Logging tool permission errors somewhere ..

I'm working in integrating this into an internal tool to help our teams get some extra insights into PRs ..
I'm seeing that the agent at times likes to invent creative ways of getting some information and decides to run various permutation of for example Bash commands ..
I'm trying to avoid just letting it run any Bash command, but I'd like to also get observability into when it tries to run a command, but it doesn't have the permissions to.

I already tried enabling otlp telemetry, and while the logs and metrics are interesting, they seem to only log "actually attempted" tool executions, and not those denied by "allowed_tools"

I know I can manually see the failed tools in the job execution summary, but I was hoping to hook up some monitors to this event so that we can react and evaluate if we should be allowing these additional tools on a per case basis.

Is there currently an easy way to hook .. anything .. I'd be happy if I can trigger a shell script when a tool is denied, I can then log an event about it or whatever ..

Also how much is this implementation specific to the GHA edition of claude code, should I also be filing a ticket against claude code itself to perhaps have a new event type be logged for denied tools?