TP: If you can confirm that inbox rule was created by an OAuth 3rd-celebration app with suspicious scopes sent from an unidentified source, then a true beneficial is detected. FP: If immediately after investigation, you may affirm that the application features a legitimate company use wit