The request passed the usual checks, matched an existing role, and came from a valid user. But something in the pattern was off—a subtle deviation in usage frequency, timing, and request path. Without anomaly detection, it would have slipped through. With anomaly detection built into self-service access requests, threats