admin - The admin role is global, not per project, so granting a user the admin role in any project gives the user administrative rights across the whole environment. Member and reader roles are the default roles in openstack

You can define actions for OpenStack service roles in the /etc/PROJECT/policy.json files. For example, define actions for Keystone service roles in the /etc/keystone/policy.json file.

You can manage projects, users, and roles independently from each other.

for all projects in OpenStack, you can define the policies by using the above-mentioned method

You use policies to determine what a role can do. Policies used to be defined in configuration files named policy.json, but Keystone, Nova and Cinder now have hard-coded default policies.

Default roles are reader, admin and member.