{
  "name": "Route IAM events with GPT-4o-mini, forgeLLM, Slack, email, and audit logs",
  "nodes": [
    {
      "id": "f7e0a39e-40b2-432f-b801-423513af3b0e",
      "name": "Receive IAM Event",
      "type": "n8n-nodes-base.webhook",
      "position": [
        240,
        576
      ]
    },
    {
      "id": "26355701-d643-4d5c-855d-2550f928ab8d",
      "name": "Governance Agent",
      "type": "@n8n/n8n-nodes-langchain.agent",
      "position": [
        1024,
        576
      ]
    },
    {
      "id": "1affc496-cb3e-452e-92fb-5f22687675ba",
      "name": "Governance Model",
      "type": "@n8n/n8n-nodes-langchain.lmChatOpenAi",
      "position": [
        464,
        800
      ]
    },
    {
      "id": "ba81b3a7-266c-4b0f-a6ab-809c4760e3db",
      "name": "Conversation Memory",
      "type": "@n8n/n8n-nodes-langchain.memoryBufferWindow",
      "position": [
        592,
        800
      ]
    },
    {
      "id": "fc93a4b4-3603-42ed-b055-18357384a1bf",
      "name": "Access Signal Agent",
      "type": "@n8n/n8n-nodes-langchain.agentTool",
      "position": [
        720,
        800
      ]
    },
    {
      "id": "0fba0275-4e87-46de-8f1d-2699f0ee08e8",
      "name": "Access Signal Model",
      "type": "@n8n/n8n-nodes-langchain.lmChatOpenAi",
      "position": [
        672,
        1008
      ]
    },
    {
      "id": "91ef5ab1-b9a5-4fbd-8918-c99ae37b1c72",
      "name": "Governance Output Parser",
      "type": "@n8n/n8n-nodes-langchain.outputParserStructured",
      "position": [
        1744,
        800
      ]
    },
    {
      "id": "ef038eaa-e54f-486e-9be3-60bc8953c5a7",
      "name": "Validation Output Parser",
      "type": "@n8n/n8n-nodes-langchain.outputParserStructured",
      "position": [
        864,
        1008
      ]
    },
    {
      "id": "676c7cd7-dd20-447e-b715-065c094c930f",
      "name": "forgeLLM API Tool",
      "type": "n8n-nodes-base.httpRequestTool",
      "position": [
        1040,
        768
      ]
    },
    {
      "id": "ec6f3988-e4d2-4652-aa4c-ed4e2f5798f7",
      "name": "Slack Notification Tool",
      "type": "n8n-nodes-base.slackTool",
      "position": [
        1136,
        896
      ]
    },
    {
      "id": "94e72945-3dcd-4f02-8973-02a2eb806c36",
      "name": "Email Notification Tool",
      "type": "n8n-nodes-base.gmailTool",
      "position": [
        1280,
        800
      ]
    },
    {
      "id": "a0bd5b97-ec29-423d-99f5-da1b637f9684",
      "name": "Audit Log Tool",
      "type": "n8n-nodes-base.dataTableTool",
      "position": [
        1408,
        800
      ]
    },
    {
      "id": "aca59098-e567-4736-84fe-22e3ef35952e",
      "name": "Compliance Query Tool",
      "type": "n8n-nodes-base.dataTableTool",
      "position": [
        1568,
        800
      ]
    },
    {
      "id": "82137ccf-8b47-4c5d-a0b9-3ceae3eacc7c",
      "name": "Route by Decision",
      "type": "n8n-nodes-base.switch",
      "position": [
        1936,
        640
      ]
    },
    {
      "id": "d4c10a49-f3dc-47eb-a167-865624a3015d",
      "name": "Store Approved Events",
      "type": "n8n-nodes-base.dataTable",
      "position": [
        2448,
        528
      ]
    },
    {
      "id": "12ae62c9-1891-408c-9c79-a6080c29190e",
      "name": "Store Revoked Events",
      "type": "n8n-nodes-base.dataTable",
      "position": [
        2448,
        800
      ]
    },
    {
      "id": "7bd206cd-53c0-476d-8aa4-22a1ebe344ee",
      "name": "Store Escalated Events",
      "type": "n8n-nodes-base.dataTable",
      "position": [
        2448,
        1088
      ]
    },
    {
      "id": "3c971b20-48d2-4aca-839d-d1dd457747b8",
      "name": "Return Response",
      "type": "n8n-nodes-base.respondToWebhook",
      "position": [
        2672,
        800
      ]
    },
    {
      "id": "3adeae89-c376-4082-877e-dbd70105183f",
      "name": "Prepare Approved Data",
      "type": "n8n-nodes-base.set",
      "position": [
        2224,
        560
      ]
    },
    {
      "id": "215d2c50-dbb1-4682-ac23-1d6be5f9e96b",
      "name": "Prepare Revoked Data",
      "type": "n8n-nodes-base.set",
      "position": [
        2224,
        720
      ]
    },
    {
      "id": "7203c53a-b326-48dd-82b4-8e3797131c95",
      "name": "Prepare Escalated Data",
      "type": "n8n-nodes-base.set",
      "position": [
        2224,
        1008
      ]
    },
    {
      "id": "4fd6004b-aec7-49ca-8a25-60849cb9c12a",
      "name": "Sticky Note",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        112,
        16
      ],
      "parameters": {
        "width": 592,
        "height": 352,
        "content": "## How It Works\nThis workflow automates Identity and Access Management (IAM) event governance using an AI agent, targeting security operations teams, compliance officers, and IT governance teams manag"
      }
    },
    {
      "id": "df496e71-cffa-4e0c-a3ca-93417b835229",
      "name": "Sticky Note1",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        816,
        0
      ],
      "parameters": {
        "width": 432,
        "height": 336,
        "content": "## Setup Steps\n1. Configure the Webhook node with your IAM event source endpoint.\n2. Add LLM credentials to the forgeLLM API Tool node.\n3. Set up Governance Model with your policy prompt and connect C"
      }
    },
    {
      "id": "58111447-a957-44a0-a0dc-4c0dad4f6968",
      "name": "Sticky Note2",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1328,
        -64
      ],
      "parameters": {
        "width": 400,
        "height": 368,
        "content": "## Prerequisites\n- forgeLLM or compatible LLM API key\n- Slack Bot token\n- Gmail/SMTP credentials\n## Use Cases\n- Automatically approve or revoke IAM role assignments based on policy.\n## Customization\n-"
      }
    },
    {
      "id": "fe07e97f-41c4-4711-9142-45685aafb058",
      "name": "Sticky Note3",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        992,
        432
      ],
      "parameters": {
        "width": 880,
        "height": 704,
        "content": "## Compliance & Audit\n**What:** Queries compliance rules; logs event details to audit store.\n**Why:** Ensures regulatory traceability and policy alignment."
      }
    },
    {
      "id": "f39e60a8-945d-44b3-bfd5-f8db58060a83",
      "name": "Sticky Note4",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1888,
        432
      ],
      "parameters": {
        "width": 496,
        "height": 848,
        "content": "\n## Route by Decision\n**What:** Rules engine splits events into Approved, Revoked, or Escalated paths.\n**Why:** Automates downstream handling based on AI verdict.\n"
      }
    },
    {
      "id": "c5cc2514-aa83-4fe9-bcca-f8f4e075854b",
      "name": "Sticky Note5",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        112,
        432
      ],
      "parameters": {
        "width": 864,
        "height": 832,
        "content": "## Receive & Evaluate IAM Event\n**What:** Webhook triggers on incoming IAM event payload; LLM agent immediately assesses it using memory.\n**Why:** Enables real-time, event-driven governance while appl"
      }
    },
    {
      "id": "c1d1a394-9256-4d37-95eb-eb6b82ce34ef",
      "name": "Sticky Note6",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        2400,
        400
      ],
      "parameters": {
        "width": 416,
        "height": 864,
        "content": "\n## Store & Respond\n**What:** Prepares and stores classified event data; returns response.\n**Why:** Maintains a structured audit trail and closes the governance loop."
      }
    }
  ],
  "connections": {
    "Audit Log Tool": {
      "ai_tool": [
        [
          {
            "node": "Governance Agent",
            "type": "ai_tool",
            "index": 0
          }
        ]
      ]
    },
    "Governance Agent": {
      "main": [
        [
          {
            "node": "Route by Decision",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Governance Model": {
      "ai_languageModel": [
        [
          {
            "node": "Governance Agent",
            "type": "ai_languageModel",
            "index": 0
          }
        ]
      ]
    },
    "Receive IAM Event": {
      "main": [
        [
          {
            "node": "Governance Agent",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Route by Decision": {
      "main": [
        [
          {
            "node": "Prepare Approved Data",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Store Revoked Events",
            "type": "main",
            "index": 0
          },
          {
            "node": "Prepare Revoked Data",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Store Escalated Events",
            "type": "main",
            "index": 0
          },
          {
            "node": "Prepare Escalated Data",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "forgeLLM API Tool": {
      "ai_tool": [
        [
          {
            "node": "Governance Agent",
            "type": "ai_tool",
            "index": 0
          }
        ]
      ]
    },
    "Access Signal Agent": {
      "ai_tool": [
        [
          {
            "node": "Governance Agent",
            "type": "ai_tool",
            "index": 0
          }
        ]
      ]
    },
    "Access Signal Model": {
      "ai_languageModel": [
        [
          {
            "node": "Access Signal Agent",
            "type": "ai_languageModel",
            "index": 0
          }
        ]
      ]
    },
    "Conversation Memory": {
      "ai_memory": [
        [
          {
            "node": "Governance Agent",
            "type": "ai_memory",
            "index": 0
          }
        ]
      ]
    },
    "Prepare Revoked Data": {
      "main": [
        [
          {
            "node": "Store Revoked Events",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Store Revoked Events": {
      "main": [
        [
          {
            "node": "Return Response",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Compliance Query Tool": {
      "ai_tool": [
        [
          {
            "node": "Governance Agent",
            "type": "ai_tool",
            "index": 0
          }
        ]
      ]
    },
    "Prepare Approved Data": {
      "main": [
        [
          {
            "node": "Store Approved Events",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Store Approved Events": {
      "main": [
        [
          {
            "node": "Return Response",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Prepare Escalated Data": {
      "main": [
        [
          {
            "node": "Store Escalated Events",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Store Escalated Events": {
      "main": [
        [
          {
            "node": "Return Response",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Email Notification Tool": {
      "ai_tool": [
        [
          {
            "node": "Governance Agent",
            "type": "ai_tool",
            "index": 0
          }
        ]
      ]
    },
    "Slack Notification Tool": {
      "ai_tool": [
        [
          {
            "node": "Governance Agent",
            "type": "ai_tool",
            "index": 0
          }
        ]
      ]
    },
    "Governance Output Parser": {
      "ai_outputParser": [
        [
          {
            "node": "Governance Agent",
            "type": "ai_outputParser",
            "index": 0
          }
        ]
      ]
    },
    "Validation Output Parser": {
      "ai_outputParser": [
        [
          {
            "node": "Access Signal Agent",
            "type": "ai_outputParser",
            "index": 0
          }
        ]
      ]
    }
  }
}