drop rancher audit log · parse multi-cluster admin events
flags global admin grants · cluster template edits · cattle token creation · timeline + actor rollup
heuristic screener · log format varies by rancher version and distro — not definitive proof