You can actually set this up in your account. It’ll record all the permission your roles actually use (over a customizable period of time), so you can remove all others