You removed a user’s access to a Notion page, but that user still receives a notification when someone mentions them in a comment on that page. This behavior seems like a security flaw. The root cause is that Notion processes mention notifications at the moment the mention is created, and the system does not retroactively revoke notifications based on later permission changes. This article explains why this happens, how the notification pipeline works, and what you can do to prevent unwanted notifications in the future.
Key Takeaways: Notion Mention Notifications and Permission Changes
- Mention @user in a comment: Notion fires an immediate notification to that user, even if their page access is removed seconds later
- Settings & Members > Permissions > Remove member: This action does not delete notifications that were already sent to that user
- Remove the user from the workspace before mentioning: The only way to guarantee the user never sees the notification
Why Notion Sends Notifications for Mentions on Locked Pages
Notion uses an event-driven notification system. When you type @username in a page comment or a database discussion and press Enter, Notion immediately queues a notification for that user. The system checks the user’s permission at the time the mention is created. If the user has at least Can View access to the page at that moment, the notification is sent. Removing the user’s permission after the mention does not cancel the notification that is already in the queue or has already been delivered.
This is not a bug. It is a design decision to keep the notification system fast and simple. Re-checking permissions for every queued notification would require significant server overhead, especially in workspaces with many pages and users. Notion prioritizes speed over retroactive permission checks. The notification is treated as a one-time event that is logged and delivered immediately.
The Role of the Notification Queue
When you mention a user, Notion adds an entry to an internal notification queue. This queue is processed almost instantly. The notification includes a link to the page where the mention occurred. The user can click that link, but if their permission has been removed, they will see a “You do not have access to this page” message. The notification itself, however, remains in their notification list and can be read. The user sees the content of the mention (the comment text) in the notification preview, which may contain sensitive information.
Why Removing Permissions After a Mention Does Not Work
Removing a user from a page or workspace after a mention has been created does not delete the notification from the user’s inbox. The notification is already stored in the user’s personal notification feed, which is a separate data store from the page permissions database. Notion does not run a background job to cross-reference all notifications with current permissions. Therefore, the user retains the ability to view the notification text and the fact that they were mentioned, even if they can no longer access the underlying page.
Steps to Prevent Unwanted Mention Notifications
To ensure a user does not receive a mention notification for a page they should not see, you must remove their access before creating the mention. If you need to mention someone but then revoke access, you must delete the mention itself.
- Remove the user from the page before mentioning
Go to the page where you want to mention the user. Open the Share menu in the top-right corner. Find the user’s name and click Remove. Confirm the removal. After this, any mention of that user will not trigger a notification because the user no longer has any permission to the page at the time the mention is created. - Delete the mention after removing permissions (if you already mentioned)
If you already mentioned the user and then removed their permission, the notification has already been sent. To stop the notification, you must delete the comment or block that contains the mention. Hover over the comment, click the three-dot icon, and select Delete. The notification will be removed from the user’s feed only if they have not yet opened it. If they have already seen the notification, deleting the mention does not remove the notification from their feed. - Remove the user from the entire workspace
If you need to prevent all future notifications for a user, go to Settings & Members in the left sidebar. Select the Members tab. Find the user and click the three-dot icon next to their name. Choose Remove from workspace. This revokes all page permissions immediately. Any mention created after this point will not trigger a notification. However, mentions created before the removal still deliver notifications.
If Notion Still Sends Notifications After You Follow These Steps
User receives notification for a mention created after permission removal
This can happen if the user has access to the page through a shared parent page or a teamspace. Check the page’s Share menu and look for inherited permissions. Click the three-dot icon next to the user and select Remove. Also check the page’s parent page and the teamspace settings. Remove the user from all sources of inherited access.
Notification appears in the user’s inbox even after deleting the mention
If the user already opened the notification before you deleted the mention, the notification remains in their inbox indefinitely. Notion does not provide a way for workspace admins to delete notifications from another user’s inbox. The only workaround is to ask the user to manually dismiss the notification by clicking the bell icon and then clicking the X next to the notification.
User sees the mention text in the email notification
Notion sends email notifications for mentions. These emails contain the comment text. If the email has already been delivered to the user’s inbox, you cannot recall it. To prevent this, disable email notifications for the workspace or ask users to adjust their personal notification settings. Go to Settings & Members > Notifications > Email notifications and toggle off “Mentions” for all members.
Notion Notification Behavior: Mention With Access vs Without Access
| Item | User has page access at mention time | User does not have page access at mention time |
|---|---|---|
| Notification delivered | Yes, immediately | No |
| User can click notification link | Yes, opens the page | No, shows access denied page |
| Notification remains if permission removed after mention | Yes, stays in inbox | N/A — notification was never sent |
| Email notification sent | Yes, if email notifications are enabled | No |
You can now predict exactly when a mention notification will reach a user. To prevent leaks, always remove page access before typing the @ symbol. If you need to mention someone after they lose access, consider copying the relevant text into a direct message instead. As an advanced tip, use a dedicated guest account with no page permissions for testing mentions in a sandbox page to avoid accidental notifications to real team members.