_system_grants_for_user
-  deprecated_since: null
   description: List all grants a specific user has on the system.
   name: identity:list_system_grants_for_user
   operations:
@@ -1010,11 +1048,12 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The assignment API is now aware of system scope and default
+      roles.
+    deprecated_since: S
     name: identity:check_system_grant_for_user
-  deprecated_since: null
   description: Check if a user has a role on the system.
   name: identity:check_system_grant_for_user
   operations:
@@ -1026,11 +1065,12 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The assignment API is now aware of system scope and default
+      roles.
+    deprecated_since: S
     name: identity:create_system_grant_for_user
-  deprecated_since: null
   description: Grant a user a role on the system.
   name: identity:create_system_grant_for_user
   operations:
@@ -1041,11 +1081,12 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The assignment API is now aware of system scope and default
+      roles.
+    deprecated_since: S
     name: identity:revoke_system_grant_for_user
-  deprecated_since: null
   description: Remove a role from a user on the system.
   name: identity:revoke_system_grant_for_user
   operations:
@@ -1056,11 +1097,12 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The assignment API is now aware of system scope and default
+      roles.
+    deprecated_since: S
     name: identity:list_system_grants_for_group
-  deprecated_since: null
   description: List all grants a specific group has on the system.
   name: identity:list_system_grants_for_group
   operations:
@@ -1072,11 +1114,12 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The assignment API is now aware of system scope and default
+      roles.
+    deprecated_since: S
     name: identity:check_system_grant_for_group
-  deprecated_since: null
   description: Check if a group has a role on the system.
   name: identity:check_system_grant_for_group
   operations:
@@ -1088,11 +1131,12 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The assignment API is now aware of system scope and default
+      roles.
+    deprecated_since: S
     name: identity:create_system_grant_for_group
-  deprecated_since: null
   description: Grant a group a role on the system.
   name: identity:create_system_grant_for_group
   operations:
@@ -1103,11 +1147,12 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The assignment API is now aware of system scope and default
+      roles.
+    deprecated_since: S
     name: identity:revoke_system_grant_for_group
-  deprecated_since: null
   description: Remove a role from a group on the system.
   name: identity:revoke_system_grant_for_group
   operations:
@@ -1119,11 +1164,11 @@
   - project
 - check_str: (rule:admin_required) or (role:reader and system_scope:all) or (role:reader
     and domain_id:%(target.group.domain_id)s)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The group API is now aware of system scope and default roles.
+    deprecated_since: S
     name: identity:get_group
-  deprecated_since: null
   description: Show group details.
   name: identity:get_group
   operations:
@@ -1137,11 +1182,11 @@
   - project
 - check_str: (rule:admin_required) or (role:reader and system_scope:all) or (role:reader
     and domain_id:%(target.group.domain_id)s)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The group API is now aware of system scope and default roles.
+    deprecated_since: S
     name: identity:list_groups
-  deprecated_since: null
   description: List groups.
   name: identity:list_groups
   operations:
@@ -1155,11 +1200,11 @@
   - project
 - check_str: (rule:admin_required) or (role:reader and system_scope:all) or (role:reader
     and domain_id:%(target.user.domain_id)s) or user_id:%(user_id)s
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: The group API is now aware of system scope and default roles.
+    deprecated_since: S
     name: identity:list_groups_for_user
-  deprecated_since: null
   description: List groups to which a user belongs.
   name: identity:list_groups_for_user
   operations:
@@ -1172,11 +1217,11 @@
   - domain
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The group API is now aware of system scope and default roles.
+    deprecated_since: S
     name: identity:create_group
-  deprecated_since: null
   description: Create group.
   name: identity:create_group
   operations:
@@ -1187,11 +1232,11 @@
   - domain
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The group API is now aware of system scope and default roles.
+    deprecated_since: S
     name: identity:update_group
-  deprecated_since: null
   description: Update group.
   name: identity:update_group
   operations:
@@ -1202,11 +1247,11 @@
   - domain
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The group API is now aware of system scope and default roles.
+    deprecated_since: S
     name: identity:delete_group
-  deprecated_since: null
   description: Delete group.
   name: identity:delete_group
   operations:
@@ -1218,11 +1263,11 @@
   - project
 - check_str: (rule:admin_required) or (role:reader and system_scope:all) or (role:reader
     and domain_id:%(target.group.domain_id)s)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The group API is now aware of system scope and default roles.
+    deprecated_since: S
     name: identity:list_users_in_group
-  deprecated_since: null
   description: List members of a specific group.
   name: identity:list_users_in_group
   operations:
@@ -1235,11 +1280,11 @@
   - domain
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The group API is now aware of system scope and default roles.
+    deprecated_since: S
     name: identity:remove_user_from_group
-  deprecated_since: null
   description: Remove user from group.
   name: identity:remove_user_from_group
   operations:
@@ -1251,11 +1296,11 @@
   - project
 - check_str: (rule:admin_required) or (role:reader and system_scope:all) or (role:reader
     and domain_id:%(target.group.domain_id)s and domain_id:%(target.user.domain_id)s)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The group API is now aware of system scope and default roles.
+    deprecated_since: S
     name: identity:check_user_in_group
-  deprecated_since: null
   description: Check whether a user is a member of a group.
   name: identity:check_user_in_group
   operations:
@@ -1268,11 +1313,11 @@
   - domain
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The group API is now aware of system scope and default roles.
+    deprecated_since: S
     name: identity:add_user_to_group
-  deprecated_since: null
   description: Add user to group.
   name: identity:add_user_to_group
   operations:
@@ -1283,11 +1328,12 @@
   - domain
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The identity provider API is now aware of system scope and
+      default roles.
+    deprecated_since: S
     name: identity:create_identity_provider
-  deprecated_since: null
   description: Create identity provider.
   name: identity:create_identity_provider
   operations:
@@ -1297,11 +1343,12 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The identity provider API is now aware of system scope and
+      default roles.
+    deprecated_since: S
     name: identity:list_identity_providers
-  deprecated_since: null
   description: List identity providers.
   name: identity:list_identity_providers
   operations:
@@ -1313,11 +1360,12 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The identity provider API is now aware of system scope and
+      default roles.
+    deprecated_since: S
     name: identity:get_identity_provider
-  deprecated_since: null
   description: Get identity provider.
   name: identity:get_identity_provider
   operations:
@@ -1329,11 +1377,12 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The identity provider API is now aware of system scope and
+      default roles.
+    deprecated_since: S
     name: identity:update_identity_provider
-  deprecated_since: null
   description: Update identity provider.
   name: identity:update_identity_provider
   operations:
@@ -1343,11 +1392,12 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The identity provider API is now aware of system scope and
+      default roles.
+    deprecated_since: S
     name: identity:delete_identity_provider
-  deprecated_since: null
   description: Delete identity provider.
   name: identity:delete_identity_provider
   operations:
@@ -1357,11 +1407,12 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The implied role API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:get_implied_role
-  deprecated_since: null
   description: Get information about an association between two roles. When a relationship
     exists between a prior role and an implied role and the prior role is assigned
     to a user, the user also assumes the implied role.
@@ -1373,11 +1424,12 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The implied role API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:list_implied_roles
-  deprecated_since: null
   description: List associations between two roles. When a relationship exists between
     a prior role and an implied role and the prior role is assigned to a user, the
     user also assumes the implied role. This will return all the implied roles that
@@ -1392,11 +1444,12 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The implied role API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:create_implied_role
-  deprecated_since: null
   description: Create an association between two roles. When a relationship exists
     between a prior role and an implied role and the prior role is assigned to a user,
     the user also assumes the implied role.
@@ -1408,11 +1461,12 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The implied role API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:delete_implied_role
-  deprecated_since: null
   description: Delete the association between two roles. When a relationship exists
     between a prior role and an implied role and the prior role is assigned to a user,
     the user also assumes the implied role. Removing the association will cause that
@@ -1425,11 +1479,12 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The implied role API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:list_role_inference_rules
-  deprecated_since: null
   description: List all associations between two roles in the system. When a relationship
     exists between a prior role and an implied role and the prior role is assigned
     to a user, the user also assumes the implied role.
@@ -1443,11 +1498,12 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The implied role API is now aware of system scope and default
+      roles.
+    deprecated_since: T
     name: identity:check_implied_role
-  deprecated_since: null
   description: Check an association between two roles. When a relationship exists
     between a prior role and an implied role and the prior role is assigned to a user,
     the user also assumes the implied role.
@@ -1524,11 +1580,12 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The federated mapping API is now aware of system scope and
+      default roles.
+    deprecated_since: S
     name: identity:create_mapping
-  deprecated_since: null
   description: Create a new federated mapping containing one or more sets of rules.
   name: identity:create_mapping
   operations:
@@ -1538,11 +1595,12 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The federated mapping API is now aware of system scope and
+      default roles.
+    deprecated_since: S
     name: identity:get_mapping
-  deprecated_since: null
   description: Get a federated mapping.
   name: identity:get_mapping
   operations:
@@ -1554,11 +1612,12 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The federated mapping API is now aware of system scope and
+      default roles.
+    deprecated_since: S
     name: identity:list_mappings
-  deprecated_since: null
   description: List federated mappings.
   name: identity:list_mappings
   operations:
@@ -1570,11 +1629,12 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The federated mapping API is now aware of system scope and
+      default roles.
+    deprecated_since: S
     name: identity:delete_mapping
-  deprecated_since: null
   description: Delete a federated mapping.
   name: identity:delete_mapping
   operations:
@@ -1584,11 +1644,12 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The federated mapping API is now aware of system scope and
+      default roles.
+    deprecated_since: S
     name: identity:update_mapping
-  deprecated_since: null
   description: Update a federated mapping.
   name: identity:update_mapping
   operations:
@@ -1598,11 +1659,11 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The policy API is now aware of system scope and default roles.
+    deprecated_since: T
     name: identity:get_policy
-  deprecated_since: null
   description: Show policy details.
   name: identity:get_policy
   operations:
@@ -1612,11 +1673,11 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The policy API is now aware of system scope and default roles.
+    deprecated_since: T
     name: identity:list_policies
-  deprecated_since: null
   description: List policies.
   name: identity:list_policies
   operations:
@@ -1626,11 +1687,11 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The policy API is now aware of system scope and default roles.
+    deprecated_since: T
     name: identity:create_policy
-  deprecated_since: null
   description: Create policy.
   name: identity:create_policy
   operations:
@@ -1640,11 +1701,11 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The policy API is now aware of system scope and default roles.
+    deprecated_since: T
     name: identity:update_policy
-  deprecated_since: null
   description: Update policy.
   name: identity:update_policy
   operations:
@@ -1654,11 +1715,11 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The policy API is now aware of system scope and default roles.
+    deprecated_since: T
     name: identity:delete_policy
-  deprecated_since: null
   description: Delete policy.
   name: identity:delete_policy
   operations:
@@ -1668,11 +1729,12 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The policy association API is now aware of system scope and
+      default roles.
+    deprecated_since: T
     name: identity:create_policy_association_for_endpoint
-  deprecated_since: null
   description: Associate a policy to a specific endpoint.
   name: identity:create_policy_association_for_endpoint
   operations:
@@ -1682,11 +1744,12 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The policy association API is now aware of system scope and
+      default roles.
+    deprecated_since: T
     name: identity:check_policy_association_for_endpoint
-  deprecated_since: null
   description: Check policy association for endpoint.
   name: identity:check_policy_association_for_endpoint
   operations:
@@ -1698,11 +1761,12 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The policy association API is now aware of system scope and
+      default roles.
+    deprecated_since: T
     name: identity:delete_policy_association_for_endpoint
-  deprecated_since: null
   description: Delete policy association for endpoint.
   name: identity:delete_policy_association_for_endpoint
   operations:
@@ -1712,11 +1776,12 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The policy association API is now aware of system scope and
+      default roles.
+    deprecated_since: T
     name: identity:create_policy_association_for_service
-  deprecated_since: null
   description: Associate a policy to a specific service.
   name: identity:create_policy_association_for_service
   operations:
@@ -1726,11 +1791,12 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The policy association API is now aware of system scope and
+      default roles.
+    deprecated_since: T
     name: identity:check_policy_association_for_service
-  deprecated_since: null
   description: Check policy association for service.
   name: identity:check_policy_association_for_service
   operations:
@@ -1742,11 +1808,12 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The policy association API is now aware of system scope and
+      default roles.
+    deprecated_since: T
     name: identity:delete_policy_association_for_service
-  deprecated_since: null
   description: Delete policy association for service.
   name: identity:delete_policy_association_for_service
   operations:
@@ -1756,11 +1823,12 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The policy association API is now aware of system scope and
+      default roles.
+    deprecated_since: T
     name: identity:create_policy_association_for_region_and_service
-  deprecated_since: null
   description: Associate a policy to a specific region and service combination.
   name: identity:create_policy_association_for_region_and_service
   operations:
@@ -1770,11 +1838,12 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The policy association API is now aware of system scope and
+      default roles.
+    deprecated_since: T
     name: identity:check_policy_association_for_region_and_service
-  deprecated_since: null
   description: Check policy association for region and service.
   name: identity:check_policy_association_for_region_and_service
   operations:
@@ -1786,11 +1855,12 @@
   - system
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The policy association API is now aware of system scope and
+      default roles.
+    deprecated_since: T
     name: identity:delete_policy_association_for_region_and_service
-  deprecated_since: null
   description: Delete policy association for region and service.
   name: identity:delete_policy_association_for_region_and_service
   operations:
@@ -1800,11 +1870,12 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The policy association API is now aware of system scope and
+      default roles.
+    deprecated_since: T
     name: identity:get_policy_for_endpoint
-  deprecated_since: null
   description: Get policy for endpoint.
   name: identity:get_policy_for_endpoint
   operations:
@@ -1816,11 +1887,12 @@
   - system
   - project
 - check_str: rule:admin_required or (role:reader and system_scope:all)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The policy association API is now aware of system scope and
+      default roles.
+    deprecated_since: T
     name: identity:list_endpoints_for_policy
-  deprecated_since: null
   description: List endpoints for policy.
   name: identity:list_endpoints_for_policy
   operations:
@@ -1831,11 +1903,11 @@
   - project
 - check_str: (rule:admin_required) or (role:reader and system_scope:all) or (role:reader
     and domain_id:%(target.project.domain_id)s) or project_id:%(target.project.id)s
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required or project_id:%(target.project.id)s
+    deprecated_reason: The project API is now aware of system scope and default roles.
+    deprecated_since: S
     name: identity:get_project
-  deprecated_since: null
   description: Show project details.
   name: identity:get_project
   operations:
@@ -1847,11 +1919,11 @@
   - project
 - check_str: (rule:admin_required) or (role:reader and system_scope:all) or (role:reader
     and domain_id:%(target.domain_id)s)
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The project API is now aware of system scope and default roles.
+    deprecated_since: S
     name: identity:list_projects
-  deprecated_since: null
   description: List projects.
   name: identity:list_projects
   operations:
@@ -1863,11 +1935,11 @@
   - project
 - check_str: (rule:admin_required) or (role:reader and system_scope:all) or (role:reader
     and domain_id:%(target.user.domain_id)s) or user_id:%(target.user.id)s
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_or_owner
+    deprecated_reason: The project API is now aware of system scope and default roles.
+    deprecated_since: S
     name: identity:list_user_projects
-  deprecated_since: null
   description: List projects for user.
   name: identity:list_user_projects
   operations:
@@ -1878,11 +1950,11 @@
   - domain
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The project API is now aware of system scope and default roles.
+    deprecated_since: S
     name: identity:create_project
-  deprecated_since: null
   description: Create project.
   name: identity:create_project
   operations:
@@ -1893,11 +1965,11 @@
   - domain
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The project API is now aware of system scope and default roles.
+    deprecated_since: S
     name: identity:update_project
-  deprecated_since: null
   description: Update project.
   name: identity:update_project
   operations:
@@ -1908,11 +1980,11 @@
   - domain
   - project
 - check_str: rule:admin_required
-  deprecated_reason: null
   deprecated_rule:
     check_str: rule:admin_required
+    deprecated_reason: The project API is now aware of system scope and default roles.
+    deprecated_since: S
     name: identity:delete_project
-  deprecated_since: null
   description: Delete project.
   name: identity:delete_project
   operations:
@@ -1924,11 +1996,11 @@
   - project
 - check_str: (rule:admin_required) or (role:reader and system_scope:all) or (role:reader