Alice should be shown as a stable but high-consequence user story: trusted identity, meaningful access, and influence across shared lanes.

Trust starts strong here

Email, account id, and host all align cleanly for Alice.

That makes her a strong narrative anchor for the rest of the graph.

Shared infrastructure is the caveat

The user is known, but the key and some adjacent tooling remain shared.

That is why the page still needs a meaning layer.

Normal work can be consequential

Alice’s work touches auth and configuration context often enough to shape the story.

Consequence does not require obviously suspicious behavior.

Use Alice as a baseline anchor

Compare unresolved or weaker identity chains against this stable user pattern.

Review the shared key around the lane

Confirm whether the shared credential use matches Alice’s normal work shape.

Trace the highest-signal session

Open the session story to follow how Alice’s work moved from company context to outbound traffic.

Identity bundle

alice@company.com, acct_01AbcXyz..., and OS username alice all align.

This is the strongest trust anchor in the lane.

Execution bundle

Claude Code on alice-mbp.local is the dominant lane for recent meaningful work.

This explains why Alice appears near several other high-signal entities.

Context bundle

Auth and config-related repo paths recur in Alice’s recent sessions.

That is why her work carries company consequence.

Boundary bundle

Some of the important file activity in Alice’s sessions precedes outbound traffic.

The sequence is why the story matters operationally.