Surgical Permissions: Why Manifest V3 Scopes LamaniSync Strictly to Your Paired Clinic Portal

The Hospital Security Keycard: A Least-Privilege Analogy

In a well-managed hospital or multi-specialty medical center, electronic RFID keycards govern physical security.

When a visiting pediatric dentist arrives for their morning surgical shift, the hospital security team doesn't hand them a master skeleton key that unlocks the emergency pharmacy vault, the psychiatric ward, the financial records office, and every locker in the facility.

Instead, the security desk programs the dentist's badge with surgical precision:

• The card unlocks the front entrance.
• It unlocks Pediatric Operatory Room 4.
• It unlocks the staff scrub room on Level 2.
• It unlocks nothing else.

If the dentist attempts to swipe into the central narcotics safe or the hospital accounting office, the reader flashes red and access is strictly denied.

In information security, this is the foundational Principle of Least Privilege (PoLP). And in browser extension architecture, LamaniSync enforces this exact surgical scope.

---

The Wildcard Permission Trap in Browser Extensions

When you install extensions from the Chrome Web Store, you have likely encountered this alarming browser permission prompt:

"This extension can: Read and change all your data on all websites you visit."

In the extension manifest file, this dangerous permission is represented as:

"host_permissions": [
  "<all_urls>"
]

Why is this terrifying for a healthcare clinic?
Because front-desk workstations are used for dozens of sensitive administrative tasks throughout the day:

• Logging into the clinic's corporate bank accounts to pay laboratory fees and staff salaries.
• Accessing Gmail or Microsoft Outlook to communicate with medical suppliers and patients.
• Viewing personal social media or reading news during lunch breaks.
• Managing insurance claims portals containing sensitive patient billing histories.

If an extension has permission to <all_urls>, its scripts can run inside every single one of those tabs. A buggy update or a rogue extension could log keystrokes on banking sites, scrape emails, or read personal passwords.

---

Rule #3 of Our Core Engineering Manifesto

At LamaniSync, our security manifesto explicitly outlaws broad, lazy permissions:

AGENTS.md Rule #3: Never request a runtime host permission broader than the exact paired CMS origin.

LamaniSync rejects the <all_urls> wildcard completely. When you pair LamaniSync with your clinic's workspace, the extension requests access strictly and exclusively to your specific CMS domain.

// LamaniSync Scoped Host Permission
"host_permissions": [
  "https://myclinic.kreloses.com/*"
]

If your clinic uses Kreloses, Dentrix Enterprise, or Pulse at https://myclinic.kreloses.com, Chrome's security engine grants LamaniSync permission to interact with that URL and nowhere else on the entire internet.

---

Chrome Sandbox Boundary Enforcement

How does the browser guarantee that LamaniSync stays in its lane?

Google Chrome's underlying Chromium engine enforces strict Cross-Origin Isolation at the operating-system process level:

┌────────────────────────────────────────────────────────┐
│             Front-Desk Google Chrome Browser           │
│                                                        │
│  [Tab 1: Maybank Corporate Banking]                   │
│   └── LamaniSync Status: 🚫 PHYSICALLY INACTIVE        │
│       (Browser blocks script injection entirely)       │
│                                                        │
│  [Tab 2: Clinic Staff Gmail]                           │
│   └── LamaniSync Status: 🚫 PHYSICALLY INACTIVE        │
│       (Zero visibility into emails or attachments)     │
│                                                        │
│  [Tab 3: myclinic.kreloses.com (Paired CMS)]           │
│   └── LamaniSync Status: ✅ ACTIVE SYNC BRIDGE         │
│       (Executes predefined appointment actions)        │
└────────────────────────────────────────────────────────┘

1. Process-Level Denial: Chrome checks the extension's host permissions before injecting any content script. When your receptionist switches to a tab with corporate banking or personal email, Chrome's process manager does not even load LamaniSync's code into memory.
2. Zero DOM or Network Visibility: LamaniSync cannot see what is typed into other tabs, cannot intercept cookies on other domains, and cannot observe any web requests occurring outside the paired CMS origin.
3. Auditability in Chrome Settings: At any time, your clinic's IT administrator can open chrome://extensions, click LamaniSync details, and verify that site access is restricted to your single, specific clinic portal URL.

---

Google Web Store Review & Verification

Under Google's Manifest V3 security program, extensions that request sensitive or broad permissions are subjected to intensive manual reviews and high rejection rates.

Because LamaniSync is engineered with minimal, scoped permissions and adheres to Google's strictest least-privilege standards:

• Every release is cryptographically signed and distributed directly through Google's official Web Store infrastructure.
• Zero external remote scripts or unverified third-party libraries are permitted in our builds.
• Practice managers can install the extension knowing it has passed Google's stringent enterprise extension audits.

---

In Plain English: The Layman Summary

By scoping permissions with surgical precision, LamaniSync guarantees that your clinic's financial records, communications, and personal browsing remain completely private and isolated.