Access.md added.

Some thoughts around identity and access management.  
Ideas still rough, but trying to share early.  Comments welcomed.

Some of this maybe should go into docs/security.md
Do you see policies closely tied to REST resources, or to underlying resources that each have a canonical "path"? 

We typically tend to think of the underlying resources and the underlying intents, mostly because in practice few systems implement strong REST resources, and also because in some cases the same intent can be done via two separate API paths.

There are certain operations that seem difficult to properly represent in this form (method / path) because update seems very different.  I.e., should I be able to update the resource attributes of a pod on PUT?  Environment variables?  Is removing all the containers from a pod equivalent to deleting a pod?  Effectively equivalent?  Does changing the replication controller replica count require DELETE /pods (since the replication controller is a delegate, does it check whether the user it's acting on behalf of have access to delete pods)?  Or should an admin be aware that PUT /replicationControllers == DELETE /pods?