Tim,
just the other day I found this openstack's project called Ara which you can use standalone and is basically what Brian was referring to, a callabck plugin. I haven't tried it yet, but looks very promising, not just recording everything that happened, but also providing a very nice interface to review the changes.
That said for my own setup I'm experimenting with rundeck which should be able to collect all the output along with providing access control to the jobs and a record of who initiated it.
best,
Spike