# Browser boundaries and embedding

> Treat app framing and sessions as deliberate security choices.

- Canonical page: https://docs.userland.fun/guides/embedding/
- Docs index for agents: https://docs.userland.fun/llms.txt

> **For agents:** Read the [complete native guide](/native-guide.md) and current `context.get` capabilities. Use only implemented operations and preserve exact Account, app and environment authority.

Shared Userland app addresses enforce a protective framing and cookie boundary. Do not assume an app can embed another app or share its session cookies. An unguessable URL is not private access.

Use native response headers and the supported custom-domain policy when the product needs framing. Never remove exact Origin/CSRF checks or change a protected session into a parent-domain cookie as a workaround. Check current domain capabilities and test the actual browser flow before claiming support.