File system warnings for moves of shared content items

The present technology operates in an application layer of an operating system on a client device of a content management system to monitor for changes to shared content items that are likely unintentional-for example the change might move a content item out of a shared space, or otherwise remove the shared content item from access by other users. The present technology can detect a content item change event on a client device, compare a source file system path for the content item change event with a destination file system path for the content item change event to determine a canonical move causing the content item change event, determine that the canonical move was likely unintentional; and display a notification informing the user that a content item change that was likely unintentional was detected and then allow the user to either confirm or deny (undo) the detected change.