Accessing session.ad.last.errmsg in an iRule

If a user attempts to change their password and their password choice doesn't meet our complexity requirements, I'd like to inform them of that and give them another try.

Is there an iRule event where I can access session.ad.last.errmsg? I've tried HTTP_RESPONSE, with no luck.

I would like to somehow send the value of session.ad.last.errmsg to the access policy page. Is this possible?

Thanks!