How about:

[work@9bb10564cc6f ~]$ koji list-history --active --permission=admin --show=user_perms
...
Wed Aug  2 19:01:45 2017 permission admin granted to ralph by ausil [still active]
Wed Aug  2 19:03:56 2017 permission admin granted to puiterwijk by ausil [still active]

I've definitely recommended the list-history option in the past.

I've shied away from making it easier to figure out who has special perms (i.e. who best to target). Of course, you /can/ get the data, so that makes it merely security through obscurity. Perhaps we should:

1. make the permissions data only generally readable by admins
2. provide a call like this, but admin-only
3. allow non-admin users to query only their own perms (via getUserPerms)

Or am I just being paranoid?

I would say, that security by obscurity doesn't work well here. It is easy to get list of all users and try what is needed - we don't log unsuccessful attempts visibly.

I would say, that some regular user could benefit from looking who he has to hunt if he needs specific privilege - on the other hand it happens very rarely.

Admin-call only - If there is a way to do it via list-history, it probably doesn't have much advantage.

non-admin users already can get their permissions via 'koji list-permissions --mine'.

So, we can probably drop this one as my original reason is not valid :-).