There is are to parameter in heat (not documented) which will help.

Solution: (edit /etc/heat/heat.conf for heat-engine):

[DEFAULT]
deferred_auth_method = trusts
trusts_delegated_roles = heat_stack_owner  (role of user in project)

solution from: http://hardysteven.blogspot.de/2014/04/heat-auth-model-updates-part-1-trusts.html

you must create the role and add the role to the user / tenant who runs the stack / magnum create bay