When a bag is GET or PUT as JSON the following form is used:

{
    "desc": "decription of the bag (may be be an empty string or absent)",
    "policy": {
        "read": [],
        "write": [],
        "create": [],
        "delete": [],
        "manage": [],
        "owner": ""
    }
}

The policy may be an empty dict but the key must be present. The desc is optional.

See: How can I use curl to create stuff in TiddlyWeb?