Comment 0 for bug 1804446

In Rocky, keystone implemented support to ensure at least three default roles were available [0]. The regions API doesn't incorporate these defaults into its default policies, but it should.

[0] http://specs.openstack.org/openstack/keystone-specs/specs/keystone/rocky/define-default-roles.html