All three frames are the same origin, so they share localStorage and sessionStorage — yet each holds its own session and its own JWT. If the embedded client keeps that token under one fixed key, whichever frame loads last overwrites the others and the earlier panels start reporting 403 PRODUCT_OUT_OF_SCOPE. This page is the quickest way to catch that: load all three, then interact with the one that finished FIRST.