Detailed answer
A sandbox starts with restrictions that can be relaxed through tokens.
Grant only abilities the embedded content actually needs and consider its origin and trust level. A sandbox does not eliminate all risks from untrusted content. Powerful combinations of permissions may undo the isolation you intended to create.
Example
<iframe title="Static preview" sandbox srcdoc="<p>Hello HTML</p>"></iframe>
Understanding the behavior
Sandbox begins with broad restrictions and individual tokens restore selected capabilities. Add only the capabilities the embed actually requires. Combining allow-scripts and allow-same-origin for same-origin content can weaken the intended protection and needs careful review.
Practical implementation notes
Test the embedded task after each change rather than adding all tokens to silence errors. Sandbox is one layer of isolation; it does not make arbitrary third-party content trustworthy.
How to check it
Begin with a sandbox without capability tokens and add permissions only for a justified need.
Expected result
Static content renders without granting unneeded script or origin privileges.
Watch out: Do not casually combine allow-scripts and allow-same-origin for same-origin untrusted content.
Read the reference ↗