Audit user roles for excessive admin-level access

Exported user list from an agency-managed WordPress site, 47 accounts total, 11
of them Administrator:

[- "jsmith_contractor" and "m.diaz_dev", Administrator, last login 8+ months ago,
both tied to contractors whose engagement ended earlier this year
- "shopmgr_auto" and "backup_svc", Administrator, last login is automated
  (plugin-driven, no human session pattern), used for scheduled posting and
  off-site backups
- "support_temp", Administrator, created for a one-time site migration in early
  2024, never logged in since, never removed
- Remaining 6 admins are current staff who need some elevated access but not
  necessarily full Administrator]

Audit this the way a least-privilege review should work:
1. Classify each account or account type into keep-as-is, downgrade, remove, or
   investigate-first, and say why. A dormant contractor admin account is a
   removal candidate, but check first whether it owns any content, scheduled
   posts, or API connections that would break if deleted outright versus
   deactivated.
2. For the two service accounts, don't just downgrade blindly: work out what each
   one actually needs to do (scheduled posting needs Editor/Author-level content
   capabilities, not user management or plugin install) and propose the minimum
   role or custom capability set that keeps the automation working.
3. For "support_temp," treat an unused admin account that predates current staff
   memory as a standing risk regardless of activity, and give the safe removal
   sequence: check for owned content or dependent integrations, then revoke.
4. Propose a re-mapping for the 6 current staff admins to Editor, Shop Manager,
   or a custom role, based on what each person's day-to-day work actually
   requires, and flag which ones you can't decide from role title alone and need
   to ask the client about.
5. Recommend a recurring cadence (quarterly is typical) for re-running this audit
   and who should own it.