Access.md added.

Some thoughts around identity and access management.  
Ideas still rough, but trying to share early.  Comments welcomed.

Some of this maybe should go into docs/security.md
This is very complex to build coherent user experiences around.  While the flexibility may be valuable in some cases, when any kind of self-service (user a needs to add user b) is involved it would be better to be able to easily frame this for clients in terms of subjects mapping to predefined "roles".

Looking at the example below I have a hard time believing humans will be able to use these - ootb for enterprise scenarios and hosted multi-tenant scenarios it would be important to offer something that bridges that gap (whether pre canned templates that fit the view / edit / admin) roles.

I'm skeptical of policies that allow selective access to resources in a project - perhaps that's something better implemented via scoping.  I have trouble imagining use cases for human actors to have access to only pods in a service.