Expose fine-grained system:* checks (admin grants all) and list system_setting_policy_audits for settings change visibility.