diff --git a/nova/api/openstack/compute/console_output.py b/nova/api/openstack/compute/console_output.py
index 93285cc55c77..75727fb2f832 100644
--- a/nova/api/openstack/compute/console_output.py
+++ b/nova/api/openstack/compute/console_output.py
@@ -38,9 +38,10 @@ class ConsoleOutputController(wsgi.Controller):
     def get_console_output(self, req, id, body):
         """Get text console output."""
         context = req.environ['nova.context']
-        context.can(co_policies.BASE_POLICY_NAME)
-
         instance = common.get_instance(self.compute_api, context, id)
+        context.can(co_policies.BASE_POLICY_NAME,
+                    target={'project_id': instance.project_id})
+
         length = body['os-getConsoleOutput'].get('length')
         # TODO(cyeoh): In a future API update accept a length of -1
         # as meaning unlimited length (convert to None)
diff --git a/nova/tests/unit/api/openstack/compute/test_console_output.py b/nova/tests/unit/api/openstack/compute/test_console_output.py
index 1953b04ea8ac..30f7cf405eaa 100644
--- a/nova/tests/unit/api/openstack/compute/test_console_output.py
+++ b/nova/tests/unit/api/openstack/compute/test_console_output.py
@@ -156,6 +156,7 @@ class ConsoleOutputPolicyEnforcementV21(test.NoDBTestCase):
     def setUp(self):
         super(ConsoleOutputPolicyEnforcementV21, self).setUp()
         self.controller = console_output_v21.ConsoleOutputController()
+        self.stub_out('nova.compute.api.API.get', fake_get)
 
     def test_get_console_output_policy_failed(self):
         rule_name = "os_compute_api:os-console-output"