Permission Change Audit Log

Permission Change Audit Log keeps a searchable history of every role permission change on your Drupal site: which permission was added or removed, on which role, by whom, and when. It is useful for security reviews, compliance requirements, debugging "who changed this?" questions, and sites with several administrators.

Features

• Automatic recording: every time a role is saved, the module compares its permissions with the previous state and stores one entry per permission that was added or removed. A newly created role logs all of its initial permissions as added.
• Who, what, when: each entry stores the role, the permission machine name, the action (added or removed), the user who made the change, and the date and time.
• Admin report: a paginated report is available at Administration » Reports » Permission change audit log (/admin/reports/permission-change-audit-log).
• Filters: narrow the report by role, permission (partial match), action, the user who made the change, and a date range. Filters are part of the URL, so a filtered report can be bookmarked or shared with a colleague.
• Changes outside the web interface: changes made through Drush or other command line tools are recorded and shown as "System/unknown".
• Safe by design: the log is append-only, there is no interface to edit or delete entries, and a failure while recording is written to the site log without ever blocking a role from being saved.
• Developer API: the permission_change_audit_log.last_changed service lets other modules ask for the most recent change to a given role and/or permission.

Post-Installation

The module has no settings form. After enabling it:

1. Go to Administration » People » Permissions and grant the "View permission change audit log" permission to the roles that should be able to see the report.
2. Open Administration » Reports » Permission change audit log to view the history.

Recording starts immediately after installation. Permission changes made before the module was installed are not recorded. Uninstalling the module removes its database table and all recorded history.

Additional Requirements

This module requires no modules outside of Drupal core.

• Drupal core 10 or 11
• PHP 8.3 or higher
• Drupal core User module (no contributed dependencies)

Recommended modules/libraries

No additional modules or libraries are needed. The module works on its own.

Similar projects

• Permission watchdog logs role permission changes by altering the administrative permissions form user_admin_permissions and storing each submission as a custom Content Entity that is displayed using Views. In contrast, Permission Change Audit Log tracks changes at the entity layer using user_role presave/update hooks. This fundamental difference means Permission Change Audit Log captures permission changes made not only via the Drupal UI, but also through Drush/CLI commands, configuration imports (drush cim), and programmatic Role API saves all of which are missed by form-alter approaches. Additionally, Permission Change Audit Log stores atomic, time-series entries in a lightweight, append-only database table, provides a built-in filtered admin report without Views dependency, and exposes a dedicated service API (LastChangedLookupInterface) for peer modules to query recent permission modifications.
• Role Watchdog records changes to which roles are assigned to individual users. Permission Change Audit Log is complementary: it records changes to which permissions are assigned to each role. The two can be used together for a fuller picture of access changes.