If the point of the proposed change is not to deny access to globals, then what is the point of it?

You say that this change is to "close a simpler gap in the audit system".
What it is that the audit system is supposed to prevent, that is currently possible, and that your proposed change would prevent?

I'm worried that we end up adding more and more hooks. Performance and maintainability will suffer.