A company has grown from a small startup to an enterprise employing over 1000 people. As the team size has grown, the company has recently observed some strange behavior, with Amazon S3 bucket settings being changed regularly. How can you figure out what's happening without restricting the rights of the users?