I can't tell which project guests are safe to remove after the work ends

I start the morning with a message from a manager asking whether an old supplier still has access to a project Team. I open Teams, then the connected SharePoint site, then the group membership, and the answer is not as clean as anyone wants. The guest is still there, but the project owner has moved departments.

By lunchtime I have a list of external users and sharing signals. The small win is that I can separate the obvious group memberships from the cases that need more checking. But none of those signals tells me whether the collaboration is actually finished. One guest might still need access for warranty work. Another belongs to a contractor who left months ago. The report shows technical access; it does not show the missing business decision.

By the afternoon, both choices feel risky. If I remove the wrong guest, I could break live work and get pulled into an escalation. If I leave stale access alone, I may have to defend it during the next security review. I also have to remember that removing someone from the Team does not prove that every separate SharePoint link or other resource assignment is gone.

At the end of the day, what I want is a repeatable closeout rhythm: a project owner to confirm keep or remove, a short exception note when access stays, and a safe checklist that lets me make the narrowest change without guessing.