TP: If you're able to validate that inbox rule was designed by an OAuth third-occasion app with suspicious scopes delivered from an unfamiliar resource, then a true favourable is indicated. FP: If following investigation, it is possible to affirm that the app has a reputable organizat