Rule [identity:revocation_list] doesn't exist

[jowolf]

Was due to incorrect /etc/keystone/policy.json supplied by salt formula -

salt should edit the config files (only as necessary, of course) provided by upstream, never replace them - need ini_manage.