Cheng Siong Chin This workflow corresponds to n8n.io template #13330 — we link there as the canonical source.
This workflow follows the Agent → Agenttool recipe pattern — see all workflows that pair these two integrations.
The workflow JSON
Copy or download the full n8n JSON below. Paste it into a new n8n workflow, add your credentials, activate. Full import guide →
{
"id": "FB7OKsmUCMgwor-6FW4xp",
"name": "AI-driven procurement fraud detection & supplier compliance system",
"tags": [],
"nodes": [
{
"id": "752a202d-bffb-4c07-9e38-324f9f783007",
"name": "Schedule Trigger",
"type": "n8n-nodes-base.scheduleTrigger",
"position": [
-1936,
508
],
"parameters": {
"rule": {
"interval": [
{
"field": "minutes",
"minutesInterval": 15
}
]
}
},
"typeVersion": 1.3
},
{
"id": "0a741961-8286-49f5-aa7d-8e7b361734ed",
"name": "Workflow Configuration",
"type": "n8n-nodes-base.set",
"position": [
-1712,
508
],
"parameters": {
"options": {},
"assignments": {
"assignments": [
{
"id": "id-1",
"name": "criticalSlackChannel",
"type": "string",
"value": "<__PLACEHOLDER_VALUE__Critical Events Slack Channel ID__>"
},
{
"id": "id-2",
"name": "highPrioritySlackChannel",
"type": "string",
"value": "<__PLACEHOLDER_VALUE__High Priority Slack Channel ID__>"
},
{
"id": "id-3",
"name": "escalationEmail",
"type": "string",
"value": "<__PLACEHOLDER_VALUE__Escalation Team Email Address__>"
},
{
"id": "id-4",
"name": "criticalEmailRecipient",
"type": "string",
"value": "<__PLACEHOLDER_VALUE__Critical Events Email Recipient__>"
},
{
"id": "id-5",
"name": "priorityThresholdCritical",
"type": "number",
"value": 90
},
{
"id": "id-6",
"name": "priorityThresholdHigh",
"type": "number",
"value": 70
},
{
"id": "id-7",
"name": "priorityThresholdMedium",
"type": "number",
"value": 40
}
]
},
"includeOtherFields": true
},
"typeVersion": 3.4
},
{
"id": "efd381fb-b497-445c-8887-3c6f4d2f8cc4",
"name": "Generate Sample Events",
"type": "n8n-nodes-base.code",
"position": [
-1488,
508
],
"parameters": {
"jsCode": "// Generate 5 sample events with varying severity levels and types\nconst events = [\n {\n event_id: \"EVT-001\",\n event_type: \"system_alert\",\n severity: \"critical\",\n description: \"Database server CPU usage exceeded 95% threshold\",\n timestamp: new Date().toISOString(),\n source_system: \"monitoring-prod-db-01\",\n metadata: {\n affected_users: 1500,\n impact_score: 9.2,\n server_name: \"prod-db-primary\",\n cpu_usage: 97.3\n }\n },\n {\n event_id: \"EVT-002\",\n event_type: \"security_incident\",\n severity: \"high\",\n description: \"Multiple failed login attempts detected from unusual IP address\",\n timestamp: new Date(Date.now() - 300000).toISOString(),\n source_system: \"security-auth-service\",\n metadata: {\n affected_users: 1,\n impact_score: 7.8,\n ip_address: \"192.168.45.123\",\n failed_attempts: 15\n }\n },\n {\n event_id: \"EVT-003\",\n event_type: \"performance_degradation\",\n severity: \"medium\",\n description: \"API response time increased by 40% over baseline\",\n timestamp: new Date(Date.now() - 600000).toISOString(),\n source_system: \"api-gateway-prod\",\n metadata: {\n affected_users: 350,\n impact_score: 5.5,\n avg_response_time: \"850ms\",\n baseline: \"600ms\"\n }\n },\n {\n event_id: \"EVT-004\",\n event_type: \"user_complaint\",\n severity: \"low\",\n description: \"User reported slow page load times on dashboard\",\n timestamp: new Date(Date.now() - 900000).toISOString(),\n source_system: \"support-ticket-system\",\n metadata: {\n affected_users: 1,\n impact_score: 2.3,\n ticket_id: \"SUPP-4521\",\n user_tier: \"free\"\n }\n },\n {\n event_id: \"EVT-005\",\n event_type: \"data_anomaly\",\n severity: \"high\",\n description: \"Unusual spike in transaction failures detected\",\n timestamp: new Date(Date.now() - 1200000).toISOString(),\n source_system: \"payment-processing\",\n metadata: {\n affected_users: 450,\n impact_score: 8.1,\n failure_rate: \"12.5%\",\n normal_rate: \"0.8%\"\n }\n }\n];\n\n// Return the events as separate items\nreturn events.map(event => ({ json: event }));"
},
"typeVersion": 2
},
{
"id": "3de724c0-a62f-4f8c-9da4-309f5081b870",
"name": "OpenAI Model - Prioritization Agent",
"type": "@n8n/n8n-nodes-langchain.lmChatOpenAi",
"position": [
-1360,
752
],
"parameters": {
"model": {
"__rl": true,
"mode": "id",
"value": "gpt-4o"
},
"options": {
"temperature": 0.2
},
"builtInTools": {}
},
"credentials": {
"openAiApi": {
"name": "<your credential>"
}
},
"typeVersion": 1.3
},
{
"id": "f52b8d9f-324f-4aa3-b27c-aad714fc50f3",
"name": "Structured Output - Prioritization",
"type": "@n8n/n8n-nodes-langchain.outputParserStructured",
"position": [
-1136,
732
],
"parameters": {
"schemaType": "manual",
"inputSchema": "{\n\t\"type\": \"object\",\n\t\"properties\": {\n\t\t\"priorityScore\": {\n\t\t\t\"type\": \"number\",\n\t\t\t\"minimum\": 0,\n\t\t\t\"maximum\": 100,\n\t\t\t\"description\": \"Numerical priority score from 0 to 100\"\n\t\t},\n\t\t\"priorityLevel\": {\n\t\t\t\"type\": \"string\",\n\t\t\t\"enum\": [\"critical\", \"high\", \"medium\", \"low\"],\n\t\t\t\"description\": \"Priority level classification\"\n\t\t},\n\t\t\"riskAssessment\": {\n\t\t\t\"type\": \"string\",\n\t\t\t\"description\": \"Assessment of risks associated with the signal\"\n\t\t},\n\t\t\"impactAnalysis\": {\n\t\t\t\"type\": \"string\",\n\t\t\t\"description\": \"Analysis of potential impact\"\n\t\t},\n\t\t\"recommendedActions\": {\n\t\t\t\"type\": \"array\",\n\t\t\t\"items\": {\n\t\t\t\t\"type\": \"string\"\n\t\t\t},\n\t\t\t\"description\": \"List of recommended actions to take\"\n\t\t},\n\t\t\"requiresEscalation\": {\n\t\t\t\"type\": \"boolean\",\n\t\t\t\"description\": \"Whether this signal requires escalation\"\n\t\t},\n\t\t\"reasoning\": {\n\t\t\t\"type\": \"string\",\n\t\t\t\"description\": \"Reasoning behind the prioritization decision\"\n\t\t}\n\t},\n\t\"required\": [\"priorityScore\", \"priorityLevel\", \"riskAssessment\", \"impactAnalysis\", \"recommendedActions\", \"requiresEscalation\", \"reasoning\"]\n}"
},
"typeVersion": 1.3
},
{
"id": "95480795-d8f5-4b97-ab65-dd508e70db07",
"name": "Signal Prioritization Agent",
"type": "@n8n/n8n-nodes-langchain.agent",
"position": [
-1208,
508
],
"parameters": {
"text": "=Event Data: {{ JSON.stringify($json) }}",
"options": {
"systemMessage": "You are a Signal Prioritization Agent specialized in evaluating structured events and assigning priority scores.\n\nYour task is to:\n1. Analyze incoming event data including type, severity, description, affected systems, and impact metrics\n2. Calculate a priority score (0-100) based on:\n - Severity level and urgency\n - Number of affected users/systems\n - Business impact and financial implications\n - Security and compliance risks\n - Historical patterns and trends\n3. Assign priority level: critical (90-100), high (70-89), medium (40-69), low (0-39)\n4. Perform risk assessment identifying potential cascading failures\n5. Conduct impact analysis on business operations, user experience, and system stability\n6. Recommend specific actions with priority order\n7. Determine if escalation to senior management is required (critical events or high-risk situations)\n8. Use the Enrichment Agent Tool to gather additional context about affected systems, users, or historical incidents\n9. Provide detailed reasoning for all assessments\n\nConsider:\n- Time sensitivity and SLA requirements\n- Regulatory and compliance implications\n- Customer-facing vs internal impact\n- Resource availability for remediation\n- Potential for automation vs manual intervention"
},
"promptType": "define",
"hasOutputParser": true
},
"typeVersion": 3.1
},
{
"id": "47348986-8c0c-4727-99a5-744743ce4c7c",
"name": "OpenAI Model - Enrichment Agent",
"type": "@n8n/n8n-nodes-langchain.lmChatOpenAi",
"position": [
-1104,
960
],
"parameters": {
"model": {
"__rl": true,
"mode": "id",
"value": "gpt-4o"
},
"options": {
"temperature": 0.3
},
"builtInTools": {}
},
"credentials": {
"openAiApi": {
"name": "<your credential>"
}
},
"typeVersion": 1.3
},
{
"id": "4e965551-3bb1-4492-a733-8838d792c197",
"name": "Structured Output - Enrichment",
"type": "@n8n/n8n-nodes-langchain.outputParserStructured",
"position": [
-840,
940
],
"parameters": {
"schemaType": "manual",
"inputSchema": "{\n\t\"type\": \"object\",\n\t\"properties\": {\n\t\t\"enrichedData\": {\n\t\t\t\"type\": \"object\"\n\t\t},\n\t\t\"historicalContext\": {\n\t\t\t\"type\": \"string\"\n\t\t},\n\t\t\"relatedIncidents\": {\n\t\t\t\"type\": \"array\"\n\t\t},\n\t\t\"systemHealth\": {\n\t\t\t\"type\": \"object\",\n\t\t\t\"properties\": {\n\t\t\t\t\"status\": {\n\t\t\t\t\t\"type\": \"string\"\n\t\t\t\t},\n\t\t\t\t\"metrics\": {\n\t\t\t\t\t\"type\": \"object\"\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\t\t\"userImpactDetails\": {\n\t\t\t\"type\": \"object\"\n\t\t},\n\t\t\"recommendations\": {\n\t\t\t\"type\": \"array\",\n\t\t\t\"items\": {\n\t\t\t\t\"type\": \"string\"\n\t\t\t}\n\t\t}\n\t}\n}"
},
"typeVersion": 1.3
},
{
"id": "45e05022-2f58-4bf4-af5c-70726916d9e9",
"name": "Enrichment Agent Tool",
"type": "@n8n/n8n-nodes-langchain.agentTool",
"position": [
-1008,
732
],
"parameters": {
"text": "={{ $fromAI(\"enrichmentQuery\", \"Query for enrichment including system name, user ID, or incident type\", \"string\") }}",
"options": {
"systemMessage": "You are an Enrichment Agent Tool that provides additional context and historical data for event analysis.\n\nYour task is to:\n1. Process enrichment queries for systems, users, or incident types\n2. Retrieve historical incident data and patterns\n3. Provide system health metrics and status information\n4. Identify related incidents and correlations\n5. Calculate user impact details including affected user count and business criticality\n6. Return comprehensive enriched data with context\n\nProvide structured, actionable enrichment data to support prioritization decisions."
},
"hasOutputParser": true,
"toolDescription": "Enriches event data with historical context, system health metrics, related incidents, and user impact analysis"
},
"typeVersion": 3
},
{
"id": "559108e8-680a-4227-a4fd-a22d301b0d02",
"name": "OpenAI Model - Delivery Agent",
"type": "@n8n/n8n-nodes-langchain.lmChatOpenAi",
"position": [
-592,
732
],
"parameters": {
"model": {
"__rl": true,
"mode": "id",
"value": "gpt-4o"
},
"options": {
"temperature": 0.2
},
"builtInTools": {}
},
"credentials": {
"openAiApi": {
"name": "<your credential>"
}
},
"typeVersion": 1.3
},
{
"id": "68c681f0-4598-4011-afa1-51edeebda220",
"name": "Structured Output - Delivery",
"type": "@n8n/n8n-nodes-langchain.outputParserStructured",
"position": [
-464,
732
],
"parameters": {
"schemaType": "manual",
"inputSchema": "{\n\t\"type\": \"object\",\n\t\"properties\": {\n\t\t\"deliveryChannels\": {\n\t\t\t\"type\": \"array\",\n\t\t\t\"items\": {\n\t\t\t\t\"type\": \"string\",\n\t\t\t\t\"enum\": [\"slack\", \"email\", \"both\"]\n\t\t\t}\n\t\t},\n\t\t\"notificationUrgency\": {\n\t\t\t\"type\": \"string\",\n\t\t\t\"enum\": [\"immediate\", \"scheduled\", \"batched\"]\n\t\t},\n\t\t\"messageContent\": {\n\t\t\t\"type\": \"object\",\n\t\t\t\"properties\": {\n\t\t\t\t\"subject\": {\n\t\t\t\t\t\"type\": \"string\"\n\t\t\t\t},\n\t\t\t\t\"body\": {\n\t\t\t\t\t\"type\": \"string\"\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\t\t\"recipientGroups\": {\n\t\t\t\"type\": \"array\",\n\t\t\t\"items\": {\n\t\t\t\t\"type\": \"string\"\n\t\t\t}\n\t\t},\n\t\t\"deliveryTiming\": {\n\t\t\t\"type\": \"string\"\n\t\t},\n\t\t\"escalationPath\": {\n\t\t\t\"type\": \"array\",\n\t\t\t\"items\": {\n\t\t\t\t\"type\": \"string\"\n\t\t\t}\n\t\t}\n\t}\n}"
},
"typeVersion": 1.3
},
{
"id": "1280d523-52a2-4928-b467-5006b16d2492",
"name": "Slack Tool",
"type": "n8n-nodes-base.slackTool",
"position": [
-336,
732
],
"parameters": {
"text": "={{ $fromAI('slackMessage', 'Message content for Slack notification', 'string') }}",
"select": "channel",
"channelId": {
"__rl": true,
"mode": "id",
"value": "={{ $fromAI('slackChannel', 'Slack channel ID for notification', 'string') }}"
},
"otherOptions": {},
"authentication": "oAuth2"
},
"credentials": {
"slackOAuth2Api": {
"name": "<your credential>"
}
},
"typeVersion": 2.4
},
{
"id": "5d25ad79-6b61-4137-8917-b766900901a5",
"name": "Email Tool",
"type": "@n8n/n8n-nodes-langchain.toolCode",
"position": [
-208,
732
],
"parameters": {
"jsCode": "// Simulate email sending by returning confirmation with recipient, subject, and body\nconst to = $fromAI('to', 'Email recipient address', 'string');\nconst subject = $fromAI('subject', 'Email subject line', 'string');\nconst messageBody = $fromAI('messageBody', 'Email message body content', 'string');\n\nreturn `Email sent successfully to ${to} with subject \"${subject}\". Message: ${messageBody}`;",
"description": "Sends email notifications with customizable recipients, subject, and body content"
},
"typeVersion": 1.3
},
{
"id": "bff1b9d9-1f2b-4dbd-8b73-fa559c4158cf",
"name": "Delivery Orchestration Agent",
"type": "@n8n/n8n-nodes-langchain.agent",
"position": [
-472,
508
],
"parameters": {
"text": "=Prioritized Event Data: {{ JSON.stringify($json) }}",
"options": {
"systemMessage": "You are a Delivery Orchestration Agent responsible for intelligent routing and notification delivery.\n\nYour task is to:\n1. Analyze the prioritized event data including priority score, level, risk assessment, and impact analysis\n2. Determine optimal delivery channels (Slack, Email, or both) based on priority and urgency\n3. Decide notification urgency: immediate (critical/high), scheduled (medium), or batched (low)\n4. Craft appropriate message content for each channel with proper formatting\n5. Identify recipient groups based on event type and severity\n6. Determine delivery timing and escalation path\n7. Use Slack Tool for Slack notifications and Email Tool for email notifications\n8. Coordinate multi-channel delivery for critical events\n\nFor critical events (priority >= 90):\n- Use both Slack and Email\n- Immediate delivery\n- Include full risk assessment and recommended actions\n\nFor high priority events (70-89):\n- Use Slack primarily\n- Immediate delivery\n- Include impact analysis and actions\n\nFor medium/low priority:\n- Use scheduled or batched delivery\n- Consolidated notifications\n\nReturn structured delivery plan with all required fields."
},
"promptType": "define",
"hasOutputParser": true
},
"typeVersion": 3.1
},
{
"id": "f91ac73a-d3c7-4c83-aedb-3504a0077989",
"name": "Route by Priority",
"type": "n8n-nodes-base.switch",
"position": [
112,
656
],
"parameters": {
"rules": {
"values": [
{
"outputKey": "Critical",
"conditions": {
"options": {
"leftValue": "",
"caseSensitive": false,
"typeValidation": "loose"
},
"combinator": "and",
"conditions": [
{
"operator": {
"type": "string",
"operation": "equals"
},
"leftValue": "={{ $json.output.priorityLevel }}",
"rightValue": "critical"
}
]
},
"renameOutput": true
},
{
"outputKey": "High",
"conditions": {
"options": {
"leftValue": "",
"caseSensitive": false,
"typeValidation": "loose"
},
"combinator": "and",
"conditions": [
{
"operator": {
"type": "string",
"operation": "equals"
},
"leftValue": "={{ $json.output.priorityLevel }}",
"rightValue": "high"
}
]
},
"renameOutput": true
},
{
"outputKey": "Medium",
"conditions": {
"options": {
"leftValue": "",
"caseSensitive": false,
"typeValidation": "loose"
},
"combinator": "and",
"conditions": [
{
"operator": {
"type": "string",
"operation": "equals"
},
"leftValue": "={{ $json.output.priorityLevel }}",
"rightValue": "medium"
}
]
},
"renameOutput": true
},
{
"outputKey": "Low",
"conditions": {
"options": {
"leftValue": "",
"caseSensitive": false,
"typeValidation": "loose"
},
"combinator": "and",
"conditions": [
{
"operator": {
"type": "string",
"operation": "equals"
},
"leftValue": "={{ $json.output.priorityLevel }}",
"rightValue": "low"
}
]
},
"renameOutput": true
}
]
},
"options": {
"fallbackOutput": "extra",
"renameFallbackOutput": "Unclassified"
}
},
"typeVersion": 3.4
},
{
"id": "8824f18b-d686-40de-b7b0-3098542bc1c7",
"name": "Store Critical Events",
"type": "n8n-nodes-base.dataTable",
"position": [
352,
416
],
"parameters": {
"columns": {
"value": null,
"mappingMode": "autoMapInputData"
},
"options": {},
"dataTableId": {
"__rl": true,
"mode": "name",
"value": "critical_events"
}
},
"typeVersion": 1.1
},
{
"id": "0b8851d5-fc8f-47ef-b541-8e51ae766150",
"name": "Store High Priority Events",
"type": "n8n-nodes-base.dataTable",
"position": [
640,
608
],
"parameters": {
"columns": {
"value": null,
"mappingMode": "autoMapInputData"
},
"options": {},
"dataTableId": {
"__rl": true,
"mode": "name",
"value": "high_priority_events"
}
},
"typeVersion": 1.1
},
{
"id": "a1ac83df-2755-4ff7-b7ce-b80f089a2e41",
"name": "Store Medium Priority Events",
"type": "n8n-nodes-base.dataTable",
"position": [
864,
800
],
"parameters": {
"columns": {
"value": null,
"mappingMode": "autoMapInputData"
},
"options": {},
"dataTableId": {
"__rl": true,
"mode": "name",
"value": "medium_priority_events"
}
},
"typeVersion": 1.1
},
{
"id": "5f7acebd-9be2-4baa-9f5b-14ed4745c0f6",
"name": "Store Low Priority Events",
"type": "n8n-nodes-base.dataTable",
"position": [
864,
992
],
"parameters": {
"columns": {
"value": null,
"mappingMode": "autoMapInputData"
},
"options": {},
"dataTableId": {
"__rl": true,
"mode": "name",
"value": "low_priority_events"
}
},
"typeVersion": 1.1
},
{
"id": "8bfef42b-2f34-4867-ad19-a5949fe9510f",
"name": "Notify Critical - Slack",
"type": "n8n-nodes-base.slack",
"position": [
640,
416
],
"parameters": {
"text": "=\ud83d\udea8 CRITICAL EVENT ALERT \ud83d\udea8\n\nPriority Score: {{ $json.output.priorityScore }}/100\nEvent Type: {{ $json.eventType }}\nSource: {{ $json.sourceSystem }}\n\n\ud83d\udccb Description:\n{{ $json.description }}\n\n\u26a0\ufe0f Risk Assessment:\n{{ $json.output.riskAssessment }}\n\n\ud83d\udcca Impact Analysis:\n{{ $json.output.impactAnalysis }}\n\n\u2705 Recommended Actions:\n{{ $json.output.recommendedActions.map((action, i) => `${i + 1}. ${action}`).join(\"\\n\") }}\n\n{{ $json.output.requiresEscalation ? \"\u2b06\ufe0f ESCALATION REQUIRED\" : \"\" }}\n\nTimestamp: {{ $json.timestamp }}",
"select": "channel",
"channelId": {
"__rl": true,
"mode": "id",
"value": "={{ $('Workflow Configuration').first().json.criticalSlackChannel }}"
},
"otherOptions": {},
"authentication": "oAuth2"
},
"credentials": {
"slackOAuth2Api": {
"name": "<your credential>"
}
},
"typeVersion": 2.4
},
{
"id": "04f25208-cc97-4aff-bb12-ade2805d46e3",
"name": "Notify Critical - Email",
"type": "n8n-nodes-base.emailSend",
"position": [
864,
416
],
"parameters": {
"html": "=<html><body><h2 style=\"color: #d32f2f;\">\ud83d\udea8 CRITICAL EVENT ALERT</h2><p><strong>Priority Score:</strong> {{ $json.output.priorityScore }}/100</p><p><strong>Event Type:</strong> {{ $json.eventType }}</p><p><strong>Source System:</strong> {{ $json.sourceSystem }}</p><h3>Description:</h3><p>{{ $json.description }}</p><h3>Risk Assessment:</h3><p>{{ $json.output.riskAssessment }}</p><h3>Impact Analysis:</h3><p>{{ $json.output.impactAnalysis }}</p><h3>Recommended Actions:</h3><ol>{{ $json.output.recommendedActions.map(action => `<li>${action}</li>`).join(\"\") }}</ol>{{ $json.output.requiresEscalation ? \"<p style=\\\"color: #d32f2f; font-weight: bold;\\\">\u2b06\ufe0f ESCALATION REQUIRED</p>\" : \"\" }}<p><strong>Timestamp:</strong> {{ $json.timestamp }}</p></body></html>",
"options": {},
"subject": "=CRITICAL: {{ $json.eventType }} - Priority {{ $json.output.priorityScore }}/100",
"toEmail": "={{ $('Workflow Configuration').first().json.criticalEmailRecipient }}",
"fromEmail": "<__PLACEHOLDER_VALUE__Sender Email Address__>"
},
"typeVersion": 2.1
},
{
"id": "b46af0d8-29a1-49b3-ba12-53e3668616f4",
"name": "Notify High - Slack",
"type": "n8n-nodes-base.slack",
"position": [
864,
608
],
"parameters": {
"text": "=\u26a0\ufe0f HIGH PRIORITY EVENT\n\nPriority Score: {{ $json.output.priorityScore }}/100\nEvent Type: {{ $json.eventType }}\nSource: {{ $json.sourceSystem }}\n\n\ud83d\udccb Description:\n{{ $json.description }}\n\n\ud83d\udcca Impact Analysis:\n{{ $json.output.impactAnalysis }}\n\n\u2705 Recommended Actions:\n{{ $json.output.recommendedActions.map((action, i) => `${i + 1}. ${action}`).join(\"\\n\") }}\n\nTimestamp: {{ $json.timestamp }}",
"select": "channel",
"channelId": {
"__rl": true,
"mode": "id",
"value": "={{ $('Workflow Configuration').first().json.highPrioritySlackChannel }}"
},
"otherOptions": {},
"authentication": "oAuth2"
},
"credentials": {
"slackOAuth2Api": {
"name": "<your credential>"
}
},
"typeVersion": 2.4
},
{
"id": "320990d1-15e7-49a4-a27b-f5ed13ea2969",
"name": "Merge All Notifications",
"type": "n8n-nodes-base.merge",
"position": [
1088,
672
],
"parameters": {
"mode": "combine",
"options": {},
"combineBy": "combineByPosition",
"numberInputs": 4
},
"typeVersion": 3.2
},
{
"id": "214bb8f2-248c-4241-9161-6bcd6c58c797",
"name": "Audit Log",
"type": "n8n-nodes-base.dataTable",
"position": [
1312,
704
],
"parameters": {
"columns": {
"value": null,
"mappingMode": "autoMapInputData"
},
"options": {},
"dataTableId": {
"__rl": true,
"mode": "name",
"value": "audit_log"
}
},
"typeVersion": 1.1
},
{
"id": "3413b680-356f-4f1a-ad44-34a94545b04e",
"name": "Check Escalation Required",
"type": "n8n-nodes-base.if",
"position": [
144,
1168
],
"parameters": {
"options": {},
"conditions": {
"options": {
"leftValue": "",
"caseSensitive": false,
"typeValidation": "loose"
},
"combinator": "and",
"conditions": [
{
"id": "id-1",
"operator": {
"type": "boolean",
"operation": "equals"
},
"leftValue": "={{ $json.output.requiresEscalation }}",
"rightValue": true
}
]
}
},
"typeVersion": 2.3
},
{
"id": "a5e5b4a5-15f8-47b5-8db1-5ce25c88a964",
"name": "OpenAI Model - Escalation Agent",
"type": "@n8n/n8n-nodes-langchain.lmChatOpenAi",
"position": [
384,
1392
],
"parameters": {
"model": {
"__rl": true,
"mode": "id",
"value": "gpt-4o"
},
"options": {
"temperature": 0.2
},
"builtInTools": {}
},
"credentials": {
"openAiApi": {
"name": "<your credential>"
}
},
"typeVersion": 1.3
},
{
"id": "61746131-27b2-439c-a95c-4a5ed53b61c7",
"name": "Structured Output - Escalation",
"type": "@n8n/n8n-nodes-langchain.outputParserStructured",
"position": [
512,
1392
],
"parameters": {
"schemaType": "manual",
"inputSchema": "{\n\t\"type\": \"object\",\n\t\"properties\": {\n\t\t\"escalationLevel\": {\n\t\t\t\"type\": \"string\",\n\t\t\t\"enum\": [\"executive\", \"senior_management\", \"technical_lead\"]\n\t\t},\n\t\t\"escalationReason\": {\n\t\t\t\"type\": \"string\"\n\t\t},\n\t\t\"executiveSummary\": {\n\t\t\t\"type\": \"string\"\n\t\t},\n\t\t\"businessImpact\": {\n\t\t\t\"type\": \"string\"\n\t\t},\n\t\t\"urgentActions\": {\n\t\t\t\"type\": \"array\",\n\t\t\t\"items\": {\n\t\t\t\t\"type\": \"string\"\n\t\t\t}\n\t\t},\n\t\t\"stakeholders\": {\n\t\t\t\"type\": \"array\",\n\t\t\t\"items\": {\n\t\t\t\t\"type\": \"string\"\n\t\t\t}\n\t\t},\n\t\t\"estimatedResolutionTime\": {\n\t\t\t\"type\": \"string\"\n\t\t}\n\t}\n}"
},
"typeVersion": 1.3
},
{
"id": "5c12a734-4e95-4953-a5d7-3aff4c9edc75",
"name": "Escalation Agent",
"type": "@n8n/n8n-nodes-langchain.agent",
"position": [
368,
1168
],
"parameters": {
"text": "=Analyze this escalation event and provide executive-level escalation details:\n\nEvent Type: {{ $json.eventType }}\nPriority: {{ $json.priority }}\nSeverity: {{ $json.severity }}\nDescription: {{ $json.description }}\nImpact: {{ $json.impact }}\nAffected Systems: {{ $json.affectedSystems }}\nEnrichment Data: {{ $json.enrichmentData }}",
"options": {
"systemMessage": "You are an escalation management agent responsible for preparing critical events for executive-level attention.\n\nYour task is to:\n1. Analyze the event details and determine the appropriate escalation level\n2. Craft a clear executive summary suitable for senior leadership\n3. Identify business impact and urgency\n4. Define specific urgent actions required\n5. Identify key stakeholders who need to be involved\n6. Estimate resolution timeframe\n\nProvide structured escalation information that enables rapid decision-making at the executive level."
},
"promptType": "define",
"hasOutputParser": true
},
"typeVersion": 3.1
},
{
"id": "904d68e6-e75e-43c2-845f-42ddb9195206",
"name": "Escalation Email",
"type": "n8n-nodes-base.emailSend",
"position": [
720,
1168
],
"parameters": {
"html": "=<html><body><h2 style=\"color: #d32f2f;\">\u2b06\ufe0f ESCALATION REQUIRED</h2><p><strong>Escalation Level:</strong> {{ $json.output.escalationLevel }}</p><p><strong>Event Type:</strong> {{ $json.eventType }}</p><h3>Escalation Reason:</h3><p>{{ $json.output.escalationReason }}</p><h3>Executive Summary:</h3><p>{{ $json.output.executiveSummary }}</p><h3>Business Impact:</h3><p>{{ $json.output.businessImpact }}</p><h3>Urgent Actions Required:</h3><ol>{{ $json.output.urgentActions.map(action => `<li>${action}</li>`).join(\"\") }}</ol><h3>Key Stakeholders:</h3><ul>{{ $json.output.stakeholders.map(stakeholder => `<li>${stakeholder}</li>`).join(\"\") }}</ul><p><strong>Estimated Resolution Time:</strong> {{ $json.output.estimatedResolutionTime }}</p><p style=\"color: #d32f2f; font-weight: bold;\">This event requires immediate attention and coordination.</p></body></html>",
"options": {},
"subject": "=ESCALATION REQUIRED: {{ $json.output.escalationLevel }} - {{ $json.eventType }}",
"toEmail": "={{ $('Workflow Configuration').first().json.escalationEmail }}",
"fromEmail": "<__PLACEHOLDER_VALUE__Sender Email Address__>"
},
"typeVersion": 2.1
},
{
"id": "751dcadc-8388-4568-b29e-7d1c598672a6",
"name": "Sticky Note",
"type": "n8n-nodes-base.stickyNote",
"position": [
-1888,
-160
],
"parameters": {
"width": 624,
"height": 368,
"content": "## How It Works\nThis workflow automates procurement fraud detection and supplier compliance monitoring for organizations managing complex purchasing operations. Designed for procurement teams, audit departments, and compliance officers, it solves the challenge of identifying fraudulent transactions, contract violations, and supplier misconduct across thousands of purchase orders and vendor relationships.The system schedules continuous monitoring, generates sample transaction data, analyzes patterns through dual AI agents (Price Reasonableness validates pricing against market rates, Delivery Agent assesses fulfillment performance), orchestrates comprehensive risk evaluation through Orchestration Agent, routes findings by severity (critical/high/medium/low), and triggers multi-channel responses: critical issues activate immediate Slack/email alerts with detailed logging; high-priority cases receive escalation workflows; medium/low findings generate routine compliance reports. By combining AI-powered anomaly detection with intelligent routing and coordinated notifications, organizations prevent fraud losses by 75%, ensure vendor compliance, maintain audit trails, and enable procurement teams to focus on strategic sourcing rather than manual transaction reviews.\n"
},
"typeVersion": 1
},
{
"id": "5d5874f9-1b46-4c3b-8672-a0193c4e0a24",
"name": "Sticky Note1",
"type": "n8n-nodes-base.stickyNote",
"position": [
-1232,
-64
],
"parameters": {
"width": 448,
"height": 272,
"content": "## Setup Steps\n1. Connect **Schedule Trigger** for monitoring frequency\n2. Configure **procurement systems** with API credentials\n3. Add **AI model API keys** to Price Reasonableness, Delivery, and Orchestration Agent nodes\n4. Define **fraud indicators** and compliance thresholds in agent prompts based on company policies\n5. Link **Slack webhooks** for critical and high-priority fraud alerts to procurement and audit teams\n6. Connect **email credentials** for stakeholder notifications and escalation workflows"
},
"typeVersion": 1
},
{
"id": "d1461779-3b74-4ec9-94f8-f982a9609c30",
"name": "Sticky Note2",
"type": "n8n-nodes-base.stickyNote",
"position": [
-752,
-176
],
"parameters": {
"color": 6,
"width": 384,
"height": 368,
"content": "## Prerequisites\nProcurement system API access, AI service accounts, market pricing databases for benchmarking\n## Use Cases\nInvoice fraud detection, bid rigging identification, duplicate payment prevention\n## Customization\nModify agent prompts for industry-specific fraud patterns, adjust risk scoring algorithms\n## Benefits\nPrevents fraud losses by 75%, automates compliance monitoring across unlimited transactions"
},
"typeVersion": 1
},
{
"id": "a01826f3-fedd-4b8c-8313-dbb3e0311ee2",
"name": "Sticky Note4",
"type": "n8n-nodes-base.stickyNote",
"position": [
-640,
304
],
"parameters": {
"color": 7,
"width": 656,
"height": 736,
"content": "## Orchestrated Risk Evaluation\n**What**: Orchestration Agent synthesizes findings, applies risk scoring, generates prioritized recommendations \n**Why**: Unified assessment enables clear fraud/compliance determination and appropriate escalation decisions"
},
"typeVersion": 1
},
{
"id": "d27285c0-54a9-455d-9eca-de7f0d35f66b",
"name": "Sticky Note5",
"type": "n8n-nodes-base.stickyNote",
"position": [
48,
288
],
"parameters": {
"color": 7,
"width": 1552,
"height": 1376,
"content": "\n## Priority-Based Response\n**What**: Routes by severity\u2014critical triggers immediate alerts and audit logs, lower priorities enable planned reviews \n**Why**: Risk-stratified workflows ensure urgent fraud receives instant attention while maintaining comprehensive documentation\n"
},
"typeVersion": 1
},
{
"id": "eb8f8dca-ebab-402d-9104-71300100d057",
"name": "Sticky Note6",
"type": "n8n-nodes-base.stickyNote",
"position": [
-2048,
320
],
"parameters": {
"color": 7,
"width": 1392,
"height": 864,
"content": "## Automated Transaction Monitoring & Dual-Agent Risk Assessment\n**What**: Price Reasonableness Agent validates pricing; Delivery Agent evaluates supplier performance metrics \n**Why**: Parallel expert analysis identifies both pricing fraud and fulfillment violations across procurement lifecycle"
},
"typeVersion": 1
}
],
"active": false,
"settings": {
"availableInMCP": false,
"executionOrder": "v1"
},
"versionId": "5eae8e52-9eed-4a63-a608-d296fdd6d039",
"connections": {
"Email Tool": {
"ai_tool": [
[
{
"node": "Delivery Orchestration Agent",
"type": "ai_tool",
"index": 0
}
]
]
},
"Slack Tool": {
"ai_tool": [
[
{
"node": "Delivery Orchestration Agent",
"type": "ai_tool",
"index": 0
}
]
]
},
"Escalation Agent": {
"main": [
[
{
"node": "Escalation Email",
"type": "main",
"index": 0
}
]
]
},
"Schedule Trigger": {
"main": [
[
{
"node": "Workflow Configuration",
"type": "main",
"index": 0
}
]
]
},
"Route by Priority": {
"main": [
[
{
"node": "Store Critical Events",
"type": "main",
"index": 0
}
],
[
{
"node": "Store High Priority Events",
"type": "main",
"index": 0
}
],
[
{
"node": "Store Medium Priority Events",
"type": "main",
"index": 0
}
],
[
{
"node": "Store Low Priority Events",
"type": "main",
"index": 0
}
]
]
},
"Notify High - Slack": {
"main": [
[
{
"node": "Merge All Notifications",
"type": "main",
"index": 1
}
]
]
},
"Enrichment Agent Tool": {
"ai_tool": [
[
{
"node": "Signal Prioritization Agent",
"type": "ai_tool",
"index": 0
}
]
]
},
"Store Critical Events": {
"main": [
[
{
"node": "Notify Critical - Slack",
"type": "main",
"index": 0
}
]
]
},
"Generate Sample Events": {
"main": [
[
{
"node": "Signal Prioritization Agent",
"type": "main",
"index": 0
}
]
]
},
"Workflow Configuration": {
"main": [
[
{
"node": "Generate Sample Events",
"type": "main",
"index": 0
}
]
]
},
"Merge All Notifications": {
"main": [
[
{
"node": "Audit Log",
"type": "main",
"index": 0
}
]
]
},
"Notify Critical - Email": {
"main": [
[
{
"node": "Merge All Notifications",
"type": "main",
"index": 0
}
]
]
},
"Notify Critical - Slack": {
"main": [
[
{
"node": "Notify Critical - Email",
"type": "main",
"index": 0
}
]
]
},
"Check Escalation Required": {
"main": [
[
{
"node": "Escalation Agent",
"type": "main",
"index": 0
}
]
]
},
"Store Low Priority Events": {
"main": [
[
{
"node": "Merge All Notifications",
"type": "main",
"index": 3
}
]
]
},
"Store High Priority Events": {
"main": [
[
{
"node": "Notify High - Slack",
"type": "main",
"index": 0
}
]
]
},
"Signal Prioritization Agent": {
"main": [
[
{
"node": "Delivery Orchestration Agent",
"type": "main",
"index": 0
}
]
]
},
"Delivery Orchestration Agent": {
"main": [
[
{
"node": "Route by Priority",
"type": "main",
"index": 0
},
{
"node": "Check Escalation Required",
"type": "main",
"index": 0
}
]
]
},
"Store Medium Priority Events": {
"main": [
[
{
"node": "Merge All Notifications",
"type": "main",
"index": 2
}
]
]
},
"Structured Output - Delivery": {
"ai_outputParser": [
[
{
"node": "Delivery Orchestration Agent",
"type": "ai_outputParser",
"index": 0
}
]
]
},
"OpenAI Model - Delivery Agent": {
"ai_languageModel": [
[
{
"node": "Delivery Orchestration Agent",
"type": "ai_languageModel",
"index": 0
}
]
]
},
"Structured Output - Enrichment": {
"ai_outputParser": [
[
{
"node": "Enrichment Agent Tool",
"type": "ai_outputParser",
"index": 0
}
]
]
},
"Structured Output - Escalation": {
"ai_outputParser": [
[
{
"node": "Escalation Agent",
"type": "ai_outputParser",
"index": 0
}
]
]
},
"OpenAI Model - Enrichment Agent": {
"ai_languageModel": [
[
{
"node": "Enrichment Agent Tool",
"type": "ai_languageModel",
"index": 0
}
]
]
},
"OpenAI Model - Escalation Agent": {
"ai_languageModel": [
[
{
"node": "Escalation Agent",
"type": "ai_languageModel",
"index": 0
}
]
]
},
"Structured Output - Prioritization": {
"ai_outputParser": [
[
{
"node": "Signal Prioritization Agent",
"type": "ai_outputParser",
"index": 0
}
]
]
},
"OpenAI Model - Prioritization Agent": {
"ai_languageModel": [
[
{
"node": "Signal Prioritization Agent",
"type": "ai_languageModel",
"index": 0
}
]
]
}
}
}
Credentials you'll need
Each integration node will prompt for credentials when you import. We strip credential IDs before publishing — you'll add your own.
openAiApislackOAuth2Api
Pro
For the full experience including quality scoring and batch install features for each workflow upgrade to Pro
About this workflow
This workflow automates procurement fraud detection and supplier compliance monitoring for organizations managing complex purchasing operations. Designed for procurement teams, audit departments, and compliance officers, it solves the challenge of identifying fraudulent…
Source: https://n8n.io/workflows/13330/ — original creator credit. Request a take-down →
Related workflows
Workflows that share integrations, category, or trigger type with this one. All free to copy and import.
This workflow automates end-to-end sustainability lifecycle management for corporate sustainability teams, ESG governance officers, and circular economy programme leads. It addresses the challenge of
Form Trigger, Agent, OpenAI Chat +11
This workflow automates end-to-end carbon emissions monitoring, strategy optimisation, and ESG reporting using a multi-agent AI supervisor architecture in n8n. Designed for sustainability managers, ES
Agent, OpenAI Chat, Output Parser Structured +10
This workflow automates end-to-end ESG (Environmental, Social, and Governance) sustainability reporting for enterprise sustainability teams, compliance officers, and green governance leads. It solves
Agent, OpenAI Chat, Output Parser Structured +12
This workflow automates medical imaging analysis and diagnostic reporting for radiology departments, imaging centers, and hospital networks managing high patient volumes. Designed for radiologists, me
HTTP Request, Agent, OpenAI Chat +7
This workflow automates end-to-end carbon emissions monitoring, strategy optimisation, and ESG reporting using a multi-agent AI supervisor architecture in n8n. Designed for sustainability managers, ES
Agent, OpenAI Chat, Output Parser Structured +10