* Begin of the insertion[x]End of the insertion Begin of the deletion [ ]End of the deletion Pass data into the iFrame (e.g. a scoped authentication token, Nextcloud fileID(s), ...)
* Begin of the insertion[x]End of the insertion Begin of the deletion [ ]End of the deletion iFrame content knows that it is opened as an integrating iFrame and adjust and simplify the layout
* Begin of the insertion[x]End of the insertion Begin of the deletion [ ]End of the deletion Pass values back to the integrating page (e.g. work package ID after integration, or cancel event, or error)
* [ ] What CSP amendments are needed for both parties?
* [ ] Maybe: Ensuring that the user session within the iFrame belongs to a specific user. Ask for login otherwise.

Out of scope:

* Limiting the iFrame to a separate, limited, scoped session