Triage a SaaS or collaboration alert where data leaves or is overshared from a repository — bulk download or upload, an external or anonymous share link, third-party sharing, inbox auto-forwarding including forward-and-delete, a repo fork or transfer, or a mass export. Reads the destination, the actor, and the volume against that actor's baseline to tell documented backup, migration, and pipeline movement apart from an unexpected external share or off-baseline move, and decides escalate or dismiss.
