1. A method for system security forensics in a system for allowing or denying a requester access to a protected asset comprising: receiving a request to access a protected asset from a requester having a reputation; making a decision whether to allow or to deny the requester access to the protected asset based upon the requester's reputation; creating access decision data related to the access decision; assessing the access decision data to determine why the access decision was made; determining that the requester's reputation has changed, and if the decision is to deny the requester to access the protected asset based on the change in reputation, identifying other protected assets previously accessed by the requester; identifying potential risks associated with the other protected assets previously accessed by the requester; and determining whether there would be a violation of system security for the requester to access the other protected assets after the reputation change.