List people, service accounts and third-party integrations with access to the repository or deployment. For each, record an owner and the task that still requires the permission.
Review dormant and overly broad permissions through the normal change process. Check dependent automation before removing access so security cleanup does not become an unexplained outage.