Hi,

You could hook into the ContentSecuritySaved event in the IContentSecurityRepository.

Something like the following:

    [InitializableModule]
    [ModuleDependency(typeof(Web.InitializationModule))]
    public class SecuritySavedEventInitializationModule : IInitializableModule
    {
        private readonly ILogger _log = LogManager.GetLogger(typeof(SecuritySavedEventInitializationModule));

        public void Initialize(InitializationEngine context)
        {
            var contentSecurityRepository = ServiceLocator.Current.GetInstance<IContentSecurityRepository>();
            contentSecurityRepository.ContentSecuritySaved += LogContentSecuritySaved;
        }

        private void LogContentSecuritySaved(object sender, ContentSecurityEventArg e)
        {
            var principal = PrincipalInfo.CurrentPrincipal;
            var contentLoader = ServiceLocator.Current.GetInstance<IContentLoader>();

            IContent content;

            if (!contentLoader.TryGet(e.ContentLink, out content))
            {
                return;
            }

            IEnumerable<string> permissions = e.ContentSecurityDescriptor.Entries.Select(entry => $"{entry.Name}: {entry.Access.ToString()}");

            var message =
                $"{principal.Identity.Name} changed access rights for {content.Name} ({content.ContentLink}). Permissions: {string.Join(", ", permissions)}";

            _log.Log(Level.Information, message);

        }

        public void Uninitialize(InitializationEngine context)
        {
            var contentSecurityRepository = ServiceLocator.Current.GetInstance<IContentSecurityRepository>();
            contentSecurityRepository.ContentSecuritySaved -= LogContentSecuritySaved;
        }
    }

[InitializableModule]
[ModuleDependency(typeof(EPiServer.Web.InitializationModule))]
public class EpiserverInitialization : IInitializableModule
{
    private ILogger _log;
    public void Initialize(InitializationEngine context)
    {
       _log = EPiServer.Logging.LogManager.GetLogger(typeof(EpiserverInitialization));
            var securityRepo = EPiServer.ServiceLocation.ServiceLocator.Current.GetInstance<IContentSecurityRepository>();
       securityRepo.ContentSecuritySaved += SecurityRepo_ContentSecuritySaved;
    }

    private void SecurityRepo_ContentSecuritySaved(object sender, ContentSecurityEventArg e)
    {
            _log.Information($"Content security has been changed for {e.ContentLink} by {HttpContext.Current.User.Identity.Name}");
    }
    public void Uninitialize(InitializationEngine context)
    {
        var securityRepo = EPiServer.ServiceLocation.ServiceLocator.Current.GetInstance<IContentSecurityRepository>();
        securityRepo.ContentSecuritySaved -= SecurityRepo_ContentSecuritySaved;
    }
}