Insider_Risk_Investigation / Review downloads, USB activity, cloud uploads, repo cloning, unusual archive creation, and access patterns without assuming malicious intent. · size 20 · threshold 4 · max attempts 3