Are the permissions in SP Embedded identical to the ones in SPO? Looking at, for example, disallowing downloads. Can it be done? Leading to this question: can SP Embedded be used to manage highly sensitive content, so it comes with built-in document preview/streaming.