There needs to be a power user / tenant administrator / org administrator role that can add new users to their tenant, upload private glance images that are only assigned to their own tenant, create private flavors that are only assigned to their own tenant, manage image snapshots for that tenant, etc.