---
sidebar_position: 3
title: Isolate untrusted components
sidebar_label: Component isolation
description: Decide, per component, how much of your page a Myop component can touch — from full host access to a sandboxed cross-origin iframe with no access to your DOM, cookies or storage, or block it entirely.
keywords: [component isolation, sandboxed iframe, untrusted code, third-party ui security, cross-origin iframe, render policy, micro frontend security, host security]
---
# Isolate untrusted components

When your applications load UI that someone else wrote (a partner, an agency, a marketplace, an AI
tool), you need to decide how much of your page that code can reach. Myop lets your application make
that decision **per component, at render time**.

## Four levels, chosen by your code

| Mode | What the component can reach |
|---|---|
| **Web component** | Your page directly. For first-party UI you trust |
| **Iframe** | Its own frame, on your origin. The default |
| **Isolated iframe** | Nothing of yours. A sandboxed, cross-origin frame with no access to your DOM, cookies, storage or `window.parent` |
| **Blocked** | It does not render at all |

Your application installs one **render policy**, a function that sees each component before it renders
and returns the mode. A common rule: render your own components as authored, isolate everything that
comes from outside your organization.

```ts
hostSDK.setRenderPolicy((ctx) =>
  isFirstParty(ctx.componentDefinition) ? ctx.requestedMode : 'isolatedIframe');
```

## What isolation does

An isolated component runs in a sandboxed iframe **without** same-origin access, so it cannot read or
change anything on your page. It still works as a normal component: data goes in, actions come out, and
it resizes to its content, through a narrow message bridge the SDK provides. Component authors don't
change anything.

Net effect: **code from outside your organization never runs on your page.**

## Learn more

The full guide covers the policy hook, precedence rules, framework-specific usage, and which kinds of
components should not be isolated: [Component Isolation & Render Policy](/docs/learn/component-isolation).