The Logs screen at /admin/hipaalog (browser tab shows "System Logs"; there's no side-menu link — go there by URL). It has four tabs: Role Logs (who changed a user's role, old → new), Permission Logs (who added/removed which permission on which role), Failed Login Logs (attempted logins with a bad password), and User Activity Logs (successful logins/logouts and 2FA events like enabling, disabling, recovery-code use, and SuperAdmin resets).