Contoso has onboarded Windows 11 devices to Purview Endpoint DLP. Security wants to prevent egress (copy to USB, upload to cloud) of sensitive files that have NOT yet been evaluated by any DLP policy — for example, brand-new documents created offline before classification runs. They want the action blocked until a policy evaluation completes, then allowed or blocked based on the result. Which Endpoint DLP capability should you enable?