The operational task
Withdrawal and wallet approvals must use the transaction service's actual identity and signing policy. Behavioral monitoring is additional evidence.
What the implementation supports
Identity Fabric Monitor can flag supplied identity and privilege anomalies. Match alerts to verified account/service identities rather than accepting a user-provided role as proof.
Integration and limits
1-SEC is not a transaction-signing or multi-signature authorization engine. An alert does not establish that a session ended before a signature or payment.
Check collector wiring, the current event schema, and the enforcing component before relying on a response. Preserve the original event and verify the result on your actual deployment. An emitted alert does not prove that the initiating operation was stopped.