Before
Reviewers manually researched unfamiliar applications, compared findings with usage and approved alternatives, and recorded the assessment separately. When notification was needed, they also had to look up affected users and coordinate individual notifications.
How it works
- Receive an unapproved application event and gather its usage, catalogue, approved-alternative, and public research context.
- Assess risk, validate the AI result against the notification policy, and record the qualification before routing continues.
- If notification is enabled and required, find distinct affected users, invoke the notification workflow for each, and summarize the outcomes.
Workflow details
- Intake and research: When an unapproved application is observed or requalified, the flow combines usage, departments, catalogue status, and approved alternatives with public research on the vendor, hosting, privacy, AI training, and security information.
- Risk qualification: An AI assessment returns application context, data exposure, risk level, reasons, confidence, and an approved alternative when available. A validation layer checks the response, handles missing evidence, restricts alternatives to the authorized catalogue, and applies the notification policy: high or critical risk qualifies, while medium risk requires an approved alternative and at least 100 MB sent.
- Record and route: The qualification is recorded in Artifacts before any notification path begins. Other cases remain report-only or ignored according to the assessment and policy checks.
- Targeted notification: When notification is enabled and required, the flow queries usage records for distinct email logins, limits the lookup to 200 users, and invokes the notification workflow for each person, then summarizes notified, already-notified, not-found, and error outcomes.
What changed
The assessment, policy validation, and Artifacts record are completed in one flow before notification begins. Required user lookups and per-user notification handoffs are generated automatically, while report-only and ignored cases stop without notification.
Work removed
Manually researching application vendors, copying usage and research data into an assessment, checking risk and notification thresholds, looking up affected user logins, initiating individual notifications, and tallying delivery outcomes.
Expected outcome
A reusable, traceable assessment is produced for each triggered application, with up to 200 user records eligible for targeted notification when policy and the enablement setting require it.
