Oh that's a cool idea. Super useful for detection and response teams, guessing they're able to get some of that by standard OS telemetry via agents/EDR.
At the same time, when something is left in a bad state, you want to know how it got that way and when; not even necessarily just to punish people, but so that the right people are in the room to explain the full circumstances of what they did and why.