If your site has its own **Content-Security-Policy (CSP)**, the voice widget needs the same permissions the web chat already requires (Manual 06), plus the call provider's own origin: - Allow the **widget's CDN** in `script-src` (the exact URL of the snippet you copied, section 2). - Allow the **voice infrastructure's origin** in `connect-src` (and, if your CSP explicitly requires it, `media-src`) — your provider confirms the exact URL if your CSP is restrictive. - The orb's iframe needs **microphone** permission: if you embed the snippet inside another iframe of your own (uncommon), make sure that iframe declares `allow="microphone"` — the widget's own snippet already does this for you in the normal case (pasted directly into your site). The rest of the technical behavior (origin isolation, attestation, and the visitor's browser NEVER receiving internal session credentials) is the same security model the chat widget already uses — nothing extra to configure beyond the CSP above.