18 U.S.C. § 4001 : US Code - Section 4001: Limitation on detention; control of prisons

      (a) No citizen shall be imprisoned or otherwise detained by the
    United States except pursuant to an Act of Congress.
      (b)(1) The control and management of Federal penal and
    correctional institutions, except military or naval institutions,
    shall be vested in the Attorney General, who shall promulgate rules
    for the government thereof, and appoint all necessary officers and
    employees in accordance with the civil-service laws, the
    Classification Act, as amended, and the applicable regulations.
      (2) The Attorney General may establish and conduct industries,
    farms, and other activities and classify the inmates; and provide
    for their proper government, discipline, treatment, care,
    rehabilitation, and reformation.