You shouldn't have to use Keystone for a policy file to work, assuming you are using the auth system in Nova. All it does it look at the user information in your context and apply it to the necessary rules. After the Essex release, however, we will be removing that auth system from Nova. At that point you will be required to use Keystone.