def get_limited_to(headers, enforcer):
    """Return the user and project the request should be limited to.

    :param headers: HTTP headers dictionary
    :param enforcer: policy enforcer
    :return: A tuple of (user, project), set to None if there's no limit on
    one of these.

    """
    target = {}
    credentials = {'roles': headers.get('X-Roles', '').split(',')}
    rules = enforcer.rules.keys()
    rule_name = 'segregation' if 'segregation' in rules else 'context_is_admin'
    if not enforcer.enforce(rule_name, target, credentials):
        return headers.get('X-User-Id'), headers.get('X-Project-Id')
    return None, None
