A config setting which declares who or what is able to create a bag on the system. Since policies are associated with existing bags, we need a separate mechanism for controlling creation. The bag_create_policy does this. It's default value is an empty string, which means anyone can create a new bag via a PUT to /bags/{bag_name}. Other options are:

ANY

Any authenticated user may create a bag.

ADMIN

Any user with the ADMIN role may create a bag.

Other options are possible by overriding existing code.