Open Stack

I think I am missing something on a best practice here.

I have an external 'provider' network called ext-net.
Into that i have attached via the admin-user a router called
'public-rtr' and a subnet called 'public'.

If I set 'external:True' on public, then I can use heat constructs like this:

  rtr:
    type: OS::Neutron::Router
    properties:
      admin_state_up: True
      name: 'rtr'
      external_gateway_info:
        network: "public"

but, each user needs to be 'admin'.

If I set external:False on public, I can attach instances manually to
it, but i cannot use 'external_gateway_info' to attach a router to it.

What am I supposed to do? I don't want all users to be admin, but i do
want all users to be able to attach to the network.