diff --git a/.zuul.yaml b/.zuul.yaml
index c72477c8f8..c051b2ac6d 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -47,6 +47,16 @@
       - name: openstack/stevedore
       - name: openstack/taskflow
 
+- job:
+    name: glance-tox-functional-py38-rbac-defaults
+    parent: openstack-tox-functional-py38
+    voting: false
+    description: |
+      Glance py38 functional tests with enforce_secure_rbac=True
+    vars:
+      python_version: 3.8
+      tox_envlist: functional-py38-rbac
+
 - job:
     name: glance-tox-functional-py38-oslo-tips
     parent: glance-tox-oslo-tips-base
@@ -296,6 +306,7 @@
       jobs:
         - openstack-tox-functional-py36
         - openstack-tox-functional-py38
+        - glance-tox-functional-py38-rbac-defaults
         - glance-code-constants-check
         - glance-ceph-thin-provisioning:
             voting: false
diff --git a/glance/tests/functional/__init__.py b/glance/tests/functional/__init__.py
index 4e0db981d8..c516c79e92 100644
--- a/glance/tests/functional/__init__.py
+++ b/glance/tests/functional/__init__.py
@@ -412,6 +412,10 @@ class ApiServer(Server):
         self.image_location_quota = 2
         self.disable_path = None
 
+        secure_rbac = bool(os.getenv('OS_GLANCE_TEST_RBAC_DEFAULTS'))
+        self.enforce_secure_rbac = secure_rbac
+        self.enforce_new_defaults = secure_rbac
+
         self.needs_database = True
         default_sql_connection = SQLITE_CONN_TEMPLATE % self.test_dir
         self.sql_connection = os.environ.get('GLANCE_TEST_SQL_CONNECTION',
@@ -456,9 +460,11 @@ image_location_quota=%(image_location_quota)s
 location_strategy=%(location_strategy)s
 allow_additional_image_properties = True
 node_staging_uri=%(node_staging_uri)s
+enforce_secure_rbac=%(enforce_secure_rbac)s
 [oslo_policy]
 policy_file = %(policy_file)s
 policy_default_rule = %(policy_default_rule)s
+enforce_new_defaults=%(enforce_new_defaults)s
 [paste_deploy]
 flavor = %(deployment_flavor)s
 [store_type_location_strategy]
@@ -1592,6 +1598,10 @@ class SynchronousAPIBase(test_utils.BaseTestCase):
         config.set_config_defaults()
         self.api = config.load_paste_app('glance-api',
                                          conf_file=self.paste_config)
+        secure_rbac = bool(os.getenv('OS_GLANCE_TEST_RBAC_DEFAULTS'))
+        self.config(enforce_secure_rbac=secure_rbac)
+        self.config(enforce_new_defaults=secure_rbac,
+                    group='oslo_policy')
 
     def _headers(self, custom_headers=None):
         base_headers = {
diff --git a/tox.ini b/tox.ini
index 32eca0e2c8..acd3473d06 100644
--- a/tox.ini
+++ b/tox.ini
@@ -58,6 +58,12 @@ commands = {[testenv:functional]commands}
 setenv = {[testenv:functional]setenv}
 commands = {[testenv:functional]commands}
 
+[testenv:functional-py38-rbac]
+setenv =
+  {[testenv:functional]setenv}
+  OS_GLANCE_TEST_RBAC_DEFAULTS = True
+commands = {[testenv:functional]commands}
+
 [testenv:genpolicy]
 basepython = python3
 commands =