Answer
Activate History Log logging on the FND_USER_ROLE_TAB table — it may not be visible/enabled by default, so make sure the option to show the Foundation1 component is turned on wherever you're configuring History Log so this table shows up as a selectable option. Once logging is active on it, every modification to a user's permission-set/role assignments gets tracked the same way History Log tracks changes on any other logged table.