Who has access?
When was it granted?
Who did have access but does not anymore?
Is it a role or direct grant?
How much overlap is there? i.e.: where Browse & Update roles are the same.
Does anyone have 'admin' privileges?