When an AI system answers from company data, two separate permission questions apply. The first is what the system may read. The second is who may receive what it produces. A derived answer is a new artifact: it can combine sources that had different audiences, and no single one of those sources governs the result. So the design choice that decides company-wide safety is whose permissions the derived answer carries — the reader asking for it, the person who set up the automation that produced it, or an audience computed from the answer’s own inputs.
This page sets one documented approach beside ours. Every statement about Notion below is a verbatim quote from a Notion page, linked to the exact sourceVendor documentation changes. Read the sources.
What Notion documents about permissions, in Notion’s words. *
Notion AI responses generated for a user
Notion’s AI security and privacy page states: “Yes, Notion AI honors existing permissions. The LLMs and AI Models used to generate AI responses for a user cannot see or use any information to which that user does not already have access.” (Notion AI security & privacy practices
On retrieval scope, Notion’s FAQ states that what Notion AI draws on “includes pages in your Notion workspace that you have access to; your Notion AI Connectors, which connect to apps like Slack or Google Drive; and information from the web.” (What is Notion AI? FAQs Notion’s Enterprise Search page adds: “All queries respect user permissions for each connected app (permissions sync periodically; see individual AI Connector documentation for specific details)” and “Results filtered based on user's access rights in both Notion and connected apps”. (Enterprise Search security & privacy
Custom Agents
Notion’s Custom Agents security page opens: “Custom Agents operate with their own independent permissions separate from individual user permissions. This means anyone who can use an agent might access information through it that they couldn't access directly.” (Notion Custom Agents security features
The two statements above sit on two different Notion pages and describe two different surfaces: AI responses generated for a user, and Custom Agents. Each is quoted here in full so the scope of each is visible, and both are linked so you can read them in place.
The controls Notion documents
Notion frames the mitigation on the same page: “Custom Agent security features help you control this access to keep your data safe.” The documented controls include an access floor, a revocation rule, and an escalation rule.
The access floor: “Each connected resource must have at least one Agent editor that has access to that resource”. The revocation rule: “If all editors lose access to a resource, the agent stops running.” Notion names the failure mode this addresses: “This prevents "orphaned" agents from continuing to access sensitive data after everyone who set them up has left the team or lost access.”
The escalation rule: “For each Custom Agent, only the person who connected an integration can add more Slack channels or increase access (for example, from `Read Only` to `Read & Reply`).” And: “Users with "Can Edit" access can remove third-party connections, but cannot expand what the connection can see.” (All four quotes: Notion Custom Agents security features
How Notion describes delivery
Notion draws its own line between the two products: “Custom Agents are team-wide AI teammates that run automatically on schedules or triggers. Notion Agent is a personal AI assistant that works on-demand when you ask.” On how an unattended agent is set up, the same page says: “One person sets up a workflow: what data to pull, how to format it, where to post it. Set a trigger or schedule, and the agent handles it from there—24/7, whether you're online or not.” (Meet your 24/7 AI team | Notion
WonderForce attaches an audience to every fact.
WonderForce does not treat permission as a property of a container. Each fact in a company’s brain carries an audience of its own, derived from who actually had access to that fact’s sources. The audience is a property of the knowledge, not of the page it happens to sit on and not of the channel it is later delivered into.
That audience is enforced at the moment an answer is served. An answer assembled from several facts reaches the intersection: everyone cleared for every input, and no one else. If one supporting fact is out of a reader’s reach, the answer built on that fact does not reach that reader. Nothing at delivery time widens an audience that was set by source access.
This is the property that makes company-wide proactive delivery safe rather than risky. WonderForce pushes a morning playbook and a pre-meeting brief to each person without waiting for a query, so the same synthesis that combines a support thread, an engineering fix, and a renewal date also combines three audiences. The combined artifact is governed by the intersection of them, computed per reader, at serve time.
The same rule holds for agents. An agent connected over the Model Context Protocol recalls from the same brain under its own principal’s access, and reads exactly what that principal may read. Agents read and recall; connecting one widens no one’s access. Every claim served carries the supporting email, document, or meeting behind it, and a request that runs past the available evidence returns an explicit gap rather than invented content. Permission-aware AI retrieval explains the enforcement in detail.
Six questions, two answers.
Every Notion cell below is a verbatim quote from a Notion page listed in the previous section
| Question | Notion, as documented | WonderForce |
|---|---|---|
| Unit of permission | A page, and for a Custom Agent, each connected resource: “Each connected resource must have at least one Agent editor that has access to that resource”. | A fact. Each fact carries an audience derived from who had access to that fact’s sources. |
| When the check is applied | For AI responses, against the asking user: the models “cannot see or use any information to which that user does not already have access.” For connected apps, “permissions sync periodically”. | When the answer is served, per reader, on the audience carried by every fact the answer used. |
| Whose permissions a derived answer carries | For Custom Agents, the agent’s own: they “operate with their own independent permissions separate from individual user permissions”, and “anyone who can use an agent might access information through it that they couldn't access directly.” | The reader’s. An answer built from several facts reaches only the people cleared for every one of them. |
| Delivery model | Split across two products: Custom Agents “run automatically on schedules or triggers”, and “Notion Agent is a personal AI assistant that works on-demand when you ask.” | Pushed per person. A morning playbook and a pre-meeting brief arrive without a query. Agents recall the same brain over MCP. |
| What one person configures | The workflow and its destination: “One person sets up a workflow: what data to pull, how to format it, where to post it.” | The connections. No one configures who may receive an answer, because the audience is derived from source access. |
| Documented control on reach | Editor-anchored access and revocation: “If all editors lose access to a resource, the agent stops running.” And: “Users with "Can Edit" access can remove third-party connections, but cannot expand what the connection can see.” | The audience travels with the fact. Delivery cannot widen it, and a reader missing one input does not receive the answer. |
What to check for yourself, with any vendor.
These questions are not about any one product. Ask them of every AI assistant you are considering, and read the vendor’s own documentation for the answers rather than a comparison page.
- Whose permissions does a derived answer carry?Ask whether an answer runs on the asking reader’s access, on the access of whoever built the automation, or on an audience computed from the answer’s own inputs. These are three different guarantees and the difference only shows up at scale.
- At what moment is the check applied?Filtering at retrieval and enforcing at delivery are not the same promise. Ask specifically which one governs an answer that is posted into a shared space rather than returned to one person.
- What is the unit?A document, a container, a connected resource, or a single claim. The unit sets the smallest thing the system is able to withhold, and therefore how coarse every decision above it has to be.
- What can one configuring person widen?Ask who can expand an automation’s reach, who can revoke it, what happens when that person leaves, and whether anyone else can see what was expanded.
- Where does derived output land?Output delivered into a channel is governed by that channel’s membership unless something else governs it. Ask what that something else is, and ask the vendor to name it in their documentation.
Questions people ask about Notion AI and permissions.
Does Notion AI respect user permissions?
Notion documents that Notion AI honors existing permissions for AI responses generated for a user. Notion’s AI security and privacy page states: “Yes, Notion AI honors existing permissions. The LLMs and AI Models used to generate AI responses for a user cannot see or use any information to which that user does not already have access.”
Can a Notion Custom Agent reach information a person cannot open directly?
Notion documents that a Custom Agent runs on its own permissions rather than on the permissions of the person using it. Notion’s Custom Agents security page states: “Custom Agents operate with their own independent permissions separate from individual user permissions. This means anyone who can use an agent might access information through it that they couldn't access directly.” The same page documents the controls Notion provides for that access.
What controls does Notion document for Custom Agents?
Notion documents an access floor and a revocation rule: every connected resource needs an agent editor with access to it, and the agent stops running if all its editors lose access. In Notion’s words: “Each connected resource must have at least one Agent editor that has access to that resource”, and “If all editors lose access to a resource, the agent stops running.” Notion frames these as: “Custom Agent security features help you control this access to keep your data safe.”
How does WonderForce decide who may receive an answer?
WonderForce attaches an audience to each fact, derived from who actually had access to that fact’s sources, and enforces that audience when the answer is served. An answer built from several facts reaches only the people cleared for every one of them, so combining sources never produces an artifact with wider reach than its inputs.
Is a Notion Custom Agent proactive?
Notion documents that Custom Agents run on schedules or triggers, while the personal Notion Agent works on demand. Notion’s product page states: “Custom Agents are team-wide AI teammates that run automatically on schedules or triggers. Notion Agent is a personal AI assistant that works on-demand when you ask.”
What should I check before rolling out any AI assistant company-wide?
Check whose permissions a derived answer carries, at what moment that check is applied, and what unit it applies to. Then ask what one person configuring an automation is able to widen, and what governs output that is delivered into a shared space rather than returned to one reader.
One company brain. Personalized for everyone.
WonderForce is in private development. Join the waitlist for product updates.
* Every quotation on this page is verbatim from Notion’s own public documentation, retrieved 23 August 2026, and each is linked to the exact page it was read from. Vendor documentation changes; the links are there so anything here can be re-checked at the source.