User:

• Rename (change of login, change of "realname", change of email, other ?)
• Status change: Suspended / Deleted
• Take into account category
  • Active: have access to all public projects as well as project they are member of
  • Restricted: only have access to project they are member of

Projects:

• Public incl. Restricted: Can be accessed by all users regardless if they are Active or Restricted
• Public: Can only be accessed by Active users
• Private: Can only be accessed by Members
• Private without Restricted: Can only be accessed by Members (FWIW,, from MW point of view it's the same thing than Private)

Platform can be:

• Accessible by anonymous
• Or mandate a login
• Or mandate a login + have "Restricted users"

From Mediawiki point of view, it's a new REST route accessible with oauth2-mediawiki_standalone scope: GET /projects/{id}/mediawiki_standalone_permissions:

{
  "permissions": {
    "is_reader": bool,
    "is_writer": bool,
    "is_admin": bool,
    "is_bot": bool
  }
}