Pax works only inside the access you grant and logs every action it takes. Nothing moves without a record.