Added checking create to the default data authorization REGO as this should...

Added checking create to the default data authorization REGO as this should ensure that records are not created with invalid ACLs.

deployment/default-policies/dataauthz.rego

@@ -38,7 +38,7 @@ check_errors[{"id": id, "message": "User is not authorized to create or update r
 }
 
 check_errors[{"id": id, "message": "The user is not authorized to perform this action", "reason": "Access denied", "code": "403"}] {
-    input.operation == ["update", "purge", "delete"][_]
+    input.operation == ["create", "update", "purge", "delete"][_]
     owners := {o | o := input.records[x].acls.owners[_]}
     count(owners & permissionSet) == 0
     root_user == false
@@ -78,4 +78,4 @@ check_errors[{"id": id, "message": "Invalid 'operation' supplied on input", "rea
     input.operation != "delete"
 
     id := input.records[x].id
-}
+}
\ No newline at end of file