Access.md added.

Some thoughts around identity and access management.  
Ideas still rough, but trying to share early.  Comments welcomed.

Some of this maybe should go into docs/security.md
Interesting - yeah, I could see groups and other types of role things mapping in here.  Helps simplify the general user -> mapping rules.  With policy I could see value.