Sandbox

Yeah.

Now, proponents of NCP apps will immediately point to the standard browser sandboxing mechanics.

You strip the allow same origin tag so the iframe cannot read your corporate cookies or access local storage.

Right.

Strickeway SP1865 and A2UI v1.0-RC, the real question every architect has to answer is, who do you trust to define the experience and what does that mean for your governance model?

Let's do another myth debunking here because this one comes up constantly.

Myth number three, if frame sandboxing makes embedded third-party UI safe by default in a system of record.

We touched on this earlier, but it bears repeating as a fundamental fact.