How do I enable keystone v3, multi domain using cloud policy to manage multiple domains

Issue

How do I enable keystone v3, multi domain using cloud policy to manage multiple domains? We'd like to achieve the following:

• Domain = represents a customer

• Project = customer project / team / department. Can be multiple inside of a domain.

• Cloud_admin = Superadmin for whole cloud across all domains. Creates domains, assigns domain quotas, etc.

• domain_admin = Admin of a customer, responsible for a single domain. Shall create new projects, assign project quotas, etc.
• project_admin = admin of a single project. Can add, remove users from his project and assign roles to them.