Triage Ramp policy violations in Slack

Build me a real-time policy violation triage workflow for Ramp transactions, with Slack as the human review surface.

Trigger: poll Ramp for new card transactions, filtered to ones with the policy violation flag set. Anchor the workflow on Ramp.

When a flagged transaction fires, the agent should:

1. Call Ramp Get Transaction with the transaction ID from the trigger to pull full detail (amount, merchant, category, which policy rule was violated, the cardholder user ID, memo, receipt status, time).

2. Call Ramp Get User on the cardholder to get their name, email, department, and role.

3. Call Ramp List Transactions filtered to that same cardholder over the last 30 days so we can see whether this is a one-off or a repeat pattern. Count how many of those prior transactions also had a policy violation flag and roll that up as the repeat-offender signal.

4. Write a concise summary in plain English that includes: employee name and department, transaction amount and merchant, which policy rule was violated, repeat-offender status (e.g. "3rd violation in 30 days" vs "first time"), and a suggested next step. The suggested next step should be one of: auto-approve as a reasonable exception, ask the employee to add a memo or receipt, or escalate to the finance lead. Pick based on amount, the specific rule violated, and the repeat count.

5. Use Slack Send a Message to post that summary into a dedicated #ramp-policy-flags channel. Include a link back to the transaction in Ramp.

6. If the cardholder has had 2 or more flagged transactions in the last 30 days (this one included), use Slack Open a Conversation to start a DM with them, then Slack Send a Message to send a polite, friendly reminder. The DM should reference the policy rule, the transaction, and ask them to add a memo or receipt. Keep the tone respectful, not punitive. Do not DM first-time offenders, only repeat offenders.

Inputs the user should configure when running this:

- Slack channel for the team-facing alerts (default #ramp-policy-flags).

- Repeat-offender threshold (default 2 flagged transactions in 30 days triggers the DM).

- Lookback window for history (default 30 days).

- Optional: dollar threshold above which the suggested next step is always "escalate" regardless of repeat count.

Skip and do nothing if the transaction does not actually have a policy violation flag set, or if the cardholder cannot be resolved to a Slack user (in that case still post to the channel, just skip the DM).