What immediate containment steps should I take when an employee with high-level SaaS permissions exhibits suspicious download patterns?