Access.md added.

Some thoughts around identity and access management.  
Ideas still rough, but trying to share early.  Comments welcomed.

Some of this maybe should go into docs/security.md
Yeah, that's something I want to try to spin up as well.  I have a fairly clear idea in my head about how I'd build the old system we have using some of these new ideas, and I think it'd be productive to glue them together (as I see them) so they could be intelligently discussed.