RiskGate AI - The Governance Layer for Slack

💡 Inspiration

Every enterprise loses control the same way — inside Slack.

I work in cyber risk and audit at a consulting firm, and I see the same pattern in almost every engagement: risky work doesn't start in a GRC platform, a ticketing system, or a policy document. It starts as a Slack message.

• "Can I get production admin access till Friday?"
• "Can we upload customer transcripts to this AI tool for the pilot demo?"
• "Can we waive the security review just this once — it's urgent."
• "Manager already approved, let's move fast."

By the time anyone reviews these decisions, the exception has already been granted, the data has already been shared, and there's no auditable trail. The conversation is buried across threads, channels, and DMs.

Slack is where enterprise decisions actually happen — but it has never had a governance layer that operates natively inside it. RiskGate AI is that layer.

🛡️ What RiskGate AI Does

RiskGate AI is a Slack-native agent that catches risky enterprise requests inside Slack conversations and turns them into governed, auditable approval workflows.

• Runs on the /riskgate slash command in any channel
• Reads the current conversation via the Slack Web API
• Uses Slack's Real-Time Search (RTS) API to scan the entire workspace for related history — prior exceptions, past approvals, denied vendors, policy references
• Sends both current context and workspace precedents to Google Gemini 2.5 Flash for structured risk reasoning
• Returns a Block Kit "RiskGate Review" card with risk level, category, missing approvals, policy gaps, workspace precedents, safe alternative, and recommended decision
• Provides five one-click action buttons: Ask Security · Ask Legal · Create Ticket · Approve with Expiry · Reject
• Every action posts a native follow-up message so decisions stay auditable in-channel

Unlike a generic chatbot, RiskGate is Slack-context-aware. It reasons across channels using the RTS API and cites prior workspace decisions in its reviews — something no external assistant can replicate.

🏗️ How I Built It

Architecture

• Slack Bolt for Python + Socket Mode — no public URL needed, ideal for fast iteration
• Slack Web API (conversations.history, chat.postMessage) for channel context and posting
• Slack Real-Time Search API (search.messages) for cross-channel workspace precedents
• Google Gemini 2.5 Flash with JSON-mode structured output for risk classification and reasoning
• Slack Block Kit for the interactive Review card and five action handlers
• python-dotenv for local secrets management

Prompt design

Gemini receives two inputs — the current channel conversation and RTS workspace precedents — and returns a strict JSON schema with risk_level, risk_category, missing_approvals, policy_gaps, workspace_precedents, safe_alternative, and recommended_decision. This makes the output deterministic enough to render as a Block Kit card while still contextual enough to feel intelligent.

Cross-channel intelligence

The RTS query is dynamically built from enterprise-risk keywords (access, vendor, DPA, retention, exception, PII, etc.) detected in the current conversation. That way the workspace search returns only the relevant precedents — not every message ever posted.

🧠 What I Learned

• Slack is the perfect surface for agents because it's already where the risky work happens. Combining the RTS API with an LLM turns "context inside Slack" from a passive resource into an active governance signal.
• Structured JSON prompting is what makes agents feel like products instead of demos. Forcing Gemini into a strict schema meant the Block Kit card always rendered cleanly, even on edge-case conversations.
• The best agents are narrow, not broad. A "generic Slack copilot" is forgettable. A "risk approval agent that cites prior workspace decisions" is memorable.
• Real-Time Search API changes the game. Without it, RiskGate would just be a summarizer. With it, RiskGate becomes an organizational memory that reasons over live workspace context — securely, without exporting Slack data.

⚙️ Challenges I Ran Into

• Python 3.14 SSL failure on macOS — fresh Python installs from python.org don't link to the system trust store. Fixed by running Install Certificates.command to link certifi root certificates.
• Sandbox domain rules — Slack requires lowercase, dashes only, ≤ 21 characters. Took a few tries to land a valid workspace URL.
• Model deprecation mid-hackathon — gemini-2.0-flash was deprecated during the build. Swapped to gemini-2.5-flash, which actually improved reasoning quality.
• JSON reliability — early prompts occasionally returned Markdown-wrapped JSON. Solved by combining response_mime_type="application/json" with a strict system prompt schema.
• RTS query design — a naive search returned too much noise. Solved by extracting only enterprise-risk keywords (vendor, access, dpa, pii, exception, etc.) from the current conversation before querying.
• Scoping in the sandbox — some search.* scopes are hidden or only offered as User Token scopes. Confirmed search:read.public was sufficient for the demo path.

🏆 Accomplishments I'm Proud Of

• Built an agent that isn't a generic chatbot — it uses Slack's own conversational data as its core intelligence source.
• Cross-channel awareness via the Real-Time Search API — RiskGate can cite prior workspace decisions inside its reviews, which no generic AI assistant can do.
• A production-feel Block Kit UX with 5 interactive action buttons that each trigger native Slack follow-ups.
• Fully working end-to-end — Slack ⇄ RTS ⇄ Gemini ⇄ Block Kit ⇄ interactive actions — built and demoed in a single afternoon.

🚀 What's Next for RiskGate AI

• MCP server integration for external tools — Jira, Okta, ServiceNow, GitHub, Google Drive — so RiskGate can create tickets, check access records, and pull evidence automatically
• Exception expiry engine — auto-revoke reminders, evidence collection, and time-boxed approvals
• Learning loop — RiskGate remembers past decisions per workspace and improves risk classification over time
• Policy-as-code — each organization defines its own risk rules; RiskGate applies them
• Slack Marketplace submission with SOC 2 readiness for enterprise distribution
• Agent-to-agent orchestration — RiskGate hands off to specialized Slack agents (Security, Legal, Audit) via the emerging Slack agent protocol

Built With

• ai-agents
• gemini-2.5-flash
• python
• slack
• slack-api
• slack-block-kit
• slack-bolt
• slack-real-time-search-api