In OOB 4.0 and 4.5, removing an authorization role from a user does not get written to the activity log's after column; however, adding an authorization role does get added to before/after column. The authzRole is visible only after changing its schema property returnByDefault to true on a User Managed Object.
Steps to reproduce:
- create an account using the admin UI;
- add an authorization role such as openidm-admin;
- remove the same authorization role;
- inspect the activity logs;
- notice that the after column on the delete action is empty.