storage: add some initial namespace docs

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>

docs/storage.rst

@@ -261,6 +261,46 @@ categorized by checksum, after a backup operation has been executed.
  276490 drwxr-x--- 1 backup backup 1.1M Jul  8 12:35 .
 
 
+Once you uploaded some backups, or created namespaces, you may see the Backup
+Type (`ct`, `vm`, `host`) and the start of the namespace hierachy (`ns`).
+
+Backup Namespaces
+~~~~~~~~~~~~~~~~~
+
+A datastore can host many backups as long as the underlying storage is big
+enough and provides the performance required for one's use case.
+But, without any hierarchy or separation its easy to run into naming conflicts,
+especially when using the same datastore for multiple Proxmox VE instances or
+multiple users.
+
+The backup namespace hierarchy allows you to clearly separate different users
+or backup sources in general, avoiding naming conflicts and providing
+well-organized backup content view.
+
+Each namespace level can host any backup type, CT, VM or Host but also other
+namespaces, up to a depth of 8 level, where the root namespace is the first
+level.
+
+
+Namespace Permissions
+^^^^^^^^^^^^^^^^^^^^^
+
+You can make the permission configuration of a datastore more fine-grained by
+setting permissions only on a specific namespace.
+
+To see a datastore you need permission that has at least one of `AUDIT`,
+`MODIFY`, `READ` or `BACKUP` privilege on any namespace it contains.
+
+To create or delete a namespace you require the modify privilege on the parent
+namespace. So, to initially create namespaces you need to have a permission
+with a access role that includes the `MODIFY` privilege on the datastore itself.
+
+For backup groups the existing privilege rules still apply, you either need a
+powerful permission or be the owner of the backup group, nothing changed here.
+
+.. todo:: continue
+
+
 Options
 ~~~~~~~