How can I track changes that were made to Protection Policies?

How can I track the changes that were done to the Protection Policies?

Overview:
An Admin needs to be able to track the changes that were done to a Policy Group and also on a device, especially if the client PC has permissions to make changes locally.

How to identify changes:
In the Workspace, you might have noticed the: Edits counter, per device. This counter indicates the number of changes related to the parent policy and ideally should be zero.

Note that settings should always be managed either at the root level or the group level, and not on a device level. If you make a setting change on the lowest level (which is device level), it breaks the inheritance from parent group(s).

Setting changes on the device level (on the local machine itself or in the Workspace) overrule Protection Policy settings, which are displayed as a blue circular arrow icon in the Protection Policies.
If you later make a change in the parent policy or root policy, this change will not be inherited by the device, unless you click the revert to parent policy (blue circular arrow) button.

When you click that revert arrow, it will reset the device polices to the parent group.