'Determine if rescoping is allowed based on the token model.
:param token_model_ref: `keystone.models.token.KeystoneToken` object.'

def _restrict_scope(self, token_model_ref):

    if token_model_ref.trust_scoped:
        raise exception.Forbidden()
    if (not CONF.token.allow_rescope_scoped_token):
        if (token_model_ref.project_scoped or token_model_ref.domain_scoped):
            raise exception.Forbidden(action=_('rescope    a    scoped    token'))
