How to see which rule, hook or sandbox blocked a Claude Code tool call with safety_event

Since Claude Code v2.1.307, OpenTelemetry logs include a claude_code.safety_event event. Its category tells you whether a permission rule, a hook, the auto mode classifier or the sandbox refused a tool call or asked for approval. Use it to find where and why an unattended run stopped.

1. Turn on telemetry and export log events. The event has no separate setting; it exports with the other events.

export CLAUDE_CODE_ENABLE_TELEMETRY=1
export OTEL_LOGS_EXPORTER=console
claude

1. In records whose event.name is safety_event, read category and decision. Common values:

• permission_rule and managed_policy are deny or ask permission rules. rule_source says which settings they came from.
• hook means a hook such as PreToolUse or PermissionRequest stepped in.
• auto_mode_block means the auto mode classifier blocked the call.
• safety_check is a built-in check, such as reading or writing outside your working directories. circuit_breaker names the check.
• sandbox_network means the sandbox's network proxy refused a connection; sandbox_violation_count gives the number of refusals.

1. A safety event holds no command text, file paths or host names. To see the blocked command, turn on tool details and read tool_parameters on the tool_decision event with the same tool_use_id. This setting puts Bash commands and file paths in your logs, so check where they go first.

export OTEL_LOG_TOOL_DETAILS=1

In a -p run with neither --permission-prompt-tool nor --permission-prompts none, a call refused because nobody could answer the prompt leaves no safety event. Look for a tool_decision event with decision reject and source config instead.