Access.md added.

Some thoughts around identity and access management.  
Ideas still rough, but trying to share early.  Comments welcomed.

Some of this maybe should go into docs/security.md
Labels could be used to create groups of userAccounts to make Policies more succinct.

For example:
userAccounts "alice" and "bob" have label "employee_type=fulltime-engineers" and "chuck" has label "employee_type=intern".
then have policy that "employee_type=intern" can GET /pods but not PUT, POST or DELETE /pods (assuming that was somehow useful)

I thought that k8s would not dictate special meanings for any particular labels.

I haven't worked out exactly how to use labels for roles.  Some mechanism is needed for the user to assert the role when taking an action, but not assert it otherwise.