feat(replay): add docs for granular replay permissions

docs/product/explore/session-replay/access-control.mdx

@@ -0,0 +1,41 @@
+---
+title: Restricting Replay Access
+sidebar_order: 75
+description: "Restrict which users can view Session Replays using user-based allowlists."
+---
+
+Restricting Session Replay access allows organization managers and owners to control who can view replays by creating an allowlist of authorized users. This feature provides an additional permission layer on top of existing role, team, and project permissions.
+
+## How It Works
+
+Restricting replay access works in conjunction with your existing Sentry permissions. When enabled, users must meet both requirements to view replays:
+
+1. Have standard role/team/project permissions that would normally grant replay access
+2. Be included in the replay allowlist
+
+This means the allowlist adds an additional layer of access control without replacing your existing permission model. If the feature is disabled, only standard Sentry permissions apply.
+
+For example, if a user doesn't have access to a project containing replay data, adding them to the allowlist won't grant them access to those replays. Conversely, a user with full project access but not on the allowlist won't be able to view replays when the feature is enabled.
+
+## Restricting Replay Access
+
+Organization managers and owners can restrict replay access in the organization settings:
+
+1. Navigate to **Settings > Organization Settings**
+2. Locate the **Restrict Replay Access** setting
+3. Toggle on the **setting** to enable replay access restrictions
+4. Once enabled, you'll see an input field that allows you to manage the allowlist
+
+<Alert level="info">
+
+Only organization managers and owners can enable this feature and manage the allowlist.
+
+</Alert>
+
+## User Experience Without Permissions
+
+When a user doesn't have replay access permissions, they'll experience the following:
+
+- **No replay data**: Replays won't appear in Issue Details or other contexts where they're normally shown
+- **Hidden UI components**: Replay-related buttons, menus, and navigation items won't be visible
+- **Blocked API endpoints**: Direct API requests to replay endpoints will be denied

docs/product/explore/session-replay/index.mdx

@@ -10,4 +10,6 @@ For browser-based applications, this includes static websites, single-page appli
 
 To learn more about which SDKs we support, please visit our docs for [Web](web/#supported-sdks) and [Mobile](mobile/#supported-sdks).
 
+
+Organizations can also [restrict replay access](access-control/) to specific users, which provides granular user-based permissions on top of standard role and team permissions.
 <PageGrid />