Root-only visibility into signoffs, login attempts, auth failures, role/user changes, and system-side errors.