Function access_denied_hint 

pub(crate) fn access_denied_hint(
    buf: &[u8],
    exit_code: i32,
) -> Option<&'static str>

The hint for the model, if the command failed and its output shows an access denial. The whole buffer is searched, including any part the model blob elides. A successful command never gets the hint, so a grep or a log that merely mentions AccessDenied stays untouched.