Administration
Notifications
What gets sent, to whom, and what cannot be muted.
A notification is recorded in the same operation that makes the underlying thing true, so an approval that committed always has its notification queued. Delivery is separate and retried, so a mail outage cannot fail an approval.
Recipients match the access rules
A notification is a side channel around access control if you let it be. The first version of leave submission notified every HR manager — telling them about absences they are not permitted to look at. It is HR administrators plus the requester's own line manager.
- Document expiry and right-to-work notifications are mandatory and ignore preferences. Nobody mutes their own visa lapsing.
- Probation notifications tell both states: ending soon, and just lapsed — the latter once, the day after. Repeating something irreversible daily trains people to ignore it.
- Ending somebody's probation notifies nobody. That conversation is had by a person.
Work management
| Sent when | To |
|---|---|
| You are mentioned in a comment | You, and only this message — never both this and the one below |
| Work is assigned to you | You. It is about you rather than about the item, so it reaches you even on a muted item |
| A comment is added | Everybody watching, except anybody the mention above already reached |
| State, assignee or priority changes | Everybody watching, except the new assignee |
That list is short on purpose. A board is a live document and most edits — a typo in a title, a rank nudge, an estimate — are not news; notifying on every field is the fastest way to make the whole channel worthless. One event never produces two messages to the same person.
Watching is mostly implicit and turning it off is permanent — nothing puts you back on an item you have left, not even commenting on it again. See Comments, mentions and watching.
All four can be switched off per person. Notifications about work carry no legal weight, unlike the HR ones above, so none of them is mandatory.
Email delivery
Mail goes out over an API rather than SMTP, which means no outbound mail port to be blocked and errors that come back as readable JSON rather than as a status code. SMTP remains as a deployment fallback — for staging, or a region where the vendor is unavailable — rather than as something a customer configures. Sends are idempotent across retries, so a send that timed out after being accepted does not mail somebody twice. Delivery runs every few minutes — see Scheduled jobs.
The sender is never a no-reply address
This mail tells somebody their visa is expiring. A reply is a person asking for help, and discarding it is a support failure dressed up as a configuration default.