Detection of Anthropic organization IP restriction deletion from audit logs. The rule watches for the org_ip_restriction_deleted action in Anthropic audit data, which can widen the surface for admin sessions and admin API keys. Because delete events often omit the removed CIDR, the rule treats this as an early signal and triangulates with nearby org_ip_restriction_created or org_ip_restriction_updated events to recover the missing context. It maps to MITRE ATT&CK Defense Evasion (T1562.007: Disable or Modify Cloud Firewall) and signals potential attempts to bypass network access controls. The rule supports rapid triage by correlating actor type, organization context, and adjacent allowlist changes, and guides responders toward verifying whether a replacement restriction was applied in time. Remediation involves restoring required IP restrictions, reviewing admin activity during the open window, and rotating credentials or API keys used in that period. False positives commonly arise from office moves, VPN migrations, or policy redesigns where IP ranges are removed before new ones are applied.