set force-create policy to be admin only