yep - agree that sometimes (a lot of the times) starting with ML is not always the solution when some more simple and interpretable business rules or logic can work just as well or even better or basically good enough. So think we might be talking a little about slightly different things.
I like you idea as a sort of post alert or post trigger check - could be a nice concept to have.