Test Matrix

Scope: is_admin_project true, is_admin_project true, project scoped, domain scoped
Role: admin, member, reader, banana (none)
Target: project or domain matches/does not match

| |System scoped |is_admin_project true|project scoped|domain scoped
|admin|O |O |O |O|
|member|X|X|O|O|
|Reader|O|O|O|O|
|Banana|O|O|O|O|

TODO: rename the current and original files to indicate match/mismatch.

Need 4 * 4 scopes subdirs: role * scope Each with match/mismatch

Rules of Thumb:
is_admin_project true and system scoped should have the same results
Banana role assignments should always fail
Domain scoped should only ever pass on Keystone
System scoped rules should ignore target project_id
No system/is_admin_project=true scoped member roles