Template Variables - Living Security Platform

Template variables let you personalize playbook notifications, nudges, scorecard emails, and report messages without writing separate copy for every recipient. The platform resolves each {{ token }} against directory data, the run context, and the triggering event before the message is delivered.

Syntax

All template variables use Mustache-style double braces:

Hi {{ recipient.firstName }}, your training is due {{ training.dueDate }}.

Whitespace inside the braces is optional. {{recipient.firstName}}, {{ recipient.firstName }}, and {{ recipient.firstName }} all resolve identically.
Tokens are case-sensitive and use dot-notation for nested fields (recipient.firstName, not recipient.first_name).
Tokens use the canonical names below, but most accept short aliases for backward compatibility (see Aliases).

Unresolved tokens are rendered literally. If you type {{ recipient.firsName }} (typo) or reference a variable the template doesn’t support, the recipient will see the raw {{ recipient.firsName }} text in their inbox. Always preview a message before sending and validate any tokens you add.

Universal recipient variables

These tokens are available in every template (welcome emails, training notifications, nudges, scorecards, reports, and playbook-step messages).

Token	Description	Sample value
`recipient.firstName`	The recipient’s first name.	`Jane`
`recipient.fullName`	The recipient’s full display name.	`Jane Doe`
`recipient.email`	The recipient’s primary email address.	`jane.doe@example.com`
`organization.name`	The customer’s organization name.	`Acme Corporation`
`system.loginUrl`	The platform sign-in URL.	`https://app.livingsecurity.ai`
`system.engageUrl`	The Engage learner app URL.	`https://engage.livingsecurity.ai`
`system.engageScorecardUrl`	Direct link to the employee’s scorecard in the Engage app.	`https://engage.livingsecurity.ai/scorecard`

Playbook step variables

When you author a playbook Send Nudge, Send Notification, or Webhook step, the recipient’s full directory record is available under the user namespace. These tokens work in subject lines, email bodies, Slack/Teams messages, and webhook body templates.

Token	Description	Sample value
`user.firstName`	First name from the directory.	`Jane`
`user.lastName`	Last name from the directory.	`Doe`
`user.displayName`	Full display name.	`Jane Doe`
`user.email`	Primary email.	`jane.doe@example.com`
`user.department`	Department from the identity provider.	`Engineering`
`user.jobTitle`	Job title from the identity provider.	`Software Engineer`
`user.managerEmail`	Manager’s primary email.	`boss@example.com`
`user.hrManagerEmail`	HR manager’s primary email.	`hr@example.com`
`user.phone`	Phone number from the directory.	`+1-555-0100`
`user.custom.<attribute_key>`	Any custom attribute defined for your org (SCIM `customAttributes` or local custom fields).	`user.custom.lms_id` → `EMP-4821`

Custom attributes are configured per organization. The key after user.custom. must exactly match the attribute key shown in Settings → People → Custom Attributes.

Risk and signal variables (playbook steps only)

If your playbook step references a risk or signal token, the platform automatically enriches the recipient’s context with their current HRI data before sending. No extra configuration required.

Token	Description	Sample value
`risk.overallScore`	Overall HRI score (0–1000, higher = safer).	`742`
`risk.riskLevel`	Derived risk category: `low`, `moderate`, `high`, `very_high`, `critical`.	`moderate`
`risk.behaviorScore`	Behavior component score (0–400).	`310`
`risk.threatScore`	Threat component score (0–200).	`145`
`risk.identityScore`	Identity component score (0–400).	`287`
`signals.<signal_key>`	Count of a specific normalized signal for the recipient.	`signals.training_overdue_30d` → `1`

Run context (advanced)

For webhook step body templates and branch expressions, the playbook run itself is addressable:

Token	Description
`participant.id`	The current run participant ID.
`participant.userId`	The participant’s user ID.
`run.id`	The playbook run ID.
`step.id`	The current step ID.
`step.name`	The current step name.
`input.<key>`	Any input parameter passed when the playbook run started.
`steps.<stepId>.<key>`	Any output value produced by a previous step.

Per-template extras

Some platform-managed templates expose additional tokens specific to their purpose. Expand the template you’re editing to see its extra variables.

Welcome email (WELCOME_EMAIL)

In addition to the universal recipient variables:

Token	Description	Sample value
`organization.supportEmail`	The customer or partner support email address.	`support@acme.com`

User invite email (USER_INVITE)

In addition to the universal recipient variables:

Token	Description	Sample value
`organization.supportEmail`	The customer or partner support email address.	`support@acme.com`
`invite.loginUrl`	The sign-in URL the invite recipient should use.	`https://app.livingsecurity.ai`
`invite.role`	The role granted by the invitation.	`OWNER`
`invite.expiresAt`	The date or time when the invite expires, when available.	`June 30, 2026`
`inviter.fullName`	The full display name of the person sending the invite.	`Alex Morgan`
`inviter.email`	The email address of the person sending the invite.	`alex.morgan@example.com`

Employee invite email (EMPLOYEE_INVITE)

In addition to the universal recipient variables:

Token	Description	Sample value
`organization.supportEmail`	The customer or partner support email address.	`support@acme.com`
`invite.loginUrl`	The sign-in URL the invite recipient should use.	`https://app.livingsecurity.ai`
`invite.role`	The role granted by the invitation.	`LEARNER`
`invite.expiresAt`	The date or time when the invite expires, when available.	`June 30, 2026`
`inviter.fullName`	The full display name of the person sending the invite.	`Alex Morgan`
`inviter.email`	The email address of the person sending the invite.	`alex.morgan@example.com`

Training assigned notification (TRAINING_ASSIGNED)

In addition to the universal recipient variables:

Token	Description	Sample value
`training.title`	The assigned training module title.	`Phishing Fundamentals`
`training.dueDate`	The assignment due date.	`May 15, 2026`

Training reminder notification (TRAINING_REMINDER)

In addition to the universal recipient variables:

Token	Description	Sample value
`training.title`	The assigned training module title.	`Phishing Fundamentals`
`training.dueDate`	The assignment due date.	`May 15, 2026`

Point-in-time training nudge (POINT_IN_TIME_TRAINING_NUDGE)

In addition to the universal recipient variables:

Token	Description	Sample value
`sender.name`	Display name of the security team / sender for the message.	`Security Team`
`recipient.department`	The recipient’s department.	`Engineering`
`recipient.jobTitle`	The recipient’s job title.	`Software Engineer`
`risk.hriScore`	The recipient’s Human Risk Index score.	`256`
`risk.level`	The recipient’s risk level label.	`Somewhat Risky`
`risk.topFactor`	The recipient’s primary HRI risk factor (behavior / threat / identity).	`Multiple DLP events`
`risk.identityScore`	The recipient’s HRI identity-pillar score (0-400).	`128`
`risk.behaviorScore`	The recipient’s HRI behavior-pillar score (0-400).	`150`
`risk.threatScore`	The recipient’s HRI threat-pillar score (0-200).	`92`
`risk.overallScore`	Alias for `risk.hriScore`. The recipient’s overall Human Risk Index (0-1000).	`256`

Manager scorecard notification (MANAGER_SCORECARD_NOTIFICATION)

In addition to the universal recipient variables:

Token	Description	Sample value
`scorecard.score`	The rendered scorecard score for the recipient.	`742`
`scorecard.snapshotUrl`	A link to view the scorecard.	`https://app.livingsecurity.com/scorecards/preview`

Employee scorecard notification (EMPLOYEE_SCORECARD_NOTIFICATION)

Uses the universal recipient variables only, including system.engageUrl and system.engageScorecardUrl for Engage deep links.

Report ready notification (REPORT_READY)

In addition to the universal recipient variables:

Token	Description	Sample value
`report.name`	The report display name.	`Monthly Human Risk Report`
`report.summary`	A short generated summary of the report contents.	`Your human risk score improved by 12% this month.`
`report.url`	A link to view the report.	`https://app.livingsecurity.com/reports/monthly-risk`

Achievement issued notification (ACHIEVEMENT_ISSUED)

The certificate/badge delivery email sent when an achievement is issued. This template supports a focused variable set (not the full universal list):

Token	Description	Sample value
`recipient.fullName`	The credential recipient’s display name.	`Jane Doe`
`recipient.firstName`	First token of the recipient’s display name.	`Jane`
`organization.name`	The issuing organization’s display name (email-wrapper branding). Empty when branding resolution degrades.	`Acme Corp`
`achievement.issuedAt`	Issue date formatted for the recipient’s locale. Empty until issued.	`July 5, 2026`
`achievement.expiresAt`	Expiry date formatted for the recipient’s locale. Empty when the credential never expires.	`July 5, 2027`
`achievement.name`	The issued certificate or badge display name.	`2026 Security Awareness Certified`
`achievement.verifyUrl`	Public verification link for the credential.	`https://api.livingsecurity.ai/verify/c/…`
`achievement.claimUrl`	Tokenized claim/download link. Empty when no claim token could be minted.	`https://api.livingsecurity.ai/claim/c?token=…`
`achievement.badgeUrl`	CDN URL of the rendered badge PNG. Empty until the badge is rendered.	`https://cdn.livingsecurity.ai/badge.png`
`achievement.badgeImageHtml`	Pre-built badge `<img>` block. Empty when the badge artifact is not ready.	(HTML block)
`achievement.claimCtaHtml`	Pre-built claim/download call-to-action. Empty when no claim link exists.	(HTML block)

Prefer achievement.badgeImageHtml and achievement.claimCtaHtml over hand-built <img>/<a> blocks: they render as empty strings when the badge or claim link is unavailable, so your template degrades cleanly instead of shipping a broken image or dead link.

Aliases

To stay backward compatible with older content, several tokens accept short or legacy aliases. The platform automatically canonicalizes them at render time, so all variants below resolve to the same value.

Canonical token	Accepted aliases
`recipient.firstName`	`first_name`, `member.firstName`, `user.firstName`
`recipient.fullName`	`full_name`, `member.fullName`, `user.fullName`, `recipient_name`
`recipient.email`	`member.email`, `user.email`
`recipient.department`	`department`, `member.department`, `user.department`
`recipient.jobTitle`	`job_title`, `member.jobTitle`, `user.jobTitle`
`organization.name`	`organization_name`, `org_name`
`system.loginUrl`	`system.login_url`, `invite_link` outside `USER_INVITE` templates
`system.engageUrl`	`system.engage_url`
`system.engageScorecardUrl`	`system.engage_scorecard_url`
`invite.loginUrl`	`invite_link`, `system.loginUrl`, `system.login_url` within `USER_INVITE` and `EMPLOYEE_INVITE` templates
`sender.name`	`sender_name`
`risk.hriScore`	`hri_score`, `risk.overallScore`
`risk.level`	`risk_level`
`risk.topFactor`	`top_risk_factor`
`risk.identityScore`	`identity_score`
`risk.behaviorScore`	`behavior_score`
`risk.threatScore`	`threat_score`
`report.name`	`report_name`
`report.summary`	`report_summary`
`report.url`	`report_url`
`achievement.name`	`achievement_name`

Prefer the canonical dot-notation form (recipient.firstName) in new content. Aliases exist for older templates and may be retired in a future release.

Examples

Training assignment notification

Subject: New training assigned — due {{ training.dueDate }}

Hi {{ recipient.firstName }},

{{ organization.name }} has assigned you a new course: **{{ training.title }}**.
Please complete it by **{{ training.dueDate }}**.

Sign in: {{ system.loginUrl }}

Point-in-time nudge after a risky behavior

Hey {{ user.firstName }},

A quick heads-up from the {{ sender.name }}: based on your recent activity,
your HRI score is currently **{{ risk.hriScore }} ({{ risk.level }})**.
The top factor driving this is: {{ risk.topFactor }}.

Spend two minutes on a refresher: {{ system.loginUrl }}

Scorecard email to a people-manager

Subject: Your team's scorecard is ready

{{ recipient.firstName }}, your team scored **{{ scorecard.score }}** this period.

View the full breakdown: {{ scorecard.snapshotUrl }}

Webhook step body using custom attributes

{
  "userId": "{{ user.custom.lms_id }}",
  "email": "{{ user.email }}",
  "department": "{{ user.department }}",
  "assignedBy": "{{ user.managerEmail }}"
}

Where to use these

Creating Nudges

Author nudge templates in Content Studio.

Editing Playbooks

Configure notification, nudge, and webhook steps inside a playbook.

Creating Playbooks

Build a new playbook from scratch.

Glossary

Definitions for HRI, signals, cohorts, and other terms used above.

​Syntax

​Universal recipient variables

​Playbook step variables

​Risk and signal variables (playbook steps only)

​Run context (advanced)

​Per-template extras

​Aliases

​Examples

​Training assignment notification

​Point-in-time nudge after a risky behavior

​Scorecard email to a people-manager

​Webhook step body using custom attributes

​Where to use these

Creating Nudges

Editing Playbooks

Creating Playbooks

Glossary

Syntax

Universal recipient variables

Playbook step variables

Risk and signal variables (playbook steps only)

Run context (advanced)

Per-template extras

Aliases

Examples

Training assignment notification

Point-in-time nudge after a risky behavior

Scorecard email to a people-manager

Webhook step body using custom attributes

Where to use these