Admins should be able to download Box Shield tagged malware without marking the file safe for everyone. That way a security admin could download the file and scan it with their own security tools. That’s the only real way to diagnose if a file is malicious or just a false positive.

Asking us to mark it safe by chatting with the user is far from best practice