Access.md added.

Some thoughts around identity and access management.  
Ideas still rough, but trying to share early.  Comments welcomed.

Some of this maybe should go into docs/security.md
Correct.  It's not common, but when it does it hurts.  Also, individuals user identifiers can change over time (some organizations have to create new ldap profiles when an employee leaves the company and returns, or gets hired as a contractor, or changes their legal name).  So even a proper ldap uid field can change for legal/HR reasons.  Other reasons are when companies are acquired lots of churn can happen - having that decoupling saves a lot of migration.  Also, you can retire /deactivate old identities but still be able to attribute an action in an audit log to the user who changed the build by their uuid.