Kubestro » Server

"Who gave this person access, and when" has to be answerable later, but nothing in the platform currently records it. Storing and browsing that history is its own piece of work; what this covers is making sure the information exists to be stored.

Every change that affects who can do what — a role created or edited, access granted or revoked, group membership changed, an account suspended or removed — announces itself with who did it, what it affected and when.