Choose the evidence and filters that answer your recurring question.

Choose the supported period and inspect the retained evidence it contains.

Choose a daily or weekly schedule and, if needed, report-ready email notices. This example creates no schedule.

Select a supported permissions-change event and review the rule conditions.

Select an email recipient, Slack incoming webhook or HTTPS webhook you control.

After setup, check the recorded delivery result and confirm receipt with the intended recipient.

A component update starts the review. Compare the recorded result with your planned maintenance.

A later configuration change adds context. Its sequence alone does not establish a cause.

Review the captured role difference and whether the access change was intended.