In order to audit all changes that might affect user permissions, it's not enough to just audit user roles, which is covered by #22051. We also need:

As a user with view_audits permission I want to see user audit record creates when a role has been assigned to a user.

As a user with view_audits permission I want to see user group audit record created when a role has been assigned to a user group.

As a user with view_audits permission I want to see user group audit record created when user group is assigned/disassigned another user group as parent/children. Note that this can have implications on what permissions a user in a given parent user group has grantes.

As a user with view_audits permission I want to see user audit record created when user is assigned or disassigned from a user group. This should include automatic external user group sync. Wile it does not necessarily is triggered by user, without this information, the critical part would be missing.

As a user with view_audits permission I want to see role audit record created when role permissions changes.