# Security boundaries

> Separate management, app authentication and private preview authority.

- Canonical page: https://docs.userland.fun/concepts/security-boundaries/
- Docs index for agents: https://docs.userland.fun/llms.txt

> **For agents:** Inspect current Account authority, exact revisions and native capabilities before acting.

Platform Users and Account membership authorize management operations. Customer App users belong to the app's own identity system. Neither app cookies nor a preview grant authenticates a platform management call.

API keys and connector grants are User-owned credentials checked against current membership. Removal, role reduction and revocation fence old operations; removing and later re-inviting a person does not revive old intent. A human who opens an agent-created preview receives a separate viewing operation under their own platform session.

App Workers receive native resource bindings, not Cloudflare or Userland management tokens. Untrusted source builds and browser tests run without management credentials. Private browser admission travels outside the guest browser and is removed before app code; it cannot be copied from a trace or screenshot.

## Browser hosts

Userland management pages use their own host-only platform sessions. Apps on shared Userland hosts are separate origins but may share a browser site, so SameSite alone is insufficient. The gateway accepts only exact valid `__Host-` app cookies, rejects ambiguous names, drops cookies for cross-origin non-navigation requests and enforces the frame boundary. App code must still use Secure, HttpOnly, Path=/ cookies and exact Origin checks on writes.

Strict custom domains keep this cookie contract. The optional `owned_site` policy requires exclusive site ownership proof and permits ordinary cookies within that site; sibling hosts within it can affect parent-domain cookies. It does not weaken the separation from Userland management credentials.

Private preview responses are private/no-store and their authorization is rechecked independently of app sessions. Platform and internal headers are stripped before app dispatch. Response cookies cannot replace management state, and shared-host responses cannot clear other apps' cookies.

## Output and access

Source, logs, database rows, stdout and browser evidence are untrusted app data. Runtime diagnostics and evidence require full publishing access because they can contain sessions or personal data. Protected input never becomes a model-visible tool argument. A provider error or empty log query is not proof that no usage or failure occurred.

See [Auth](/guides/auth/), [Secrets](/guides/secrets/), [MCP](/reference/mcp/) and the [Privacy Policy](https://userland.fun/legal/privacy/).