Based on our experience in the SITES team, we would like to have logs for roles definition changes plus some related reports.

Use case: The site has to be switched to a read-only mode. The Authenticated user role is modified so that all write-like capabilities are prohibited. To go back to the previous state, we need to know the original values of the settings.

To have a full auditing possible, it would be nice to log every little change in the permissions if possible (including local overrides, roles assignments etc). Also, if there was a way to provide a comment (like a commit message) when saving the new setting, it could help when reviewing these logs (aka "why the frog did we change this?")