Notion Agent Model Controls: Cost, Compliance and Multi-Model Governance

Quick answer

Notion released model controls on September 9, 2026, giving workspace owners more control over which AI models their teams and agents are allowed to use.

Admins can now manage model availability for Personal Agent and Custom Agents separately, and they can set a default model for Custom Agents. Notion positions the controls around two practical enterprise concerns: keeping AI costs predictable and supporting compliance requirements.

The bigger story is not the settings screen. It is the architectural shift behind it.

As productivity platforms become multi-model agent platforms, model selection is turning from a user preference into an administrative policy. Different models can carry different costs, data-handling terms, performance profiles and security characteristics. Once agents run automatically rather than only answering a user in chat, those differences matter operationally.

TowCue's view: model choice should increasingly be governed like any other production dependency — approved deliberately, monitored, and separated by workload rather than left completely open by default.

What Notion changed

Notion's September 9 release adds workspace-level model controls under:

Settings → Notion AI → General → Model controls

Workspace owners can decide which models are available in Personal Agent and Custom Agents independently. For Custom Agents, admins can also choose a default model.

That separation matters because a personal assistant and an always-running workflow agent are not the same risk or cost profile.

A person may deliberately select a premium model for a difficult one-off task. A Custom Agent may run repeatedly on triggers or schedules, multiplying the cost and operational impact of that model choice across the workspace.

Personal Agent and Custom Agents need different policies

Notion's agent system now spans two broad usage patterns.

Personal Agent

The Personal Agent is user-driven. It helps an individual search, reason, draft and work across their Notion context and connected sources.

The main governance questions are usually:

which models members can access
how much premium-model usage they can spend
whether sensitive workloads are allowed on particular models
whether the workspace wants consistency or user choice

Custom Agents

Custom Agents can be configured with instructions, tools, access, triggers and schedules. They can run repeatedly and interact with Notion, Slack, the web and connected systems depending on their configuration.

That changes the question from:

"Which model does this employee prefer?"

to:

"Which model is this automated business process allowed to depend on?"

That is a much closer cousin of infrastructure governance than a normal chat preference.

Why a default model matters

Notion allows admins to set a default model for Custom Agents.

This sounds minor, but defaults shape production behavior.

If every agent builder picks independently, an organization can quickly end up with:

inconsistent cost profiles
different output quality for similar workflows
harder incident investigation
model-specific data handling scattered across dozens of agents
surprise changes when teams experiment with new models

A default gives the organization a baseline while still allowing approved exceptions.

TowCue would treat the default as the production-safe model, not necessarily the most capable model available.

The best default is usually the model that meets the organization's acceptable balance of reliability, data handling, latency and cost for the majority of workflows.

The cost side is becoming explicit

Notion's current help documentation adds an important related change: starting September 10, 2026, premium models are off by default for Notion Agent in every workspace until a workspace owner or admin enables them.

Premium models consume Notion credits, and admins can set member or group spending caps. Custom Agents have their own model controls and credit model, separate from Personal Agent.

That means model governance is also becoming FinOps.

A model that is only slightly better for one request may be much more expensive when an agent runs hundreds or thousands of times.

For recurring workflows, teams should evaluate:

quality improvement per run
cost per run
number of expected runs
failure and retry rate
whether a cheaper model can handle the common case
whether escalation to a premium model can be conditional

The useful metric is not "best model". It is best model for this workload at this volume.

Compliance is another reason model choice cannot stay purely personal

Notion explicitly says model controls can help teams support compliance needs.

That is important because different model providers can have different terms or operational characteristics. Notion's Custom Agents help documentation, for example, calls out special data-handling considerations for one premium Anthropic model and requires admin enablement before workspace members can use it.

That does not mean one provider is categorically safer than another. It means the organization may need to evaluate providers differently based on its own legal, security and contractual requirements.

A strong model governance process should be able to answer:

Which providers are approved?
Which models are approved for sensitive content?
Which models are allowed for unattended agents?
Who can enable a premium or exceptional model?
What happens if an approved model is later disabled?

Notion says that if an admin turns off a model currently used by a Custom Agent, the agent automatically switches to the workspace default model, or to Auto if no default is configured.

That fallback behavior is convenient, but it also deserves testing. A model swap can change quality, latency, tool behavior or instruction-following in a production workflow.

Model changes are production changes

This is the part teams should not underestimate.

If a Custom Agent is responsible for triaging requests, updating records, generating reports or reacting to Slack events, changing the underlying model can change the behavior of the workflow even when the prompt and tools remain identical.

That means a model change should be treated more like changing a software dependency than changing a UI preference.

For important agents, TowCue would use a simple process:

define the approved model set
keep a conservative default
test alternative models on representative historical tasks
compare quality, latency and cost
review security and data-handling differences
roll out changes gradually
monitor failures after the switch

The more autonomous the agent, the more important this becomes.

Model governance is also a security control

Notion's Custom Agents security guidance makes another useful point: model choice can affect security characteristics.

Notion warns that smaller models may be more vulnerable to prompt injection and suggests using more capable models for workflows that process sensitive or untrusted content.

This should not be interpreted as "large model equals secure." Prompt injection is an architectural problem, not something solved by model size alone.

But the guidance highlights a real principle: the model is part of the threat model.

For agents that read external webpages, uploaded documents, shared content or Slack messages, teams should combine model selection with controls outside the model:

least-privilege access
restricted tools
URL confirmation
approval for high-impact actions
visible agent configuration
audit and activity logs

Model governance is one layer, not the entire security boundary.

Who should care

Workspace owners and IT admins

This update gives them a practical way to reduce model sprawl and prevent every agent creator from independently deciding cost and provider policy.

Teams building Custom Agents

Agent builders should assume that model availability may be centrally governed. Workflows should tolerate approved model changes and avoid depending on undocumented behavior from a single model.

Finance and procurement teams

Premium-model usage increasingly behaves like variable infrastructure spend. Recurring agents can make consumption grow much faster than ordinary chat usage.

Security and compliance teams

The model roster is becoming part of vendor and data-governance policy, especially when agents process confidential or externally sourced content.

A practical model policy for AI agents

TowCue would divide models into four buckets.

1. Default production models

Approved for normal internal workflows. Predictable cost, acceptable quality, reviewed data terms.

2. Premium escalation models

Used when complexity or quality justifies higher cost. Enable selectively and track credit consumption.

3. Restricted models

Allowed only for specific teams or data classifications because of compliance, retention or operational considerations.

4. Experimental models

Available in sandboxes or evaluation workflows, but not as unattended production-agent dependencies until tested.

This preserves model choice without turning the workspace into an uncontrolled model marketplace.

TowCue take

The most interesting part of Notion's September 9 update is that multi-model AI is becoming an administration problem.

The first wave of AI products encouraged users to ask: "Which model gives me the best answer?"

Agent platforms force organizations to ask a harder set of questions:

Which model is allowed to run this workflow?
What does it cost at production volume?
What data can it process?
What happens if the model changes?
Can we prove which model an agent was configured to use?

Those are operational questions, not benchmark questions.

As more productivity platforms expose multiple models behind agents, the winning enterprise architecture will probably not be "everyone can choose anything." It will be approved choice inside policy boundaries.

Notion adds model controls for AI agents: why model choice is becoming an admin policy