# Authoring constraints Exhaustive rules for a DataLens HTML page. The runtime = opaque-origin sandboxed iframe + injected CSP ([csp-and-sandbox.md](csp-and-sandbox.md)). Golden rule: **self-contained, network-less, state-in-memory.** ## Allowed external resources | Resource | Allowed sources | |----------|-----------------| | `