The risky part is not the button. It is the missing review.
- Treating project permissions as if they explain product access
- Removing one group membership and assuming the seat is no longer billable
- Changing default groups without checking onboarding impact
- Mixing app access cleanup with unrelated identity governance work