We prefer to have audit logging in our services that leverage databases. It gives us clarity into sources of where ACL issues might originate as well as gives us a general timeline of activity in our application.
Audit logging is tedious to set up so this gist contains our latest iteration of audit logging support for a sequelize based service.