Since you're using SQL 2012, you can leverage SQL Server Auditing, which was introduced with SQL 2008. SQL Server Auditing can be used to track a multitude of actions within SQL Server, include database object permission
GRANT/REVOKE/DENY actions. You'll be able to see the security principal that executed the statement, when the statement was run, and what that exact statement was. To create your audit, you will need to perform the following:
Create an Audit
The Audit defines the over-arching logging for all the audits. To create an Audit, you can use the object explorer to browse under the instance to Security->Audits. Right click on Audits and select "New Audit". Fill out the next dialog (the important bit here is where you store the audit file, the rest you can use defaults on). After you create it, you will need to right click on the Audit in the object browser and enable it.
Create an Audit Specification
The Specification defines what action you want to track, using any combination of actions/groups to define the Specification. There are many different actions, both on the server and database level, that can be tracked. To create a Specification for database permission changes, browse under the database you wish to track in to Security->Database Audit Specifications. Right click and fill out the dialog. Select the Audit you created above to write to. Under Audit Action Type, select
SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP from the drop down. This action allows you to track permissions changes on schema objects. Once you have this, click 'Ok' to create the specification. Then, in the object browser, enable it.
Viewing the audit
Once this is all complete, the audit is running and will capture and
GRANT/REVOKE/DENY actions in that database. To view the audit logs, browse to the audit under the instance in Security->Audits. Right click on the audit and select 'View Audit Logs' and you will be able to see all the audit actions that have occurred in your database since you started the auditing.
As an alternative, your auditing can be enabled using T-SQL with the following commands:
CREATE SERVER AUDIT [PermissionTracking]
( FILEPATH = N'C:\DBData'
,MAXSIZE = 0 MB
,MAX_ROLLOVER_FILES = 2147483647
,RESERVE_DISK_SPACE = OFF
( QUEUE_DELAY = 1000
,ON_FAILURE = CONTINUE
ALTER SERVER AUDIT [PermissionTracking] WITH (STATE=ON);
--Create Database Audit Specification
CREATE DATABASE AUDIT SPECIFICATION [FooDBPermissions]
FOR SERVER AUDIT [PermissionTracking]