drop multi-tenant idp logins · detect impossible travel across same person's accounts · runs locally
drop multi-tenant idp logins · local only
heuristic screener · vendor schema varies · not definitive proof