1. A method for system security forensics in a system for allowing or denying a requester access to a protected asset comprising: receiving a request to access a protected asset from a requester having a reputation; making a decision whether to allow or to deny the requester access to the protected asset based upon the requester's reputation; creating access decision data related to the access decision; and assessing the access decision data to determine why the access decision was made.