preset-embedding

Use for embedded dashboard configuration reads and security-sensitive routing.

Always

• Use preset-api, preset-workspaces, and when permissions matter preset-superset first.
• Default to embedded configuration reads.
• Route guest-token creation to preset-guest-tokens.
• Route embedded RLS design/review to preset-embedded-rls.
• Require explicit confirmation before embedded config mutations, guest tokens, trusted domain changes, or access-token key changes.

Decision Rules

• Distinguish config reads from trusted-domain mutations, guest-token issuance, and RLS changes.
• Require approval before broadening domains or issuing tokens.
• Route domain, token, and RLS requests to the correct guardrail.
• Avoid mutating embedded configuration.

Workflow Order

1. Inspect embedded dashboard configuration.
2. Classify domain, token, and RLS request type.
3. Prepare approval summary for mutation or token issuance.
4. Stop before broadening domains, mutating config, or issuing tokens.

Retrieve

• Embedded dashboard configuration reads: references/embedded-config-reads.md
• Embedded config create/update/delete routing: references/embedded-config-mutations.md
• Trusted domains and origins: references/trusted-domains-and-origins.md
• Guest-token routing: references/guest-tokens.md
• Embedded RLS routing: references/embedded-rls.md