By default, your bot can be embedded and run from any origin. Allowed Origins restricts execution to only the origins you list — for example, your own website — preventing the bot from being embedded elsewhere.

Add an origin (e.g. https://my-company.com) to the allowed list to enable the restriction.