The policy of a bag is set or edited when editing a bag either via twanager or using the HTTP API.

The bag command of twanager takes a bag name as an argument and an optional JSON string representing a policy:

twanager bag foobar
{"policy": {"read":["someusername"]}}
^D

PUT to /bags/{bag_name} is much the same: the JSON representation must include a policy element.

In either case, if the bag already exists, the bag's current policy is clobbered by the new one provided.

In the example above only the read constraint will be set. The rest of the constraints will be set to their empty defaults. Be careful, this may not be the result you want.