I'm now using Gerrit 2.14.7.
With "Create Reference" permission for "refs/heads/*", users can create branch from any existing commit on Gerrit UI or "gerrit create-branch" command.
But when creating branch "git push origin HEAD:refs/heads/NEW_BRANCH_NAME", I see message like:
remote: ERROR: In commit b9120288f2036ab5590049f1d16de5d87ad8a0f5
remote: ERROR: does not match your user account.
remote: ERROR:
remote: ERROR: The following addresses are currently registered:
remote: ERROR:
remote: ERROR: To register an email address, please visit:
HEAD is a commit which already exists in remote.
So I need to assign additional "Forge Committer Identity" permission in order to create branch by git push.
Since required permissions for creating new branch in different ways are different, I think this is a bug.
I remembered that in Gerrit 2.13.11, there's no such issue.