Hi,
I understand why a notification about new authorization is a good idea. But it seems to me that technical solution is overkill for an event that happens not so often in my experience. Your idea of using BADI for transport release is a good solution That uses BADI delivered by SAP. Another would be to remove authorization in DEV to create object so they would have to request it.
Cheers