A user reports that a message flagged by Safe Attachments arrived in their inbox with a placeholder body while the attachment was still being scanned, and later the real attachment appeared. Your SOC lead asks you to confirm which Safe Attachments policy setting produced this behavior so you can decide whether to change it during an active phishing campaign that uses weaponized attachments. Which Safe Attachments action was configured for this policy?