The Notify User action object does not modify the Allow or Deny states; therefore, it requires that the request hit an allow rule before the user is served with the notify user page.

When you add a rule to notify user, it comes with a notifiable condition. Notify user rule will only work if it matches the condition below, one of them is http.response.code = 200 (i.e. the flow should 'Allowed' for the 'notify_user' to work. Please also look at other conditions, those may also have an impact.

From the Policy Trace, you may see this:

Called policy definition: NotifyUser1
        <Proxy> [vpm-cpl:45655]
  miss:     condition=__NotifyUser1_should_notify 

And from sysinfo:

define condition __NotifyUser1_should_notify
    condition=__is_notifiable \
    condition=!__is_notify_internal \
    request.header.Cookie=!'notified-NotifyUser1=1'
end

define condition __is_notifiable
    url.scheme=(http,https) \
    http.method=GET \
    request.header.User-Agent = '^(Mozilla|Opera)' \ 
    request.header.Range = !'' \
    request.header.If-Range = !'' \
    http.response.code = 200 \ 
    response.header.Content-Type='text/html'
end

You must be aware of the conditions above and make sure it matches the conditions above. If you have Default Deny Policy, add an 'ALLOW' rule for the flow in Web Access Layer, e.g. WebAccessLayer(1), then you can add the Notify User rule in the next Web Access Layer, e.g. WebAccessLayer(2). 

Note: For the condition 'http.method=GET \' to match, the flow must be SSL intercepted/decrypted or else GET request will not be visible to the Edge SWG (ProxySG).