TokenGuard: Expired Token Risk Mitigation

Users are repeatedly flagged as high risk when a known malicious actor attempts to access with an expired token, causing unnecessary friction and alert fatigue. TokenGuard intelligently detects expired token attempts from known bad actors and suppresses redundant high-risk flags, streamlining security workflows and reducing false positives.