'Identifies attributes to exclude according to authZ policies.
Return a list of attribute names which should be stripped from the
response returned to the user because the user is not authorized
to see them.'

def _exclude_attributes_by_policy(self, context, controller, resource, collection, data):

    attributes_to_exclude = []
    for attr_name in data.keys():
        if (attr_name == 'project_id'):
            continue
        attr_data = controller.resource_info.get(attr_name)
        if (attr_data and attr_data['is_visible']):
            if policy.check(context, ('get_%s:%s' % (resource, attr_name)), data, might_not_exist=True, pluralized=collection):
                continue
        attributes_to_exclude.append(attr_name)
        if (attr_name == 'tenant_id'):
            attributes_to_exclude.append('project_id')
    return attributes_to_exclude
