Flagging usage patterns that look like misuse or excessive access before they're discovered in a periodic review — one user's prompts pulling an unusual volume of a sensitive field, a template suddenly being invoked far outside its normal frequency — and routing the alert to whoever owns that response.