diff --git a/invenio.cfg b/invenio.cfg
index 15ca380c..52d6dc20 100644
--- a/invenio.cfg
+++ b/invenio.cfg
@@ -65,6 +65,9 @@ from invenio_rdm_records.notifications.vcs import (
     RepositoryReleaseCommunitySubmittedNotificationBuilder,
     RepositoryReleaseFailureNotificationBuilder,
     RepositoryReleaseSuccessNotificationBuilder)
+from invenio_rdm_records.services.request_policies import (
+    FileModificationAdminPolicy,
+)
 from invenio_preservation_sync.utils import preservation_info_render
 from invenio_cern_sync.users.profile import CERNUserProfileSchema
 from invenio_oauthclient.views.client import auto_redirect_login
@@ -499,6 +502,23 @@ RDM_COMMUNITY_REQUIRED_TO_PUBLISH = True
 RDM_NEW_RECORD_VERSION_REVIEW_POLICY = CDSRecordVersionReviewPolicy
 CDS_COMMUNITIES_REQUIRING_NEW_RECORD_VERSION_REVIEW = []
 
+RDM_IMMEDIATE_FILE_MODIFICATION_POLICIES = [
+    FileModificationAdminPolicy(),
+]
+"""Allow only instance-wide admins to modify files of records without creating a new version."""
+
+RDM_FILE_MODIFICATION_PERIOD = timedelta(days=30)
+"""
+Instance-wide admins should only be able to modify files for up to 30 days after the publishing of a record
+version.
+
+The file "bucket" can be unlocked (only by the admin) at any point in this period, and then the admin, the owner of the record,
+or the curators of the community can modify the files. The record must be definitively published by the end
+of 30 days after first publication.
+
+E.g. if the bucket is unlocked 29 days after initial publication, files can only be modified for 1 day.
+"""
+
 RDM_SEARCH = {
     **deepcopy(RDM_SEARCH),
     "query_parser_cls": QueryParser.factory(