Credential phishing: Personalized document signing request

type.inbound
// personalized document form ensures recipients should always be 1
and length(recipients.to) == 1
and 2 of (
  // document/sign language
  strings.icontains(body.current_thread.text, 'docusign', 'document'),
  // greeting uses recipient's email local_part
  any(recipients.to,
      strings.icontains(body.current_thread.text,
                        strings.concat("You're receiving this on behalf of ",
                                       .email.domain.sld
                        )
      )
      or strings.icontains(body.current_thread.text,
                           strings.concat("Invitation to sign document for ",
                                          .email.domain.sld
                           )
      )
  ),
  // templated html artifact
  strings.contains(body.html.raw,
                   'STAR Capital invites you to exchange',
                   'Reminder: Invitation to sign document for Agito AS'
  )
)