The separation between permission to embed and permission to act is the useful framing here, and the rule that the parent re-queries its own backend after a completion notice closes the biggest hole. One edge case worth adding to the contract: a partner frame that navigates itself to a different path or subdomain on the approved origin. An exact origin match passes, but the document is no longer the one that was reviewed, so the handshake should re-run on every load, which you cover, and the parent should also pin the expected frame URL path, not just the origin. A second question: for the resize loop, would you rather rate-limit in the message handler or coalesce with requestAnimationFrame and a max-height clamp? I'd lean towards the clamp plus coalescing, since a rate limit alone still lets a hostile partner pin the layout at the maximum.