Whoever Sets the Default Owns the Bill

Three announcements landed this week that have nothing to do with each other on the surface. Notion rebuilt its AI agents. Replit changed which model its users get out of the box. And Financial Cents, a practice-management tool for accounting firms, launched a connector so bookkeepers can talk to their software through Claude, ChatGPT or Gemini.

Put them side by side and they say the same thing. The AI model is turning into plumbing. The product is the default setting, and the permission system that decides what the agent is allowed to touch.

Notion: a router that picks the cheapest model that works

On 19 October Notion co-founder Akshay Kothari announced the sixth generation of Notion's agent harness. The headline change is run length. A single task can now run for about 24 hours, up from five minutes. Each session gets its own dedicated service with a queue-backed worker loop, so a long job survives a restart instead of dying halfway through.

The agents also got a computer of their own. Instead of spending tokens reasoning through a repetitive job, the agent can write and run a script. There is browser use, native compaction so long conversations do not fall over, and a "Review for me" mode where a separate model checks whether an action is safe before the agent takes it.

But the part I keep coming back to is the router. Notion's new Auto mode picks the model for you. Across more than 20 tasks in Notion's own tests, Auto delivered results similar to Opus 5.5 and Astra at about 90 percent lower average cost. That is a vendor's number about its own product, so hold it loosely. Even if the real figure is half that, it changes the economics of letting an agent run all day.

Pricing follows the same logic. Business and Enterprise seats now get 1,500 Standard credits a month, where Notion picks the model, plus 500 Select credits, where you pick the model or run a Custom Agent. New customers are on it now. Existing customers move on 2 November. Notion also says its MCP connector is the fastest-growing product in the company's history. The governance piece, an AI Command Center with per-member usage, spending limits and a model allow-list, is "soon" rather than shipped.

Replit: flip one setting, move most of the spend

At TechCrunch Disrupt, Replit CEO Amjad Masad said Replit "is no longer working with Anthropic", citing cost, partnership and performance, and said Sol and Astra beat the alternatives on Replit's own benchmark. He later softened it. Anthropic models remain selectable, but OpenAI is now the default. An unnamed insider told TechCrunch the partnership has not ended at all.

The contradiction matters less than the mechanism. TechCrunch notes that most customers stick with the default, and that Replit had been a top-five Anthropic customer. So changing one dropdown could significantly reduce Replit's spend with Anthropic. Masad also said enterprise went from about 2 percent to about 15 percent of Replit's revenue in a year, with more than half of revenue now B2B.

Think of a supermarket shelf. The brand at eye level sells. Not because shoppers compared every option, but because they did not. In AI products, the default model is the eye-level shelf, and the app that owns the shelf owns the negotiation with the labs.

The model is becoming plumbing. The product is the default, and the permission system that decides what the agent may touch.

Financial Cents: the permission design the whole industry should copy

The third story comes from the smallest company and carries the most important design. On 20 October Financial Cents launched an MCP server so accounting firms can ask an assistant "What's overdue this week?" and have it log time or create tasks. The control list reads like the checklist I wish every vendor used:

• OAuth 2.1, so no password or API key is ever handed to the AI client.
• Each connection is bound to a single firm account, inside the firm's existing permission levels.
• The assistant confirms before any change.
• Every action is audited and rate limited.
• Access can be revoked in one click.
• Deletes are not exposed over MCP at all.

It ships on the Scale plan only, as a single server URL with no developer setup. That is a paid upsell, which tells you where the vendor thinks the value sits. Not in the model, which belongs to someone else, but in the safe, scoped door into the firm's data.

The same week, Figma added 20 MCP partners including Linear, Notion, ClickUp, Mistral and JetBrains Junie, and CEO Dylan Field said the quiet part out loud. MCP "is not a perfect protocol", he said, and is "advantaged more to frontier labs", because platforms are asked to expose data to labs that do not expose their own artifacts back. Figma will not be fully open, because more exposed data means more abuse risk. Financial Cents and Figma are answering the same question from opposite ends: how much of yourself do you let an agent see?

Why it matters

If you buy AI tools, three things follow.

1. Expect two-tier pricing everywhere. A cheap routed tier for routine work and a metered premium tier for chosen models and long runs. Notion's 1,500 plus 500 split is the first clear template.
2. Ask who controls the default. If your vendor can switch models with one setting, your results can change without a release note. Ask how they test before a switch.
3. Judge connectors by their permission list, not their demo. Confirm before writes, no deletes, one-click revoke and a full audit log should be the baseline, not a premium feature.

For a decade we argued about which engine was best. This week the car makers showed us the gearbox and the ignition key. The engine still matters. But the gearbox decides how much fuel you burn, and the key decides who gets to drive.