Browser boundaries and embedding

For agents: Read the complete native guide and current context.get capabilities. Use only implemented operations and preserve exact Account, app and environment authority.

Shared Userland app addresses enforce a protective framing and cookie boundary. Do not assume an app can embed another app or share its session cookies. An unguessable URL is not private access.

Use native response headers and the supported custom-domain policy when the product needs framing. Never remove exact Origin/CSRF checks or change a protected session into a parent-domain cookie as a workaround. Check current domain capabilities and test the actual browser flow before claiming support.