taken from /opt/stack/nova/etc/nova/policy.json