Isolate untrusted components

When your applications load UI that someone else wrote (a partner, an agency, a marketplace, an AI tool), you need to decide how much of your page that code can reach. Myop lets your application make that decision per component, at render time.

Four levels, chosen by your code

Mode	What the component can reach
Web component	Your page directly. For first-party UI you trust
Iframe	Its own frame, on your origin. The default
Isolated iframe	Nothing of yours. A sandboxed, cross-origin frame with no access to your DOM, cookies, storage or window.parent
Blocked	It does not render at all

Your application installs one render policy, a function that sees each component before it renders and returns the mode. A common rule: render your own components as authored, isolate everything that comes from outside your organization.

hostSDK.setRenderPolicy((ctx) =>
  isFirstParty(ctx.componentDefinition) ? ctx.requestedMode : 'isolatedIframe');

What isolation does

An isolated component runs in a sandboxed iframe without same-origin access, so it cannot read or change anything on your page. It still works as a normal component: data goes in, actions come out, and it resizes to its content, through a narrow message bridge the SDK provides. Component authors don't change anything.

Net effect: code from outside your organization never runs on your page.

Learn more

The full guide covers the policy hook, precedence rules, framework-specific usage, and which kinds of components should not be isolated: Component Isolation & Render Policy.