Are there any attribute-based access control platforms that handle auditable permission changes?

Yes. A number of ABAC-oriented platforms support auditable permission changes, though the exact terminology varies. What you want to look for is support for:

• Policy versioning
• Change history / audit logs
• Approval workflows
• Delegated administration
• Immutable event trails
• Policy-as-code with Git history

Examples of platforms or ecosystems that commonly support this well:

1. Axiomatics

   • ABAC-focused commercial platform
   • Typically includes policy management, versioning, and auditing features

2. IBM Security Verify / IBM Tivoli-based policy frameworks

   • Enterprise policy engines often support audit trails and governance features

3. Open Policy Agent (OPA) + external governance tooling

   • OPA itself is primarily a policy engine, not a full governance platform
   • Auditability comes from surrounding systems like Git, CI/CD, and change-management workflows

4. AWS Cedar / Verified Permissions

   • Policy changes can be tracked via AWS tooling, CloudTrail, and IaC workflows
   • More authorization-as-code than a traditional ABAC suite

5. SAP, Oracle, and large IAM suites with ABAC-like capabilities

   • Often include change logs and approval workflows as part of identity governance

If your main concern is “who changed which permission, when, and why?”, then the best fit is usually not just an ABAC engine, but an IAM/IAG platform with:

• auditable policy lifecycle
• approvals
• separation of duties
• reporting

If you want, I can also give you:

• a shortlist of products by category
• a comparison table
• or help you evaluate open-source vs commercial options.