diff --git a/pkg/cloudcommon/db/db_dispatcher.go b/pkg/cloudcommon/db/db_dispatcher.go
index 83e6754bf3..782b823e4f 100644
--- a/pkg/cloudcommon/db/db_dispatcher.go
+++ b/pkg/cloudcommon/db/db_dispatcher.go
@@ -30,7 +30,6 @@ import (
 	"yunion.io/x/pkg/utils"
 	"yunion.io/x/sqlchemy"
 
-	"sort"
 	"yunion.io/x/onecloud/pkg/appsrv"
 	"yunion.io/x/onecloud/pkg/appsrv/dispatcher"
 	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
diff --git a/pkg/cloudcommon/policy/defaults.go b/pkg/cloudcommon/policy/defaults.go
index 78de4ed785..968da01c1d 100644
--- a/pkg/cloudcommon/policy/defaults.go
+++ b/pkg/cloudcommon/policy/defaults.go
@@ -178,17 +178,5 @@ var (
 			Action:   PolicyActionGet,
 			Result:   rbacutils.OwnerAllow,
 		},
-		{
-			Service:  "identity",
-			Resource: "policies",
-			Action:   PolicyActionList,
-			Result:   rbacutils.UserAllow,
-		},
-		{
-			Service:  "identity",
-			Resource: "policies",
-			Action:   PolicyActionGet,
-			Result:   rbacutils.UserAllow,
-		},
 	}
 )
diff --git a/pkg/keystone/service/service.go b/pkg/keystone/service/service.go
index e52682bf12..4169b4c0f4 100644
--- a/pkg/keystone/service/service.go
+++ b/pkg/keystone/service/service.go
@@ -72,6 +72,39 @@ func StartService() {
 	models.InitDB()
 
 	app_common.InitBaseAuth(commonOpts)
+	// register bootstrap default policy
+	defaultAdminPolicy := rbacutils.SRbacPolicy{
+		IsAdmin:  true,
+		Projects: []string{options.Options.AdminProjectName},
+		Roles:    []string{options.Options.AdminRoleName},
+		Rules: []rbacutils.SRbacRule{
+			{
+				Service:  api.SERVICE_TYPE,
+				Resource: "policies",
+				Action:   policy.PolicyActionCreate,
+				Result:   rbacutils.AdminAllow,
+			},
+			{
+				Service:  api.SERVICE_TYPE,
+				Resource: "policies",
+				Action:   policy.PolicyActionList,
+				Result:   rbacutils.AdminAllow,
+			},
+			{
+				Service:  api.SERVICE_TYPE,
+				Resource: "policies",
+				Action:   policy.PolicyActionUpdate,
+				Result:   rbacutils.AdminAllow,
+			},
+			{
+				Service:  api.SERVICE_TYPE,
+				Resource: "policies",
+				Action:   policy.PolicyActionGet,
+				Result:   rbacutils.AdminAllow,
+			},
+		},
+	}
+	policy.PolicyManager.RegisterDefaultAdminPolicy(&defaultAdminPolicy)
 
 	// cron := cronman.GetCronJobManager(true)
 	// cron.AddJob1("CleanPendingDeleteImages", time.Duration(options.Options.PendingDeleteCheckSeconds)*time.Second, models.ImageManager.CleanPendingDeleteImages)