keystone.common.policies.role_assignment module