Skip to content

Mail Pipelines

Provisionr uses four distinct types of mail groups, each designed for a specific communication pattern. Choosing the right pipe prevents noise, ensures the right people see the right messages, and keeps audit trails clean.

PipePurposeWho SendsWho Receives
MailHuman-facing distribution & shared inboxesHumans (internal or external)Humans
IntakeMachine report ingestion & audit feedsSystems (vendors, scanners, SaaS)Small review group or archive-only
AlertsOn-call alarms & urgent eventsMonitoring systemsOn-call personnel (small, focused)
InfraAutomation routers & fan-outMachinesOther groups (no human members)
Is the sender a human?
YES → Mail
NO → Is the message urgent / on-call actionable?
YES → Alerts
NO → Is it a report or audit feed for later review?
YES → Intake
NO → Is it machine-to-machine routing?
YES → Infra
  • Archive: ON for all groups (archives are audit records)
  • Mailing label: ON
  • Security label: OFF (mail pipes don’t grant access)
  • Owners: Minimum 2 from durable admin cohorts (prv-plt-team-wks, prv-sec-team-grc)
  • Never use mail-*, intake-*, alerts-*, or infra-* on any access ACL.
  • Never mix pipe types in one group (e.g., human mail + machine reports in the same list).
  • Never put humans as direct members of infra-* groups.
  • Never skip moderation/allowlisting on externally-posting groups.

Pipes can be wired together for sophisticated routing:

Vendor system → Intake (archive + digest) → Mail (humans review weekly)
Multiple systems → Infra (classifier/router) → Alerts (on-call)
GitLab → Infra (classifier) → Alerts (security) + Alerts (deploy) + Intake (audit)
Website form → Mail (collaborative inbox) → Internal triage → Intake (optional archive)
Tenant A Infra → Bridge router → Tenant B Alerts
  • Mail — Human-facing distribution lists and shared inboxes
  • Intake — Machine report ingestion and audit feeds
  • Alerts — On-call alarms and urgent events
  • Infra — Automation routers and fan-out