This production rule detects changes to the Anthropic tenant's domain boundary by monitoring Anthropic audit logs for domain-related actions. Specifically, it watches events such as org_domain_verified, org_domain_removed, org_domain_add_initiated, and domain_claim_initiated in the anthropic.audit dataset. Unauthorized or unplanned changes can alter which email domains are trusted for membership, potentially pulling attacker-controlled mailboxes into the tenant or excluding legitimate corporate domains, thereby impacting organization-wide membership trust and persistence. The rule maps to MITRE ATT&CK technique T1098 (Account Manipulation) under the Persistence tactic, highlighting risks to identity and access management. It is designed to assist security teams with triage, investigation, and containment by correlating domain-boundary events with actor identity, DNS ownership/work, and related invites or SSO changes within a similar time window. Remediation guidance includes reverting unauthorized changes via the Anthropic administrator interface and reviewing users and memberships under the affected domain. The rule has a high risk rating and is intended to flag sensitive IAM boundary events for rapid response.