diff --git a/patrole_tempest_plugin/rbac_rule_validation.py b/patrole_tempest_plugin/rbac_rule_validation.py
index daf03e4..97d246f 100644
--- a/patrole_tempest_plugin/rbac_rule_validation.py
+++ b/patrole_tempest_plugin/rbac_rule_validation.py
@@ -26,7 +26,6 @@
 
 from patrole_tempest_plugin import policy_authority
 from patrole_tempest_plugin import rbac_exceptions
-from patrole_tempest_plugin import rbac_utils
 from patrole_tempest_plugin import requirements_authority
 
 CONF = config.CONF
@@ -37,8 +36,7 @@
 RBACLOG = logging.getLogger('rbac_reporting')
 
 
-def action(service, rule='', admin_only=False, expected_error_code=403,
-           extra_target_data=None):
+def action(service, rule='', expected_error_code=403, extra_target_data=None):
     """A decorator for verifying OpenStack policy enforcement.
 
     A decorator which allows for positive and negative RBAC testing. Given:
@@ -77,10 +75,6 @@
 
             Patrole currently only supports custom JSON policy files.
 
-    :param admin_only: Skips over ``oslo.policy`` check because the policy
-        action defined by ``rule`` is not enforced by the service's policy
-        enforcement engine. For example, Keystone v2 performs an admin check
-        for most of its endpoints. If True, ``rule`` is effectively ignored.
     :param expected_error_code: Overrides default value of 403 (Forbidden)
         with endpoint-specific error code. Currently only supports 403 and 404.
         Support for 404 is needed because some services, like Neutron,
@@ -131,7 +125,7 @@
                     'an instance of `tempest.test.BaseTestCase`.')
 
             allowed = _is_authorized(test_obj, service, rule,
-                                     extra_target_data, admin_only)
+                                     extra_target_data)
 
             expected_exception, irregular_msg = _get_exception_type(
                 expected_error_code)
@@ -188,7 +182,7 @@
     return decorator
 
 
-def _is_authorized(test_obj, service, rule, extra_target_data, admin_only):
+def _is_authorized(test_obj, service, rule, extra_target_data):
     """Validates whether current RBAC role has permission to do policy action.
 
     :param test_obj: An instance or subclass of ``tempest.test.BaseTestCase``.
@@ -200,10 +194,6 @@
         ``tempest.test.BaseTestCase`` attributes. Used by ``oslo.policy`` for
         performing matching against attributes that are sent along with the API
         calls.
-    :param admin_only: Skips over ``oslo.policy`` check because the policy
-        action defined by ``rule`` is not enforced by the service's policy
-        enforcement engine. For example, Keystone v2 performs an admin check
-        for most of its endpoints. If True, ``rule`` is effectively ignored.
 
     :returns: True if the current RBAC role can perform the policy action,
         else False.
@@ -216,12 +206,6 @@
         the ``rule`` does not exist in the system.
     """
 
-    if admin_only:
-        LOG.info("As admin_only is True, only admin role should be "
-                 "allowed to perform the API. Skipping oslo.policy "
-                 "check for policy action {0}.".format(rule))
-        return rbac_utils.is_admin()
-
     try:
         project_id = test_obj.os_primary.credentials.project_id
         user_id = test_obj.os_primary.credentials.user_id
diff --git a/patrole_tempest_plugin/tests/api/volume/test_volume_metadata_rbac.py b/patrole_tempest_plugin/tests/api/volume/test_volume_metadata_rbac.py
index 768372f..8a50141 100644
--- a/patrole_tempest_plugin/tests/api/volume/test_volume_metadata_rbac.py
+++ b/patrole_tempest_plugin/tests/api/volume/test_volume_metadata_rbac.py
@@ -17,6 +17,7 @@
 from tempest.lib.common.utils import test_utils
 from tempest.lib import decorators
 
+from patrole_tempest_plugin import rbac_exceptions
 from patrole_tempest_plugin import rbac_rule_validation
 from patrole_tempest_plugin.tests.api.volume import rbac_base
 
@@ -31,19 +32,14 @@
         cls.volume = cls.create_volume()
         cls.image_id = CONF.compute.image_ref
 
-    def setUp(self):
-        super(VolumeMetadataV3RbacTest, self).setUp()
-        self._add_metadata(self.volume)
-
-    def tearDown(self):
-        self.volumes_client.update_volume_metadata(self.volume['id'], {})
-        super(VolumeMetadataV3RbacTest, self).tearDown()
-
     def _add_metadata(self, volume):
-        # Create metadata for the volume
+        # Create metadata for the volume.
         metadata = {"key1": "value1"}
         self.volumes_client.create_volume_metadata(
             self.volume['id'], metadata)['metadata']
+        self.addCleanup(test_utils.call_and_ignore_notfound_exc,
+                        self.volumes_client.delete_volume_metadata_item,
+                        self.volume['id'], "key1")
 
     @rbac_rule_validation.action(service="cinder",
                                  rule="volume:create_volume_metadata")
@@ -60,10 +56,22 @@
             self.volumes_client.show_volume_metadata(
                 self.volume['id'])['metadata']
 
+    @decorators.idempotent_id('5c0f4c19-b448-4f51-9224-dad5faddc3bb')
+    @rbac_rule_validation.action(service="cinder",
+                                 rule="volume:get_volume_metadata")
+    def test_show_volume_metadata_item(self):
+        self._add_metadata(self.volume)
+
+        with self.rbac_utils.override_role(self):
+            self.volumes_client.show_volume_metadata_item(
+                self.volume['id'], "key1")
+
     @rbac_rule_validation.action(service="cinder",
                                  rule="volume:delete_volume_metadata")
     @decorators.idempotent_id('7498dfc1-9db2-4423-ad20-e6dcb25d1beb')
     def test_delete_volume_metadata_item(self):
+        self._add_metadata(self.volume)
+
         with self.rbac_utils.override_role(self):
             self.volumes_client.delete_volume_metadata_item(self.volume['id'],
                                                             "key1")
@@ -72,6 +80,7 @@
                                  rule="volume:update_volume_metadata")
     @decorators.idempotent_id('8ce2ff80-99ba-49ae-9bb1-7e96729ee5af')
     def test_update_volume_metadata_item(self):
+        self._add_metadata(self.volume)
         updated_metadata_item = {"key1": "value1_update"}
         with self.rbac_utils.override_role(self):
             self.volumes_client.update_volume_metadata_item(
@@ -81,11 +90,48 @@
     @rbac_rule_validation.action(service="cinder",
                                  rule="volume:update_volume_metadata")
     def test_update_volume_metadata(self):
+        self._add_metadata(self.volume)
         updated_metadata = {"key1": "value1"}
         with self.rbac_utils.override_role(self):
             self.volumes_client.update_volume_metadata(self.volume['id'],
                                                        updated_metadata)
 
+    @decorators.idempotent_id('39e8f82c-f1fc-4905-bf47-177ce2f71bb9')
+    @rbac_rule_validation.action(
+        service="cinder",
+        rule="volume_extension:volume_image_metadata")
+    def test_list_volumes_details_image_metadata(self):
+        self.volumes_client.update_volume_image_metadata(
+            self.volume['id'], image_id=self.image_id)
+        self.addCleanup(self.volumes_client.delete_volume_image_metadata,
+                        self.volume['id'], 'image_id')
+
+        with self.rbac_utils.override_role(self):
+            resp_body = self.volumes_client.list_volumes(detail=True)[
+                'volumes']
+        expected_attr = 'volume_image_metadata'
+        if expected_attr not in resp_body[0]:
+            raise rbac_exceptions.RbacMalformedResponse(
+                attribute=expected_attr)
+
+    @decorators.idempotent_id('53f94d52-0dd5-42cf-a3a4-59b35150b3d5')
+    @rbac_rule_validation.action(
+        service="cinder",
+        rule="volume_extension:volume_image_metadata")
+    def test_show_volume_details_image_metadata(self):
+        self.volumes_client.update_volume_image_metadata(
+            self.volume['id'], image_id=self.image_id)
+        self.addCleanup(self.volumes_client.delete_volume_image_metadata,
+                        self.volume['id'], 'image_id')
+
+        with self.rbac_utils.override_role(self):
+            resp_body = self.volumes_client.show_volume(self.volume['id'])[
+                'volume']
+        expected_attr = 'volume_image_metadata'
+        if expected_attr not in resp_body:
+            raise rbac_exceptions.RbacMalformedResponse(
+                attribute=expected_attr)
+
     @decorators.idempotent_id('a9d9e825-5ea3-42e6-96f3-7ac4e97b2ed0')
     @rbac_rule_validation.action(
         service="cinder",
diff --git a/releasenotes/notes/remove-admin-only-kwarg-919f1a4797318a33.yaml b/releasenotes/notes/remove-admin-only-kwarg-919f1a4797318a33.yaml
new file mode 100644
index 0000000..21b8eb0
--- /dev/null
+++ b/releasenotes/notes/remove-admin-only-kwarg-919f1a4797318a33.yaml
@@ -0,0 +1,8 @@
+---
+upgrade:
+  - |
+    The ``admin_only`` kwarg has been removed from ``rbac_rule_validation``
+    decorator because it is no longer used by any tests. Besides that,
+    it should not be used because Patrole is dedicated to RBAC testing and
+    an admin-only check is not RBAC because it does not use ``oslo.policy``
+    library.