Publish aggregate information on excess permissions across customers and the product nudges and changes being made to reduce that attack surface; such unused privileges are natural candidates for seat-belt style administrator alerts.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.