Authorize AI Agent Actions with Postgres Policy Rules & Alerts

Authorize AI Agent Actions with Postgres Policy Rules—and alert on risky denials

This n8n workflow provides a webhook-based policy-as-code authorization layer for AI agent actions. It evaluates every request against prioritized rules stored in Postgres, records an auditable decision trail, and can notify Slack (and optionally PagerDuty) when denials or approvals become high-risk.

What this workflow does

• Receives authorization requests via a POST webhook to /policy-evaluate (or runs manually/on a schedule) to start an evaluation.
• Ensures Postgres tables exist for policies, decisions, and run tracking.
• Loads enabled policies from Postgres in priority order, merges them with embedded fallback policies/configuration, and pulls 24-hour decision statistics to inform evaluation.
• Normalizes the incoming request, calculates a risk score, and evaluates policies in priority order to return the first matching effect: allow, deny, or require_approval.
• Persists every decision to Postgres (decision + run summary) for auditing.
• Alerts on high-risk outcomes: if the effect is deny or require_approval and the risk score exceeds the configured threshold, it sends a Slack notification and can trigger PagerDuty for severe denials.
• Responds to the webhook caller with a final payload including the matched policy, reason, and risk score.

Use cases

• Control when an AI agent is allowed to perform sensitive actions (e.g., restricted tool calls) using Postgres-managed policy rules.
• Enforce “require approval” workflows for borderline requests and escalate high-risk denials to Slack/PagerDuty.
• Provide auditors with complete logs of which rule matched and why each decision was made.

Technical details

• Webhook: /policy-evaluate
• Database: Postgres (policies, decisions, run tracking, enabled policies, 24-hour stats)
• Core logic nodes: if, code, no op, webhook, postgres, sticky note
• Notifications: Slack incoming webhook URL (optional PagerDuty for severe denials)

Setup note: Configure a Postgres credential, ensure DB connectivity from n8n, and update embedded CONFIG values (default effect, embedded policies, risk thresholds, Slack incoming webhook URL, and related settings).