---
title: "How we built security into Custom Agents"
description: "Custom Agents were designed for collaborative workspaces where useful access must be balanced against dangerous actions. They use a build-from-nothing model with no default read, write, or interaction permissions, then add resource-level controls such as page-level access, Slack “read and reply,” email confirmation, and selected MCP tools. Runtime safeguards combine permission controls with prompt-injection mitigations, monitoring of external data, warnings, owner confirmation for risky actions, and remediation such as deleting an incorrect Slack message. Alpha testing across Notion and customers produced more than 3,000 internal and 25,000 customer agents, and exposed overly broad Slack write access that could reach #general. That finding led to the custom permission and reinforced the case for first-party integrations, while planned work includes admin-approved broader scopes, Workers integrations, and additional permission modes."
---

# How we built security into Custom Agents

[Notion](https://yomu.fyi/company/notion) · Sean Keenan, Jacob Brackett · Feb 27, 2026

**Type:** Explainer

## Summary

Custom Agents were designed for collaborative workspaces where useful access must be balanced against dangerous actions. They use a build-from-nothing model with no default read, write, or interaction permissions, then add resource-level controls such as page-level access, Slack “read and reply,” email confirmation, and selected MCP tools. Runtime safeguards combine permission controls with prompt-injection mitigations, monitoring of external data, warnings, owner confirmation for risky actions, and remediation such as deleting an incorrect Slack message. Alpha testing across Notion and customers produced more than 3,000 internal and 25,000 customer agents, and exposed overly broad Slack write access that could reach #general. That finding led to the custom permission and reinforced the case for first-party integrations, while planned work includes admin-approved broader scopes, Workers integrations, and additional permission modes.

## Context

Custom Agents needed to be useful in collaborative environments without granting broad permissions that could enable dangerous actions. The work also addressed prompt injection, unexpected runtime behavior, and lessons from early testing in which agents received overly broad Slack write access.

## Approach / What changed

The security model starts with no access and adds granular resource or tool permissions. It layers deterministic access controls with prompt-injection mitigations, monitoring, warnings, user or owner confirmations, workspace-admin approvals, and remediation capabilities. First-party integrations provide controls that many MCP integrations do not natively support.

## Takeaways

- Custom Agents start without permission to read, write, or interact with most resources, allowing users to grant access deliberately.
- Slack’s custom “read and reply” permission was introduced after early agents with broad write access posted to the company-wide #general channel.
- Runtime protections include external-data monitoring, warnings, owner confirmation for risky actions, and the ability to delete an incorrect Slack message.

**Tags:** [AI Agents](https://yomu.fyi/topic/ai-agents), [MCP](https://yomu.fyi/topic/mcp), [Security](https://yomu.fyi/topic/security)

- Source: [Notion](https://www.notion.com/en-gb/blog/how-we-built-security-into-custom-agents)
- Source URL: https://www.notion.com/en-gb/blog/how-we-built-security-into-custom-agents
- Ingested by Yomu: 2026-09-09T05:20:07.842Z

[Read original post](https://www.notion.com/en-gb/blog/how-we-built-security-into-custom-agents)