SQL Server instance level action tracking
Actions happening at the instance level can be monitored by one of the following:


SQL Server Audit feature


https://docs.microsoft.com/en-us/sql/relational-databases/security/auditing/sql-server-audit-action-groups-and-actions?view=sql-server-ver15

DATABASE_CHANGE_GROUP - who created database
SERVER_PERMISSION_CHANGE_GROUP - who gave server-level permissions to particular login
DATABASE_PERMISSION_CHANGE_GROUP - who gave database-level permissions to particular user
... etc


Extended Events feature


Provides some additional benefits and is highly configurable, allows to track 1000+ different kind of events and will cover most your needs


DDL and Logon triggers