Well shit, AI might be helpful, in tracking what a user changed on their system

What AI can really help with in this situation is stitching together the evidence that already exists across multiple logs and configuration sources. A typical system change touches package managers, shell history, configuration files, service restarts, and sometimes orchestration or monitoring tools. Each of those records a small fragment of the event, but they live in different places and often on different retention schedules. When someone tries to reconstruct what happened later, the difficulty is correlating timestamps, users, and processes across those fragments before some of them roll off storage. AI can assist by parsing those sources, aligning the events, and reconstructing the sequence that led to the current system state. The operational benefit is not just convenience. When the event chain is reconstructed quickly, troubleshooting time drops and teams avoid the cost of extended outages or unnecessary rebuilds. It also improves audit defensibility because the system can show how a change propagated rather than leaving administrators to manually piece together partial logs from multiple systems.