Create a protected workspace for suspicious requests.

Add cases, upload or describe evidence, and review risk signals with limitations kept visible.