Add docs for identity acl rules (#19713)

website/content/docs/security/acl/acl-rules.mdx

@@ -19,6 +19,7 @@ The following table provides an overview of the resources you can use to create
 | `partition`<br/>`partition_prefix` | <EnterpriseAlert inline /> Controls access to one or more admin partitions. <br/>See [Admin Partition Rules](#admin-partition-rules) for details.                                                                                                                                                                                                    | Yes    |
 | `agent`<br/>`agent_prefix`         | Controls access to the utility operations in the [Agent API](/consul/api-docs/agent), such as `join` and `leave`. <br/>See [Agent Rules](#agent-rules) for details.                                                                                                                                                                                              | Yes    |
 | `event`<br/>`event_prefix`         | Controls access to event operations in the [Event API](/consul/api-docs/event), such as firing and listing events. <br/>See [Event Rules](#event-rules) for details.                                                                                                                                                                                             | Yes    |
+| `identity`<br/>`identity_prefix`   | Controls access to workload identity operations in the [Catalog v2 group](/consul/docs/architecture/catalog/v2).
 | `key`<br/>`key_prefix` &nbsp;      | Controls access to key/value store operations in the [KV API](/consul/api-docs/kv). <br/>Can also use the `list` access level when setting the policy disposition. <br/>Has additional value options in Consul Enterprise for integrating with [Sentinel](https://docs.hashicorp.com/sentinel/consul). <br/>See [Key/Value Rules](#key-value-rules) for details. | Yes    |
 | `keyring` &nbsp; &nbsp; &nbsp;     | Controls access to keyring operations in the [Keyring API](/consul/api-docs/operator/keyring). <br/>See [Keyring Rules](#keyring-rules) for details.                                                                                                                                                                                                                      | No     |
 | `mesh` &nbsp; &nbsp; &nbsp;        | Provides operator-level permissions for resources in the admin partition, such as ingress gateways or mesh proxy defaults. See [Mesh Rules](#mesh-rules) for details.                                                                                                                                                                                | No     |
@@ -247,6 +248,48 @@ operation, so to enable this feature in a Consul environment with ACLs enabled,
 give agents a token with access to this event prefix, in addition to configuring
 [`disable_remote_exec`](/consul/docs/agent/config/config-files#disable_remote_exec) to `false`.
 
+## Identity Rules
+
+The `identity` and `identity_prefix` resources control workload-identity-level registration and read access to the [Catalog v2 API group](/consul/docs/architecture/catalog/v2).
+Specify the resource label in identity rules to set the scope of the rule.
+The resource label in the following example is empty. As a result, the rules allow read-only access to any workload identity name with the empty prefix.
+The rules also allow read-write access to the `app` identity and deny all access to the `admin` identity:
+
+<CodeTabs heading="Example identity rules">
+
+```hcl
+identity_prefix "" {
+  policy = "read"
+}
+identity "app" {
+  policy = "write"
+}
+identity "admin" {
+  policy = "deny"
+}
+```
+
+```json
+{
+  "identity_prefix": {
+    "": {
+      "policy": "read"
+    }
+  },
+  "identity": {
+    "app": {
+      "policy": "write"
+    },
+    "admin": {
+      "policy": "deny"
+    }
+  }
+}
+```
+
+</CodeTabs>
+
+
 ## Key/Value Rules
 
 The `key` and `key_prefix` resources control access to key/value store operations in the [KV API](/consul/api-docs/kv).