diff --git a/crates/engine/src/macros/policy.rs b/crates/engine/src/macros/policy.rs
index 84bbc497b..8f23a5b40 100644
--- a/crates/engine/src/macros/policy.rs
+++ b/crates/engine/src/macros/policy.rs
@@ -30,8 +30,13 @@ const DENIED_PREFIXES: &[(&str, &str)] = &[
 ];
 
 /// Single commands that never run in a macro.
-const DENIED: &[(&str, &str)] =
-    &[("edit.undo", "a macro is undone as one step after it runs"), ("edit.redo", "a macro is undone as one step after it runs")];
+const DENIED: &[(&str, &str)] = &[
+    ("edit.undo", "a macro is undone as one step after it runs"),
+    ("edit.redo", "a macro is undone as one step after it runs"),
+    ("view.newWindow", "macros don't open, hide or show windows"),
+    ("view.hideWindow", "macros don't open, hide or show windows"),
+    ("view.unhideWindow", "macros don't open, hide or show windows"),
+];
 
 /// Commands under a denied prefix that only change the workbook.
 const ALLOWED: &[&str] = &["file.properties"];
@@ -97,6 +102,9 @@ mod tests {
             "macro.record",
             "edit.undo",
             "edit.redo",
+            "view.newWindow",
+            "view.hideWindow",
+            "view.unhideWindow",
         ] {
             assert!(matches!(macro_policy(id, &none, Trust::Local), Policy::Deny(_)), "{id}");
             assert!(matches!(macro_policy(id, &path, Trust::FromFile), Policy::Deny(_)), "{id}");
diff --git a/crates/engine/src/tests/macros.rs b/crates/engine/src/tests/macros.rs
index 2855f11e6..a928e9b53 100644
--- a/crates/engine/src/tests/macros.rs
+++ b/crates/engine/src/tests/macros.rs
@@ -419,6 +419,8 @@ fn the_policy_keeps_macros_away_from_files_and_the_app() {
         ("automate.runScript", json!({"name": "Script 1"})),
         ("edit.undo", json!({})),
         ("macro.run", json!({"name": "Self"})),
+        ("view.newWindow", json!({})),
+        ("view.hideWindow", json!({})),
     ] {
         put(
             &mut s,
diff --git a/docs/macros.md b/docs/macros.md
index 1e1b873fb..cf93148d3 100644
--- a/docs/macros.md
+++ b/docs/macros.md
@@ -75,8 +75,8 @@ called Output, even when a token or input has that name.
 
 `macro.run {name, inputs?, onConflict?, overwrite?, approve?, timeLimit?}`:
 
-1. **Policy.** File, app, window, automate and macro commands, and Undo and Redo, never run in a
-   macro. Reading or writing a file (`data.getData`, `data.fromTextCsv`, `insert.picture` or
+1. **Policy.** File, app, window (including New Window, Hide and Unhide), automate and macro
+   commands, and Undo and Redo, never run in a macro. Reading or writing a file (`data.getData`, `data.fromTextCsv`, `insert.picture` or
    `pageLayout.background` with a `path`, or an export or print with a `path`) needs the command
    in the macro's `permissions`. Any `path` other than `null` counts, including a blank one and a
    token, and the policy is checked again on the parameters as they are when the step runs. A macro that touches files, or that came with a workbook opened