There are a handful of user audits that the Security-Team should be regularly performing:

1. T237696: Wikimedia deployers audit
2. {https://phabricator.wikimedia.org/T252465}
3. T245526: Audit @wikimedia GitHub org access (2020)
4. {https://phabricator.wikimedia.org/T225069}
5. {https://phabricator.wikimedia.org/T263784}
6. {https://phabricator.wikimedia.org/T273829}
7. {https://phabricator.wikimedia.org/T263237}
8. T299400: Audit members of acl*security for more than x duration of no activity (Jan 2022)
9. T274475: Audit WM maintained libraries for lack of phan
10. T391150: Audit Phabricator security policies and groups membership

Likely some others too, which we should catalog here and automate/schedule in the simplest way possible.