Alerts when a user reads an unusual volume of passwords or records

Password reveals and record views are already in the activity logs, but reviewing them is entirely after the fact.

Let admins set a threshold on read activity -- X reveals or X record views by one user in a given window -- and get notified when it's crossed. Threshold and recipient configurable, since normal read volume varies a lot by team.

Two cases: an employee pulling client data on their way out, and a compromised endpoint where an attacker or automated agent drives an already-authenticated browser session through client passwords and asset pages. API and MCP restrictions don't help with the second -- it's an ordinary signed-in user in a normal browser.

The evidence is already logged. The gap is that nobody finds out until they go looking.