User does something suspicious (eg. copies lots of sensitive files in a short space of time) This triggers an alert Off the back of this alert the user account is disabled / locked the user will then get a notification (possibly email) that directs them to LADSS to unlock their account using enrolment Q/A
