Alerts and ticketing

Policy rules with action: alert (or with an alert: block on any action) notify people where they already work. PromptGlass supports Slack, Microsoft Teams, email, PagerDuty, generic webhooks, and ticket creation in ServiceNow and Jira. Notifications carry pseudonymous identities by default and link back to the event in the console.

Channels

apiVersion: promptglass.ai/v1
kind: Destination
metadata: { name: slack-ai-risk }
spec:
  type: slack
  webhookSecret: slack-ai-risk-webhook
---
kind: Destination
metadata: { name: teams-governance }
spec:
  type: teams
  workflowUrlSecret: teams-governance-workflow   # Teams Workflows (Power Automate) webhook
---
kind: Destination
metadata: { name: servicenow }
spec:
  type: servicenow
  instance: acme.service-now.com
  table: sn_si_incident            # or incident, sc_task
  credentialsSecret: snow-oauth
  mapping:
    short_description: "AI data exposure: {{detections}} in {{app}}"
    assignment_group: "Security Operations"
    severity: "{{severity}}"

Refer to destinations in rules as channels: ["slack:slack-ai-risk", "servicenow"].

Throttling and digests

• throttle per rule suppresses repeat alerts for the same user and rule within a window.
• digest: daily groups low-severity alerts into one message per channel.

Workflow automations

Trigger	Automation
Idle seat found	Ticket to IT asset management to reclaim the license, or a “use it or lose it” email to the user
New shadow AI app crosses a user threshold	Review ticket for the AI governance board
secret.* blocked	Security incident + Slack message to the secret owner’s team to rotate
Budget at 80%	Teams message to the budget owner

Webhooks

POST https://hooks.example.com/promptglass
X-PromptGlass-Signature: t=1730556191,v1=5f2b…   (HMAC-SHA256 of body with your signing secret)
{ "type": "alert", "event_id": "evt_01JD4…", "rule": "block-secrets", "severity": "high", "app": "claude-personal", "actor": { "pid": "u_7f3a91", "department": "Engineering" } }

Verify the signature and reject timestamps older than five minutes.