Role changes, sensitive actions, login/security events, exports. Real role model does not exist yet - see docs/backend/TRACK-S-SECURITY-RBAC-CONTRACT.md. Today every authenticated admin has full access regardless of role.