Privilege escalation can happen by accident, through policy gaps, or by malicious intent. Without tight monitoring, elevated access can let attackers move sideways, read confidential data, or disrupt operations. Alerts need to detect the exact moment a permission jump occurs, whether it’s a role upgrade in production or a