diff --git a/code/__DEFINES/access.dm b/code/__DEFINES/access.dm
index 21de860a388..c4398add600 100644
--- a/code/__DEFINES/access.dm
+++ b/code/__DEFINES/access.dm
@@ -141,3 +141,6 @@
 #define ACCESS_MECH_SECURITY 302
 #define ACCESS_MECH_SCIENCE 303
 #define ACCESS_MECH_ENGINE 304
+
+/// A list of access levels that, when added to an ID card, will warn admins. This is currently a list of access levels that can change other access levels.
+#define ACCESS_ALERT_ADMINS list(ACCESS_CHANGE_IDS, ACCESS_HOP, ACCESS_HOS, ACCESS_RD, ACCESS_CMO, ACCESS_CE)
diff --git a/code/game/machinery/computer/card.dm b/code/game/machinery/computer/card.dm
index 7832deb8e7b..e51fd6ff270 100644
--- a/code/game/machinery/computer/card.dm
+++ b/code/game/machinery/computer/card.dm
@@ -1,5 +1,3 @@
-
-
 //Keeps track of the time for the ID console. Having it as a global variable prevents people from dismantling/reassembling it to
 //increase the slots of many jobs.
 GLOBAL_VAR_INIT(time_last_changed_position, 0)
@@ -448,6 +446,10 @@ GLOBAL_VAR_INIT(time_last_changed_position, 0)
 						inserted_modify_id.access -= access_type
 						if(access_allowed == 1)
 							inserted_modify_id.access += access_type
+							if(access_type in ACCESS_ALERT_ADMINS)
+								message_admins("[ADMIN_LOOKUPFLW(usr)] just added [get_access_desc(access_type)] to an ID card [ADMIN_VV(inserted_modify_id)] [(inserted_modify_id.registered_name) ? "belonging to [inserted_modify_id.registered_name]." : "with no registered name."]")
+							log_game("[key_name(usr)] added [get_access_desc(access_type)] to an ID card [(inserted_modify_id.registered_name) ? "belonging to [inserted_modify_id.registered_name]." : "with no registered name."]")
+							usr.log_message("added [get_access_desc(access_type)] to an ID card [(inserted_modify_id.registered_name) ? "belonging to [inserted_modify_id.registered_name]." : "with no registered name."]", LOG_GAME)
 						playsound(src, "terminal_type", 50, FALSE)
 		if ("assign")
 			if (authenticated == 2)
@@ -476,6 +478,14 @@ GLOBAL_VAR_INIT(time_last_changed_position, 0)
 						inserted_modify_id.registered_account.account_job = jobdatum // this is a terrible idea and people will grief but sure whatever
 
 					inserted_modify_id.access = ( istype(src, /obj/machinery/computer/card/centcom) ? get_centcom_access(t1) : jobdatum.get_access() )
+
+					// Check if we should alert admins that an ID card has been given a new access level.
+					for(var/logged_access in ACCESS_ALERT_ADMINS)
+						if(logged_access in inserted_modify_id.access)
+							message_admins("[ADMIN_LOOKUPFLW(usr)] assigned the job [jobdatum.title] to an ID card [ADMIN_VV(inserted_modify_id)] [(inserted_modify_id.registered_name) ? "belonging to [inserted_modify_id.registered_name]." : "with no registered name."]")
+							break
+					log_game("[key_name(usr)] assigned the job [jobdatum.title] to an ID card [(inserted_modify_id.registered_name) ? "belonging to [inserted_modify_id.registered_name]." : "with no registered name."]")
+					usr.log_message("assigned the job [jobdatum.title] to an ID card [(inserted_modify_id.registered_name) ? "belonging to [inserted_modify_id.registered_name]." : "with no registered name."]", LOG_GAME)
 				if (inserted_modify_id)
 					inserted_modify_id.assignment = t1
 					playsound(src, 'sound/machines/terminal_prompt_confirm.ogg', 50, FALSE)
diff --git a/code/modules/modular_computers/file_system/programs/card.dm b/code/modules/modular_computers/file_system/programs/card.dm
index 10be48af7f1..0045cb3d66f 100644
--- a/code/modules/modular_computers/file_system/programs/card.dm
+++ b/code/modules/modular_computers/file_system/programs/card.dm
@@ -213,6 +213,12 @@
 						to_chat(user, "<span class='warning'>No class exists for this job: [target]</span>")
 						return
 					new_access = job.get_access()
+					for(var/logged_access in ACCESS_ALERT_ADMINS)
+						if(logged_access in new_access)
+							message_admins("[ADMIN_LOOKUPFLW(user)] assigned the job [job.title] to an ID card [ADMIN_VV(target_id_card)] [(target_id_card.registered_name) ? "belonging to [target_id_card.registered_name]." : "with no registered name."]")
+							break
+					log_game("[key_name(user)] assigned the job [job.title] to an ID card [(target_id_card.registered_name) ? "belonging to [target_id_card.registered_name]." : "with no registered name."]")
+					user.log_message("assigned the job [job.title] to an ID card [(target_id_card.registered_name) ? "belonging to [target_id_card.registered_name]." : "with no registered name."]", LOG_GAME)
 				target_id_card.access -= get_all_centcom_access() + get_all_accesses()
 				target_id_card.access |= new_access
 				target_id_card.assignment = target
@@ -228,12 +234,21 @@
 					target_id_card.access -= access_type
 				else
 					target_id_card.access |= access_type
+					if(access_type in ACCESS_ALERT_ADMINS)
+						message_admins("[ADMIN_LOOKUPFLW(user)] just added [get_access_desc(access_type)] to an ID card [ADMIN_VV(target_id_card)] [(target_id_card.registered_name) ? "belonging to [target_id_card.registered_name]." : "with no registered name."]")
+					log_game("[key_name(user)] added [get_access_desc(access_type)] to an ID card [(target_id_card.registered_name) ? "belonging to [target_id_card.registered_name]." : "with no registered name."]")
+					user.log_message("added [get_access_desc(access_type)] to an ID card [(target_id_card.registered_name) ? "belonging to [target_id_card.registered_name]." : "with no registered name."]", LOG_GAME)
 				playsound(computer, "terminal_type", 50, FALSE)
 				return TRUE
 		if("PRG_grantall")
 			if(!computer || !authenticated || minor)
 				return
 			target_id_card.access |= (is_centcom ? get_all_centcom_access() : get_all_accesses())
+
+			log_game("[key_name(user)] added All Access permissions to an ID card [(target_id_card.registered_name) ? "belonging to [target_id_card.registered_name]." : "with no registered name."]")
+			user.log_message("added All Access permissions to an ID card [(target_id_card.registered_name) ? "belonging to [target_id_card.registered_name]." : "with no registered name."]", LOG_GAME)
+			message_admins("[ADMIN_LOOKUPFLW(user)] just added All Access to an ID card [ADMIN_VV(target_id_card)] [(target_id_card.registered_name) ? "belonging to [target_id_card.registered_name]." : "with no registered name."]")
+
 			playsound(computer, 'sound/machines/terminal_prompt_confirm.ogg', 50, FALSE)
 			return TRUE
 		if("PRG_denyall")
@@ -249,6 +264,11 @@
 			if(isnull(region))
 				return
 			target_id_card.access |= get_region_accesses(region)
+
+			log_game("[key_name(user)] added [get_region_accesses_name(region)] region access to an ID card [(target_id_card.registered_name) ? "belonging to [target_id_card.registered_name]." : "with no registered name."]")
+			user.log_message("added [get_region_accesses_name(region)] region access to an ID card [(target_id_card.registered_name) ? "belonging to [target_id_card.registered_name]." : "with no registered name."]", LOG_GAME)
+			message_admins("[ADMIN_LOOKUPFLW(user)] just added [get_region_accesses_name(region)] region access to an ID card [ADMIN_VV(target_id_card)] [(target_id_card.registered_name) ? "belonging to [target_id_card.registered_name]." : "with no registered name."]")
+
 			playsound(computer, 'sound/machines/terminal_prompt_confirm.ogg', 50, FALSE)
 			return TRUE
 		if("PRG_denyregion")