Monitor treasury signers, transactions, and config drift. Detect governance and policy changes before they become incidents.