When a configured toxic policy rule decides to deny an entitlement in favor of another entitlement, I would like to see that decision mentioned in the persons audit log. Otherwise it would be hard to see why a person should get an entitlement according to a business rule but does not get it.