Capabilities and architecture Model Not reported The captures do not identify one model for this representative workflow. Harness Shared Custom Agents harness with team-owned tools and evaluations[Source 1 Sandbox Not reported Execution isolation for the representative workflow is not documented. Tool access Agents start without access; owners grant resource and tool permissions for the intended work[Source 2 Knowledge Workspace pages and connected resources granted to the individual agent[Source 2 Context management Tool definitions and progressive disclosure expose capabilities as needed[Source 1 Credentials Deterministic resource and action permissions; risky runtime actions require owner confirmation[Source 2 Interfaces Mechanisms Default-deny permission model Each Custom Agent starts without access to most resources and receives explicit page, integration, tool, and action permissions[Source 2
Documented uses Internal Slack bug report → routed task-database entry.
Slack bug-triage agent A documented internal agent receives a bug posted in Slack, routes it to the responsible team, creates a task-database entry, and replies in the triggering channel[Source 1
Access and controls See documented credential and access boundaries in the architecture above. Scoped human-review assessments for individual uses remain in research details.
Reliability and validation Risk confirmation and remediation Potentially risky runtime actions pause for confirmation from the agent owner, who can also delete an incorrect Slack message[Source 2
Adoption and operating evidence These results come from the sources. Notes below each result explain what it covers and any reported limits.
Headline claim More than 3,000 internal Custom Agents by end of alpha testing[Source 2
Reported by Notion Scope Internal Notion Custom Agents at the end of alpha; excludes the separate customer alpha count The source does not report the denominator of this figure.
Observed in April 2026
About this result Category Implementation scale Evidence type Reported measurement What it covers Internal Custom Agents at the end of alpha testing Key observation Notion's security team is one of the most active internal users[Source 2
Notion security team internal Custom Agent use
About this result Category Adoption output Evidence type Qualitative What it covers Notion security team's internal Custom Agent use Key observation Agent harness rebuilt three to five times as models improved[Source 1
Reported by Notion Scope Notion agent/framework rebuilds recalled by participants; estimates range from three to five The source does not report the denominator of this figure.
About this result Category Implementation scale Evidence type Estimate What it covers Rebuilds of Notion's agent harness and framework Lessons Not reported: The record contains no separate lessons claim after review of both captures.
Back to infrastructure Sources and research details Citations link to the original publisher. Each source also keeps a preserved copy in the repository, so a changed or removed page stays checkable.
Notion's Token Town: 5 Rebuilds, 100+ Tools (Latent Space) https://latent.space/p/notion Podcast · Direct participant · Last source verification: 2026-08-31 How we built security into Custom Agents https://www.notion.com/en-gb/blog/how-we-built-security-into-custom-agents Engineering blog · First party · Last source verification: 2026-08-31 Meet Scruff, Security’s New AI Teammate https://www.notion.com/blog/meet-scruff-securitys-new-ai-teammate Engineering blog · First party · Last source verification: 2026-09-17 Question coverage and scope purpose Reported workflow Reported human involvement Not applicable: There is no single platform-wide agent review boundary. Scoped downstream operating-model claims remain in research details; access controls are described separately. implementation Reported validation Reported observations Reported lessons Not reported: The record contains no separate lessons claim after review of both captures. Research details for every claim on this page Summary Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Headline claim Statement type Metric Provenance Reported Confidence Medium Confidence reason Notion reported the agent count in its own engineering blog without independent verification. Reported by Notion Scope Internal Notion Custom Agents at the end of alpha; excludes the separate customer alpha count Denominator Not reported Method Not reported Observation date 2026-04 Harness Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Tool access Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Interfaces Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Knowledge Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Credentials Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Context management Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Slack bug-triage agent Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Default-deny permission model Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Risk confirmation and remediation Statement type Fact Provenance Reported Confidence Not assessed Confidence reason No explicit confidence assessment is recorded for this claim. Key observation More than 3,000 internal Custom Agents by end of alpha testing
Duplicate representation of Headline claim . Same count, population, period, and qualification as the headline observation.
Statement type Metric Provenance Reported Confidence Medium Confidence reason Notion reported the agent count in its own engineering blog. Reported by Notion Scope Internal Notion Custom Agents at the end of alpha; excludes the separate customer alpha count Denominator Not reported Method Not reported Observation date Not reported Key observation Statement type Fact Provenance Reported Confidence Medium Confidence reason Qualitative first-party description; no comparative activity count is supplied. Scope Notion security team internal Custom Agent use Key observation Statement type Metric Provenance Reported Confidence Medium Confidence reason Participants give differing approximate rebuild counts for harness, framework, and feature; not a precise engineering inventory. Reported by Notion Scope Notion agent/framework rebuilds recalled by participants; estimates range from three to five Denominator Not reported Method Not reported Observation date Not reported Operating model assessment Unclassified for cross-team internal tasks → Custom Agents output; human attention boundary: unknown.
Statement type Inference Provenance Catalog judgment Confidence Unverified Confidence reason Custom Agents spans many teams and workflows, so no single human-attention boundary applies. Observation date 2026-04 