Bitbucket Cloud visibility toggle audit log gaps

Bitbucket Cloud allows repository administrators and workspace owners to toggle repository visibility between private and public via the user interface or REST API. While these actions are critical security events, the current permission model lacks granular controls to restrict this specific action from certain administrators.

The standard audit log does not appear to capture changes to repository visibility. This creates a challenge for security teams attempting to track when internal code has been exposed to the public internet. Furthermore, there is no native policy‑level enforcement or approval workflow required to prevent a repository from being transitioned from private to public status accidentally.

Is there a method to enable visibility‑change tracking in the workspace audit logs? Can a workspace‑level policy be configured to prevent any repository from being set to public, regardless of individual admin permissions?