Root cause on anomaly alerts
When an alert fires, AI adds the likely cause from the flows behind it, so the first message already says where to look.
Alert: passkey login success below threshold
Likely cause, the affected cohort and a link to the evidence
