SQL Server Audit Changes in user permission
That is exactly what SQL Auditing is for :-)  Now you can finally know WHO did what with a user's access and many more objects in the server or at the database level.  However, Auditing does need to be setup first before it can record the results.

Specifically speaking of Database level audits:
"The database audit specification collects database-level audit actions raised by the Extended Events feature. You can add either audit action groups or audit events to a database audit specification. Audit events are the atomic actions that can be audited by the SQL Server engine. Audit action groups are predefined groups of actions. Both are at the SQL Server database scope. These actions are sent to the audit, which records them in the target."

You can read more here https://docs.microsoft.com/en-us/sql/relational-databases/security/auditing/sql-server-audit-database-engine?view=sql-server-ver15