A CASB inline proxy rewrites the downloaded filename, and the DLP hash allowlist no longer matches the approved document

Content is safe, yet the downstream control no longer recognizes it because one enforcement layer changed the file artifact identity.