Contoso wants to prevent users from emailing documents that contain credit card numbers to external recipients. However, the finance team occasionally has a legitimate business need to send such information. The compliance officer requires that finance users be able to proceed only when they provide a written business justification, and every override must be logged for later review. Which DLP rule action configuration meets these requirements?