# Enterprise embeds

> Controlling which external sites may frame your organisation's content.

By default a public blueprint can be embedded anywhere. An organisation can
narrow that to an allow-list of hosts.

Managing it needs `integration.manage`.

## Allow-listing

Add the hosts permitted to frame your content. A request to embed from anywhere
else is refused, and the frame stays empty rather than rendering.

Use it for public content, such as a reference architecture or a standard, that
you want read in context rather than embedded in somebody else's product.

## Authenticated embeds

Private content can be embedded on a permitted host with the reader
authenticating first. The reader signs in, and the embed then resolves against
what that person may see.

> [!NOTE]
> Embeds write nothing to the reader's device on any surface. Authenticated
> embeds use their own short-lived session rather than reusing a cookie the
> embed surface never sets.