okhp3-precursor-detection

Detect early indicators of distributed or agentic abuse before a confirmed incident. Use when correlating reconnaissance-like behavior, authentication anomalies, or unusual request patterns. Do not execute countermeasures without approved policy.