Permission drift events
KPIHow many access-related changes have occurred over the recent window -- users added or removed, fields and project permissions altered, issue type permission schemes touched. Spikes are worth a quick second look from a compliance perspective.