re: the Field History Tracking feature, which you can turn on for specific objects and then specific fields within those objects:
Is there any way to control access to the Field History? Apart from the Related List on the page there is also a Report Type for Field History on each object. This report type would appear to be available to anyone with access to the object.
This seems like a bit of a security leak, or is it clever enough to respect Field Level Security and Sharing Rules when it shows the history to someone?