An embedded feedback client should never expose its long-lived secret. The tenant server authenticates once, identifies the current subject and visitor context, and receives a short-lived protected token. The browser uses that token to read permitted aggregates and submit feedback. Origin checks, expiry, subject binding, and entitlement checks are repeated at the service boundary.