diff --git a/pkg/services/authz/rbac/service.go b/pkg/services/authz/rbac/service.go
index e2d98a5bf9d..092f669c78d 100644
--- a/pkg/services/authz/rbac/service.go
+++ b/pkg/services/authz/rbac/service.go
@@ -108,6 +108,15 @@ func (s *Service) Check(ctx context.Context, req *authzv1.CheckRequest) (*authzv
 	ctx, span := s.tracer.Start(ctx, "authz_direct_db.service.Check")
 	defer span.End()
 	ctxLogger := s.logger.FromContext(ctx)
+	defer func(start time.Time) {
+		ctxLogger.Debug("Check execution time",
+			"subject", req.GetSubject(),
+			"namespace", req.GetNamespace(),
+			"group", req.GetGroup(),
+			"resource", req.GetResource(),
+			"verb", req.GetVerb(),
+			"duration", time.Since(start).Milliseconds())
+	}(time.Now())
 
 	deny := &authzv1.CheckResponse{Allowed: false}
 
@@ -176,6 +185,15 @@ func (s *Service) List(ctx context.Context, req *authzv1.ListRequest) (*authzv1.
 	ctx, span := s.tracer.Start(ctx, "authz_direct_db.service.List")
 	defer span.End()
 	ctxLogger := s.logger.FromContext(ctx)
+	defer func(start time.Time) {
+		ctxLogger.Debug("List execution time",
+			"subject", req.GetSubject(),
+			"namespace", req.GetNamespace(),
+			"group", req.GetGroup(),
+			"resource", req.GetResource(),
+			"verb", req.GetVerb(),
+			"duration", time.Since(start).Milliseconds())
+	}(time.Now())
 
 	listReq, err := s.validateListRequest(ctx, req)
 	if err != nil {