Access.md added.

Some thoughts around identity and access management.  
Ideas still rough, but trying to share early.  Comments welcomed.

Some of this maybe should go into docs/security.md
What I had been trying to wrap my head around is what Oauth flows and profiles could be used for auth(n) and, separately, I think, for auth(z).