A CASB session rule blocks downloads in the browser, but the desktop client uses a direct API token path that bypasses the web control

The browser looks governed, yet data still leaves the tenant because another client channel was never put behind the same session controls.