Governance for your automation platform, in a git repo

How do you keep who can do what, and what runs as whom, on an automation platform reviewable? In Windmill, roles, identity mapping, run-as rules and protection rulesets are YAML in git, applied by CI.