# ADR 0008 — Legacy Links, Not iframes

**Status:** Accepted  
**Date:** 2026-06-13

## Context

Existing domain dashboards may contain sensitive data, their own routing, different auth assumptions and operational controls.

## Decision

Legacy dashboards are linked through Module Registry entries. They are not embedded iframe-first.

Global overview shows only safe module links. Health detail links are blocked by default until a protection concept exists.

## Consequences

- clearer security boundary
- simpler iPad UX
- no hidden cross-origin behavior
- no accidental exposure of legacy sensitive pages

## Exception process

Embedding later requires written technical reason, threat review and explicit approval.