diff --git a/pkg/keystone/locale/predefined_yaml.go b/pkg/keystone/locale/predefined_yaml.go
index 322c59572f..cf58ea712e 100644
--- a/pkg/keystone/locale/predefined_yaml.go
+++ b/pkg/keystone/locale/predefined_yaml.go
@@ -67,6 +67,11 @@ policy:
       '*': deny
       list: allow
       get: allow
+    users:
+      '*': deny
+      create: allow
+      list: allow
+      get: allow
     events:
       '*': deny
   monitor:
@@ -141,6 +146,9 @@ policy:
   identity:
     events:
       '*': deny
+    users:
+      create: deny
+      '*': allow
     '*':
       '*': allow
   image: