Well, for a start, you could have a recorder that actually shows all the relevant permissions for a particular API call so users can work out what they should set permissions on (including interactions with SCPs and anything else that could affect a decision).
You can actually set this up in your account. It’ll record all the permission your roles actually use (over a customizable period of time), so you can remove all others
