diff --git a/.testr.conf b/.testr.conf
index 6d83b3c..87d049d 100644
--- a/.testr.conf
+++ b/.testr.conf
@@ -2,6 +2,6 @@
 test_command=OS_STDOUT_CAPTURE=${OS_STDOUT_CAPTURE:-1} \
              OS_STDERR_CAPTURE=${OS_STDERR_CAPTURE:-1} \
              OS_TEST_TIMEOUT=${OS_TEST_TIMEOUT:-60} \
-             ${PYTHON:-python} -m subunit.run discover -t ./ . $LISTOPT $IDOPTION
+             ${PYTHON:-python} -m subunit.run discover -t ./ ${OS_TEST_PATH:-./patrole_tempest_plugin/tests/unit} $LISTOPT $IDOPTION
 test_id_option=--load-list $IDFILE
 test_list_option=--list
diff --git a/HACKING.rst b/HACKING.rst
index c5ff7c7..3bc8270 100644
--- a/HACKING.rst
+++ b/HACKING.rst
@@ -1,15 +1,15 @@
 Patrole Style Commandments
 ==========================
 
-- Step 1: Read the OpenStack Style Commandments: `<https://docs.openstack.org/developer/hacking/>`__
-- Step 2: Review Tempest's Style Commandments: `<https://docs.openstack.org/developer/tempest/HACKING.html>`__
+- Step 1: Read the OpenStack Style Commandments: `<https://docs.openstack.org/hacking/latest/>`__
+- Step 2: Review Tempest's Style Commandments: `<https://docs.openstack.org/tempest/latest/HACKING.html>`__
 - Step 3: Read on
 
 Patrole Specific Commandments
 ------------------------------
 
 Patrole borrows the following commandments from Tempest; refer to
-`Tempest's Commandments <https://docs.openstack.org/developer/tempest/HACKING.html>`__
+`Tempest's Commandments <https://docs.openstack.org/tempest/latest/HACKING.html>`__
 for more information:
 
 .. note::
diff --git a/README.rst b/README.rst
index cc22b85..6110dda 100644
--- a/README.rst
+++ b/README.rst
@@ -2,8 +2,8 @@
 Team and repository tags
 ========================
 
-.. image:: http://governance.openstack.org/badges/patrole.svg
-    :target: http://governance.openstack.org/reference/tags/index.html
+.. image:: https://governance.openstack.org/tc/badges/patrole.svg
+    :target: https://governance.openstack.org/tc/reference/tags/index.html
 
 Patrole - RBAC Integration Tempest Plugin
 =========================================
diff --git a/doc/source/configuration.rst b/doc/source/configuration.rst
index 550d2ce..8ec0013 100644
--- a/doc/source/configuration.rst
+++ b/doc/source/configuration.rst
@@ -5,7 +5,7 @@
 
 Patrole can be customized by updating Tempest's ``tempest.conf`` configuration
 file. All Patrole-specific configuration options should be included under
-the ``rbac`` group.
+the ``patrole`` group.
 
 RBAC Test Role
 --------------
diff --git a/doc/source/sampleconf.rst b/doc/source/sampleconf.rst
index c262f2d..94ebc4d 100644
--- a/doc/source/sampleconf.rst
+++ b/doc/source/sampleconf.rst
@@ -7,7 +7,7 @@
 
 .. code-block:: ini
 
-    [rbac]
+    [patrole]
 
     # The role that you want the RBAC tests to use for RBAC testing
     # This needs to be edited to run the test as a different role.
@@ -36,7 +36,7 @@
     # are.
     test_custom_requirements = False
 
-    File path of the yaml file that defines your RBAC requirements. This
+    # File path of the yaml file that defines your RBAC requirements. This
     # file must be located on the same host that Patrole runs on. The yaml
     # file should be written as follows:
     custom_requirements_file = patrole/requirements.txt
diff --git a/doc/source/usage.rst b/doc/source/usage.rst
index 7470e9e..dff43f2 100644
--- a/doc/source/usage.rst
+++ b/doc/source/usage.rst
@@ -30,7 +30,7 @@
 To change the role that the patrole tests are being run as, edit
 ``rbac_test_role`` in the ``rbac`` section of tempest.conf: ::
 
-    [rbac]
+    [patrole]
     rbac_test_role = Member
     ...
 
diff --git a/patrole_tempest_plugin/config.py b/patrole_tempest_plugin/config.py
index a6f30e7..a53edd4 100644
--- a/patrole_tempest_plugin/config.py
+++ b/patrole_tempest_plugin/config.py
@@ -15,19 +15,23 @@
 
 from oslo_config import cfg
 
-rbac_group = cfg.OptGroup(name='rbac',
-                          title='RBAC testing options')
 
-RbacGroup = [
+patrole_group = cfg.OptGroup(name='patrole', title='Patrole Testing Options')
+
+
+PatroleGroup = [
     cfg.StrOpt('rbac_test_role',
                default='admin',
+               deprecated_group='rbac',
                help="""The current RBAC role against which to run Patrole
 tests."""),
     cfg.BoolOpt('enable_rbac',
                 default=True,
+                deprecated_group='rbac',
                 help="Enables RBAC tests."),
     cfg.BoolOpt('strict_policy_check',
                 default=False,
+                deprecated_group='rbac',
                 help="""If true, throws RbacParsingException for policies which
 don't exist or are not included in the service's policy file. If false, throws
 skipException."""),
@@ -35,6 +39,7 @@
     # other hosts. It may be possible to leverage the v3 identity policy API.
     cfg.ListOpt('custom_policy_files',
                 default=['/etc/%s/policy.json'],
+                deprecated_group='rbac',
                 help="""List of the paths to search for policy files. Each
 policy path assumes that the service name is included in the path once. Also
 assumes Patrole is on the same host as the policy files. The paths should be
@@ -45,6 +50,7 @@
                default='/etc/cinder/policy.json',
                help="""Location of the Cinder policy file. Assumed to be on
 the same host as Patrole.""",
+               deprecated_group='rbac',
                deprecated_for_removal=True,
                deprecated_reason="It is better to use `custom_policy_files` "
                                  "which supports any OpenStack service."),
@@ -52,6 +58,7 @@
                default='/etc/glance/policy.json',
                help="""Location of the Glance policy file. Assumed to be on
 the same host as Patrole.""",
+               deprecated_group='rbac',
                deprecated_for_removal=True,
                deprecated_reason="It is better to use `custom_policy_files` "
                                  "which supports any OpenStack service."),
@@ -59,6 +66,7 @@
                default='/etc/keystone/policy.json',
                help="""Location of the custom Keystone policy file. Assumed to
 be on the same host as Patrole.""",
+               deprecated_group='rbac',
                deprecated_for_removal=True,
                deprecated_reason="It is better to use `custom_policy_files` "
                                  "which supports any OpenStack service."),
@@ -66,6 +74,7 @@
                default='/etc/neutron/policy.json',
                help="""Location of the Neutron policy file. Assumed to be on
 the same host as Patrole.""",
+               deprecated_group='rbac',
                deprecated_for_removal=True,
                deprecated_reason="It is better to use `custom_policy_files` "
                                  "which supports any OpenStack service."),
@@ -73,11 +82,13 @@
                default='/etc/nova/policy.json',
                help="""Location of the custom Nova policy file. Assumed to be
 on the same host as Patrole.""",
+               deprecated_group='rbac',
                deprecated_for_removal=True,
                deprecated_reason="It is better to use `custom_policy_files` "
                                  "which supports any OpenStack service."),
     cfg.BoolOpt('test_custom_requirements',
                 default=False,
+                deprecated_group='rbac',
                 help="""
 This option determines whether Patrole should run against a
 `custom_requirements_file` which defines RBAC requirements. The
@@ -101,6 +112,7 @@
 test result: fail (over-permission)
 """),
     cfg.StrOpt('custom_requirements_file',
+               deprecated_group='rbac',
                help="""
 File path of the yaml file that defines your RBAC requirements. This
 file must be located on the same host that Patrole runs on. The yaml
@@ -128,3 +140,10 @@
 allowed_role = the Keystone role that is allowed to perform the API
 """)
 ]
+
+
+rbac_group = cfg.OptGroup(name='rbac',
+                          title='RBAC testing options',
+                          help="This group is deprecated and will be removed "
+                               "in the next release. Use the [patrole] group "
+                               "instead.")
diff --git a/patrole_tempest_plugin/plugin.py b/patrole_tempest_plugin/plugin.py
index 28ce12c..4bba037 100644
--- a/patrole_tempest_plugin/plugin.py
+++ b/patrole_tempest_plugin/plugin.py
@@ -30,10 +30,17 @@
         return full_test_dir, base_path
 
     def register_opts(self, conf):
+        # TODO(fmontei): Remove ``rbac_group`` in a future release as it is
+        # currently deprecated.
         config.register_opt_group(
             conf,
             project_config.rbac_group,
-            project_config.RbacGroup)
+            project_config.PatroleGroup)
+        config.register_opt_group(
+            conf,
+            project_config.patrole_group,
+            project_config.PatroleGroup)
 
     def get_opt_lists(self):
-        return [(project_config.rbac_group.name, project_config.RbacGroup)]
+        return [(project_config.patrole_group.name,
+                 project_config.PatroleGroup)]
diff --git a/patrole_tempest_plugin/rbac_exceptions.py b/patrole_tempest_plugin/rbac_exceptions.py
index 5ccb216..5ee65ae 100644
--- a/patrole_tempest_plugin/rbac_exceptions.py
+++ b/patrole_tempest_plugin/rbac_exceptions.py
@@ -16,8 +16,25 @@
 from tempest.lib import exceptions
 
 
-class RbacActionFailed(exceptions.ClientRestClientException):
-    message = "Rbac action failed"
+class RbacConflictingPolicies(exceptions.TempestException):
+    message = ("Conflicting policies preventing this action from being "
+               "performed.")
+
+
+class RbacMalformedResponse(exceptions.TempestException):
+    message = ("The response body is missing the expected %(attribute)s due "
+               "to policy enforcement failure.")
+
+    def __init__(self, empty=False, extra_attr=False, **kwargs):
+        if empty:
+            self.message = ("The response body is empty due to policy "
+                            "enforcement failure.")
+            kwargs = {}
+        if extra_attr:
+            self.message = ("The response body contained an unexpected "
+                            "attribute due to policy enforcement failure.")
+            kwargs = {}
+        super(RbacMalformedResponse, self).__init__(**kwargs)
 
 
 class RbacResourceSetupFailed(exceptions.TempestException):
diff --git a/patrole_tempest_plugin/rbac_policy_parser.py b/patrole_tempest_plugin/rbac_policy_parser.py
index 254bb18..aff4e66 100644
--- a/patrole_tempest_plugin/rbac_policy_parser.py
+++ b/patrole_tempest_plugin/rbac_policy_parser.py
@@ -20,7 +20,7 @@
 from oslo_log import log as logging
 from oslo_policy import policy
 import stevedore
-
+from tempest import clients
 from tempest.common import credentials_factory as credentials
 from tempest import config
 
@@ -72,11 +72,11 @@
 
         # Prioritize dynamically searching for policy files over relying on
         # deprecated service-specific policy file locations.
-        if CONF.rbac.custom_policy_files:
+        if CONF.patrole.custom_policy_files:
             self.discover_policy_files()
             self.path = self.policy_files.get(service)
         else:
-            self.path = getattr(CONF.rbac, '%s_policy_file' % str(service),
+            self.path = getattr(CONF.patrole, '%s_policy_file' % str(service),
                                 None)
 
         self.rules = policy.Rules.load(self._get_policy_data(service),
@@ -93,7 +93,8 @@
         # Cache the list of available services in memory to avoid needlessly
         # doing an API call every time.
         if not hasattr(cls, 'available_services'):
-            admin_mgr = credentials.AdminManager()
+            admin_mgr = clients.Manager(
+                credentials.get_configured_admin_credentials())
             services_client = (admin_mgr.identity_services_v3_client
                                if CONF.identity_feature_enabled.api_v3
                                else admin_mgr.identity_services_client)
@@ -109,11 +110,11 @@
     def discover_policy_files(cls):
         # Dynamically discover the policy file for each service in
         # ``cls.available_services``. Pick the first ``candidate_path`` found
-        # out of the potential paths in ``CONF.rbac.custom_policy_files``.
+        # out of the potential paths in ``CONF.patrole.custom_policy_files``.
         if not hasattr(cls, 'policy_files'):
             cls.policy_files = {}
             for service in cls.available_services:
-                for candidate_path in CONF.rbac.custom_policy_files:
+                for candidate_path in CONF.patrole.custom_policy_files:
                     if os.path.isfile(candidate_path % service):
                         cls.policy_files.setdefault(service,
                                                     candidate_path % service)
@@ -177,7 +178,7 @@
             error_message = (
                 'Policy file for {0} service neither found in code nor at {1}.'
                 .format(service, [loc % service for loc in
-                                  CONF.rbac.custom_policy_files])
+                                  CONF.patrole.custom_policy_files])
             )
             raise rbac_exceptions.RbacParsingException(error_message)
 
diff --git a/patrole_tempest_plugin/rbac_rule_validation.py b/patrole_tempest_plugin/rbac_rule_validation.py
index 51b9d92..d06986a 100644
--- a/patrole_tempest_plugin/rbac_rule_validation.py
+++ b/patrole_tempest_plugin/rbac_rule_validation.py
@@ -25,6 +25,7 @@
 
 from patrole_tempest_plugin import rbac_exceptions
 from patrole_tempest_plugin import rbac_policy_parser
+from patrole_tempest_plugin import rbac_utils
 from patrole_tempest_plugin import requirements_authority
 
 CONF = config.CONF
@@ -35,43 +36,90 @@
 
 def action(service, rule='', admin_only=False, expected_error_code=403,
            extra_target_data=None):
-    """A decorator which does a policy check and matches it against test run.
+    """A decorator for verifying policy enforcement.
 
-    A decorator which allows for positive and negative RBAC testing. Given
-    an OpenStack service and a policy action enforced by that service, an
-    oslo.policy lookup is performed by calling `authority.get_permission`.
-    Alternatively, the RBAC tests can run against a YAML file that defines
-    policy requirements.
+    A decorator which allows for positive and negative RBAC testing. Given:
 
-    The following cases are possible:
+        * an OpenStack service,
+        * a policy action (``rule``) enforced by that service, and
+        * the test role defined by ``[patrole] rbac_test_role``
 
-    * If `allowed` is True and the test passes, this is a success.
-    * If `allowed` is True and the test fails, this is a failure.
-    * If `allowed` is False and the test passes, this is a failure.
-    * If `allowed` is False and the test fails, this is a success.
+    determines whether the test role has sufficient permissions to perform an
+    API call that enforces the ``rule``.
 
-    :param service: A OpenStack service: for example, "nova" or "neutron".
-    :param rule: A policy action defined in a policy.json file (or in code).
-    :param admin_only: Skips over oslo.policy check because the policy action
-        defined by `rule` is not enforced by the service's  policy enforcement
-        logic. For example, Keystone v2 performs an admin check for most of its
-        endpoints. If True, `rule` is effectively ignored.
+    This decorator should only be applied to an instance or subclass of
+        `tempest.base.BaseTestCase`.
+
+    The result from ``_is_authorized`` is used to determine the *expected*
+    test result. The *actual* test result is determined by running the
+    Tempest test this decorator applies to.
+
+    Below are the following possibilities from comparing the *expected* and
+    *actual* results:
+
+    1) If *expected* is True and the test passes (*actual*), this is a success.
+    2) If *expected* is True and the test fails (*actual*), this results in a
+       `Forbidden` exception failure.
+    3) If *expected* is False and the test passes (*actual*), this results in
+       an `OverPermission` exception failure.
+    4) If *expected* is False and the test fails (*actual*), this is a success.
+
+    As such, negative and positive testing can be applied using this decorator.
+
+    :param service: A OpenStack service. Examples: "nova" or "neutron".
+    :param rule: A policy action defined in a policy.json file (or in
+        code).
+
+        .. note::
+
+            Patrole currently only supports custom JSON policy files.
+
+    :param admin_only: Skips over `oslo.policy` check because the policy action
+        defined by `rule` is not enforced by the service's policy
+        enforcement engine. For example, Keystone v2 performs an admin check
+        for most of its endpoints. If True, `rule` is effectively
+        ignored.
     :param expected_error_code: Overrides default value of 403 (Forbidden)
         with endpoint-specific error code. Currently only supports 403 and 404.
         Support for 404 is needed because some services, like Neutron,
         intentionally throw a 404 for security reasons.
 
-    :raises NotFound: if `service` is invalid or
-                      if Tempest credentials cannot be found.
-    :raises Forbidden: for bullet (2) above.
-    :raises RbacOverPermission: for bullet (3) above.
+        .. warning::
+
+            A 404 should not be provided *unless* the endpoint masks a
+            `Forbidden` exception as a `Not Found` exception.
+
+    :param extra_target_data: Dictionary, keyed with `oslo.policy` generic
+        check names, whose values are string literals that reference nested
+        `tempest.base.BaseTestCase` attributes. Used by `oslo.policy` for
+        performing matching against attributes that are sent along with the API
+        calls. Example::
+
+            extra_target_data={
+                "target.token.user_id":
+                "os_alt.auth_provider.credentials.user_id"
+            })
+
+    :raises NotFound: If `service` is invalid or if Tempest credentials cannot
+        be found.
+    :raises Forbidden: For item (2) above.
+    :raises RbacOverPermission: For item (3) above.
+
+    Examples::
+
+        @rbac_rule_validation.action(
+            service="nova", rule="os_compute_api:os-agents")
+        def test_list_agents_rbac(self):
+            # The call to ``switch_role`` is mandatory.
+            self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+            self.agents_client.list_agents()
     """
 
     if extra_target_data is None:
         extra_target_data = {}
 
     def decorator(func):
-        role = CONF.rbac.rbac_test_role
+        role = CONF.patrole.rbac_test_role
 
         def wrapper(*args, **kwargs):
             if args and isinstance(args[0], test.BaseTestCase):
@@ -85,7 +133,7 @@
                 LOG.info("As admin_only is True, only admin role should be "
                          "allowed to perform the API. Skipping oslo.policy "
                          "check for policy action {0}.".format(rule))
-                allowed = test_obj.rbac_utils.is_admin
+                allowed = rbac_utils.is_admin()
             else:
                 allowed = _is_authorized(test_obj, service, rule,
                                          extra_target_data)
@@ -100,7 +148,9 @@
                 LOG.error(msg)
                 raise exceptions.NotFound(
                     "%s RbacInvalidService was: %s" % (msg, e))
-            except (expected_exception, rbac_exceptions.RbacActionFailed) as e:
+            except (expected_exception,
+                    rbac_exceptions.RbacConflictingPolicies,
+                    rbac_exceptions.RbacMalformedResponse) as e:
                 if irregular_msg:
                     LOG.warning(irregular_msg.format(rule, service))
                 if allowed:
@@ -133,23 +183,26 @@
     return decorator
 
 
-def _is_authorized(test_obj, service, rule_name, extra_target_data):
+def _is_authorized(test_obj, service, rule, extra_target_data):
     """Validates whether current RBAC role has permission to do policy action.
 
-    :param test_obj: type BaseTestCase (tempest base test class)
-    :param service: the OpenStack service that enforces ``rule_name``
-    :param rule_name: the name of the policy action
-    :param extra_target_data: dictionary with unresolved string literals that
-        reference nested BaseTestCase attributes
-    :returns: True if the current RBAC role can perform the policy action else
-        False
-
-    :raises RbacResourceSetupFailed: if project_id or user_id are missing from
-        the Tempest test object's `auth_provider`
-    :raises RbacParsingException: if ``CONF.rbac.strict_policy_check`` is
-        enabled and the ``rule_name`` does not exist in the system
-    :raises skipException: if ``CONF.rbac.strict_policy_check`` is
-        disabled and the ``rule_name`` does not exist in the system
+    :param test_obj: An instance or subclass of `tempest.base.BaseTestCase`.
+    :param service: The OpenStack service that enforces ``rule``.
+    :param rule: The name of the policy action. Examples include
+        "identity:create_user" or "os_compute_api:os-agents".
+    :param extra_target_data: Dictionary, keyed with `oslo.policy` generic
+        check names, whose values are string literals that reference nested
+        `tempest.base.BaseTestCase` attributes. Used by `oslo.policy` for
+        performing matching against attributes that are sent along with the API
+        calls.
+    :returns: True if the current RBAC role can perform the policy action,
+        else False.
+    :raises RbacResourceSetupFailed: If `project_id` or `user_id` are missing
+        from the `auth_provider` attribute in `test_obj`.
+    :raises RbacParsingException: if ``[patrole] strict_policy_check`` is True
+        and the ``rule`` does not exist in the system.
+    :raises skipException: If ``[patrole] strict_policy_check`` is False and
+        the ``rule`` does not exist in the system.
     """
     try:
         project_id = test_obj.os_primary.credentials.project_id
@@ -161,28 +214,28 @@
         raise rbac_exceptions.RbacResourceSetupFailed(msg)
 
     try:
-        role = CONF.rbac.rbac_test_role
+        role = CONF.patrole.rbac_test_role
         # Test RBAC against custom requirements. Otherwise use oslo.policy
-        if CONF.rbac.test_custom_requirements:
+        if CONF.patrole.test_custom_requirements:
             authority = requirements_authority.RequirementsAuthority(
-                CONF.rbac.custom_requirements_file, service)
+                CONF.patrole.custom_requirements_file, service)
         else:
             formatted_target_data = _format_extra_target_data(
                 test_obj, extra_target_data)
             authority = rbac_policy_parser.RbacPolicyParser(
                 project_id, user_id, service,
                 extra_target_data=formatted_target_data)
-        is_allowed = authority.allowed(rule_name, role)
+        is_allowed = authority.allowed(rule, role)
 
         if is_allowed:
-            LOG.debug("[Action]: %s, [Role]: %s is allowed!", rule_name,
+            LOG.debug("[Action]: %s, [Role]: %s is allowed!", rule,
                       role)
         else:
             LOG.debug("[Action]: %s, [Role]: %s is NOT allowed!",
-                      rule_name, role)
+                      rule, role)
         return is_allowed
     except rbac_exceptions.RbacParsingException as e:
-        if CONF.rbac.strict_policy_check:
+        if CONF.patrole.strict_policy_check:
             raise e
         else:
             raise testtools.TestCase.skipException(str(e))
@@ -228,21 +281,24 @@
     """Formats the "extra_target_data" dictionary with correct test data.
 
     Before being formatted, "extra_target_data" is a dictionary that maps a
-    policy string like "trust.trustor_user_id" to a nested list of BaseTestCase
-    attributes. For example, the attribute list in:
+    policy string like "trust.trustor_user_id" to a nested list of
+    `tempest.base.BaseTestCase` attributes. For example, the attribute list in:
 
         "trust.trustor_user_id": "os.auth_provider.credentials.user_id"
 
-    is parsed by iteratively calling `getattr` until the value of "user_id"
+    is parsed by iteratively calling ``getattr`` until the value of "user_id"
     is resolved. The resulting dictionary returns:
 
-        "trust.trustor_user_id": "the user_id of the `primary` credential"
+        "trust.trustor_user_id": "the user_id of the `os_primary` credential"
 
-    :param test_obj: type BaseTestCase (tempest base test class)
-    :param extra_target_data: dictionary with unresolved string literals that
-        reference nested BaseTestCase attributes
-    :returns: dictionary containing additional object data needed by
-        oslo.policy to validate generic checks
+    :param test_obj: An instance or subclass of `tempest.base.BaseTestCase`.
+    :param extra_target_data: Dictionary, keyed with `oslo.policy` generic
+        check names, whose values are string literals that reference nested
+        `tempest.base.BaseTestCase` attributes. Used by `oslo.policy` for
+        performing matching against attributes that are sent along with the API
+        calls.
+    :returns: Dictionary containing additional object data needed by
+        `oslo.policy` to validate generic checks.
     """
     attr_value = test_obj
     formatted_target_data = {}
diff --git a/patrole_tempest_plugin/rbac_utils.py b/patrole_tempest_plugin/rbac_utils.py
index 9d7a807..5736645 100644
--- a/patrole_tempest_plugin/rbac_utils.py
+++ b/patrole_tempest_plugin/rbac_utils.py
@@ -19,9 +19,9 @@
 import time
 
 from oslo_log import log as logging
-import oslo_utils.uuidutils as uuid_utils
-import testtools
+from oslo_utils import excutils
 
+from tempest import clients
 from tempest.common import credentials_factory as credentials
 from tempest import config
 
@@ -39,29 +39,21 @@
     seamlessly swap between admin credentials, needed for setup and clean up,
     and primary credentials, needed to perform the API call which does
     policy enforcement. The primary credentials always cycle between roles
-    defined by ``CONF.identity.admin_role`` and `CONF.rbac.rbac_test_role``.
+    defined by ``CONF.identity.admin_role`` and `CONF.patrole.rbac_test_role``.
     """
 
     def __init__(self, test_obj):
         """Constructor for ``RbacUtils``.
 
-        :param test_obj: A Tempest test instance.
-        :type test_obj: tempest.lib.base.BaseTestCase or
-            tempest.test.BaseTestCase
+        :param test_obj: An instance of `tempest.test.BaseTestCase`.
         """
-        # Since we are going to instantiate a client manager with
-        # admin credentials, first check if admin is available.
-        if not credentials.is_admin_available(
-                identity_version=test_obj.get_identity_version()):
-            msg = "Missing Identity Admin API credentials in configuration."
-            raise testtools.TestCase.skipException(msg)
-
         # Intialize the admin roles_client to perform role switching.
-        admin_creds = test_obj.get_client_manager(credential_type='admin')
+        admin_mgr = clients.Manager(
+            credentials.get_configured_admin_credentials())
         if test_obj.get_identity_version() == 'v3':
-            admin_roles_client = admin_creds.roles_v3_client
+            admin_roles_client = admin_mgr.roles_v3_client
         else:
-            admin_roles_client = admin_creds.roles_client
+            admin_roles_client = admin_mgr.roles_client
 
         self.admin_roles_client = admin_roles_client
         self.switch_role(test_obj, toggle_rbac_role=False)
@@ -80,7 +72,7 @@
 
         Switch the role used by `os_primary` credentials to:
           * admin if `toggle_rbac_role` is False
-          * `CONF.rbac.rbac_test_role` if `toggle_rbac_role` is True
+          * `CONF.patrole.rbac_test_role` if `toggle_rbac_role` is True
 
         :param test_obj: test object of type tempest.lib.base.BaseTestCase
         :param toggle_rbac_role: role to switch `os_primary` Tempest creds to
@@ -90,46 +82,69 @@
         self.token = test_obj.os_primary.auth_provider.get_token()
 
         LOG.debug('Switching role to: %s.', toggle_rbac_role)
+        role_already_present = False
+
         try:
-            if not self.admin_role_id or not self.rbac_role_id:
-                self._get_roles()
+            if not all([self.admin_role_id, self.rbac_role_id]):
+                self._get_roles_by_name()
 
             self._validate_switch_role(test_obj, toggle_rbac_role)
 
-            if toggle_rbac_role:
-                self._add_role_to_user(self.rbac_role_id)
-            else:
-                self._add_role_to_user(self.admin_role_id)
+            target_role = (
+                self.rbac_role_id if toggle_rbac_role else self.admin_role_id)
+            role_already_present = self._list_and_clear_user_roles_on_project(
+                target_role)
+
+            # Do not switch roles if `target_role` already exists.
+            if not role_already_present:
+                self._create_user_role_on_project(target_role)
         except Exception as exp:
-            LOG.exception(exp)
-            raise
+            with excutils.save_and_reraise_exception():
+                LOG.exception(exp)
         finally:
             test_obj.os_primary.auth_provider.clear_auth()
             # Fernet tokens are not subsecond aware so sleep to ensure we are
             # passing the second boundary before attempting to authenticate.
-            #
-            # FIXME(felipemonteiro): Rather than skipping sleep if the token
-            # is not uuid, this should instead be skipped if the token is not
-            # Fernet.
-            if not uuid_utils.is_uuid_like(self.token):
+            # Only sleep if a token revocation occurred as a result of role
+            # switching. This will optimize test runtime in the case where
+            # ``[identity] admin_role`` == ``[rbac] rbac_test_role``.
+            if not role_already_present:
                 time.sleep(1)
             test_obj.os_primary.auth_provider.set_auth()
 
-    def _add_role_to_user(self, role_id):
-        role_already_present = self._clear_user_roles(role_id)
-        if role_already_present:
-            return
+    def _get_roles_by_name(self):
+        available_roles = self.admin_roles_client.list_roles()
+        admin_role_id = rbac_role_id = None
 
+        for role in available_roles['roles']:
+            if role['name'] == CONF.patrole.rbac_test_role:
+                rbac_role_id = role['id']
+            if role['name'] == CONF.identity.admin_role:
+                admin_role_id = role['id']
+
+        if not all([admin_role_id, rbac_role_id]):
+            msg = ("Roles defined by `[patrole] rbac_test_role` and "
+                   "`[identity] admin_role` must be defined in the system.")
+            raise rbac_exceptions.RbacResourceSetupFailed(msg)
+
+        self.admin_role_id = admin_role_id
+        self.rbac_role_id = rbac_role_id
+
+    def _create_user_role_on_project(self, role_id):
         self.admin_roles_client.create_user_role_on_project(
             self.project_id, self.user_id, role_id)
 
-    def _clear_user_roles(self, role_id):
+    def _list_and_clear_user_roles_on_project(self, role_id):
         roles = self.admin_roles_client.list_user_roles_on_project(
             self.project_id, self.user_id)['roles']
-
-        # If the user already has the role that is required, return early.
         role_ids = [role['id'] for role in roles]
-        if role_ids == [role_id]:
+
+        # NOTE(felipemonteiro): We do not use ``role_id in role_ids`` here to
+        # avoid over-permission errors: if the current list of roles on the
+        # project includes "admin" and "Member", and we are switching to the
+        # "Member" role, then we must delete the "admin" role. Thus, we only
+        # return early if the user's roles on the project are an exact match.
+        if [role_id] == role_ids:
             return True
 
         for role in roles:
@@ -139,11 +154,11 @@
         return False
 
     def _validate_switch_role(self, test_obj, toggle_rbac_role):
-        """Validates that the rbac role passed to `switch_role` is legal.
+        """Validates that the test role passed to `switch_role` is legal.
 
         Throws an error for the following improper usages of `switch_role`:
             * `switch_role` is not called with a boolean value
-            * `switch_role` is never called in a test file, except in tearDown
+            * `switch_role` is never called inside a test, except in tearDown
             * `switch_role` is called with the same boolean value twice
 
         If a `skipException` is thrown then this is a legitimate reason why
@@ -151,7 +166,7 @@
         """
         if not isinstance(toggle_rbac_role, bool):
             raise rbac_exceptions.RbacResourceSetupFailed(
-                'toggle_rbac_role must be a boolean value.')
+                '`toggle_rbac_role` must be a boolean value.')
 
         # The unique key is the combination of module path plus class name.
         class_name = test_obj.__name__ if isinstance(test_obj, type) else \
@@ -181,7 +196,7 @@
         admin_role_id = rbac_role_id = None
 
         for role in available_roles['roles']:
-            if role['name'] == CONF.rbac.rbac_test_role:
+            if role['name'] == CONF.patrole.rbac_test_role:
                 rbac_role_id = role['id']
             if role['name'] == CONF.identity.admin_role:
                 admin_role_id = role['id']
@@ -195,13 +210,13 @@
         self.admin_role_id = admin_role_id
         self.rbac_role_id = rbac_role_id
 
-    @property
-    def is_admin(self):
-        """Verifies whether the current test role equals the admin role.
 
-        :returns: True if ``rbac_test_role`` is the admin role.
-        """
-        return CONF.rbac.rbac_test_role == CONF.identity.admin_role
+def is_admin():
+    """Verifies whether the current test role equals the admin role.
+
+    :returns: True if ``rbac_test_role`` is the admin role.
+    """
+    return CONF.patrole.rbac_test_role == CONF.identity.admin_role
 
 
 @six.add_metaclass(abc.ABCMeta)
diff --git a/patrole_tempest_plugin/tests/api/compute/rbac_base.py b/patrole_tempest_plugin/tests/api/compute/rbac_base.py
index 7e9a402..3807ae9 100644
--- a/patrole_tempest_plugin/tests/api/compute/rbac_base.py
+++ b/patrole_tempest_plugin/tests/api/compute/rbac_base.py
@@ -26,7 +26,7 @@
     @classmethod
     def skip_checks(cls):
         super(BaseV2ComputeRbacTest, cls).skip_checks()
-        if not CONF.rbac.enable_rbac:
+        if not CONF.patrole.enable_rbac:
             raise cls.skipException(
                 '%s skipped as RBAC testing not enabled' % cls.__name__)
 
diff --git a/patrole_tempest_plugin/tests/api/compute/test_agents_rbac.py b/patrole_tempest_plugin/tests/api/compute/test_agents_rbac.py
index f355358..4712ed0 100644
--- a/patrole_tempest_plugin/tests/api/compute/test_agents_rbac.py
+++ b/patrole_tempest_plugin/tests/api/compute/test_agents_rbac.py
@@ -13,6 +13,8 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+from tempest.lib.common.utils import data_utils
+from tempest.lib.common.utils import test_utils
 from tempest.lib import decorators
 from tempest import test
 
@@ -29,6 +31,16 @@
             raise cls.skipException(
                 '%s skipped as os-agents not enabled' % cls.__name__)
 
+    def _param_helper(self, **kwargs):
+        rand_key = 'architecture'
+        if rand_key in kwargs:
+            # NOTE: The rand_name is for avoiding agent conflicts.
+            # If you try to create an agent with the same hypervisor,
+            # os and architecture as an existing agent, Nova will return
+            # an HTTPConflict or HTTPServerError.
+            kwargs[rand_key] = data_utils.rand_name(kwargs[rand_key])
+        return kwargs
+
     @rbac_rule_validation.action(
         service="nova", rule="os_compute_api:os-agents")
     @decorators.idempotent_id('d1bc6d97-07f5-4f45-ac29-1c619a6a7e27')
@@ -48,3 +60,41 @@
         body = self.agents_client.create_agent(**params)['agent']
         self.addCleanup(self.agents_client.delete_agent,
                         body['agent_id'])
+
+    @rbac_rule_validation.action(
+        service="nova",
+        rule="os_compute_api:os-agents")
+    @decorators.idempotent_id('b22f2681-9ffb-439b-b240-dae503e41020')
+    def test_update_agent(self):
+        params = self._param_helper(
+            hypervisor='common', os='linux',
+            architecture='x86_64', version='7.0',
+            url='xxx://xxxx/xxx/xxx',
+            md5hash='add6bb58e139be103324d04d82d8f545')
+        body = self.agents_client.create_agent(**params)['agent']
+        self.addCleanup(self.agents_client.delete_agent,
+                        body['agent_id'])
+
+        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+        update_params = self._param_helper(
+            version='8.0',
+            url='xxx://xxxx/xxx/xxx2',
+            md5hash='add6bb58e139be103324d04d82d8f547')
+        self.agents_client.update_agent(body['agent_id'], **update_params)
+
+    @rbac_rule_validation.action(
+        service="nova",
+        rule="os_compute_api:os-agents")
+    @decorators.idempotent_id('c5042af8-0682-43b0-abc4-bf33349e23dd')
+    def test_delete_agent(self):
+        params = self._param_helper(
+            hypervisor='common', os='linux',
+            architecture='x86_64', version='7.0',
+            url='xxx://xxxx/xxx/xxx',
+            md5hash='add6bb58e139be103324d04d82d8f545')
+        body = self.agents_client.create_agent(**params)['agent']
+        self.addCleanup(test_utils.call_and_ignore_notfound_exc,
+                        self.agents_client.delete_agent,
+                        body['agent_id'])
+        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+        self.agents_client.delete_agent(body['agent_id'])
diff --git a/patrole_tempest_plugin/tests/api/compute/test_server_actions_rbac.py b/patrole_tempest_plugin/tests/api/compute/test_server_actions_rbac.py
index cb32eec..aeefebf 100644
--- a/patrole_tempest_plugin/tests/api/compute/test_server_actions_rbac.py
+++ b/patrole_tempest_plugin/tests/api/compute/test_server_actions_rbac.py
@@ -322,7 +322,7 @@
 
     # This class has test case(s) that requires at least microversion 2.16.
     # See the following link for details:
-    # http://developer.openstack.org/api-ref-compute-v2.1.html#show-server-details
+    # https://developer.openstack.org/api-ref/compute/#show-server-details
     min_microversion = '2.16'
     max_microversion = 'latest'
 
@@ -340,6 +340,5 @@
         server = self.servers_client.show_server(self.server_id)['server']
 
         if 'host_status' not in server:
-            LOG.info("host_status attribute not returned when role doesn't "
-                     "have permission to access it.")
-            raise rbac_exceptions.RbacActionFailed
+            raise rbac_exceptions.RbacMalformedResponse(
+                attribute='host_status')
diff --git a/patrole_tempest_plugin/tests/api/compute/test_server_misc_policy_actions_rbac.py b/patrole_tempest_plugin/tests/api/compute/test_server_misc_policy_actions_rbac.py
index e942f08..b1956c2 100644
--- a/patrole_tempest_plugin/tests/api/compute/test_server_misc_policy_actions_rbac.py
+++ b/patrole_tempest_plugin/tests/api/compute/test_server_misc_policy_actions_rbac.py
@@ -137,8 +137,8 @@
         body = self.servers_client.list_servers(detail=True)['servers']
         # If the first server contains "config_drive", then all the others do.
         if 'config_drive' not in body[0]:
-            raise rbac_exceptions.RbacActionFailed(
-                '"config_drive" attribute not found in response body.')
+            raise rbac_exceptions.RbacMalformedResponse(
+                attribute='config_drive')
 
     @test.requires_ext(extension='os-config-drive', service='compute')
     @decorators.idempotent_id('55c62ef7-b72b-4970-acc6-05b0a4316e5d')
@@ -150,8 +150,8 @@
         self.rbac_utils.switch_role(self, toggle_rbac_role=True)
         body = self.servers_client.show_server(self.server['id'])['server']
         if 'config_drive' not in body:
-            raise rbac_exceptions.RbacActionFailed(
-                '"config_drive" attribute not found in response body.')
+            raise rbac_exceptions.RbacMalformedResponse(
+                attribute="config_drive")
 
     @test.requires_ext(extension='os-deferred-delete', service='compute')
     @decorators.idempotent_id('189bfed4-1e6d-475c-bb8c-d57e60895391')
@@ -192,14 +192,47 @@
             self.server['id'], request_id)['instanceAction']
 
         if 'events' not in instance_action:
-            raise rbac_exceptions.RbacActionFailed(
-                '"%s" attribute not found in response body.' % 'events')
+            raise rbac_exceptions.RbacMalformedResponse(
+                attribute='events')
         # Microversion 2.51+ returns 'events' always, but not 'traceback'. If
         # 'traceback' is also present then policy enforcement passed.
         if 'traceback' not in instance_action['events'][0]:
-            raise rbac_exceptions.RbacActionFailed(
-                '"%s" attribute not found in response body.'
-                % 'events.traceback')
+            raise rbac_exceptions.RbacMalformedResponse(
+                attribute='events.traceback')
+
+    @decorators.idempotent_id('82053c27-3134-4003-9b55-bc9fafdb0e3b')
+    @test.requires_ext(extension='OS-EXT-STS', service='compute')
+    @rbac_rule_validation.action(
+        service="nova",
+        rule="os_compute_api:os-extended-status")
+    def test_list_servers_extended_status(self):
+        """Test list servers with extended properties in response body."""
+        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+        body = self.servers_client.list_servers(detail=True)['servers']
+
+        expected_attrs = ('OS-EXT-STS:task_state', 'OS-EXT-STS:vm_state',
+                          'OS-EXT-STS:power_state')
+        for attr in expected_attrs:
+            if attr not in body[0]:
+                raise rbac_exceptions.RbacMalformedResponse(
+                    attribute=attr)
+
+    @decorators.idempotent_id('7d2620a5-eea1-4a8b-96ea-86ad77a73fc8')
+    @test.requires_ext(extension='OS-EXT-STS', service='compute')
+    @rbac_rule_validation.action(
+        service="nova",
+        rule="os_compute_api:os-extended-status")
+    def test_show_server_extended_status(self):
+        """Test show server with extended properties in response body."""
+        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+        body = self.servers_client.show_server(self.server['id'])['server']
+
+        expected_attrs = ('OS-EXT-STS:task_state', 'OS-EXT-STS:vm_state',
+                          'OS-EXT-STS:power_state')
+        for attr in expected_attrs:
+            if attr not in body:
+                raise rbac_exceptions.RbacMalformedResponse(
+                    attribute=attr)
 
     @rbac_rule_validation.action(
         service="nova",
diff --git a/patrole_tempest_plugin/tests/api/compute/test_server_rbac.py b/patrole_tempest_plugin/tests/api/compute/test_server_rbac.py
index 5539221..10ea801 100644
--- a/patrole_tempest_plugin/tests/api/compute/test_server_rbac.py
+++ b/patrole_tempest_plugin/tests/api/compute/test_server_rbac.py
@@ -184,7 +184,7 @@
             # Some other policy may have blocked it.
             LOG.info("ServerFault exception caught. Some other policy "
                      "blocked updating of server")
-            raise rbac_exceptions.RbacActionFailed(e)
+            raise rbac_exceptions.RbacConflictingPolicies(e)
 
 
 class SecurtiyGroupsRbacTest(base.BaseV2ComputeRbacTest):
diff --git a/patrole_tempest_plugin/tests/api/compute/test_server_volume_attachments_rbac.py b/patrole_tempest_plugin/tests/api/compute/test_server_volume_attachments_rbac.py
index 943cb69..65d9edb 100644
--- a/patrole_tempest_plugin/tests/api/compute/test_server_volume_attachments_rbac.py
+++ b/patrole_tempest_plugin/tests/api/compute/test_server_volume_attachments_rbac.py
@@ -97,6 +97,7 @@
                         self.servers_client.detach_volume,
                         self.server['id'], alt_volume['id'])
 
+    @decorators.attr(type='slow')
     @rbac_rule_validation.action(
         service="nova",
         rule="os_compute_api:os-volumes-attachments:delete")
diff --git a/patrole_tempest_plugin/tests/api/identity/rbac_base.py b/patrole_tempest_plugin/tests/api/identity/rbac_base.py
index 8ee80c6..51daf96 100644
--- a/patrole_tempest_plugin/tests/api/identity/rbac_base.py
+++ b/patrole_tempest_plugin/tests/api/identity/rbac_base.py
@@ -31,7 +31,7 @@
     @classmethod
     def skip_checks(cls):
         super(BaseIdentityV2RbacTest, cls).skip_checks()
-        if not CONF.rbac.enable_rbac:
+        if not CONF.patrole.enable_rbac:
             raise cls.skipException(
                 "%s skipped as RBAC testing not enabled" % cls.__name__)
 
diff --git a/patrole_tempest_plugin/tests/api/identity/v2/test_projects_rbac.py b/patrole_tempest_plugin/tests/api/identity/v2/test_projects_rbac.py
index e733e26..db1f6e6 100644
--- a/patrole_tempest_plugin/tests/api/identity/v2/test_projects_rbac.py
+++ b/patrole_tempest_plugin/tests/api/identity/v2/test_projects_rbac.py
@@ -18,6 +18,7 @@
 
 from patrole_tempest_plugin import rbac_exceptions
 from patrole_tempest_plugin import rbac_rule_validation
+from patrole_tempest_plugin import rbac_utils
 from patrole_tempest_plugin.tests.api.identity import rbac_base
 
 CONF = config.CONF
@@ -112,7 +113,7 @@
         admin-scoped tenants, raise ``RbacActionFailed`` exception otherwise.
         """
         tenants_client = self.os_admin.tenants_client if \
-            self.rbac_utils.is_admin else self.os_primary.tenants_client
+            rbac_utils.is_admin() else self.os_primary.tenants_client
         admin_tenant_id = self.os_admin.credentials.project_id
         non_admin_tenant_id = self.os_primary.credentials.project_id
 
@@ -121,10 +122,8 @@
 
         tenant_ids = [t['id'] for t in tenants]
         if admin_tenant_id not in tenant_ids:
-            raise rbac_exceptions.RbacActionFailed(
-                "The admin tenant id was not returned by the call to "
-                "``list_tenants``.")
+            raise rbac_exceptions.RbacMalformedResponse(
+                attribute="admin tenant id")
         if non_admin_tenant_id in tenant_ids:
-            raise rbac_exceptions.RbacActionFailed(
-                "The non-admin tenant id was returned by the call to "
-                "``list_tenants``.")
+            raise rbac_exceptions.RbacMalformedResponse(
+                extra_attr=True)
diff --git a/patrole_tempest_plugin/tests/api/identity/v3/test_tokens_negative_rbac.py b/patrole_tempest_plugin/tests/api/identity/v3/test_tokens_negative_rbac.py
index 90952a8..18e5bf1 100644
--- a/patrole_tempest_plugin/tests/api/identity/v3/test_tokens_negative_rbac.py
+++ b/patrole_tempest_plugin/tests/api/identity/v3/test_tokens_negative_rbac.py
@@ -18,6 +18,7 @@
 from tempest.lib import exceptions as lib_exc
 
 from patrole_tempest_plugin import rbac_rule_validation
+from patrole_tempest_plugin import rbac_utils
 from patrole_tempest_plugin.tests.api.identity import rbac_base
 
 CONF = config.CONF
@@ -31,8 +32,8 @@
     def skip_checks(cls):
         super(IdentityTokenV3RbacTest, cls).skip_checks()
         # In case of admin, the positive testcase would be used, hence
-        # skipping negative testcase
-        if CONF.rbac.rbac_test_role == CONF.identity.admin_role:
+        # skipping negative testcase.
+        if rbac_utils.is_admin():
             raise cls.skipException(
                 "Skipped as admin role doesn't require negative testing")
 
diff --git a/patrole_tempest_plugin/tests/api/image/rbac_base.py b/patrole_tempest_plugin/tests/api/image/rbac_base.py
index e49e2f6..dd4e5ed 100644
--- a/patrole_tempest_plugin/tests/api/image/rbac_base.py
+++ b/patrole_tempest_plugin/tests/api/image/rbac_base.py
@@ -24,7 +24,7 @@
     @classmethod
     def skip_checks(cls):
         super(BaseV1ImageRbacTest, cls).skip_checks()
-        if not CONF.rbac.enable_rbac:
+        if not CONF.patrole.enable_rbac:
             raise cls.skipException(
                 "%s skipped as RBAC testing not enabled" % cls.__name__)
 
@@ -39,7 +39,7 @@
     @classmethod
     def skip_checks(cls):
         super(BaseV2ImageRbacTest, cls).skip_checks()
-        if not CONF.rbac.enable_rbac:
+        if not CONF.patrole.enable_rbac:
             raise cls.skipException(
                 "%s skipped as RBAC testing not enabled" % cls.__name__)
 
diff --git a/patrole_tempest_plugin/tests/api/network/rbac_base.py b/patrole_tempest_plugin/tests/api/network/rbac_base.py
index 6cf0138..b495098 100644
--- a/patrole_tempest_plugin/tests/api/network/rbac_base.py
+++ b/patrole_tempest_plugin/tests/api/network/rbac_base.py
@@ -26,7 +26,7 @@
     @classmethod
     def skip_checks(cls):
         super(BaseNetworkRbacTest, cls).skip_checks()
-        if not CONF.rbac.enable_rbac:
+        if not CONF.patrole.enable_rbac:
             raise cls.skipException(
                 "%s skipped as RBAC testing not enabled" % cls.__name__)
 
diff --git a/patrole_tempest_plugin/tests/api/network/test_networks_multiprovider_rbac.py b/patrole_tempest_plugin/tests/api/network/test_networks_multiprovider_rbac.py
index 01cf0fd..9d2b67a 100644
--- a/patrole_tempest_plugin/tests/api/network/test_networks_multiprovider_rbac.py
+++ b/patrole_tempest_plugin/tests/api/network/test_networks_multiprovider_rbac.py
@@ -95,6 +95,5 @@
         if len(response_network) == 0:
             LOG.info("NotFound or Forbidden exception are not thrown when "
                      "role doesn't have access to the endpoint. Instead, "
-                     "the response will have an empty network body. "
-                     "This is irregular and should be fixed.")
-            raise rbac_exceptions.RbacActionFailed
+                     "the response will have an empty network body.")
+            raise rbac_exceptions.RbacMalformedResponse(True)
diff --git a/patrole_tempest_plugin/tests/api/network/test_networks_rbac.py b/patrole_tempest_plugin/tests/api/network/test_networks_rbac.py
index b42be93..148804e 100644
--- a/patrole_tempest_plugin/tests/api/network/test_networks_rbac.py
+++ b/patrole_tempest_plugin/tests/api/network/test_networks_rbac.py
@@ -238,7 +238,7 @@
             self.network['id'], **kwargs)['network']
 
         if len(retrieved_network) == 0:
-            raise rbac_exceptions.RbacActionFailed
+            raise rbac_exceptions.RbacMalformedResponse(True)
 
     @test.requires_ext(extension='provider', service='network')
     @rbac_rule_validation.action(service="neutron",
@@ -257,7 +257,7 @@
             self.network['id'], **kwargs)['network']
 
         if len(retrieved_network) == 0:
-            raise rbac_exceptions.RbacActionFailed
+            raise rbac_exceptions.RbacMalformedResponse(empty=True)
 
     @test.requires_ext(extension='provider', service='network')
     @rbac_rule_validation.action(service="neutron",
@@ -276,7 +276,7 @@
             self.network['id'], **kwargs)['network']
 
         if len(retrieved_network) == 0:
-            raise rbac_exceptions.RbacActionFailed
+            raise rbac_exceptions.RbacMalformedResponse(empty=True)
 
         key = retrieved_network.get('provider:segmentation_id', "NotFound")
         self.assertNotEqual(key, "NotFound")
diff --git a/patrole_tempest_plugin/tests/api/network/test_ports_rbac.py b/patrole_tempest_plugin/tests/api/network/test_ports_rbac.py
index cec860c..888f879 100644
--- a/patrole_tempest_plugin/tests/api/network/test_ports_rbac.py
+++ b/patrole_tempest_plugin/tests/api/network/test_ports_rbac.py
@@ -170,7 +170,8 @@
 
         # Rather than throwing a 403, the field is not present, so raise exc.
         if fields[0] not in retrieved_port:
-            raise rbac_exceptions.RbacActionFailed
+            raise rbac_exceptions.RbacMalformedResponse(
+                attribute='binding:vif_type')
 
     @test.requires_ext(extension='binding', service='network')
     @rbac_rule_validation.action(service="neutron",
@@ -188,7 +189,8 @@
 
         # Rather than throwing a 403, the field is not present, so raise exc.
         if fields[0] not in retrieved_port:
-            raise rbac_exceptions.RbacActionFailed
+            raise rbac_exceptions.RbacMalformedResponse(
+                attribute='binding:vif_details')
 
     @test.requires_ext(extension='binding', service='network')
     @rbac_rule_validation.action(service="neutron",
@@ -208,7 +210,8 @@
 
         # Rather than throwing a 403, the field is not present, so raise exc.
         if fields[0] not in retrieved_port:
-            raise rbac_exceptions.RbacActionFailed
+            raise rbac_exceptions.RbacMalformedResponse(
+                attribute='binding:host_id')
 
     @test.requires_ext(extension='binding', service='network')
     @rbac_rule_validation.action(service="neutron",
@@ -229,7 +232,8 @@
 
         # Rather than throwing a 403, the field is not present, so raise exc.
         if fields[0] not in retrieved_port:
-            raise rbac_exceptions.RbacActionFailed
+            raise rbac_exceptions.RbacMalformedResponse(
+                attribute='binding:profile')
 
     @rbac_rule_validation.action(service="neutron",
                                  rule="update_port")
diff --git a/patrole_tempest_plugin/tests/api/network/test_routers_rbac.py b/patrole_tempest_plugin/tests/api/network/test_routers_rbac.py
index 6aec5d1..9ed9eb6 100644
--- a/patrole_tempest_plugin/tests/api/network/test_routers_rbac.py
+++ b/patrole_tempest_plugin/tests/api/network/test_routers_rbac.py
@@ -173,8 +173,8 @@
 
         # Rather than throwing a 403, the field is not present, so raise exc.
         if 'distributed' not in retrieved_fields:
-            raise rbac_exceptions.RbacActionFailed(
-                '"distributed" parameter not present in response body')
+            raise rbac_exceptions.RbacMalformedResponse(
+                attribute='distributed')
 
     @rbac_rule_validation.action(
         service="neutron", rule="update_router")
diff --git a/patrole_tempest_plugin/tests/api/volume/rbac_base.py b/patrole_tempest_plugin/tests/api/volume/rbac_base.py
index 4d3b612..c43c552 100644
--- a/patrole_tempest_plugin/tests/api/volume/rbac_base.py
+++ b/patrole_tempest_plugin/tests/api/volume/rbac_base.py
@@ -26,7 +26,7 @@
     @classmethod
     def skip_checks(cls):
         super(BaseVolumeRbacTest, cls).skip_checks()
-        if not CONF.rbac.enable_rbac:
+        if not CONF.patrole.enable_rbac:
             raise cls.skipException(
                 "%s skipped as RBAC testing not enabled" % cls.__name__)
 
diff --git a/patrole_tempest_plugin/tests/api/volume/test_groups_rbac.py b/patrole_tempest_plugin/tests/api/volume/test_groups_rbac.py
index 6b07aaa..20f20a5 100644
--- a/patrole_tempest_plugin/tests/api/volume/test_groups_rbac.py
+++ b/patrole_tempest_plugin/tests/api/volume/test_groups_rbac.py
@@ -90,6 +90,18 @@
         self.rbac_utils.switch_role(self, toggle_rbac_role=True)
         self.groups_client.list_groups(detail=True)['groups']
 
+    @decorators.idempotent_id('f499fc48-df83-4917-bf8d-783ebf6f080b')
+    @rbac_rule_validation.action(
+        service="cinder",
+        rule="group:update")
+    def test_update_group(self):
+        group = self._create_group(group_type=self.group_type_id,
+                                   volume_types=[self.volume_type_id])
+        updated_name = data_utils.rand_name(self.__class__.__name__ + '-Group')
+
+        self.rbac_utils.switch_role(self, toggle_rbac_role=True)
+        self.groups_client.update_group(group['id'], name=updated_name)
+
     @decorators.idempotent_id('66fda391-5774-42a9-a018-80b34e57ab76')
     @rbac_rule_validation.action(
         service="cinder",
@@ -128,9 +140,8 @@
         group_type = self.create_group_type(ignore_notfound=True)
 
         if 'group_specs' not in group_type:
-            raise rbac_exceptions.RbacActionFailed(
-                'Policy %s does not return %s in response body.' %
-                ('group:access_group_types_specs', 'group_specs'))
+            raise rbac_exceptions.RbacMalformedResponse(
+                attribute='group_specs')
 
     @decorators.idempotent_id('f77f8156-4fc9-4f02-be15-8930f748e10c')
     @rbac_rule_validation.action(
diff --git a/patrole_tempest_plugin/tests/api/volume/test_volumes_backup_rbac.py b/patrole_tempest_plugin/tests/api/volume/test_volumes_backup_rbac.py
index a734e58..7eb1cf0 100644
--- a/patrole_tempest_plugin/tests/api/volume/test_volumes_backup_rbac.py
+++ b/patrole_tempest_plugin/tests/api/volume/test_volumes_backup_rbac.py
@@ -90,6 +90,7 @@
         self.rbac_utils.switch_role(self, toggle_rbac_role=True)
         self.backups_client.list_backups(detail=True)
 
+    @decorators.attr(type='slow')
     @decorators.idempotent_id('50f43bde-205e-438e-9a05-5eac07fc3d63')
     @rbac_rule_validation.action(
         service="cinder",
diff --git a/patrole_tempest_plugin/tests/unit/fixtures.py b/patrole_tempest_plugin/tests/unit/fixtures.py
index f25e05d..9d53eb9 100644
--- a/patrole_tempest_plugin/tests/unit/fixtures.py
+++ b/patrole_tempest_plugin/tests/unit/fixtures.py
@@ -19,6 +19,8 @@
 import fixtures
 import mock
 
+from tempest import clients
+from tempest.common import credentials_factory as credentials
 from tempest import config
 
 from patrole_tempest_plugin import rbac_utils
@@ -53,19 +55,15 @@
 
 
 class RbacUtilsFixture(fixtures.Fixture):
-    """Fixture for RbacUtils class."""
+    """Fixture for `RbacUtils` class."""
 
     USER_ID = mock.sentinel.user_id
     PROJECT_ID = mock.sentinel.project_id
 
-    def __init__(self, **kwargs):
-        super(RbacUtilsFixture, self).__init__()
-        self.available_roles = None
-
     def setUp(self):
         super(RbacUtilsFixture, self).setUp()
 
-        self.useFixture(ConfPatcher(rbac_test_role='member', group='rbac'))
+        self.useFixture(ConfPatcher(rbac_test_role='member', group='patrole'))
         self.useFixture(ConfPatcher(
             admin_role='admin', auth_version='v3', group='identity'))
 
@@ -76,34 +74,62 @@
             'get_identity_version.return_value': 'v3'
         }
         self.mock_test_obj = mock.Mock(**test_obj_kwargs)
-        self.mock_time = mock.patch.object(rbac_utils, 'time').start()
 
-        self.roles_v3_client = (
-            self.mock_test_obj.get_client_manager.return_value.roles_v3_client)
+        # Mock out functionality that can't be used by unit tests.
+        self.mock_time = mock.patch.object(rbac_utils, 'time').start()
+        mock.patch.object(
+            credentials, 'get_configured_admin_credentials').start()
+        mock_admin_mgr = mock.patch.object(clients, 'Manager').start()
+        self.roles_v3_client = mock_admin_mgr.return_value.roles_v3_client
+
+        self.set_roles(['admin', 'member'], [])
 
     def switch_role(self, *role_toggles):
         """Instantiate `rbac_utils.RbacUtils` and call `switch_role`.
 
         Create an instance of `rbac_utils.RbacUtils` and call `switch_role`
         for each boolean value in `role_toggles`. The number of calls to
-        `switch_role` is always 1 + len(role_toggles) because the
+        `switch_role` is always 1 + len(`role_toggles`) because the
         `rbac_utils.RbacUtils` constructor automatically calls `switch_role`.
 
         :param role_toggles: the list of boolean values iterated over and
             passed to `switch_role`.
         """
-        if not self.available_roles:
-            self.set_roles('admin', 'member')
-
         self.fake_rbac_utils = rbac_utils.RbacUtils(self.mock_test_obj)
+
         for role_toggle in role_toggles:
             self.fake_rbac_utils.switch_role(self.mock_test_obj, role_toggle)
+            # NOTE(felipemonteiro): Simulate that a role switch has occurred
+            # by updating the user's current role to the new role. This means
+            # that all API actions involved during a role switch -- listing,
+            # deleting and adding roles -- are executed, making it easier to
+            # assert that mock calls were called as expected.
+            new_role = 'member' if role_toggle else 'admin'
+            self.set_roles(['admin', 'member'], [new_role])
 
-    def set_roles(self, *roles):
-        """Set the list of available roles in the system to `roles`."""
-        self.available_roles = {
+    def set_roles(self, roles, roles_on_project=None):
+        """Set the list of available roles in the system.
+
+        :param roles: List of roles returned by ``list_roles``.
+        :param roles_on_project: List of roles returned by
+            ``list_user_roles_on_project``.
+        :returns: None.
+        """
+        if not roles_on_project:
+            roles_on_project = []
+        if not isinstance(roles, list):
+            roles = [roles]
+        if not isinstance(roles_on_project, list):
+            roles_on_project = [roles_on_project]
+
+        available_roles = {
             'roles': [{'name': role, 'id': '%s_id' % role} for role in roles]
         }
-        self.roles_v3_client.list_user_roles_on_project.return_value =\
-            self.available_roles
-        self.roles_v3_client.list_roles.return_value = self.available_roles
+        available_project_roles = {
+            'roles': [{'name': role, 'id': '%s_id' % role}
+                      for role in roles_on_project]
+        }
+
+        self.roles_v3_client.list_roles.return_value = available_roles
+        self.roles_v3_client.list_user_roles_on_project.return_value = (
+            available_project_roles)
diff --git a/patrole_tempest_plugin/tests/unit/test_patrole.py b/patrole_tempest_plugin/tests/unit/test_patrole.py
index 58aff05..9b8e88c 100644
--- a/patrole_tempest_plugin/tests/unit/test_patrole.py
+++ b/patrole_tempest_plugin/tests/unit/test_patrole.py
@@ -14,16 +14,23 @@
 # under the License.
 
 """
-test_patrole
-----------------------------------
-
 Tests for `patrole` module.
 """
 
+from tempest import config
+
 from patrole_tempest_plugin.tests.unit import base
 
+CONF = config.CONF
+
 
 class TestPatrole(base.TestCase):
 
-    def test_something(self):
-        pass
+    def test_rbac_group_backwards_compatability(self):
+        """Validate that the deprecated group [rbac] is available and has the
+        same options and option values as [patrole] group, which is current.
+        """
+        self.assertTrue(hasattr(CONF, 'patrole'))
+        self.assertTrue(hasattr(CONF, 'rbac'))
+        # Validate that both groups are identical.
+        self.assertEqual(CONF.patrole.items(), CONF.rbac.items())
diff --git a/patrole_tempest_plugin/tests/unit/test_rbac_policy_parser.py b/patrole_tempest_plugin/tests/unit/test_rbac_policy_parser.py
index 7ce925a..6f173a2 100644
--- a/patrole_tempest_plugin/tests/unit/test_rbac_policy_parser.py
+++ b/patrole_tempest_plugin/tests/unit/test_rbac_policy_parser.py
@@ -40,11 +40,11 @@
 
     def setUp(self):
         super(RbacPolicyTest, self).setUp()
-
-        m_creds = self.patchobject(rbac_policy_parser, 'credentials')
-        m_creds.AdminManager().identity_services_client.list_services.\
+        self.patchobject(rbac_policy_parser, 'credentials')
+        m_creds = self.patchobject(rbac_policy_parser, 'clients')
+        m_creds.Manager().identity_services_client.list_services.\
             return_value = self.services
-        m_creds.AdminManager().identity_services_v3_client.list_services.\
+        m_creds.Manager().identity_services_v3_client.list_services.\
             return_value = self.services
 
         current_directory = os.path.dirname(os.path.realpath(__file__))
@@ -64,9 +64,9 @@
             current_directory, 'resources', '%s.json')
 
         CONF.set_override(
-            'custom_policy_files', [self.conf_policy_path], group='rbac')
+            'custom_policy_files', [self.conf_policy_path], group='patrole')
         self.addCleanup(CONF.clear_override, 'custom_policy_files',
-                        group='rbac')
+                        group='patrole')
 
         # Guarantee a blank slate for each test.
         for attr in ('available_services', 'policy_files'):
@@ -393,7 +393,7 @@
             'Policy file for {0} service neither found in code '\
             'nor at {1}.'.format(
                 'test_service',
-                [CONF.rbac.custom_policy_files[0] % 'test_service'])
+                [CONF.patrole.custom_policy_files[0] % 'test_service'])
 
         self.assertIn(expected_error, str(e))
 
@@ -439,7 +439,7 @@
 
         expected_error = (
             'Policy file for {0} service neither found in code nor at {1}.'
-            .format('tenant_rbac_policy', [CONF.rbac.custom_policy_files[0]
+            .format('tenant_rbac_policy', [CONF.patrole.custom_policy_files[0]
                                            % 'tenant_rbac_policy']))
         self.assertIn(expected_error, str(e))
 
@@ -458,7 +458,7 @@
     @mock.patch.object(rbac_policy_parser, 'policy', autospec=True)
     @mock.patch.object(rbac_policy_parser.RbacPolicyParser, '_get_policy_data',
                        autospec=True)
-    @mock.patch.object(rbac_policy_parser, 'credentials', autospec=True)
+    @mock.patch.object(rbac_policy_parser, 'clients', autospec=True)
     @mock.patch.object(rbac_policy_parser, 'os', autospec=True)
     def test_discover_policy_files_with_many_invalid_one_valid(self, m_os,
                                                                m_creds, *args):
@@ -466,14 +466,14 @@
         m_os.path.isfile.side_effect = [False, False, True, False]
 
         # Ensure the outer for loop runs only once in `discover_policy_files`.
-        m_creds.AdminManager().identity_services_v3_client.\
+        m_creds.Manager().identity_services_v3_client.\
             list_services.return_value = {
                 'services': [{'name': 'test_service'}]}
 
         # The expected policy will be 'baz/test_service'.
         CONF.set_override(
             'custom_policy_files', ['foo/%s', 'bar/%s', 'baz/%s'],
-            group='rbac')
+            group='patrole')
 
         policy_parser = rbac_policy_parser.RbacPolicyParser(
             None, None, 'test_service')
@@ -504,10 +504,10 @@
 
     def _test_validate_service(self, v2_services, v3_services,
                                expected_failure=False, expected_services=None):
-        with mock.patch.object(rbac_policy_parser, 'credentials') as m_creds:
-            m_creds.AdminManager().identity_services_client.list_services.\
+        with mock.patch.object(rbac_policy_parser, 'clients') as m_creds:
+            m_creds.Manager().identity_services_client.list_services.\
                 return_value = v2_services
-            m_creds.AdminManager().identity_services_v3_client.list_services.\
+            m_creds.Manager().identity_services_v3_client.list_services.\
                 return_value = v3_services
 
         test_tenant_id = mock.sentinel.tenant_id
diff --git a/patrole_tempest_plugin/tests/unit/test_rbac_rule_validation.py b/patrole_tempest_plugin/tests/unit/test_rbac_rule_validation.py
index 7ce5548..8a69ff6 100644
--- a/patrole_tempest_plugin/tests/unit/test_rbac_rule_validation.py
+++ b/patrole_tempest_plugin/tests/unit/test_rbac_rule_validation.py
@@ -37,8 +37,8 @@
         self.mock_args.os_primary.credentials.user_id = \
             mock.sentinel.user_id
 
-        CONF.set_override('rbac_test_role', 'Member', group='rbac')
-        self.addCleanup(CONF.clear_override, 'rbac_test_role', group='rbac')
+        CONF.set_override('rbac_test_role', 'Member', group='patrole')
+        self.addCleanup(CONF.clear_override, 'rbac_test_role', group='patrole')
 
     @mock.patch.object(rbac_rv, 'LOG', autospec=True)
     @mock.patch.object(rbac_rv, 'rbac_policy_parser', autospec=True)
@@ -108,16 +108,17 @@
 
     @mock.patch.object(rbac_rv, 'LOG', autospec=True)
     @mock.patch.object(rbac_rv, 'rbac_policy_parser', autospec=True)
-    def test_rule_validation_rbac_action_failed_positive(self, mock_policy,
-                                                         mock_log):
-        """Test RbacActionFailed error is thrown without permission passes.
+    def test_rule_validation_rbac_malformed_response_positive(self,
+                                                              mock_policy,
+                                                              mock_log):
+        """Test RbacMalformedResponse error is thrown without permission passes.
 
-        Positive test case: if RbacActionFailed is thrown and the user is not
-        allowed to perform the action, then this is a success.
+        Positive test case: if RbacMalformedResponse is thrown and the user is
+        not allowed to perform the action, then this is a success.
         """
         decorator = rbac_rv.action(mock.sentinel.service, mock.sentinel.action)
         mock_function = mock.Mock()
-        mock_function.side_effect = rbac_exceptions.RbacActionFailed
+        mock_function.side_effect = rbac_exceptions.RbacMalformedResponse
         wrapper = decorator(mock_function)
 
         mock_policy.RbacPolicyParser.return_value.allowed.return_value = False
@@ -130,16 +131,65 @@
 
     @mock.patch.object(rbac_rv, 'LOG', autospec=True)
     @mock.patch.object(rbac_rv, 'rbac_policy_parser', autospec=True)
-    def test_rule_validation_rbac_action_failed_negative(self, mock_policy,
-                                                         mock_log):
-        """Test RbacActionFailed error is thrown with permission fails.
+    def test_rule_validation_rbac_malformed_response_negative(self,
+                                                              mock_policy,
+                                                              mock_log):
+        """Test RbacMalformedResponse error is thrown with permission fails.
 
-        Negative test case: if RbacActionFailed is thrown and the user is
+        Negative test case: if RbacMalformedResponse is thrown and the user is
         allowed to perform the action, then this is an expected failure.
         """
         decorator = rbac_rv.action(mock.sentinel.service, mock.sentinel.action)
         mock_function = mock.Mock()
-        mock_function.side_effect = rbac_exceptions.RbacActionFailed
+        mock_function.side_effect = rbac_exceptions.RbacMalformedResponse
+        wrapper = decorator(mock_function)
+
+        mock_policy.RbacPolicyParser.return_value.allowed.return_value = True
+
+        e = self.assertRaises(exceptions.Forbidden, wrapper, self.mock_args)
+        self.assertIn(
+            "Role Member was not allowed to perform sentinel.action.",
+            e.__str__())
+
+        mock_log.error.assert_called_once_with("Role Member was not allowed to"
+                                               " perform sentinel.action.")
+
+    @mock.patch.object(rbac_rv, 'LOG', autospec=True)
+    @mock.patch.object(rbac_rv, 'rbac_policy_parser', autospec=True)
+    def test_rule_validation_rbac_conflicting_policies_positive(self,
+                                                                mock_policy,
+                                                                mock_log):
+        """Test RbacConflictingPolicies error is thrown without permission passes.
+
+        Positive test case: if RbacConflictingPolicies is thrown and the user
+        is not allowed to perform the action, then this is a success.
+        """
+        decorator = rbac_rv.action(mock.sentinel.service, mock.sentinel.action)
+        mock_function = mock.Mock()
+        mock_function.side_effect = rbac_exceptions.RbacConflictingPolicies
+        wrapper = decorator(mock_function)
+
+        mock_policy.RbacPolicyParser.return_value.allowed.return_value = False
+
+        result = wrapper(self.mock_args)
+
+        self.assertIsNone(result)
+        mock_log.error.assert_not_called()
+        mock_log.warning.assert_not_called()
+
+    @mock.patch.object(rbac_rv, 'LOG', autospec=True)
+    @mock.patch.object(rbac_rv, 'rbac_policy_parser', autospec=True)
+    def test_rule_validation_rbac_conflicting_policies_negative(self,
+                                                                mock_policy,
+                                                                mock_log):
+        """Test RbacConflictingPolicies error is thrown with permission fails.
+
+        Negative test case: if RbacConflictingPolicies is thrown and the user
+        is allowed to perform the action, then this is an expected failure.
+        """
+        decorator = rbac_rv.action(mock.sentinel.service, mock.sentinel.action)
+        mock_function = mock.Mock()
+        mock_function.side_effect = rbac_exceptions.RbacConflictingPolicies
         wrapper = decorator(mock_function)
 
         mock_policy.RbacPolicyParser.return_value.allowed.return_value = True
@@ -260,9 +310,9 @@
     def test_invalid_policy_rule_throws_parsing_exception(
             self, mock_rbac_policy_parser):
         """Test that invalid policy action causes test to be skipped."""
-        CONF.set_override('strict_policy_check', True, group='rbac')
+        CONF.set_override('strict_policy_check', True, group='patrole')
         self.addCleanup(CONF.clear_override, 'strict_policy_check',
-                        group='rbac')
+                        group='patrole')
 
         mock_rbac_policy_parser.RbacPolicyParser.return_value.allowed.\
             side_effect = rbac_exceptions.RbacParsingException
diff --git a/patrole_tempest_plugin/tests/unit/test_rbac_utils.py b/patrole_tempest_plugin/tests/unit/test_rbac_utils.py
index 79503b1..87adff0 100644
--- a/patrole_tempest_plugin/tests/unit/test_rbac_utils.py
+++ b/patrole_tempest_plugin/tests/unit/test_rbac_utils.py
@@ -34,17 +34,19 @@
 
     def test_switch_role_with_missing_admin_role(self):
         self.rbac_utils.set_roles('member')
-        e = self.assertRaises(rbac_exceptions.RbacResourceSetupFailed,
-                              self.rbac_utils.switch_role, True)
-        self.assertIn("Role with name 'admin' does not exist in the system.",
-                      e.__str__())
+        error_re = (
+            'Roles defined by `\[patrole\] rbac_test_role` and `\[identity\] '
+            'admin_role` must be defined in the system.')
+        self.assertRaisesRegex(rbac_exceptions.RbacResourceSetupFailed,
+                               error_re, self.rbac_utils.switch_role)
 
     def test_switch_role_with_missing_rbac_role(self):
         self.rbac_utils.set_roles('admin')
-        e = self.assertRaises(rbac_exceptions.RbacResourceSetupFailed,
-                              self.rbac_utils.switch_role, True)
-        self.assertIn("Role defined by rbac_test_role does not exist in the "
-                      "system.", e.__str__())
+        error_re = (
+            'Roles defined by `\[patrole\] rbac_test_role` and `\[identity\] '
+            'admin_role` must be defined in the system.')
+        self.assertRaisesRegex(rbac_exceptions.RbacResourceSetupFailed,
+                               error_re, self.rbac_utils.switch_role)
 
     def test_switch_role_to_admin_role(self):
         self.rbac_utils.switch_role()
@@ -61,6 +63,16 @@
             .assert_called_once_with()
         mock_time.sleep.assert_called_once_with(1)
 
+    def test_switch_role_to_admin_role_avoids_role_switch(self):
+        self.rbac_utils.set_roles(['admin', 'member'], 'admin')
+        self.rbac_utils.switch_role()
+
+        roles_client = self.rbac_utils.roles_v3_client
+        mock_time = self.rbac_utils.mock_time
+
+        roles_client.create_user_role_on_project.assert_not_called()
+        mock_time.sleep.assert_not_called()
+
     def test_switch_role_to_member_role(self):
         self.rbac_utils.switch_role(True)
 
@@ -80,6 +92,19 @@
             [mock.call()] * 2)
         mock_time.sleep.assert_has_calls([mock.call(1)] * 2)
 
+    def test_switch_role_to_member_role_avoids_role_switch(self):
+        self.rbac_utils.set_roles(['admin', 'member'], 'member')
+        self.rbac_utils.switch_role(True)
+
+        roles_client = self.rbac_utils.roles_v3_client
+        mock_time = self.rbac_utils.mock_time
+
+        roles_client.create_user_role_on_project.assert_has_calls([
+            mock.call(self.rbac_utils.PROJECT_ID, self.rbac_utils.USER_ID,
+                      'admin_id')
+        ])
+        mock_time.sleep.assert_called_once_with(1)
+
     def test_switch_role_to_member_role_then_admin_role(self):
         self.rbac_utils.switch_role(True, False)
 
@@ -137,19 +162,22 @@
         self.assertIn(expected_error_message, str(e))
 
     def test_clear_user_roles(self):
-        self.rbac_utils.switch_role(True)
+        # NOTE(felipemonteiro): Set the user's roles on the project to
+        # include 'random' to coerce a role switch, or else it will be
+        # skipped.
+        self.rbac_utils.set_roles(['admin', 'member'], ['member', 'random'])
+        self.rbac_utils.switch_role()
 
         roles_client = self.rbac_utils.roles_v3_client
 
-        roles_client.list_user_roles_on_project.assert_has_calls([
-            mock.call(self.rbac_utils.PROJECT_ID, self.rbac_utils.USER_ID)
-        ] * 2)
+        roles_client.list_user_roles_on_project.assert_called_once_with(
+            self.rbac_utils.PROJECT_ID, self.rbac_utils.USER_ID)
         roles_client.delete_role_from_user_on_project.\
             assert_has_calls([
                 mock.call(mock.sentinel.project_id, mock.sentinel.user_id,
-                          'admin_id'),
+                          'member_id'),
                 mock.call(mock.sentinel.project_id, mock.sentinel.user_id,
-                          'member_id')] * 2)
+                          'random_id')])
 
     @mock.patch.object(rbac_utils, 'LOG', autospec=True)
     @mock.patch.object(rbac_utils, 'sys', autospec=True)
diff --git a/releasenotes/notes/agents-ca4a5e232ce242a5.yaml b/releasenotes/notes/agents-ca4a5e232ce242a5.yaml
new file mode 100644
index 0000000..3cd9646
--- /dev/null
+++ b/releasenotes/notes/agents-ca4a5e232ce242a5.yaml
@@ -0,0 +1,5 @@
+---
+features:
+  - |
+    Added tests to test_agents_rbac.py for PUT and
+    DELETE endpoints.
diff --git a/releasenotes/notes/deprecate-rbac-group-148e222913dc74cc.yaml b/releasenotes/notes/deprecate-rbac-group-148e222913dc74cc.yaml
new file mode 100644
index 0000000..1b1a5ac
--- /dev/null
+++ b/releasenotes/notes/deprecate-rbac-group-148e222913dc74cc.yaml
@@ -0,0 +1,6 @@
+---
+deprecations:
+  - |
+    The ``[rbac]`` configuration group has been deprecated and will be removed
+    in the next release. Use ``[patrole]`` group instead, which has the exact
+    same options.
diff --git a/releasenotes/notes/rbac-tests-for-compute-extended-status-ef00256e58b66223.yaml b/releasenotes/notes/rbac-tests-for-compute-extended-status-ef00256e58b66223.yaml
new file mode 100644
index 0000000..6cf82e6
--- /dev/null
+++ b/releasenotes/notes/rbac-tests-for-compute-extended-status-ef00256e58b66223.yaml
@@ -0,0 +1,11 @@
+---
+features:
+  - |
+    Add RBAC tests for os_compute_api:os-extended-status, which validate that
+    the following attributes:
+
+        - OS-EXT-STS:task_state
+        - OS-EXT-STS:vm_state
+        - OS-EXT-STS:power_state
+
+    are present in the relevant response bodies.
diff --git a/releasenotes/notes/update-group-volume-test-06c7475ccbe36aa8.yaml b/releasenotes/notes/update-group-volume-test-06c7475ccbe36aa8.yaml
new file mode 100644
index 0000000..77cf196
--- /dev/null
+++ b/releasenotes/notes/update-group-volume-test-06c7475ccbe36aa8.yaml
@@ -0,0 +1,5 @@
+---
+features:
+  - |
+    Add test for updating a volume group, providing coverage for group:update
+    policy action.
diff --git a/test-requirements.txt b/test-requirements.txt
index 8a97494..772694e 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -5,9 +5,9 @@
 
 sphinx>=1.6.2 # BSD
 openstackdocstheme>=1.16.0 # Apache-2.0
-reno!=2.3.1,>=1.8.0 # Apache-2.0
+reno>=2.5.0 # Apache-2.0
 fixtures>=3.0.0 # Apache-2.0/BSD
-mock>=2.0 # BSD
+mock>=2.0.0 # BSD
 coverage!=4.4,>=4.0 # Apache-2.0
 nose # LGPL
 nosexcover # BSD
diff --git a/test-whitelist.txt b/test-whitelist.txt
deleted file mode 100644
index 162992a..0000000
--- a/test-whitelist.txt
+++ /dev/null
@@ -1 +0,0 @@
-patrole_tempest_plugin.tests.unit.test*
diff --git a/tox.ini b/tox.ini
index d2e83e9..f1b5b86 100644
--- a/tox.ini
+++ b/tox.ini
@@ -8,6 +8,9 @@
 install_command = pip install -c{env:UPPER_CONSTRAINTS_FILE:https://git.openstack.org/cgit/openstack/requirements/plain/upper-constraints.txt} {opts} {packages}
 setenv =
    VIRTUAL_ENV={envdir}
+   OS_TEST_PATH=./patrole_tempest_plugin/tests/unit
+   LANGUAGE=en_US
+   LC_ALL=en_US.utf-8
    PYTHONWARNINGS=default::DeprecationWarning
 passenv = OS_STDOUT_CAPTURE OS_STDERR_CAPTURE OS_TEST_TIMEOUT OS_TEST_LOCK_PATH OS_TEST_PATH http_proxy HTTP_PROXY https_proxy HTTPS_PROXY no_proxy NO_PROXY
 whitelist_externals = find
@@ -15,7 +18,7 @@
        -r{toxinidir}/test-requirements.txt
 commands =
     find . -type f -name "*.pyc" -delete
-    ostestr {posargs} --whitelist-file test-whitelist.txt
+    ostestr {posargs}
 
 [testenv:pep8]
 commands = flake8 {posargs}
@@ -56,7 +59,11 @@
 enable-extensions = H106,H203,H904
 show-source = True
 # E123, E125 skipped as they are invalid PEP-8.
-ignore = E123,E125
+#
+# H405 is another one that is good as a guideline, but sometimes
+# multiline doc strings just don't have a natural summary
+# line. Rejecting code for this reason is wrong.
+ignore = E123,E125,H405
 builtins = _
 exclude=.venv,.git,.tox,dist,doc,*lib/python*,*egg,build