Q3 pricing deck shared externally with anyone-with-link access

MediumOpenUser: —Detected: 1 hr ago

Needs review — Requires triage — conflicting signals

pricing_2026_Q3.pptx in SharePoint · Sales-Assets was changed to "Anyone with link" at 10:12 — 3 days before an external pitch scheduled with Northwind Corp. The link was opened from unrecognized-domain.com at 10:20, 8 minutes after the permission change. Link-sharing on this file type occurs in only 3% of Sales documents. AI confidence is 67%: the pitch timing is a plausible business justification. A human should confirm intent before restricting.

WHY FLAGGED

✓Link-sharing on pricing_2026_Q3.pptx — occurs in 3% of Sales docs (90-day baseline)

✓Timing: permission change at 10:12, external open at 10:20 — 3 days before Northwind Corp pitch

✓Recipient domain unrecognized-domain.com is not on the approved partner allowlist

AI RecommendationsConflicting risk signals detected — top suggested resolution path presented below.

Resolve — benign (pre-pitch intent)

Alert Info

Assigned to

Priya Nair

Alert ID

CASE-5211

AI Investigation

Requires triage — conflicting signals

Alerts

2 linked

Detection

Datastore types

SharePoint

Policy

Risk type

Policy Violation

User

Sales team (shared drive)—

Department

Sales

Ask Matters AI

Hi, I'm Matters AI. Ask me about your alerts, cases, or policies.