Scruff
- Company
- Notion
- Approach type
- Agent
- Work
- Security
- Human involvement
- Drafts reviewed
- Invocation
- Event-driven
- Deployment stage
- Deployed
- Evidence strength
- Detailed primary
- Entry reviewed
Purpose
Scruff investigates security alerts for Notion’s Detection and Response team, preparing analysis for human decisions.
How it works
Representative workflow: security alert → investigation for DART decision. Research details
An alert enters a structured Notion database.
Scruff follows the matching runbook and queries security sources through MCP.
DART reviews the investigation and decides whether to declare an incident or dismiss the alert.
Where people stay involved
Each scope pairs its normal attention boundary with supporting evidence. See the supervision definitions for the level mapping and limits.
security alert → investigation for DART decision
Work-product review · Level 3
Catalog interpretation: Level 3 for security alert → investigation for DART decision; human attention boundary: work-product-review.
Observed in 12 January 2026
Implementation details
- Model
- Not reportedNot documented for this subject in the reviewed source.
- Harness
- Notion Custom Agents.
- Sandbox
- Not reportedNot documented for this subject in the reviewed source.
- Tool access
- MCP connections to external security tools.
- Knowledge
- Runbooks stored as Notion pages.
- Context management
- A notes page retains lessons and accepts human edits.
- Credentials
- Not reportedNot documented for this subject in the reviewed source.
- Interfaces
- Not reportedNot documented for this subject in the reviewed source.
Validation and failure handling
Unreported: The reviewed source does not report a distinct validation process for this subject.
Reported observations
The catalog records what the sources report, with the scope and the denominator of every figure. A qualification below limits the figure it sits under.
Adoption output · Reported measurement · Scruff: Notion reports more than six hours saved per week across DART.
Notion reports more than six hours saved per week across DART.
- Reported by
- Notion
- Scope
- Scruff: Notion reports more than six hours saved per week across DART.
The source does not report the denominator of this figure.
Lessons
Unreported: The reviewed source does not document this for the named subject.
Sources and research details
Citations link to the original publisher. Each source also keeps a preserved copy in the repository, so a changed or removed page stays checkable.
- Meet Scruff, Security’s New AI Teammatehttps://www.notion.com/blog/meet-scruff-securitys-new-ai-teammate
Question coverage and scope
- purpose
- Reported
- workflow
- Reported
- human involvement
- Reported
- implementation
- Reported
- validation
- Unreported: The reviewed source does not report a distinct validation process for this subject.
- observations
- Reported
- lessons
- Unreported: The reviewed source does not document this for the named subject.
Research details for every claim on this page
- Summary
- Statement type
- Fact
- Provenance
- Reported
- Confidence
- High
- Confidence reason
- A linked first-party source states the claim.
- SupportsMeet Scruff, Security’s New AI TeammateBuilding Scruff; Putting It All Together; The Results
- Harness
- Statement type
- Fact
- Provenance
- Reported
- Confidence
- High
- Confidence reason
- A linked first-party source states the claim.
- SupportsMeet Scruff, Security’s New AI TeammateBuilding Scruff; Putting It All Together; The Results
- Knowledge
- Statement type
- Fact
- Provenance
- Reported
- Confidence
- High
- Confidence reason
- A linked first-party source states the claim.
- SupportsMeet Scruff, Security’s New AI TeammateBuilding Scruff; Putting It All Together; The Results
- Context management
- Statement type
- Fact
- Provenance
- Reported
- Confidence
- High
- Confidence reason
- A linked first-party source states the claim.
- SupportsMeet Scruff, Security’s New AI TeammateBuilding Scruff: Notes page
- Tool access
- Statement type
- Fact
- Provenance
- Reported
- Confidence
- High
- Confidence reason
- A linked first-party source states the claim.
- SupportsMeet Scruff, Security’s New AI TeammateBuilding Scruff; Putting It All Together; The Results
- Trigger investigation
- Statement type
- Fact
- Provenance
- Reported
- Confidence
- High
- Confidence reason
- A linked first-party source states the claim.
- SupportsMeet Scruff, Security’s New AI TeammateBuilding Scruff; Putting It All Together; The Results
- Gather and correlate
- Statement type
- Fact
- Provenance
- Reported
- Confidence
- High
- Confidence reason
- A linked first-party source states the claim.
- SupportsMeet Scruff, Security’s New AI TeammateBuilding Scruff; Putting It All Together; The Results
- Return findings
- Statement type
- Fact
- Provenance
- Reported
- Confidence
- High
- Confidence reason
- A linked first-party source states the claim.
- SupportsMeet Scruff, Security’s New AI TeammateBuilding Scruff; Putting It All Together; The Results
- Key observation
- Statement type
- Metric
- Provenance
- Reported
- Confidence
- Medium
- Confidence reason
- Self-reported by the source; no independent verification.
- Reported by
- Notion
- Scope
- Scruff: Notion reports more than six hours saved per week across DART.
- Denominator
- Not reported
- Method
- Not reported
- Observation date
- Not reported
- SupportsMeet Scruff, Security’s New AI TeammateThe Results, first bullet: 6+ hours saved per week across DART
- Operating model assessment
- Statement type
- Inference
- Provenance
- Catalog judgment
- Confidence
- Medium
- Confidence reason
- The source explicitly places the incident/false-positive decision with DART after Scruff gathers and analyzes evidence.
- Observation date
- 2026-01-12
- SupportsMeet Scruff, Security’s New AI TeammateOpening example and The Results: DART decides whether to declare an incident or mark a false positive; analysts review Scruff investigations