Déjà — decision governance for your Slack workspace

Slack is filling up with AI agents — and none of them know what your team already decided. Teams re-open questions they settled months ago; agents confidently propose the exact thing that was rolled back. The missing piece isn't more intelligence, it's memory with accountability: a way to catch a proposal — from a human or an agent — the moment it contradicts a standing decision, and to prove it with a source. Most AI guardrails make you hand-write the rules. Déjà reads them from what the team already decided.

What it does

When a decision or proposal comes up in a channel, Déjà checks it against the team's standing decisions and — only when it conflicts — drops a sourced guardrail card:

⚠️ Conflicts with a standing decision · #eng: "Opening a PR to migrate the job queue to Temporal." — the team rolled this back on Apr 23 (@maya): "duplicate task execution under a network partition… sticking with Redis." 🔗 source

Two consumers, one engine:

• Ambient — Déjà watches every message (human and agent) and brakes conflicts. ALLOW stays silent, so the channel stays clean.
• MCP — any agent calls check_decision(proposal) → ALLOW | CONFLICTS | INCONCLUSIVE, always sourced. Five lines to adopt.

The core rule: a verdict with no source downgrades to INCONCLUSIVE. A fabricated brake is worse than no brake — Déjà never invents a decision that wasn't made.

How we built it

Python + Slack Bolt (Socket Mode) + a custom recall engine, running 24/7 on Railway. Required challenge tech, wired end-to-end: RTS (permission-aware assistant.search.context); MCP (two tools — recall_memory + check_decision, over stdio and streamable-HTTP); agent-to-agent governance (a separate Planner Bot posts proposals with zero awareness of Déjà — Déjà catches the conflicting one, stays silent on the aligned one); an ambient watcher; and an LLM trigger that runs on a Claude Max subscription — no paid API key.

Accomplishments (all measured, reproducible with no API key)

• Adversarial: 83 hostile queries → recall 96%, zero confident-wrong.
• Governance: 27 labelled proposals → precision 100%, false-CONFLICTS 0, sourceless verdicts 0, owner attribution 11/11.
• Recall beats single-hit search on a held-out set (4/6 recurring vs 1/6), and invents nothing (0/4).
• 123 tests, CI green, clean-clone verified. python scripts/verify_all.py --no-live prints a phase-by-phase pass table.
• We audit ourselves: adversarial self-audits (separate clean-context grader agents) found and fixed real blind spots — silent-green on empty evidence, a false-red bias, a store-blind verdict flip. No test was ever loosened to go green.

Challenges

Slack's Real-Time Search is aggressively rate-limited (measured Retry-After: 288s), so a live 100+-query benchmark is impossible. Instead of hiding that, we run the real engine (LLM judge included) through a reproducible RTS-free mirror calibrated to live, and disclose exactly where the live card path differs. Honest cost, documented — not a hidden failure.

What we learned

The hard part of an AI guardrail isn't detection — it's refusing to be confidently wrong. Every design choice exists to make the system fail safe: stay silent rather than fabricate a verdict.

What's next

Per-caller token scoping, semantic recall in the live hot path, one-click install for any workspace.

Built With

• anthropic-claude
• mcp
• pytest
• python
• railway
• slack-bolt
• slack-rts