bagit.py uses tempfile.mkdtemp() to generate the payload dir, which by definition limits to user-only read/write/search perms:
https://docs.python.org/2/library/tempfile.html#tempfile.mkdtemp
We work around this outside of bagit.py, but it might be worth considering reassigning more liberal perms to the payload upon completion, or at least optionally per user request on the bagit.py commandline (--group-readable or --perms 0755 or somesuch?).