doc: Add access-control.md.

The document describes access control rules.