This rule detects potential abuse of Google Cloud Vertex AI by monitoring Vertex AI GenerateContent responses that refuse to comply. It looks for three or more assistant refusals within a 60-minute lookback, aggregated by Vertex AI model and project. Refusals are identified by STOP finish_reason in the response and by specific refusal phrases in the assistant text (e.g.,