Fixed
- Access-key reveal/revoke (and other audit-logged actions) no longer fail with "not allowed" for s3-user/s3-manager roles. AuditLogsService::log() now bypasses the create-authorization check when writing the audit trail, since it's a system-triggered side effect of an already-authorized action, not a user-initiated create.
Requires nextdeveloper-nl/iam >= v2.0.7 (adds UserHelper::withRolesCheckBypassed()).