Source: https://internal-agents.com/agents/notion-scruff # Notion — Scruff Scruff investigates security alerts for Notion’s Detection and Response team, preparing analysis for human decisions. - Company: [Notion](https://internal-agents.com/organizations/notion) - Collection: Agents - Approach type: Agent - Deployment stage: Deployed - Autonomy: Drafts reviewed - Evidence strength: Detailed primary - Status: Internal - First reported year: 2026 - Work: Security - Invocation: Event-driven - Entry reviewed: 2026-09-17 ## Purpose ### Summary Scruff investigates security alerts for Notion’s Detection and Response team, preparing analysis for human decisions. Fact · Reported · High confidence · `notion-scruff--summary` Confidence reason: A linked first-party source states the claim. Evidence: - Supports · [1] [Meet Scruff, Security’s New AI Teammate](https://www.notion.com/blog/meet-scruff-securitys-new-ai-teammate) · Building Scruff; Putting It All Together; The Results Representative workflow: security alert → investigation for DART decision. ## How it works ### Trigger investigation An alert enters a structured Notion database. Fact · Reported · High confidence · `notion-scruff--primitives-0` Confidence reason: A linked first-party source states the claim. Evidence: - Supports · [1] [Meet Scruff, Security’s New AI Teammate](https://www.notion.com/blog/meet-scruff-securitys-new-ai-teammate) · Building Scruff; Putting It All Together; The Results ### Gather and correlate Scruff follows the matching runbook and queries security sources through MCP. Fact · Reported · High confidence · `notion-scruff--primitives-1` Confidence reason: A linked first-party source states the claim. Evidence: - Supports · [1] [Meet Scruff, Security’s New AI Teammate](https://www.notion.com/blog/meet-scruff-securitys-new-ai-teammate) · Building Scruff; Putting It All Together; The Results ### Return findings DART reviews the investigation and decides whether to declare an incident or dismiss the alert. Fact · Reported · High confidence · `notion-scruff--primitives-2` Confidence reason: A linked first-party source states the claim. Evidence: - Supports · [1] [Meet Scruff, Security’s New AI Teammate](https://www.notion.com/blog/meet-scruff-securitys-new-ai-teammate) · Building Scruff; Putting It All Together; The Results ## Where people stay involved - **security alert → investigation for DART decision** — Work-product review · Level 3 ### Supervision evidence #### Operating model assessment Level 3 for security alert → investigation for DART decision; human attention boundary: work-product-review. Inference · Catalog judgment · Medium confidence · `notion-scruff--operating-models-0` Confidence reason: The source explicitly places the incident/false-positive decision with DART after Scruff gathers and analyzes evidence. Qualifications: - Observation date: 2026-01-12 Evidence: - Supports · [1] [Meet Scruff, Security’s New AI Teammate](https://www.notion.com/blog/meet-scruff-securitys-new-ai-teammate) · Opening example and The Results: DART decides whether to declare an incident or mark a false positive; analysts review Scruff investigations ## Implementation details ### Harness Notion Custom Agents. Fact · Reported · High confidence · `notion-scruff--architecture-harness` Confidence reason: A linked first-party source states the claim. Evidence: - Supports · [1] [Meet Scruff, Security’s New AI Teammate](https://www.notion.com/blog/meet-scruff-securitys-new-ai-teammate) · Building Scruff; Putting It All Together; The Results ### Knowledge Runbooks stored as Notion pages. Fact · Reported · High confidence · `notion-scruff--architecture-knowledge` Confidence reason: A linked first-party source states the claim. Evidence: - Supports · [1] [Meet Scruff, Security’s New AI Teammate](https://www.notion.com/blog/meet-scruff-securitys-new-ai-teammate) · Building Scruff; Putting It All Together; The Results ### Context management A notes page retains lessons and accepts human edits. Fact · Reported · High confidence · `notion-scruff--architecture-context-mgmt` Confidence reason: A linked first-party source states the claim. Evidence: - Supports · [1] [Meet Scruff, Security’s New AI Teammate](https://www.notion.com/blog/meet-scruff-securitys-new-ai-teammate) · Building Scruff: Notes page ### Tool access MCP connections to external security tools. Fact · Reported · High confidence · `notion-scruff--architecture-tool-access` Confidence reason: A linked first-party source states the claim. Evidence: - Supports · [1] [Meet Scruff, Security’s New AI Teammate](https://www.notion.com/blog/meet-scruff-securitys-new-ai-teammate) · Building Scruff; Putting It All Together; The Results ### Implementation coverage - **Model:** unreported — Not documented for this subject in the reviewed source. - **Harness:** reported - **Sandbox:** unreported — Not documented for this subject in the reviewed source. - **Tool access:** reported - **Knowledge:** reported - **Context management:** reported - **Credentials:** unreported — Not documented for this subject in the reviewed source. - **Interfaces:** unreported — Not documented for this subject in the reviewed source. **Unreported:** The reviewed source does not report a distinct validation process for this subject. ## Reported observations Observation: Adoption output · Reported measurement · Scruff: Notion reports more than six hours saved per week across DART. ### Key observation Notion reports more than six hours saved per week across DART. Metric · Reported · Medium confidence · `notion-scruff--key-metrics-0` Confidence reason: Self-reported by the source; no independent verification. Qualifications: - The source does not report the denominator of this figure. - Reported by: Notion - Scope: Scruff: Notion reports more than six hours saved per week across DART. Evidence: - Supports · [1] [Meet Scruff, Security’s New AI Teammate](https://www.notion.com/blog/meet-scruff-securitys-new-ai-teammate) · The Results, first bullet: 6+ hours saved per week across DART ## Lessons **Unreported:** The reviewed source does not document this for the named subject. ## Question coverage and scope - **purpose:** Reported - **workflow:** Reported - **human involvement:** Reported - **implementation:** Reported - **validation:** Unreported — The reviewed source does not report a distinct validation process for this subject. - **observations:** Reported - **lessons:** Unreported — The reviewed source does not document this for the named subject. ## Related reading - Built on: [Notion — Custom Agents](https://internal-agents.com/agents/notion-custom-agents) ## Sources 1. [Meet Scruff, Security’s New AI Teammate](https://www.notion.com/blog/meet-scruff-securitys-new-ai-teammate) - Engineering blog · First party · Evidence - Original URL: - Published: 2026-01-12 · Accessed: 2026-09-17 · Last verified: 2026-09-17