Sorry for asking very basic question but basic flow is not clear to me yet. How will oauth deployment will look like ??

I found good details at

Yes. That link has everything about sepcification. Before going with keystone implementation read link to the OAUTH spec given there. One of the main goal of implemnting OAUTH in keystone is to replace the keystone trusts api with OAUTH ( which is a standard way to doing trusts).

If you really intersted in the usecase, how can you ask heat to spawn/terminate vms on behalof of you. You really don't want to give your credetnails to heat, instead you deletate certain capabilities