The most fool proof way is to build both data auditing and usage logging into the application/database design. However once you've got something online that does not incorporate these things I don't know. I think you are really limited to either tracing activity via profiler (which you don't really want to do long term) or something wacky like reading sysCacheObjects data into a table on a regular basis (which wouldn't be too reliable).