Yes. Adding or removing a permission from a role, and changing which role a user is assigned (both globally and per-location), each write an entry to the security audit log with who made the change and the before/after values — visible on the Role Logs and Permission Logs tabs of the System Logs screen.