It’s another app with exactly the permissions (make invoice, lookup invoice, get balance, list transactions) and is isolated. I have an Alby Hub PR to make this easy to do :-)