There is no way to alert on certain role grants nor see the audit trail of who granted those permissions or security options to a user and when.
It is impossible now to troubleshoot access issues.
This is a required feature for security operations and is considered during vendor review.