Notifications

Notifications keep owners and security teams informed when Forge discovers activity or creates work that requires attention. Forge supports two complementary notification models:

• Ownership notifications deliver matching governance requests to the owners assigned to a policy, AI system, or user group.
• Organization notifications deliver selected governance, Shadow AI, and Registry events to shared operational destinations.

Notifications supplement the Forge Console. They do not replace Responses, change reviewer authorization, or automatically approve an action.

​

Ownership notifications

Notification methods are configured separately for each ownership assignment.

1. Open Settings.
2. Select Ownership.
3. Add an owner or open an existing owner assignment.
4. Select one or more notification methods.
5. Save the owner.

Available methods include: Slack direct messages require each selected user to have a Slack identity linked to their Forge directory identity. Owner emails are included automatically when Email owners is enabled. Additional recipients should be used only when someone needs notification without becoming an authorized owner.

​

Organization notifications

Organization notification preferences cover three operational areas.

​

Governance

• New requests that need owner review.
• Approved requests.
• Denied requests.

​

Shadow AI

• New findings that need review.
• Remediation actions being created.
• Remediation status changes.

​

Registry

• MCP access requests.
• MCP tool expansion requests.
• New MCP server submissions.
• High-risk scan results.
• MCP tool definition changes.
• Approved, denied, changes-requested, ready, and reconnect states.
• Skill promotion requests and decisions.

Each event type can be enabled or disabled independently. Enabled organization events can be delivered by email, Slack, and one signed HTTPS webhook. The same event toggles and minimum severity apply to every organization channel. Ownership assignment methods remain Slack and email.

​

Connect Slack

1. Open Settings.
2. Select Ownership.
3. Find the Slack section.
4. Select Connect Slack.
5. Authorize the intended workspace.
6. Choose the default channel for governance and Shadow AI notifications.
7. Choose a separate Registry request channel if needed.
8. Enable the event types that should send notifications.

Private channels appear only when the Forge Slack app can see them. Archived channels are not available for selection. See Slack for the required OAuth scopes, identity matching, and interactive decision behavior.

​

Connect a webhook

1. Open Settings → Ownership.
2. In Webhook, select Connect webhook.
3. Enter a public HTTPS endpoint and save it.
4. Copy the generated signing secret.
5. Select Send test.
6. After the test succeeds, select Enable.

The Ownership page then shows the webhook as Connected. Select Manage to change its settings later. Changing the endpoint or regenerating the secret requires another successful test. See Notification Webhook for the payload, signature verification, and retry behavior.

​

Slack decisions

Supported Slack messages can include Approve and Deny actions. Before applying a decision, Forge verifies:

• The Slack request signature.
• The connected workspace.
• The Slack user’s linked Forge identity.
• The current request owner.
• The request’s current state.
• The decision and scope permitted by the workflow.

Unauthorized, stale, duplicate, or already-resolved actions do not change the request. After a successful decision, Forge updates the original Slack message and records the actor and outcome. A notification destination does not become an owner merely because it receives a message. Decision authority continues to come from the matching Ownership assignment and the user’s Forge permissions.

​

Test notifications

After configuring a destination, select Send test. Forge sends a test through each enabled notification channel and displays the result. Recent delivery records show:

• Provider.
• Destination.
• Delivery status.
• Attempt count.
• Delivery time.
• A bounded error when delivery fails.

A successful test proves that Forge could deliver the test message. It does not verify that every owner has a correctly linked directory, email, or Slack identity.

​

Delivery failures

If a Slack notification does not arrive:

1. Confirm the expected workspace is connected.
2. Confirm the Forge Slack app can see the selected channel.
3. Confirm the channel is not archived.
4. For direct messages, confirm the Forge directory email matches the Slack account email.
5. Reconnect Slack if the app was removed or its token was revoked.
6. Send another test and inspect the delivery status.

When Slack is disconnected, existing Slack owner preferences cannot deliver. Saving an affected owner assignment while Slack remains disconnected removes the unavailable Slack method. A failed external notification does not delete the underlying governance request. Authorized reviewers can still find it in Responses.

​

Audit trail

Forge records notification administration and delivery evidence, including:

• Notification setting changes.
• Slack connection changes.
• Test-notification requests.
• Generated events.
• Delivery provider and destination.
• Delivery state and attempts.
• Interactive Slack decisions and outcomes.

Notification records contain bounded event summaries and links to Forge. Slack is not used to ingest workspace message history as session or AI inventory. Use the Audit Log for administrative history and Responses for the underlying governance decision.

​

Related pages