Shipping Sandboxed Workers for Notion Agents

In this talk, we will share how we built a platform at Notion that allows developers to extend AI agents with custom code. The system enables developers to write small programs that give their agents access to tools such as internal APIs and external services.

We will focus on the engineering decisions that made the first version practical to ship: what we chose to build, what we deliberately left out, and the operational and safety constraints that shaped the design.

We will walk through the developer experience from local development through deployment and execution, and discuss how we approached packaging, distribution, and running user-supplied code in an isolated environment.

From there, we will explore the boundaries required to safely support untrusted tool code in production, including capability constraints, governance around who can manage and attach extensions, and the guardrails needed to keep agent-driven execution safe and observable.

Finally, we will share lessons from bringing the system out of its early stages, including the operational challenges we encountered and the changes we made along the way.