the problem with "what did user X have access to at time Y" is that datastores GC after a set window (usually 24 hours, but some sooner)