Monitor admin roles that are set to "Constrain this role to the entire organization"

At my organization, we have noticed incidents where an Okta admin accidentally grants a user an admin role for the entire organization, instead of for a specific resource(s). We would like to monitor and audit these changes to make sure they are valid. It doesn't seem there's any built-in way to do this.

Has anyone done this kind of thing before? Is it possible with an Event Hook into a Worfklow maybe? I poked around at that option for a bit, but the Okta logs for these "Constrain this role to the entire organization" events don't seem to contain anything different than a normal grant to a single resource would.