Authorize AI agent actions with Postgres, Slack, and PagerDuty alerts

Quick overview

This workflow exposes a webhook-based policy-as-code authorization service that evaluates AI agent action requests against prioritized rules stored in Postgres, logs every decision for auditing, and optionally sends Slack and PagerDuty alerts for high-risk denials or approval requirements.

How it works

1. Receives a POST request on the /policy-evaluate webhook (or runs manually/on a schedule) to start an authorization evaluation.
2. Ensures the required Postgres tables exist for policies, decisions, and run tracking.
3. Loads enabled policies (ordered by priority) and 24-hour decision statistics from Postgres, then merges them with embedded fallback policies and configuration.
4. Normalizes the incoming request, calculates a risk score, and evaluates policies in priority order to return the first matching effect (allow, deny, or require_approval).
5. Writes the decision and a run summary to Postgres for auditability.
6. If the decision is deny or require_approval and the risk score exceeds the configured threshold, sends a notification to Slack and optionally triggers PagerDuty for severe denials.
7. Responds to the webhook caller with the final decision payload including the matched policy, reason, and risk score.

Setup

1. Configure a Postgres credential and ensure the target database is reachable from n8n.
2. Update the embedded CONFIG values (especially the default effect, embedded policies, risk thresholds, Slack incoming webhook URL, and optional PagerDuty routing key).
3. Activate the workflow and copy the webhook URL for /policy-evaluate into the AI agent/tooling that needs authorization checks.
4. (Optional) Seed the agent_policies table with your own enabled policies to override the embedded fallback rules.