diff --git a/contrib/post_test_hook.sh b/contrib/post_test_hook.sh
new file mode 100644
index 0000000..ea4b5e3
--- /dev/null
+++ b/contrib/post_test_hook.sh
@@ -0,0 +1,60 @@
+#!/bin/bash -xe
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+# This script is executed inside post_test_hook function in devstack gate.
+# First argument ($1) expects 'rbac-role' as value for setting appropriate
+# tempest rbac option 'rbac_test_role'.
+
+# Install pip manually.
+PATROLE_DIR=$BASE/new/patrole
+sudo pip install -e $PATROLE_DIR
+
+# Allow tempest.conf to be modified by Jenkins.
+sudo chown -R jenkins:stack $BASE/new/tempest
+sudo chown -R jenkins:stack $BASE/data/tempest
+
+TEMPEST_CONFIG=$BASE/new/tempest/etc/tempest.conf
+TEMPEST_COMMAND="sudo -H -u tempest tox"
+DEVSTACK_GATE_TEMPEST_REGEX="(^patrole_tempest_plugin\.tests\.api)"
+
+# Import devstack function 'iniset'.
+source $BASE/new/devstack/functions
+
+# First argument is expected to contain value equal either to 'admin' or
+# 'member' (both lower-case).
+RBAC_ROLE=$1
+
+if [[ "$RBAC_ROLE" == "member" ]]; then
+    RBAC_ROLE="Member"
+fi
+
+# Set rbac_flag=True under [rbac] section in tempest.conf
+iniset $TEMPEST_CONFIG rbac rbac_flag True
+# Set rbac_test_role=$RBAC_ROLE under [rbac] section in tempest.conf
+iniset $TEMPEST_CONFIG rbac rbac_test_role $RBAC_ROLE
+# Set additional, necessary CONF values
+iniset $TEMPEST_CONFIG auth use_dynamic_credentials True
+iniset $TEMPEST_CONFIG auth tempest_roles Member
+
+# Give permissions back to Tempest.
+sudo chown -R tempest:stack $BASE/new/tempest
+sudo chown -R tempest:stack $BASE/data/tempest
+
+set -o errexit
+
+# cd into Tempest directory before executing tox.
+cd $BASE/new/tempest
+
+$TEMPEST_COMMAND -eall-plugin -- $DEVSTACK_GATE_TEMPEST_REGEX --concurrency=$TEMPEST_CONCURRENCY
+sudo -H -u tempest .tox/all-plugin/bin/tempest list-plugins
diff --git a/contrib/pre_test_hook.sh b/contrib/pre_test_hook.sh
index 65d1801..ffa4c20 100755
--- a/contrib/pre_test_hook.sh
+++ b/contrib/pre_test_hook.sh
@@ -12,28 +12,8 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-# This script is executed inside post_test_hook function in devstack gate.
-# First argument ($1) expects 'rbac-role' as value for setting appropriate
-# tempest rbac option 'rbac_test_role'.
+# This script is executed inside pre_test_hook function in devstack gate.
+# Installs patrole tempest plugin manually.
 
-sudo chown -R jenkins:stack $BASE/new/tempest
-sudo chown -R jenkins:stack $BASE/data/tempest
-
-# Import devstack function 'iniset'
-source $BASE/new/devstack/functions
-
-export TEMPEST_CONFIG=${TEMPEST_CONFIG:-$BASE/new/tempest/etc/tempest.conf}
-
-# First argument is expected to contain value equal either to 'admin' or
-# 'member' (both lower-case).
-RBAC_ROLE=$1
-
-if [[ "$RBAC_ROLE" == "member" ]]; then
-    $RBAC_ROLE = "Member"
-fi
-
-# Set rbac_flag=True under [rbac] section in tempest.conf
-iniset $TEMPEST_CONFIG rbac rbac_flag True
-
-# Set rbac_test_role=$RBAC_ROLE under [rbac] section in tempest.conf
-iniset $TEMPEST_CONFIG rbac rbac_test_role $RBAC_ROLE
+PATROLE_DIR=$BASE/new/patrole
+sudo pip install -e $PATROLE_DIR
diff --git a/patrole_tempest_plugin/tests/api/compute/test_server_actions_rbac.py b/patrole_tempest_plugin/tests/api/compute/test_server_actions_rbac.py
index c4b44e7..4b86210 100644
--- a/patrole_tempest_plugin/tests/api/compute/test_server_actions_rbac.py
+++ b/patrole_tempest_plugin/tests/api/compute/test_server_actions_rbac.py
@@ -13,9 +13,12 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import testtools
+
 from tempest.common import waiters
 from tempest import config
 from tempest.lib import decorators
+from tempest.lib import exceptions as lib_exc
 
 from patrole_tempest_plugin import rbac_rule_validation
 from patrole_tempest_plugin.tests.api.compute import rbac_base
@@ -25,10 +28,6 @@
 
 class ServerActionsRbacTest(rbac_base.BaseV2ComputeRbacTest):
 
-    def tearDown(self):
-        self.rbac_utils.switch_role(self, switchToRbacRole=False)
-        super(ServerActionsRbacTest, self).tearDown()
-
     @classmethod
     def setup_clients(cls):
         super(ServerActionsRbacTest, cls).setup_clients()
@@ -37,13 +36,6 @@
     @classmethod
     def skip_checks(cls):
         super(ServerActionsRbacTest, cls).skip_checks()
-        if not CONF.compute_feature_enabled.api_extensions:
-            raise cls.skipException(
-                '%s skipped as no compute extensions enabled' % cls.__name__)
-        if not CONF.compute_feature_enabled.interface_attach:
-            raise cls.skipException(
-                '%s skipped as interface attachment is not available'
-                % cls.__name__)
 
     @classmethod
     def resource_setup(cls):
@@ -51,6 +43,30 @@
         super(ServerActionsRbacTest, cls).resource_setup()
         cls.server_id = cls.create_test_server(wait_until='ACTIVE',
                                                validatable=True)['id']
+        cls.flavor_ref = CONF.compute.flavor_ref
+        cls.flavor_ref_alt = CONF.compute.flavor_ref_alt
+        cls.image_ref = CONF.compute.image_ref
+
+    def setUp(self):
+        super(ServerActionsRbacTest, self).setUp()
+        try:
+            waiters.wait_for_server_status(self.client,
+                                           self.server_id, 'ACTIVE')
+        except lib_exc.NotFound:
+            # if the server was found to be deleted by a previous test,
+            # a new one is built
+            server = self.create_test_server(
+                validatable=True,
+                wait_until='ACTIVE')
+            self.__class__.server_id = server['id']
+        except Exception:
+            # Rebuilding the server in case something happened during a test
+            self.__class__.server_id = self.rebuild_server(
+                self.server_id, validatable=True)
+
+    def tearDown(self):
+        self.rbac_utils.switch_role(self, switchToRbacRole=False)
+        super(ServerActionsRbacTest, self).tearDown()
 
     def _test_start_server(self):
         self.client.start_server(self.server_id)
@@ -62,6 +78,21 @@
         waiters.wait_for_server_status(self.client, self.server_id,
                                        'SHUTOFF')
 
+    def _test_resize_server(self, flavor):
+        self.client.resize_server(self.server_id, flavor)
+        waiters.wait_for_server_status(self.client, self.server_id,
+                                       'VERIFY_RESIZE')
+
+    def _test_revert_resize_server(self):
+        self.client.revert_resize_server(self.server_id)
+        waiters.wait_for_server_status(self.client, self.server_id,
+                                       'ACTIVE')
+
+    def _test_confirm_resize_server(self):
+        self.client.confirm_resize_server(self.server_id)
+        waiters.wait_for_server_status(self.client, self.server_id,
+                                       'ACTIVE')
+
     @rbac_rule_validation.action(
         service="nova",
         rule="os_compute_api:servers:stop")
@@ -78,3 +109,59 @@
         self._test_stop_server()
         self.rbac_utils.switch_role(self, switchToRbacRole=True)
         self._test_start_server()
+
+    @rbac_rule_validation.action(
+        service="nova",
+        rule="os_compute_api:servers:resize")
+    @decorators.idempotent_id('0546fbdd-2d8f-4ce8-ac00-f1e2129d0765')
+    @testtools.skipUnless(CONF.compute_feature_enabled.resize,
+                          'Resize is not available.')
+    def test_resize_server(self):
+        self.rbac_utils.switch_role(self, switchToRbacRole=True)
+        self._test_resize_server(self.flavor_ref_alt)
+
+    @rbac_rule_validation.action(
+        service="nova",
+        rule="os_compute_api:servers:revert_resize")
+    @decorators.idempotent_id('d41b64b8-a72d-414a-a4c5-94e1eb5e5a96')
+    @testtools.skipUnless(CONF.compute_feature_enabled.resize,
+                          'Resize is not available.')
+    def test_revert_resize_server(self):
+        self._test_resize_server(self.flavor_ref_alt)
+        self.rbac_utils.switch_role(self, switchToRbacRole=True)
+        self._test_revert_resize_server()
+
+    @rbac_rule_validation.action(
+        service="nova",
+        rule="os_compute_api:servers:confirm_resize")
+    @decorators.idempotent_id('f51620cb-dfcb-4e5d-b421-2e0edaa1316e')
+    @testtools.skipUnless(CONF.compute_feature_enabled.resize,
+                          'Resize is not available.')
+    def test_confirm_resize_server(self):
+        self._test_resize_server(self.flavor_ref_alt)
+        self.rbac_utils.switch_role(self, switchToRbacRole=True)
+        self.addCleanup(
+            lambda: (self._test_resize_server(self.flavor_ref),
+                     self._test_confirm_resize_server())
+        )
+        self._test_confirm_resize_server()
+
+    @rbac_rule_validation.action(
+        service="nova",
+        rule="os_compute_api:servers:rebuild")
+    @decorators.idempotent_id('54b1a30b-c96c-472c-9c83-ccaf6ec7e20b')
+    def test_rebuild_server(self):
+        self.rbac_utils.switch_role(self, switchToRbacRole=True)
+        self.client.rebuild_server(self.server_id, self.image_ref)
+        waiters.wait_for_server_status(self.client, self.server_id,
+                                       'ACTIVE')
+
+    @rbac_rule_validation.action(
+        service="nova",
+        rule="os_compute_api:servers:reboot")
+    @decorators.idempotent_id('19f27856-56e1-44f8-8615-7257f6b85cbb')
+    def test_reboot_server(self):
+        self.rbac_utils.switch_role(self, switchToRbacRole=True)
+        self.client.reboot_server(self.server_id, type='HARD')
+        waiters.wait_for_server_status(self.client, self.server_id,
+                                       'ACTIVE')
diff --git a/patrole_tempest_plugin/tests/api/compute/test_server_volume_attachments_rbac.py b/patrole_tempest_plugin/tests/api/compute/test_server_volume_attachments_rbac.py
index 8f96110..4e85fbe 100644
--- a/patrole_tempest_plugin/tests/api/compute/test_server_volume_attachments_rbac.py
+++ b/patrole_tempest_plugin/tests/api/compute/test_server_volume_attachments_rbac.py
@@ -35,96 +35,77 @@
     @classmethod
     def skip_checks(cls):
         super(ServerVolumeAttachmentRbacTest, cls).skip_checks()
-        if not CONF.compute_feature_enabled.api_extensions:
-            raise cls.skipException(
-                '%s skipped as no compute extensions enabled' % cls.__name__)
+        if not CONF.service_available.cinder:
+            skip_msg = ("%s skipped as Cinder is not available" % cls.__name__)
+            raise cls.skipException(skip_msg)
 
     @classmethod
     def resource_setup(cls):
         super(ServerVolumeAttachmentRbacTest, cls).resource_setup()
         cls.server = cls.create_test_server(wait_until='ACTIVE')
-
-    @classmethod
-    def resource_cleanup(cls):
-        test_utils.call_and_ignore_notfound_exc(cls.delete_server,
-                                                cls.server['id'])
-        super(ServerVolumeAttachmentRbacTest, cls).resource_cleanup()
+        cls.volume = cls.create_volume()
 
     def tearDown(self):
         self.rbac_utils.switch_role(self, switchToRbacRole=False)
         super(ServerVolumeAttachmentRbacTest, self).tearDown()
 
-    def _create_and_attach(self):
-        self.volume = self.create_volume()
-        self.attachment = self._attach(self.server, self.volume)
-
-    def _attach(self, server, volume):
-        attachment = self.client.attach_volume(
-            server['id'],
-            volumeId=volume['id'])['volumeAttachment']
-        self.addCleanup(test_utils.call_and_ignore_notfound_exc,
-                        self._detach, server['id'], volume['id'])
-        waiters.wait_for_volume_status(self.volumes_client, volume['id'],
-                                       'in-use')
-        return attachment
-
-    def _detach(self, server_id, volume_id):
-        # For test_update_volume_attachment, an addCleanup is called with
-        # a stale volume, because a new volume is attached, so only detach
-        # the new volume to avoid a bad request error.
-        if hasattr(self, 'volume') and self.volume['id'] == volume_id:
-            self.client.detach_volume(server_id, volume_id)
-            waiters.wait_for_volume_status(self.volumes_client, volume_id,
-                                           'available')
-
     @rbac_rule_validation.action(
         service="nova",
         rule="os_compute_api:os-volumes-attachments:index")
     @decorators.idempotent_id('529b668b-6edb-41d5-8886-d7dbd0614678')
     def test_list_volume_attachments(self):
         self.rbac_utils.switch_role(self, switchToRbacRole=True)
-        self.client.list_volume_attachments(self.server['id'])
-        ['volumeAttachments']
+        self.client.list_volume_attachments(self.server['id'])[
+            'volumeAttachments']
 
     @rbac_rule_validation.action(
         service="nova",
         rule="os_compute_api:os-volumes-attachments:create")
     @decorators.idempotent_id('21c2c3fd-fbe8-41b1-8ef8-115ec47d54c1')
     def test_create_volume_attachment(self):
-        self.volume = self.create_volume()
         self.rbac_utils.switch_role(self, switchToRbacRole=True)
-        self._attach(self.server, self.volume)
+        self.attach_volume(self.server, self.volume)
 
     @rbac_rule_validation.action(
         service="nova",
         rule="os_compute_api:os-volumes-attachments:show")
     @decorators.idempotent_id('997df9c2-6e54-47b6-ab74-e4fdb500f385')
     def test_show_volume_attachment(self):
-        self._create_and_attach()
+        attachment = self.attach_volume(self.server, self.volume)
         self.rbac_utils.switch_role(self, switchToRbacRole=True)
         self.client.show_volume_attachment(
-            self.server['id'], self.attachment['id'])
+            self.server['id'], attachment['id'])
 
     @rbac_rule_validation.action(
         service="nova",
         rule="os_compute_api:os-volumes-attachments:update")
     @decorators.idempotent_id('bd667186-eca6-4b78-ab6a-3e2fabcb971f')
     def test_update_volume_attachment(self):
-        self._create_and_attach()
-        self.volume = self.create_volume()
+        attachment = self.attach_volume(self.server, self.volume)
+        alt_volume = self.create_volume()
         self.rbac_utils.switch_role(self, switchToRbacRole=True)
         self.client.update_attached_volume(
-            self.server['id'], self.attachment['id'],
-            volumeId=self.volume['id'])
-        self.addCleanup(self._detach, self.server['id'], self.volume['id'])
-        waiters.wait_for_volume_status(self.volumes_client, self.volume['id'],
-                                       'in-use')
+            self.server['id'], attachment['id'], volumeId=alt_volume['id'])
+        waiters.wait_for_volume_resource_status(self.volumes_client,
+                                                alt_volume['id'], 'in-use')
+        # On teardown detach the volume and wait for it to be available. This
+        # is so we don't error out when trying to delete the volume during
+        # teardown.
+        self.addCleanup(waiters.wait_for_volume_resource_status,
+                        self.volumes_client, alt_volume['id'], 'available')
+        # Ignore 404s on detach in case the server is deleted or the volume
+        # is already detached.
+        self.addCleanup(test_utils.call_and_ignore_notfound_exc,
+                        self.servers_client.detach_volume,
+                        self.server['id'], alt_volume['id'])
 
     @rbac_rule_validation.action(
         service="nova",
         rule="os_compute_api:os-volumes-attachments:delete")
     @decorators.idempotent_id('12b03e90-d087-46af-9c4d-507d021c4984')
     def test_delete_volume_attachment(self):
-        self._create_and_attach()
+        self.attach_volume(self.server, self.volume)
         self.rbac_utils.switch_role(self, switchToRbacRole=True)
-        self._detach(self.server['id'], self.volume['id'])
+        self.client.detach_volume(self.server['id'], self.volume['id'])
+        waiters.wait_for_volume_resource_status(self.volumes_client,
+                                                self.volume['id'], 'available')
diff --git a/patrole_tempest_plugin/tests/api/identity/v3/test_credentials_rbac.py b/patrole_tempest_plugin/tests/api/identity/v3/test_credentials_rbac.py
index d51fecb..a563784 100644
--- a/patrole_tempest_plugin/tests/api/identity/v3/test_credentials_rbac.py
+++ b/patrole_tempest_plugin/tests/api/identity/v3/test_credentials_rbac.py
@@ -13,7 +13,7 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-from tempest.common.utils import data_utils
+from tempest.lib.common.utils import data_utils
 from tempest.lib.common.utils import test_utils
 from tempest.lib import decorators
 
diff --git a/patrole_tempest_plugin/tests/api/identity/v3/test_endpoints_rbac.py b/patrole_tempest_plugin/tests/api/identity/v3/test_endpoints_rbac.py
index 11b0064..dbdf8dc 100644
--- a/patrole_tempest_plugin/tests/api/identity/v3/test_endpoints_rbac.py
+++ b/patrole_tempest_plugin/tests/api/identity/v3/test_endpoints_rbac.py
@@ -13,8 +13,8 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-from tempest.common.utils import data_utils
 from tempest import config
+from tempest.lib.common.utils import data_utils
 from tempest.lib.common.utils import test_utils
 from tempest.lib import decorators
 
diff --git a/patrole_tempest_plugin/tests/api/identity/v3/test_groups_rbac.py b/patrole_tempest_plugin/tests/api/identity/v3/test_groups_rbac.py
index a9c998a..16e2dce 100644
--- a/patrole_tempest_plugin/tests/api/identity/v3/test_groups_rbac.py
+++ b/patrole_tempest_plugin/tests/api/identity/v3/test_groups_rbac.py
@@ -13,8 +13,8 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-from tempest.common.utils import data_utils
 from tempest import config
+from tempest.lib.common.utils import data_utils
 from tempest.lib.common.utils import test_utils
 from tempest.lib import decorators
 
diff --git a/patrole_tempest_plugin/tests/api/identity/v3/test_projects_rbac.py b/patrole_tempest_plugin/tests/api/identity/v3/test_projects_rbac.py
index 9d6467c..a00569d 100644
--- a/patrole_tempest_plugin/tests/api/identity/v3/test_projects_rbac.py
+++ b/patrole_tempest_plugin/tests/api/identity/v3/test_projects_rbac.py
@@ -13,8 +13,8 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-from tempest.common.utils import data_utils
 from tempest import config
+from tempest.lib.common.utils import data_utils
 from tempest.lib import decorators
 
 from patrole_tempest_plugin import rbac_rule_validation
diff --git a/patrole_tempest_plugin/tests/api/identity/v3/test_services_rbac.py b/patrole_tempest_plugin/tests/api/identity/v3/test_services_rbac.py
index e431216..42d0028 100644
--- a/patrole_tempest_plugin/tests/api/identity/v3/test_services_rbac.py
+++ b/patrole_tempest_plugin/tests/api/identity/v3/test_services_rbac.py
@@ -13,8 +13,8 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-from tempest.common.utils import data_utils
 from tempest import config
+from tempest.lib.common.utils import data_utils
 from tempest.lib import decorators
 
 from patrole_tempest_plugin import rbac_rule_validation
diff --git a/patrole_tempest_plugin/tests/api/network/test_networks_multiprovider_rbac.py b/patrole_tempest_plugin/tests/api/network/test_networks_multiprovider_rbac.py
new file mode 100644
index 0000000..99552e0
--- /dev/null
+++ b/patrole_tempest_plugin/tests/api/network/test_networks_multiprovider_rbac.py
@@ -0,0 +1,104 @@
+# Copyright 2017 AT&T Corporation.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from oslo_log import log
+from tempest.lib.common.utils import data_utils
+from tempest.lib.common.utils import test_utils
+from tempest.lib import decorators
+from tempest import test
+
+from patrole_tempest_plugin import rbac_exceptions
+from patrole_tempest_plugin import rbac_rule_validation
+from patrole_tempest_plugin.tests.api.network import rbac_base as base
+
+LOG = log.getLogger(__name__)
+
+
+class NetworksMultiProviderRbacTest(base.BaseNetworkRbacTest):
+
+    @classmethod
+    def skip_checks(cls):
+        super(NetworksMultiProviderRbacTest, cls).skip_checks()
+        if not test.is_extension_enabled('multi-provider', 'network'):
+            msg = "multi-provider extension not enabled."
+            raise cls.skipException(msg)
+
+    def tearDown(self):
+        self.rbac_utils.switch_role(self, switchToRbacRole=False)
+        super(NetworksMultiProviderRbacTest, self).tearDown()
+
+    def _create_network_segments(self):
+        segments = [{"provider:network_type": "gre"},
+                    {"provider:network_type": "gre"}]
+
+        body = self.networks_client.create_network(
+            name=data_utils.rand_name(self.__class__.__name__),
+            segments=segments)
+        network = body['network']
+        self.addCleanup(test_utils.call_and_ignore_notfound_exc,
+                        self.networks_client.delete_network,
+                        network['id'])
+        return network
+
+    @rbac_rule_validation.action(service="neutron",
+                                 rule="create_network:segments")
+    @decorators.idempotent_id('9e1d0c3d-92e3-40e3-855e-bfbb72ea6e0b')
+    def test_create_network_segments(self):
+        """Create network with segments.
+
+        RBAC test for the neutron create_network:segments policy
+        """
+        self.rbac_utils.switch_role(self, switchToRbacRole=True)
+        self._create_network_segments()
+
+    @rbac_rule_validation.action(service="neutron",
+                                 rule="update_network:segments")
+    @decorators.idempotent_id('0f45232a-7b59-4bb1-9a91-db77d0a8cc9b')
+    def test_update_network_segments(self):
+        """Update network segments.
+
+        RBAC test for the neutron update_network:segments policy
+        """
+        network = self._create_network_segments()
+        new_segments = [{"provider:network_type": "gre"}]
+
+        self.rbac_utils.switch_role(self, switchToRbacRole=True)
+        self.networks_client.update_network(network['id'],
+                                            segments=new_segments)
+
+    @rbac_rule_validation.action(service="neutron",
+                                 rule="get_network:segments")
+    @decorators.idempotent_id('094ff9b7-0c3b-4515-b19b-b9d2031337bd')
+    def test_show_network_segments(self):
+        """Show network segments.
+
+        RBAC test for the neutron get_network:segments policy
+        """
+        network = self._create_network_segments()
+
+        self.rbac_utils.switch_role(self, switchToRbacRole=True)
+        body = self.networks_client.show_network(network['id'],
+                                                 fields='segments')
+        response_network = body['network']
+
+        # If user does not have access to the network segments attribute,
+        # no NotFound or Forbidden exception are thrown.  Instead,
+        # the response will have an empty network body only.
+        if len(response_network) == 0:
+            LOG.info("NotFound or Forbidden exception are not thrown when "
+                     "role doesn't have access to the endpoint. Instead, "
+                     "the response will have an empty network body. "
+                     "This is irregular and should be fixed.")
+            raise rbac_exceptions.RbacActionFailed
diff --git a/patrole_tempest_plugin/tests/api/orchestration/test_soft_config_rbac.py b/patrole_tempest_plugin/tests/api/orchestration/test_soft_config_rbac.py
index f0172c2..fa3840c 100644
--- a/patrole_tempest_plugin/tests/api/orchestration/test_soft_config_rbac.py
+++ b/patrole_tempest_plugin/tests/api/orchestration/test_soft_config_rbac.py
@@ -13,7 +13,7 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-from tempest.common.utils import data_utils
+from tempest.lib.common.utils import data_utils
 from tempest.lib.common.utils import test_utils
 from tempest.lib import decorators