Security and Privacy
Version 3 Security Contracts
UIF 3 requires exact origin-and-path capabilities for intentional cross-origin browser requests. Declarative markup cannot grant a network capability. Configuration and untrusted JSON are parsed through bounded helpers, and application resources must remain within their configured ownership and capacity limits.
Persisted state is partitioned by application, tenant, and principal. Configure the partition before storing preferences or Micro App state, and clear the active principal partition during sign-out. Diagnostics are disabled by default and use a fixed metadata-only contract; prompt text, model output, tool payloads, editor or form content, identities, workspace names, storage values, and secret-bearing URLs are excluded.
AI and MCP browser surfaces remain provider-neutral presentation and review layers. Same-origin gateways, explicit approval, replay protection, progress, receipts, and UI audit context do not move authorization or privileged execution into the browser.
Governed Crawling and Export Boundary
Batoi UIF does not crawl arbitrary websites or bypass browser origin controls. Website discovery, crawling, credential use, content authorization, SSRF protection, robots and permission policy, and XML export belong on a governed server boundary. Browser components may collect an approved URL, show progress, and render returned results, but they must not be presented as a way around CORS or source permissions.
Batoi UIF can power browser-only tools, but production use needs clear security boundaries.
Security Boundary Diagram
Browser-Only Data
For examples such as Data Visualization, local data should stay in the browser unless the user explicitly submits it.
API Keys
Do not persist provider keys in browser storage.
For production AI interfaces, use a backend proxy.
Exports
Exports should be user-initiated.
Examples:
- JSON project file
- CSV register export
- SVG chart
- generated CSS
- generated HTML
Server Integration
When a Micro App talks to a server, define:
- authentication
- authorization
- validation
- audit
- rate limiting
- error handling
UIF 2.1 Browser Controls
- Trusted and sanitized HTML are separate contracts; server-rendered partials remain trusted server output.
- URL, selector, navigation, service-worker, and remote-data paths use explicit safety policies and same-origin defaults.
- Requests compose cancellation signals, bound retries, and avoid implicit mutation retries without an idempotency contract.
- Tables, editors, realtime feeds, AI responses, MCP reviews, RAD envelopes, offline queues, and persisted state enforce browser-side limits.
- Service-worker caches exclude authenticated/private responses by default, and offline tasks must be explicitly idempotent.
- AI and MCP packages render review UI only. Database, filesystem, deployment, email, payment, credential, tool, permission, and audit authority stays on the governed backend.
The full package classification is published with the asset snapshot in security-boundaries.json. These browser controls are defense in depth and do not replace server authorization, validation, CSRF protection, rate limiting, or audit logging.