Document a minimum policy necessary to create the stack

[ryansb]

Obviously, saying "hey, run this stack" isn't all that confidence-inspiring, so it might be good to give a policy that restricts the stack permissions to some minimum.