I've had a DDL trigger monitor permissions changes but unfortunately sp_AddRoleMember does not seem to fire an event. Thus most changes are captured but when there are multiple DBAs working...