The entity that stores the state has the most power in a system.

I've asserted in the past that computing experiences are a combination of code + data. If you change either one, the identity of the experience changes.

I used to see app developers get tripped up by this a lot when thinking about in-app browsers on mobile devices.

"I want to add experiences to my browsing experience in my app, so I'll use a WebView."

"Yes, but then your users don't get access to their primary cookie jar, and that's the thing that makes the web experience useful to a user."

In browsers, the cookie jar (well, technically the profile) is what stores login credentials, session cookies, as well as payments information.

Without the cookie jar, it's a discontinuous experience for users, an island.

The entity that renders the final pixels on screen has a lot of power; but the entity that controls access to the stored data has even more.