This would be useful so auditd can be used to diagnose some difficult to debug bugs:

• /var/lib/tor changed access rights bug
• Whonix template: /etc owned by user:user

Debian feature request:
please use configuration folder /etc/audit/rules.d/ by default

Can be implemented in form of a systemd drop-in file in the usability-misc package.