Access.md added.

Some thoughts around identity and access management.  
Ideas still rough, but trying to share early.  Comments welcomed.

Some of this maybe should go into docs/security.md
Agree that there needs to be a smooth path for users familiar with RBAC to use ABAC.  

As a point of reference, the Amazon IAM system also uses ABAC (http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policies-for-amazon-ec2.html)