To be consistent, we should rename the current MinimalPermissionsPlugin to MinimalPermissionsGuidancePlugin, because it not only checks what permissions are minimal for the set of requests but also compares them against the permissions on the token and reports excessive permissions if any. We could introduce a version that just checks minimal permissions under the current MinimalPermissionsPlugin name.