Manage user permissions

Before I send the permissions list to our security lead Aisha, frame it for action: mark any user who can change tracking or delete data, highlight service accounts without two-person approval, and propose the minimum permission levels each role (marketing, dev, finance) should keep. Include the exact steps to remove Manage Users rights safely and a template approval email.

We repeatedly have stale or excessive permissions: new hires and agencies are granted high access and it never gets revoked. Where is the process failing — onboarding, offboarding, or lack of role templates? Recommend one small policy and one automated check that a two-person ops team can run weekly to keep access minimal and auditable, plus a short wording for the access removal notice that avoids politics.