Architecture

ZeroGrant Element

Hosted clearance UI at a separate origin. Uses intent client_secret and publishable keys for config only.

Test mode can simulate owner approval for sandbox integration.
Production mode asks the owner to review recipient, purpose, scope, and lifetime before approving or declining.
Use @zerogrant/browser / @zerogrant/react with exact origin postMessage checks.