Permissions Policy Bounds Browser Feature Authority
Permissions Policy Bounds Browser Feature Authority A page can embed code from several origins while still presenting a single application surface. That composition becomes security-relevant when browser capabilities such as geolocation, camera access, microphone access, fullscreen, or payment functions are available inside the resulting document tree. The code that renders a widget may not need the same browser authority as the application that hosts it. Permissions Policy gives a site a way to restrict selected web-platform features by origin and frame. It is not a replacement for user permission prompts, sandboxing, application authorization, or browser isolation. Its value is narrower and architectural: it can remove capabilities from documents that have no legitimate reason to exercise them.