Route purchase approvals by spend, department and vendor risk with Postgres, email and Slack

Description

Quick overview
This workflow receives purchase requests via webhook, evaluates spend tiers, department budget status, and vendor risk using Postgres data, then either auto-approves, rejects, or runs a sequential email approval chain, finally notifying the requester by email and posting an audit message to Slack.

How it works
Receives a purchase request via a POST webhook and validates required fields, normalizing currency amounts to USD.
Loads vendor risk/approval status, department budget and manager details, and the last 30 days of spend with the same vendor from Postgres.
Applies policy rules (spend tiers with cumulative 30‑day vendor spend, budget limits, self-approval avoidance, and vendor risk checks) to decide whether to auto-approve, reject, or require specific approval levels.
Saves the request as pending in Postgres and immediately responds to the webhook caller with the request ID, current status, and required approval levels.
If approvals are required, sends an approval email to the next approver with approve/reject links, waits for a response, and repeats with reminders until the chain completes or expires.
Finalizes the request in Postgres by recording the decision, generating a PO number and committing budget on approval, writing an audit log entry, then emails the requester and posts an audit notification to Slack.

Setup
Add Postgres credentials for the database that stores vendors, departments, requests, and audit logs.
Add SMTP credentials for the Email Send nodes and confirm the configured sender address is allowed (the fromEmail value in the policy).
Run the manual setup once to create the required Postgres tables/sequence and seed the demo vendor and department records.
Update the policy configuration values (spend tiers, approver email addresses, currency rates, reminder settings, max request limit, and Slack webhook URL) in the policy step.
Copy the production webhook URL for the purchase-request endpoint and configure your requesting system to POST the expected JSON payload to it.