you can get notification that server.modifyacl was exercised against the object.?
afaik we don't track history on server objects though so i don't think you will know what it was changed from unless you are capturing that separately.
Thats what I suspected, ok thanks. To the drawing board!