Access.md added.

Some thoughts around identity and access management.  
Ideas still rough, but trying to share early.  Comments welcomed.

Some of this maybe should go into docs/security.md
I think it's important to express this (and similar structures in the doc) as abstract interfaces, the simplest (and first) form of which is a config file.