Actions are generated outside of the alert notification policy, it would be extremely helpful to know how to influence an action being generated (override/whitelist/safelist/etc)

For example, the anti-phish alerts are controlled by the Threat Management > Policy > Anti-phishing policies.