Open Stack

Hi stackers,
Our group are doing research on OpenStack.

One of our scenario is like this:
There are two users on cloud: user A and user B.
User A has some resources like volumes or object storage on cloud. We
hope these resource could belong to some certain user, not one tenant.
 
User A wants to verify user B and grant user B the access to user A's
resource (maybe by token, but we hope this token is not bare token and
could only be used by user B).

So does anyone have idea about it or about what part of Keystone should
we modify?

If you have any idea, I would appreciate any feedback.

Thanks,
Lichao Yin