Anyone who has it can read the visible prompts, responses, paths, and tool results, which may contain secrets, and a full-control link can also prompt, interrupt, and answer pending interactions. Frames are sealed end to end with a key that lives only in the link; the relay sees ciphertext.