Access.md added.

Some thoughts around identity and access management.  
Ideas still rough, but trying to share early.  Comments welcomed.

Some of this maybe should go into docs/security.md
I'm reconsidering the use of labels in place of groups and roles.  Lots of other similar systems have groups and not having them may be confusing for users.