docs(embed): the object runs as the viewer, who must be a DC user

Found by testing a report against a freshly configured instance: the DC
object showed its login card inside the report because the viewer's SAS
identity was not registered yet, which reads as a broken embed rather than
a permissions problem.

docs/embed-va.md

@@ -179,6 +179,12 @@ The mapping lives entirely in the URL of the report object, so the job is to get
 !!! note
     The URL is read when the object loads, so a change to `va_parmap` takes effect when the report (or the page holding the object) is next opened.
 
+### Who the object runs as
+
+The object runs as the person **viewing** the report, using their SAS identity - there is no service account behind it. That person must therefore be a registered Data Controller user: if they are not, DC shows its login card inside the object instead of the editor, which looks like a broken embed rather than a permissions matter.
+
+Register everyone who will open the report before you ship it (Users in DC), and test the report as one of them rather than as the person who built it - the author is usually an administrator, so a report that works for them can fail for everyone else.
+
 ## Debugging
 
 A hook script can tell an embedded editor from a standalone one without any client-side inspection: `work.browser_info` carries the page URL and `referrer`, and `work.browser_url_vars` carries `embed=va`. See [Browser Variables](/developer-guide/browser-variables/).