Access has a chain of custody.

Trace identity evidence, imported groups, and access drift without granting, revoking, or modifying existing services.