Future: transactional workflow notifications using STACKIT Mailout #139

Future feature — outside the current implementation scope

Use STACKIT Mailout for transactional notifications from the Landing Zone Configurator to the users involved in a workflow. This issue records the product idea; no implementation, service provisioning or email sending is requested now.

Candidate events

• Workspace invitation, including a suitable invitation link and expiry guidance.
• Application order awaiting Platform Owner approval.
• Approval granted, rejected or withdrawn, notifying the Application Owner.
• Plan/Apply completed or failed, with a link to the authorized execution view.
• Recovery/operator action required, routed to the responsible role.
• Expiring invitations or approvals and overdue actions, with bounded reminders.
• Relevant access/ownership changes where notification is appropriate.

Design requirements

• Verify official STACKIT Mailout capabilities, authentication, sender/domain requirements and region/operational constraints before choosing the integration.
• Derive recipients from verified tenant/workspace membership, role, ownership and workflow participation. Recheck access; no cross-tenant disclosure or requester-controlled arbitrary recipients.
• Link to the authenticated UI instead of emailing credentials, State, raw Plan/Apply logs or sensitive infrastructure details. Invitation links require a dedicated scoped, expiring flow.
• Use a durable transactional outbox and idempotent event identifiers. Define delivery retries, rate limits, duplicate suppression, bounces and operator diagnostics. Provider acceptance is not proof of user delivery.
• Make notifications configurable by customer/workspace and event, with sensible recipient grouping, locale, templates and preference rules. Separate essential workflow notifications from optional summaries/reminders.
• Define sender identity, secret storage/rotation, audit trail, retention and unsubscribe requirements where applicable. Email must not replace server-side authorization or approve a Plan/Apply by itself.
• Notification delivery failure must not silently change workflow state or duplicate an infrastructure operation.

Later acceptance

• Agree event/recipient matrix and supported Mailout integration.
• Invitation and approval notifications work across the relevant roles and locales.
• Plan/Apply completion/failure links preserve tenant/owner access checks.
• Retry/duplicate/failure and recipient-revocation behavior are tested without real mail in ordinary CI.
• Operators and customers can configure and diagnose the integration.

Related: #91 identity/roles, #92 template approval policies, #93 Application execution, #95 operational acceptance. This feature does not block current Public/Corporate acceptance.