Explicitly log the creation or destruction of RoleAssignments. Disallow updating of RoleAssignments as they are really atomic structures.