Document autoCreateBucket scoped-admin semantics (markdown)

S3-Configuration.md

@@ -341,6 +341,27 @@ The value is an octal file mode string (e.g. `0644`, `0666`, `0660`).
 
 ---
 
+## Automatic Bucket Creation
+
+When an upload targets a bucket that does not exist, the S3 server creates it on the fly. Enabled by default:
+
+```bash
+# Standalone S3 server
+weed s3 -autoCreateBucket=false
+
+# Embedded in weed server / filer / mini
+weed server -s3 -s3.autoCreateBucket=false
+```
+
+Only identities that may administer the named bucket can auto-create it — the same rule `CreateBucket` enforces:
+
+- A global `Admin` action can auto-create any bucket.
+- A bucket-scoped grant such as `Admin:mybucket` or `Admin:app-*` can auto-create only buckets matching the grant (`Admin:app-*` may auto-create `app-uploads`, but not `other-bucket`).
+
+Identities without a matching admin grant get `AccessDenied`, and uploads to a missing bucket fail with `NoSuchBucket` when the flag is off. The creating identity is recorded as the bucket owner.
+
+---
+
 ## Related Documentation
 
 - [[S3 Credentials]] - Detailed documentation for basic credentials

S3-Credentials.md

@@ -202,8 +202,9 @@ This user can:
 - ✅ Read, write, list, and tag objects in `mybucket`
 - ✅ Create and delete objects in `mybucket`
 - ✅ Manage bucket settings for `mybucket`
+- ✅ Create `mybucket` itself — `Admin:mybucket` authorizes `CreateBucket` for that name, and implicit bucket auto-creation on upload when `-autoCreateBucket` is enabled
 - ❌ Access any other buckets
-- ❌ Create new buckets (requires global Admin action)
+- ❌ Create buckets other than `mybucket` (requires a matching `Admin:` grant or the global `Admin` action)
 
 ### Bucket-Specific Actions