docs: Start design for aliases

README.md

@@ -20,6 +20,21 @@ Compared to lldap, llldap:
 - supports mailalias with multiple values in search queries
 - support listening on unix domain sockets (UDS) out-of-the-box
 
+## Design
+
+> [!IMPORTANT]
+> Most of these design decisions have not been implemented yet.
+
+- different users can have the same username across different domains, so `foo@bar.com` is not the same
+  user as `foo@baz.com`
+- service accounts are separated from normal user accounts, and do not have an associated domain;
+  they allow 3rd-party programs to connect via LDAP with special sets of permissions
+- service groups are separated from normal user groups, and do not have an associated domain;
+  they are meant to store permissions (eg. `admins`, or `mail`)
+- aliases are supported, but remain associated with a user account forever ([more details](docs/aliases.md))
+- TODO: should users be able to create custom groups/aliases? that sounds useful, but may need monitoring
+  to prevent accidental/malicious abuse (such as registering `comptabilité@` or `legalteam@`)
+
 ## Potential future features
 
 We may explore in the future: