Add a 'high-water' configuration option which, if reached during a file create/copy operation, prompts the user to Authenticate with 2FA and approve the extended budget.

I'd be okay with this feature if I got a 2FA alert that something 'big' was about to happen, and could approve/deny it in realtime when it happens.