GCP handles #1 with their recommended actions on IAM roles. Good luck doing this manually. GCP will give adivce on each IAM role, which person hasn't used their access in 3 months and encourage you to take action (remove it).

Instead I just remove it automatically - I now automate GCP's advice. https://github.com/james-ransom/auto-apply-gcp-iam-recommend...