Is there documentation that provides notification of when privileges become redundant, or replaced?

Summary:

With new privileges being required to be added to custom roles for Redwood so that existing functionality can be maintained (in particular, addition of numerous Use REST Service privileges) the InfoSec team would like to know if there are aligning privileges that cover the same functionality in Classic/Responsive that would become redundant and should therefore be removed once Redwood is adopted. With the addition of the extra privileges and roles that are required for Redwood the InfoSec team is concerned that the custom roles will become over-provisioned.

Is there documentation that advises of this? This will become more relevant once Redwood is able to be fully adopted, but it is a concern that is currently being raised.