Getting 403 from keystone as admin user.

We're getting strange 403's from keystone on the CLI when trying to list users, groups, and role assignments. Running keystone 17.0.1 on ussuri. I've looked through our policy.json... can't find anything strange. Has anyone seen this behavior? Any ideas what can be done? Thanks.