From 1dbc531edcd8f25ce33ca1264b91089a0d1908a4 Mon Sep 17 00:00:00 2001
From: Liam Brady <blu2.5@me.com>
Date: Wed, 12 Apr 2023 17:08:09 -0400
Subject: [PATCH 01/24] start work

---
 spec.bs | 93 +++++++++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 91 insertions(+), 2 deletions(-)

diff --git a/spec.bs b/spec.bs
index 10b00aeb..e91f17bb 100644
--- a/spec.bs
+++ b/spec.bs
@@ -70,6 +70,8 @@ spec: html; urlPrefix: https://html.spec.whatwg.org/multipage/
         text: cross-origin isolation mode; url: bcg-cross-origin-isolation
       for: cross-origin isolation mode
         text: none; url:cross-origin-isolation-none
+    urlPrefix: document-lifecycle.html
+      text: shared document creation infrastructure; url: shared-document-creation-infrastructure
     urlPrefix: browsing-the-web.html
       text: create navigation params by fetching; url: create-navigation-params-by-fetching
       text: document state; url: she-document-state
@@ -79,6 +81,7 @@ spec: html; urlPrefix: https://html.spec.whatwg.org/multipage/
       for: navigation params
         text: response; url: navigation-params-response
         text: navigable; url: navigation-params-navigable
+        text: origin; url: navigation-params-origin
       for: history handling behavior
         text: replace; url: hh-replace
       for: document state
@@ -97,6 +100,12 @@ spec: RFC8941; urlPrefix: https://www.rfc-editor.org/rfc/rfc8941.html
     text: structured header; url: #section-1
     for: structured header
       text: token; url: name-tokens
+spec: permissions-policy; urlPrefix: https://w3c.github.io/webappsec-permissions-policy
+  type: dfn
+    text: Create a Permissions Policy for a navigable; url: algo-create-for-navigable
+    text: Create a Permissions Policy for a navigable from response; url: algo-create-from-response
+    text: Define an inherited policy for feature in container at origin; url: define-inherited-policy-in-container
+    text: features; url: policy-controlled-feature
 </pre>
 
 <style>
@@ -212,6 +221,7 @@ interface HTMLFencedFrameElement : HTMLElement {
   [CEReactions] attribute FencedFrameConfig? config;
   [CEReactions] attribute DOMString width;
   [CEReactions] attribute DOMString height;
+  [CEReactions] attribute DOMString allow;
 };
 </xmp>
 </dd>
@@ -280,6 +290,10 @@ The <dfn attribute for=HTMLFencedFrameElement>config</dfn> IDL attribute getter
   1. <span class=XXX>TODO</span>
 </div>
 
+The IDL attribute
+<dfn attribute for="fencedframe"><code data-x="dom-fencedframe-allow">allow</code></dfn>
+</dfn> must [=reflect=] the respective content attributes of the same name.
+
 <h3 id=dimension-attributes>Dimension attributes</h3>
 
 This section details monkeypatches to [[!HTML]]'s <a
@@ -512,8 +526,6 @@ Note: This is because we need to ensure that we do not leak <var ignore>creator<
 document's referrer|referrer=], [=Document/origin=], [=creator base url=], [=Document/policy
 container=], across the fenced frame boundary.
 
-Issue: Ensure we are doing the right thing for [=Document/permissions policy=].
-
 <h3 id=nested-traversables>Nested traversables</h3>
 
 <h4 id=nested-traversables-intro>Introduction</h4>
@@ -880,3 +892,80 @@ specification adds another value for fenced frames:
 
 : "`fencedframe`"
 :: This [=navigable=] is displaying a <{fencedframe}>'s content
+
+<h3 id=permissions-policy-changes>Permissions Policies</h3>
+Permissions are granted to fenced frames through the FencedFrameConfig object, which defines the
+required permissions for the fenced frame to load. The fenced frame is only allowed to navigate if
+all of the required permissions are present in the context loading the fenced frame. When a fenced
+frame loads, it is assumed that the permissions checks passed, and the fenced frame will load with
+the list of permissions that were specified in the config object.
+
+Modify the [=Create a Permissions Policy for a navigable=] algorithm:
+
+<div algorithm=create-permissions-policy>
+  Modify the definition of [=Create a Permissions Policy for a navigable=] to read:
+
+  Given null or an [=element=] (|container|), an
+  [=origin=] (<var ignore>origin</var>), and null or a
+  list of [=features=] (|required features|), this algorithm returns a new
+  [=Document/permissions policy=].
+
+  Rewrite step 1 of the algorithm to read:
+
+  1. Assert: if not null, |container| is either a [=navigable container=] or a
+    [=fenced navigable container=].
+
+  Add a new step after step 1 that reads:
+
+  2. Assert: if |container| is not a [=fenced navigable container=], |required features| is null.
+
+  Rewrite step 4 to read:
+
+  4. If |container| is a [=fenced navigable container=], then for each |feature| supported,
+
+      1. If |feature| exists in |required features|, set |inherited policy|[|feature|] to "`Enabled`".
+
+        Otherwise, set |inherited policy|[|feature|] to "`Disabled`".
+
+    Otherwise, for each |feature| supported,
+
+      1. Let |isInherited| be the result of running [=Define an inherited policy for feature in
+        container at origin=] on |feature|, |container| and <var ignore>origin</var>.
+
+      2. Set |inherited policy|[|feature|] to |isInherited|.
+</div>
+
+<div algorithm=create-permissions-policy-response>
+  Modify the definition of [=Create a Permissions Policy for a navigable from response=] to read:
+
+  Given null, a [=navigable container=], or a [=fenced navigable container=] (|container|), an
+  [=origin=] (|origin|), a [=response=] (<var ignore>response</var>), and null or a
+  list of [=features=] (|required features|), this algorithm returns a new
+  [=Document/permissions policy=].
+
+  Modify step 1 of the algorithm to read:
+  1. Let <var ignore>policy</var> be the result of running
+    [=Create a Permissions Policy for a navigable=] given |container|, |origin|, and
+    |required features|.
+</div>
+
+<div algorithm=shared-document-creation-changes>
+  Modify step 3 of the [=shared document creation infrastructure=] algorithm to read:
+
+  3. Let <var ignore>permissionsPolicy</var> be the result of [=Create a Permissions Policy for a
+    navigable from response|creating a permissions policy from a response=] given
+    |navigationParams|'s [=navigable=]'s [=navigable container|container=], |navigationParams|'s
+    [=navigation params/origin=], |navigationParams|'s [=navigation params/response=], and
+    <span class=XXX>TODO: Populate this with the required permissions to load from the config in
+    the navigation params</span>. <ref spec="PERMISSIONSPOLICY">
+</div>
+
+<div algorithm=new-browsing-context-changes>
+  Modify step 7 of the [=create a new browsing context and document=] algorithm to read:
+
+  7. Let <var ignore>permissionsPolicy</var> be the result of [=Create a Permissions Policy for a
+    navigable|creating a permissions policy=] given <var ignore>embedder</var>,
+    <var ignore>origin</var>, and null. <ref spec="PERMISSIONSPOLICY">
+</div>
+
+<span class=XXX>TODO: Add gating for permissions policies to navigation algorithm - whatever the equivalent of NavigationRequest::CheckPermissionsPoliciesForFencedFrames is</span>
\ No newline at end of file

From e6fab759ceb35d3c2fba5df6e841943a6c0496bb Mon Sep 17 00:00:00 2001
From: Liam Brady <blu2.5@me.com>
Date: Thu, 13 Apr 2023 12:11:15 -0400
Subject: [PATCH 02/24] continue work

---
 spec.bs | 31 +++++++++++++++++++++++++++++--
 1 file changed, 29 insertions(+), 2 deletions(-)

diff --git a/spec.bs b/spec.bs
index e91f17bb..a526fbc4 100644
--- a/spec.bs
+++ b/spec.bs
@@ -95,6 +95,14 @@ spec: html; urlPrefix: https://html.spec.whatwg.org/multipage/
 spec: fetch; urlPrefix: https://fetch.spec.whatwg.org/
   type: dfn
     text: queue a cross-origin embedder policy CORP violation report; url: queue-a-cross-origin-embedder-policy-corp-violation-report
+    text: main fetch; url: main-fetch
+    text: should request be blocked due to a bad port; url: block-bad-port
+spec: mixed-content; urlPrefix: https://w3c.github.io/webappsec-mixed-content/
+  type: dfn
+    text: should fetching request be blocked as mixed content; url: should-block-fetch
+spec: CSP; urlPrefix: https://w3c.github.io/webappsec-csp/
+  type: dfn
+    text: should request be blocked by Content Security Policy; url: should-block-request
 spec: RFC8941; urlPrefix: https://www.rfc-editor.org/rfc/rfc8941.html
   type: dfn
     text: structured header; url: #section-1
@@ -950,7 +958,7 @@ Modify the [=Create a Permissions Policy for a navigable=] algorithm:
 </div>
 
 <div algorithm=shared-document-creation-changes>
-  Modify step 3 of the [=shared document creation infrastructure=] algorithm to read:
+  Modify the [=shared document creation infrastructure=] algorithm. Rewrite step 3 to read:
 
   3. Let <var ignore>permissionsPolicy</var> be the result of [=Create a Permissions Policy for a
     navigable from response|creating a permissions policy from a response=] given
@@ -961,11 +969,30 @@ Modify the [=Create a Permissions Policy for a navigable=] algorithm:
 </div>
 
 <div algorithm=new-browsing-context-changes>
-  Modify step 7 of the [=create a new browsing context and document=] algorithm to read:
+  Modify the [=create a new browsing context and document=] algorithm. Rewrite step 7 to read:
 
   7. Let <var ignore>permissionsPolicy</var> be the result of [=Create a Permissions Policy for a
     navigable|creating a permissions policy=] given <var ignore>embedder</var>,
     <var ignore>origin</var>, and null. <ref spec="PERMISSIONSPOLICY">
 </div>
 
+<div algorithm=main-fetch-patches>
+  Modify the [=main fetch=] algorithm. Rewrite step 7 to read:
+
+  7. If [=should request be blocked due to a bad port=], [=should fetching request be blocked as
+    mixed content=], [=should request be blocked by Content Security Policy=], or [=should request
+    be blocked by Permissions Policy=] returns blocked, then set response to a network error.
+</div>
+
+<div algorithm=permissions-policy-block-request>
+  Create a new algorithm in the [[!permissions-policy]] spec, called <dfn export>should request be
+  blocked by Permissions Policy</dfn>.
+
+  Given a [=request=] (|request|), this algorithm returns `Blocked` or `Allowed`.
+
+  <span class=XXX>Get document of embedder, then get document's permissionsPolicy.</span>
+
+  1. If |request|'s [=request/destination=] is not "`fencedframe`", then return `Allowed`.
+</div>
+
 <span class=XXX>TODO: Add gating for permissions policies to navigation algorithm - whatever the equivalent of NavigationRequest::CheckPermissionsPoliciesForFencedFrames is</span>
\ No newline at end of file

From 0be10c06d9bed8c23db3d39e5433ecbb3f03b2cf Mon Sep 17 00:00:00 2001
From: Liam Brady <blu2.5@me.com>
Date: Thu, 13 Apr 2023 19:32:44 -0400
Subject: [PATCH 03/24] fix failing build

---
 spec.bs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/spec.bs b/spec.bs
index a526fbc4..c86f69f6 100644
--- a/spec.bs
+++ b/spec.bs
@@ -913,7 +913,7 @@ Modify the [=Create a Permissions Policy for a navigable=] algorithm:
 <div algorithm=create-permissions-policy>
   Modify the definition of [=Create a Permissions Policy for a navigable=] to read:
 
-  Given null or an [=element=] (|container|), an
+  Given null or an element (|container|), an
   [=origin=] (<var ignore>origin</var>), and null or a
   list of [=features=] (|required features|), this algorithm returns a new
   [=Document/permissions policy=].

From 238f4362b54c445209861e3b9287d64f61f1dfc8 Mon Sep 17 00:00:00 2001
From: Liam Brady <blu2.5@me.com>
Date: Thu, 13 Apr 2023 23:37:21 -0400
Subject: [PATCH 04/24] fix failing build

---
 spec.bs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/spec.bs b/spec.bs
index c86f69f6..c63ae12f 100644
--- a/spec.bs
+++ b/spec.bs
@@ -965,7 +965,7 @@ Modify the [=Create a Permissions Policy for a navigable=] algorithm:
     |navigationParams|'s [=navigable=]'s [=navigable container|container=], |navigationParams|'s
     [=navigation params/origin=], |navigationParams|'s [=navigation params/response=], and
     <span class=XXX>TODO: Populate this with the required permissions to load from the config in
-    the navigation params</span>. <ref spec="PERMISSIONSPOLICY">
+    the navigation params</span>.
 </div>
 
 <div algorithm=new-browsing-context-changes>
@@ -973,7 +973,7 @@ Modify the [=Create a Permissions Policy for a navigable=] algorithm:
 
   7. Let <var ignore>permissionsPolicy</var> be the result of [=Create a Permissions Policy for a
     navigable|creating a permissions policy=] given <var ignore>embedder</var>,
-    <var ignore>origin</var>, and null. <ref spec="PERMISSIONSPOLICY">
+    <var ignore>origin</var>, and null.
 </div>
 
 <div algorithm=main-fetch-patches>

From 3f18b1986f1f07458b1e6cc1d2aa15ed00c0ad90 Mon Sep 17 00:00:00 2001
From: Liam Brady <blu2.5@me.com>
Date: Fri, 14 Apr 2023 16:00:37 -0400
Subject: [PATCH 05/24] add permissions gating algorithm

---
 spec.bs | 68 +++++++++++++++++++++++++++++++++++++++++++++++----------
 1 file changed, 57 insertions(+), 11 deletions(-)

diff --git a/spec.bs b/spec.bs
index c63ae12f..336d78fb 100644
--- a/spec.bs
+++ b/spec.bs
@@ -92,6 +92,12 @@ spec: html; urlPrefix: https://html.spec.whatwg.org/multipage/
     urlPrefix: nav-history-apis.html
       for: Window
         text: navigable; url: window-navigable
+    urlPrefix: webappapis.html
+      for: environment
+        text: target browsing context; url: concept-environment-target-browsing-context
+    urlPrefix: document-sequences.html
+      for: browsing context
+        text: active document; url: active-document
 spec: fetch; urlPrefix: https://fetch.spec.whatwg.org/
   type: dfn
     text: queue a cross-origin embedder policy CORP violation report; url: queue-a-cross-origin-embedder-policy-corp-violation-report
@@ -114,6 +120,12 @@ spec: permissions-policy; urlPrefix: https://w3c.github.io/webappsec-permissions
     text: Create a Permissions Policy for a navigable from response; url: algo-create-from-response
     text: Define an inherited policy for feature in container at origin; url: define-inherited-policy-in-container
     text: features; url: policy-controlled-feature
+    text: default allowlist; url: policy-controlled-feature-default-allowlist
+    text: The allow attribute of the iframe element; url: iframe-allow-attribute
+    text: ASCII-serialized policy directive; url: serialized-policy-directive
+    text: inherited policy; url: inherited-policy
+    for: permissions
+      text: matches; url: matches
 </pre>
 
 <style>
@@ -943,6 +955,25 @@ Modify the [=Create a Permissions Policy for a navigable=] algorithm:
       2. Set |inherited policy|[|feature|] to |isInherited|.
 </div>
 
+<div algorithm=allow-attribute-fenced-frame>
+  Modify the [=The allow attribute of the iframe element=] section.
+
+  Rename it to "The allow attribute of the iframe and fencedframe element".
+
+  Rewrite the section to read:
+
+  &lt;iframe> and &lt;fencedframe> elements have an "allow" attribute, which contains an
+  [=ASCII-serialized policy directive=].
+
+  The allowlist for the features named in the attribute may be empty; in that case, the default
+  value for the allowlist is "`src`", which represents the origin of the URL in the iframe’s src
+  attribute, or the fencedframe's [=fenced frame config=].
+
+  When not empty, the "allow" attribute will result in adding an allowlist for each recognized
+  feature to the iframe element’s content navigable's container policy or the fencedframe element'same
+  [=fenced navigable container/fenced navigable=]'s container policy, when it is constructed.
+</div>
+
 <div algorithm=create-permissions-policy-response>
   Modify the definition of [=Create a Permissions Policy for a navigable from response=] to read:
 
@@ -977,22 +1008,37 @@ Modify the [=Create a Permissions Policy for a navigable=] algorithm:
 </div>
 
 <div algorithm=main-fetch-patches>
-  Modify the [=main fetch=] algorithm. Rewrite step 7 to read:
+  Modify the [=main fetch=] algorithm. Modify step 19 to add a new bullet point to the algorithm
+  list:
 
-  7. If [=should request be blocked due to a bad port=], [=should fetching request be blocked as
-    mixed content=], [=should request be blocked by Content Security Policy=], or [=should request
-    be blocked by Permissions Policy=] returns blocked, then set response to a network error.
+  * [=should response to request be blocked by Permissions Policy=]
 </div>
 
 <div algorithm=permissions-policy-block-request>
-  Create a new algorithm in the [[!permissions-policy]] spec, called <dfn export>should request be
-  blocked by Permissions Policy</dfn>.
+  Create a new algorithm in the [[!permissions-policy]] spec, called <dfn export>should response to
+  request be blocked by Permissions Policy</dfn>.
 
-  Given a [=request=] (|request|), this algorithm returns `Blocked` or `Allowed`.
-
-  <span class=XXX>Get document of embedder, then get document's permissionsPolicy.</span>
+  Given a [=response=] (|response|) and a [=request=] (|request|), this algorithm returns `Blocked`
+  or `Allowed`.
 
   1. If |request|'s [=request/destination=] is not "`fencedframe`", then return `Allowed`.
-</div>
 
-<span class=XXX>TODO: Add gating for permissions policies to navigation algorithm - whatever the equivalent of NavigationRequest::CheckPermissionsPoliciesForFencedFrames is</span>
\ No newline at end of file
+  2. Let |required permissions to load| be the list of <span class=XXX>TODO: Populate this with the
+    required permissions to load from the config in the navigation params</span>.
+
+  3. Let |inherited policy| be |request|'s [=request/client=]'s
+    [=environment/target browsing context=]'s [=browsing context/active document=]'s
+    [=Document/permissions policy=]'s [=inherited policy=].
+
+  4. Let |origin| be |response|'s [=response/url=]'s [=url/origin=].
+
+  5. For each |permission| in |required permissions to load|:
+
+    1. If |permission| does not exist in |inherited policy|, and |permission|'s
+      [=default allowlist=] is not "`*`", return "`Blocked`".
+      
+    2. Otherwise, if the allowlist at |inherited policy|[|permission|] does not
+      [=permissions/matches|match=] |origin|, return "`Blocked`".
+  
+  6. Return "`Allowed`."
+</div>

From 29ecb234ac747f48a5acf8af42bb5667d54e6f13 Mon Sep 17 00:00:00 2001
From: Liam Brady <blu2.5@me.com>
Date: Mon, 24 Apr 2023 13:20:51 -0400
Subject: [PATCH 06/24] address review comments

---
 spec.bs | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/spec.bs b/spec.bs
index 5e9226d5..caae0c24 100644
--- a/spec.bs
+++ b/spec.bs
@@ -117,6 +117,9 @@ spec: html; urlPrefix: https://html.spec.whatwg.org/multipage/
     urlPrefix: document-sequences.html
       for: browsing context
         text: active document; url: active-document
+    urlPrefix: iframe-embed-object.html
+      for: iframe
+        text: allow; url: attr-iframe-allow
 spec: fetch; urlPrefix: https://fetch.spec.whatwg.org/
   type: dfn
     text: queue a cross-origin embedder policy CORP violation report; url: queue-a-cross-origin-embedder-policy-corp-violation-report
@@ -127,7 +130,6 @@ spec: mixed-content; urlPrefix: https://w3c.github.io/webappsec-mixed-content/
     text: should fetching request be blocked as mixed content; url: should-block-fetch
 spec: CSP; urlPrefix: https://w3c.github.io/webappsec-csp/
   type: dfn
-    text: should request be blocked by Content Security Policy; url: should-block-request
     urlPrefix: interactive-elements.html
       text: accesskey attribute command; url: using-the-accesskey-attribute-to-define-a-command-on-other-elements
       text: previously focused element; url: previously-focused-element
@@ -156,6 +158,7 @@ spec: permissions-policy; urlPrefix: https://w3c.github.io/webappsec-permissions
     text: inherited policy; url: inherited-policy
     for: permissions
       text: matches; url: matches
+      text: permissions policy; url: permissions-policy
 </pre>
 
 <style>
@@ -259,6 +262,7 @@ dl, dd {
  <dd>[=Global attributes=]</dd>
  <dd><code>[=width=]</code> — Horizontal dimension</dd>
  <dd><code>[=height=]</code> — Vertical dimension</dd>
+ <dd><code>[=iframe/allow=]</code> — [=permissions/permissions policy=] to be applied to the <{fencedframe}>'s contents</dd>
  <dt>[=Accessibility considerations=]:</dt>
  <dd><p class=XXX>TODO</p></dd>
  <dt>[=DOM interface=]:</dt>
@@ -1572,9 +1576,12 @@ TODO: Enable this once we move the WPTs to the external repository.
 Issue: Determine if we need to fence or unfence the [=queue a cross-origin embedder policy
 CORP violation report=] algorithm, as leaving it unfenced may cause a privacy leak.
 
+<!--
+TODO: Enable this once we move the WPTs to the external repository.
 <wpt>
   /fenced-frame/embedder-coop-coep-blocked.https.html
 </wpt>
+-->
 
 <h3 id=page-visibility>Page visibility</h3>
 
@@ -1606,8 +1613,6 @@ all of the required permissions are present in the context loading the fenced fr
 frame loads, it is assumed that the permissions checks passed, and the fenced frame will load with
 the list of permissions that were specified in the config object.
 
-Modify the [=Create a Permissions Policy for a navigable=] algorithm:
-
 <div algorithm=create-permissions-policy>
   Modify the definition of [=Create a Permissions Policy for a navigable=] to read:
 
@@ -1648,16 +1653,17 @@ Modify the [=Create a Permissions Policy for a navigable=] algorithm:
 
   Rewrite the section to read:
 
-  &lt;iframe> and &lt;fencedframe> elements have an "allow" attribute, which contains an
+  <{iframe}> and <{fencedframe}> elements have an [=iframe/allow=] attribute, which contains an
   [=ASCII-serialized policy directive=].
 
   The allowlist for the features named in the attribute may be empty; in that case, the default
   value for the allowlist is "`src`", which represents the origin of the URL in the iframe’s src
   attribute, or the fencedframe's [=fenced frame config=].
 
-  When not empty, the "allow" attribute will result in adding an allowlist for each recognized
-  feature to the iframe element’s content navigable's container policy or the fencedframe element'same
-  [=fenced navigable container/fenced navigable=]'s container policy, when it is constructed.
+  When not empty, the [=iframe/allow=] attribute will result in adding an allowlist for each
+  recognized feature to the iframe element’s content navigable's container policy or the fencedframe
+  element's [=fenced navigable container/fenced navigable=]'s container policy, when it is
+  constructed.
 </div>
 
 <div algorithm=create-permissions-policy-response>
@@ -1691,6 +1697,9 @@ Modify the [=Create a Permissions Policy for a navigable=] algorithm:
   7. Let <var ignore>permissionsPolicy</var> be the result of [=Create a Permissions Policy for a
     navigable|creating a permissions policy=] given <var ignore>embedder</var>,
     <var ignore>origin</var>, and null.
+
+  Note: This change is made in addition to the changes to [=create a new browsing context and
+  document=] outlined in [[#creating-browsing-contexts-patch]].
 </div>
 
 <div algorithm=main-fetch-patches>

From 6ef8d10b84f32ee4348100a45b39c59975a53aff Mon Sep 17 00:00:00 2001
From: Liam Brady <blu2.5@me.com>
Date: Tue, 25 Apr 2023 14:50:28 -0400
Subject: [PATCH 07/24] plug in config object and move change the caller of one
 of the checks

---
 spec.bs | 51 ++++++++++++++++++++++++++++++---------------------
 1 file changed, 30 insertions(+), 21 deletions(-)

diff --git a/spec.bs b/spec.bs
index caae0c24..e6656542 100644
--- a/spec.bs
+++ b/spec.bs
@@ -74,7 +74,7 @@ spec: html; urlPrefix: https://html.spec.whatwg.org/multipage/
       for: cross-origin isolation mode
         text: none; url:cross-origin-isolation-none
     urlPrefix: document-lifecycle.html
-      text: shared document creation infrastructure; url: shared-document-creation-infrastructure
+      text: create and initialize a Document object; url: initialise-the-document-object
     urlPrefix: browsing-the-web.html
       text: create navigation params by fetching; url: create-navigation-params-by-fetching
       text: document state; url: she-document-state
@@ -123,7 +123,6 @@ spec: html; urlPrefix: https://html.spec.whatwg.org/multipage/
 spec: fetch; urlPrefix: https://fetch.spec.whatwg.org/
   type: dfn
     text: queue a cross-origin embedder policy CORP violation report; url: queue-a-cross-origin-embedder-policy-corp-violation-report
-    text: main fetch; url: main-fetch
     text: should request be blocked due to a bad port; url: block-bad-port
 spec: mixed-content; urlPrefix: https://w3c.github.io/webappsec-mixed-content/
   type: dfn
@@ -627,6 +626,9 @@ A <dfn export>fenced frame config</dfn> is a struct with the following [=struct/
 
   : <dfn>embedder shared storage context</dfn>
   :: null, or an [=fencedframetype/embedder shared storage context=]
+
+  : <dfn>required permissions to load</dfn>
+  :: a [=list=] of [=features=]
 </dl>
 
 <h4 id=fenced-frame-config-instance-struct>The [=fenced frame config instance=] [=struct=]</h4>
@@ -667,6 +669,9 @@ A <dfn export>fenced frame config instance</dfn> is a struct with the following
 
   : <dfn>embedder shared storage context</dfn>
   :: null, or an [=fencedframetype/embedder shared storage context=]
+
+  : <dfn>required permissions to load</dfn>
+  :: a [=list=] of [=features=]
 </dl>
 
 <div algorithm>
@@ -734,6 +739,9 @@ A <dfn export>fenced frame config instance</dfn> is a struct with the following
 
     : [=fenced frame config instance/embedder shared storage context=]
     :: |config|'s [=fenced frame config/embedder shared storage context=]
+
+    : [=fenced frame config instance/required permissions to load=]
+    :: |config|'s [=fenced frame config/required permissions to load=]
 </div>
 
 <h4 id=fenced-frame-config-interface>The {{FencedFrameConfig}} interface</h4>
@@ -1576,12 +1584,9 @@ TODO: Enable this once we move the WPTs to the external repository.
 Issue: Determine if we need to fence or unfence the [=queue a cross-origin embedder policy
 CORP violation report=] algorithm, as leaving it unfenced may cause a privacy leak.
 
-<!--
-TODO: Enable this once we move the WPTs to the external repository.
 <wpt>
   /fenced-frame/embedder-coop-coep-blocked.https.html
 </wpt>
--->
 
 <h3 id=page-visibility>Page visibility</h3>
 
@@ -1618,7 +1623,7 @@ the list of permissions that were specified in the config object.
 
   Given null or an element (|container|), an
   [=origin=] (<var ignore>origin</var>), and null or a
-  list of [=features=] (|required features|), this algorithm returns a new
+  [=list=] of [=features=] (|required features|), this algorithm returns a new
   [=Document/permissions policy=].
 
   Rewrite step 1 of the algorithm to read:
@@ -1671,7 +1676,7 @@ the list of permissions that were specified in the config object.
 
   Given null, a [=navigable container=], or a [=fenced navigable container=] (|container|), an
   [=origin=] (|origin|), a [=response=] (<var ignore>response</var>), and null or a
-  list of [=features=] (|required features|), this algorithm returns a new
+  [=list=] of [=features=] (|required features|), this algorithm returns a new
   [=Document/permissions policy=].
 
   Modify step 1 of the algorithm to read:
@@ -1681,14 +1686,14 @@ the list of permissions that were specified in the config object.
 </div>
 
 <div algorithm=shared-document-creation-changes>
-  Modify the [=shared document creation infrastructure=] algorithm. Rewrite step 3 to read:
+  Modify the [=create and initialize a Document object=] algorithm. Rewrite step 3 to read:
 
   3. Let <var ignore>permissionsPolicy</var> be the result of [=Create a Permissions Policy for a
     navigable from response|creating a permissions policy from a response=] given
     |navigationParams|'s [=navigable=]'s [=navigable container|container=], |navigationParams|'s
     [=navigation params/origin=], |navigationParams|'s [=navigation params/response=], and
-    <span class=XXX>TODO: Populate this with the required permissions to load from the config in
-    the navigation params</span>.
+    |navigationParams|'s [=navigable=]'s [=fenced frame config instance=]'s [=fenced frame config
+    instance/required permissions to load=].
 </div>
 
 <div algorithm=new-browsing-context-changes>
@@ -1702,24 +1707,28 @@ the list of permissions that were specified in the config object.
   document=] outlined in [[#creating-browsing-contexts-patch]].
 </div>
 
-<div algorithm=main-fetch-patches>
-  Modify the [=main fetch=] algorithm. Modify step 19 to add a new bullet point to the algorithm
-  list:
+<div algorithm=attempt-populate-history-patches>
+  Modify [[HTML]]'s [=attempt to populate the history entry's document=] algorithm. Add a step
+  before the step inside the [=queue a task|queued task=] starting with "If
+  |failure| is true, then:" that reads:
 
-  * [=should response to request be blocked by Permissions Policy=]
+  8. Otherwise, if the result of [=Should navigation response to navigation request be blocked by
+    Permissions Policy?=] given |navigationParams|'s [=request=],
+    |navigationParams|'s [=response=], and <var ignore>navigable</var> is "`Blocked`", then set
+    |failure| to true.
 </div>
 
 <div algorithm=permissions-policy-block-request>
-  Create a new algorithm in the [[!permissions-policy]] spec, called <dfn export>should response to
-  request be blocked by Permissions Policy</dfn>.
+  Create a new algorithm in the [[!permissions-policy]] spec, called <dfn export>Should navigation
+  response to navigation request be blocked by Permissions Policy?</dfn>.
 
-  Given a [=response=] (|response|) and a [=request=] (|request|), this algorithm returns `Blocked`
-  or `Allowed`.
+  Given a [=response=] (|response|), a [=request=] (|request|), and a [=navigable=] (|navigable|),
+  this algorithm returns `Blocked` or `Allowed`.
 
-  1. If |request|'s [=request/destination=] is not "`fencedframe`", then return `Allowed`.
+  1. If |navigable| is not a [=fenced navigable container/fenced navigable=], then return `Allowed`.
 
-  2. Let |required permissions to load| be the list of <span class=XXX>TODO: Populate this with the
-    required permissions to load from the config in the navigation params</span>.
+  2. Let |required permissions to load| be the |navigable|'s [=fenced frame config instance=]'s
+    [=fenced frame config instance/required permissions to load=].
 
   3. Let |inherited policy| be |request|'s [=request/client=]'s
     [=environment/target browsing context=]'s [=browsing context/active document=]'s

From 5b6b0f5dba0cc7b9ebff54594b7111d0cb917954 Mon Sep 17 00:00:00 2001
From: Dominic Farolino <domfarolino@gmail.com>
Date: Wed, 26 Apr 2023 09:31:07 -0400
Subject: [PATCH 08/24] Some cleanups

---
 spec.bs | 39 ++++++++++++++++++++-------------------
 1 file changed, 20 insertions(+), 19 deletions(-)

diff --git a/spec.bs b/spec.bs
index bb0f548b..b35b1700 100644
--- a/spec.bs
+++ b/spec.bs
@@ -151,7 +151,6 @@ spec: permissions-policy; urlPrefix: https://w3c.github.io/webappsec-permissions
     text: Create a Permissions Policy for a navigable; url: algo-create-for-navigable
     text: Create a Permissions Policy for a navigable from response; url: algo-create-from-response
     text: Define an inherited policy for feature in container at origin; url: define-inherited-policy-in-container
-    text: features; url: policy-controlled-feature
     text: default allowlist; url: policy-controlled-feature-default-allowlist
     text: The allow attribute of the iframe element; url: iframe-allow-attribute
     text: ASCII-serialized policy directive; url: serialized-policy-directive
@@ -272,7 +271,7 @@ dl, dd {
  <dd>[=Global attributes=]</dd>
  <dd><code>[=width=]</code> — Horizontal dimension</dd>
  <dd><code>[=height=]</code> — Vertical dimension</dd>
- <dd><code>[=iframe/allow=]</code> — [=permissions/permissions policy=] to be applied to the <{fencedframe}>'s contents</dd>
+ <dd><code>[=iframe/allow=]</code> — [=permissions/Permissions policy=] to be applied to the <{fencedframe}>'s contents</dd>
  <dt>[=Accessibility considerations=]:</dt>
  <dd><p class=XXX>TODO</p></dd>
  <dt>[=DOM interface=]:</dt>
@@ -362,7 +361,7 @@ The <dfn attribute for=HTMLFencedFrameElement>config</dfn> IDL attribute getter
 
 The IDL attribute
 <dfn attribute for="fencedframe"><code data-x="dom-fencedframe-allow">allow</code></dfn>
-</dfn> must [=reflect=] the respective content attributes of the same name.
+must [=reflect=] the respective content attribute of the same name.
 
 <h3 id=dimension-attributes>Dimension attributes</h3>
 
@@ -643,7 +642,7 @@ A <dfn export>fenced frame config</dfn> is a struct with the following [=struct/
   :: null, or an [=fencedframetype/embedder shared storage context=]
 
   : <dfn>required permissions to load</dfn>
-  :: a [=list=] of [=features=]
+  :: a [=list=] of [=policy-controlled features=]
 </dl>
 
 <h4 id=fenced-frame-config-instance-struct>The [=fenced frame config instance=] [=struct=]</h4>
@@ -686,7 +685,7 @@ A <dfn export>fenced frame config instance</dfn> is a struct with the following
   :: null, or an [=fencedframetype/embedder shared storage context=]
 
   : <dfn>required permissions to load</dfn>
-  :: a [=list=] of [=features=]
+  :: a [=list=] of [=policy-controlled features=]
 </dl>
 
 <div algorithm>
@@ -1750,34 +1749,36 @@ specification is printed below:
 </wpt>
 
 <h3 id=permissions-policy-changes>Permissions Policies</h3>
-Permissions are granted to fenced frames through the FencedFrameConfig object, which defines the
-required permissions for the fenced frame to load. The fenced frame is only allowed to navigate if
-all of the required permissions are present in the context loading the fenced frame. When a fenced
-frame loads, it is assumed that the permissions checks passed, and the fenced frame will load with
-the list of permissions that were specified in the config object.
+
+Permissions are granted to {{Document}} inside of <{fencedframe}>s through the
+{{FencedFrameConfig}} object and its associated internal [=fencedframeconfig/config=], which defines
+the permissions [=fenced frame config/required permissions to load|required=] for a <{fencedframe}>
+to navigate successfully. Specifically, a {{Document}} inside of a <{fencedframe}> can only load if
+it has opted into all of the [=fenced frame config/required permissions to load=].
 
 <div algorithm=create-permissions-policy>
   Modify the definition of [=Create a Permissions Policy for a navigable=] to read:
 
-  Given null or an element (|container|), an
-  [=origin=] (<var ignore>origin</var>), and null or a
-  [=list=] of [=features=] (|required features|), this algorithm returns a new
+  Given null or an element (|container|), an [=origin=] (<var ignore>origin</var>), and an optional
+  [=list=] of [=policy-controlled features=] (|required features|), this algorithm returns a new
   [=Document/permissions policy=].
 
   Rewrite step 1 of the algorithm to read:
 
-  1. Assert: if not null, |container| is either a [=navigable container=] or a
-    [=fenced navigable container=].
+  1. [=Assert=]: if not null, |container| is either a [=navigable container=] or a [=fenced
+     navigable container=].
 
   Add a new step after step 1 that reads:
 
-  2. Assert: if |container| is not a [=fenced navigable container=], |required features| is null.
+  2. [=Assert=]: if |container| is not a [=fenced navigable container=], |required features| is not
+     given.
 
   Rewrite step 4 to read:
 
-  4. If |container| is a [=fenced navigable container=], then for each |feature| supported,
+  4. If |container| is a [=fenced navigable container=], then for each |feature| supported:
 
-      1. If |feature| exists in |required features|, set |inherited policy|[|feature|] to "`Enabled`".
+      1. If |feature| [=list/exists=] in |required features|, set |inherited policy|[|feature|] to
+         "`Enabled`".
 
         Otherwise, set |inherited policy|[|feature|] to "`Disabled`".
 
@@ -1883,4 +1884,4 @@ the list of permissions that were specified in the config object.
       [=permissions/matches|match=] |origin|, return "`Blocked`".
   
   6. Return "`Allowed`."
-</div>
\ No newline at end of file
+</div>

From b78ea8b61d556d8b6f2df5b7a865e07798c9c8e2 Mon Sep 17 00:00:00 2001
From: Dominic Farolino <domfarolino@gmail.com>
Date: Wed, 26 Apr 2023 10:05:30 -0400
Subject: [PATCH 09/24] More fixes

---
 spec.bs | 53 ++++++++++++++++++++++++++++++-----------------------
 1 file changed, 30 insertions(+), 23 deletions(-)

diff --git a/spec.bs b/spec.bs
index b35b1700..a56c0224 100644
--- a/spec.bs
+++ b/spec.bs
@@ -118,9 +118,6 @@ spec: html; urlPrefix: https://html.spec.whatwg.org/multipage/
     urlPrefix: document-sequences.html
       for: browsing context
         text: active document; url: active-document
-    urlPrefix: iframe-embed-object.html
-      for: iframe
-        text: allow; url: attr-iframe-allow
 spec: fetch; urlPrefix: https://fetch.spec.whatwg.org/
   type: dfn
     text: queue a cross-origin embedder policy CORP violation report; url: queue-a-cross-origin-embedder-policy-corp-violation-report
@@ -152,9 +149,9 @@ spec: permissions-policy; urlPrefix: https://w3c.github.io/webappsec-permissions
     text: Create a Permissions Policy for a navigable from response; url: algo-create-from-response
     text: Define an inherited policy for feature in container at origin; url: define-inherited-policy-in-container
     text: default allowlist; url: policy-controlled-feature-default-allowlist
-    text: The allow attribute of the iframe element; url: iframe-allow-attribute
     text: ASCII-serialized policy directive; url: serialized-policy-directive
     text: inherited policy; url: inherited-policy
+    text: serialized permissions policy; url: serialized-permissions-policy
     for: permissions
       text: matches; url: matches
       text: permissions policy; url: permissions-policy
@@ -271,7 +268,7 @@ dl, dd {
  <dd>[=Global attributes=]</dd>
  <dd><code>[=width=]</code> — Horizontal dimension</dd>
  <dd><code>[=height=]</code> — Vertical dimension</dd>
- <dd><code>[=iframe/allow=]</code> — [=permissions/Permissions policy=] to be applied to the <{fencedframe}>'s contents</dd>
+ <dd><code><{fencedframe/allow}></code> — [=permissions/Permissions policy=] to be applied to the <{fencedframe}>'s contents</dd>
  <dt>[=Accessibility considerations=]:</dt>
  <dd><p class=XXX>TODO</p></dd>
  <dt>[=DOM interface=]:</dt>
@@ -359,9 +356,13 @@ The <dfn attribute for=HTMLFencedFrameElement>config</dfn> IDL attribute getter
   1. <span class=XXX>TODO</span>
 </div>
 
-The IDL attribute
-<dfn attribute for="fencedframe"><code data-x="dom-fencedframe-allow">allow</code></dfn>
-must [=reflect=] the respective content attribute of the same name.
+The <dfn element-attr for=fencedframe>allow</dfn> attribute, when specified, determines the [=fenced
+container policy=] that will be used when the [=Document/permissions policy=] for a {{Document}} in
+the <{fencedframe}>'s [=fenced navigable container/fenced navigable=] is initialized. Its value must
+be a [=serialized permissions policy=].
+
+The IDL attribute <dfn attribute for=HTMLFencedFrameElement>allow</dfn> must [=reflect=] the
+respective content attribute of the same name.
 
 <h3 id=dimension-attributes>Dimension attributes</h3>
 
@@ -1756,6 +1757,13 @@ the permissions [=fenced frame config/required permissions to load|required=] fo
 to navigate successfully. Specifically, a {{Document}} inside of a <{fencedframe}> can only load if
 it has opted into all of the [=fenced frame config/required permissions to load=].
 
+<h4 id=fenced-container-policies>Fenced container policies</h4>
+
+TODO: define <dfn>fenced container policy</dfn> here, which is current referenced by
+<{fencedframe/allow}>.
+
+<h4 id=permissions-policy-patches>Algorithm patches</h4>
+
 <div algorithm=create-permissions-policy>
   Modify the definition of [=Create a Permissions Policy for a navigable=] to read:
 
@@ -1777,34 +1785,33 @@ it has opted into all of the [=fenced frame config/required permissions to load=
 
   4. If |container| is a [=fenced navigable container=], then for each |feature| supported:
 
-      1. If |feature| [=list/exists=] in |required features|, set |inherited policy|[|feature|] to
-         "`Enabled`".
+       1. If |feature| [=list/exists=] in |required features|, set |inherited policy|[|feature|] to
+          "`Enabled`".
 
-        Otherwise, set |inherited policy|[|feature|] to "`Disabled`".
+          Otherwise, set |inherited policy|[|feature|] to "`Disabled`".
 
-    Otherwise, for each |feature| supported,
+     Otherwise, for each |feature| supported,
 
-      1. Let |isInherited| be the result of running [=Define an inherited policy for feature in
-        container at origin=] on |feature|, |container| and <var ignore>origin</var>.
+       1. Let |isInherited| be the result of running [=Define an inherited policy for feature in
+          container at origin=] on |feature|, |container| and <var ignore>origin</var>.
 
-      2. Set |inherited policy|[|feature|] to |isInherited|.
+       2. Set |inherited policy|[|feature|] to |isInherited|.
 </div>
 
 <div algorithm=allow-attribute-fenced-frame>
-  Modify the [=The allow attribute of the iframe element=] section.
-
-  Rename it to "The allow attribute of the iframe and fencedframe element".
-
-  Rewrite the section to read:
+  Rename the <a href=https://w3c.github.io/webappsec-permissions-policy/#iframe-allow-attribute>The
+  `allow` attribute of the `iframe` element</a> section to "The `allow` attribute of the `iframe`
+  and `fencedframe` element", and rewrite the section to read:
 
-  <{iframe}> and <{fencedframe}> elements have an [=iframe/allow=] attribute, which contains an
-  [=ASCII-serialized policy directive=].
+  <{iframe}> and <{fencedframe}> elements have an respective `allow` attributes (<{iframe}>:
+  <{iframe/allow}>; <{fencedframe}>: <{fencedframe/allow}>), which contain an [=ASCII-serialized
+  policy directive=].
 
   The allowlist for the features named in the attribute may be empty; in that case, the default
   value for the allowlist is "`src`", which represents the origin of the URL in the iframe’s src
   attribute, or the fencedframe's [=fenced frame config=].
 
-  When not empty, the [=iframe/allow=] attribute will result in adding an allowlist for each
+  When not empty, the <{iframe/allow}> attribute will result in adding an allowlist for each
   recognized feature to the iframe element’s content navigable's container policy or the fencedframe
   element's [=fenced navigable container/fenced navigable=]'s container policy, when it is
   constructed.

From 33fd1809b8c9f21b35307f839415e9cf5d8a5d13 Mon Sep 17 00:00:00 2001
From: Dominic Farolino <domfarolino@gmail.com>
Date: Wed, 26 Apr 2023 10:24:13 -0400
Subject: [PATCH 10/24] Add permissions policy spec ref

---
 spec.bs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/spec.bs b/spec.bs
index a56c0224..c2b1fb90 100644
--- a/spec.bs
+++ b/spec.bs
@@ -359,7 +359,7 @@ The <dfn attribute for=HTMLFencedFrameElement>config</dfn> IDL attribute getter
 The <dfn element-attr for=fencedframe>allow</dfn> attribute, when specified, determines the [=fenced
 container policy=] that will be used when the [=Document/permissions policy=] for a {{Document}} in
 the <{fencedframe}>'s [=fenced navigable container/fenced navigable=] is initialized. Its value must
-be a [=serialized permissions policy=].
+be a [=serialized permissions policy=]. [[!PERMISSIONS-POLICY]]
 
 The IDL attribute <dfn attribute for=HTMLFencedFrameElement>allow</dfn> must [=reflect=] the
 respective content attribute of the same name.

From e24bf6cc0b99310fa0b694cfbe6a7b9c5c9a1966 Mon Sep 17 00:00:00 2001
From: Dominic Farolino <domfarolino@gmail.com>
Date: Wed, 26 Apr 2023 10:57:24 -0400
Subject: [PATCH 11/24] Small nits/fixes

---
 spec.bs | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/spec.bs b/spec.bs
index ca2e210d..44944791 100644
--- a/spec.bs
+++ b/spec.bs
@@ -1881,30 +1881,30 @@ TODO: define <dfn>fenced container policy</dfn> here, which is current reference
 </div>
 
 <div algorithm=permissions-policy-block-request>
-  Create a new algorithm in the [[!permissions-policy]] spec, called <dfn export>Should navigation
-  response to navigation request be blocked by Permissions Policy?</dfn>.
+  Create a new algorithm called <dfn>Should navigation response to navigation request be blocked by
+  Permissions Policy?</dfn> in [[!HTML]].
 
   Given a [=response=] (|response|), a [=request=] (|request|), and a [=navigable=] (|navigable|),
-  this algorithm returns `Blocked` or `Allowed`.
+  this algorithm returns `Blocked` or `Allowed`:
 
   1. If |navigable| is not a [=fenced navigable container/fenced navigable=], then return `Allowed`.
 
-  2. Let |required permissions to load| be the |navigable|'s [=fenced frame config instance=]'s
-    [=fenced frame config instance/required permissions to load=].
+  2. Let |required permissions to load| be the |navigable|'s [=navigable/fenced frame config
+     instance=]'s [=fenced frame config instance/required permissions to load=].
 
   3. Let |inherited policy| be |request|'s [=request/client=]'s
-    [=environment/target browsing context=]'s [=browsing context/active document=]'s
-    [=Document/permissions policy=]'s [=inherited policy=].
+     [=environment/target browsing context=]'s [=browsing context/active document=]'s
+     [=Document/permissions policy=]'s [=inherited policy=].
 
   4. Let |origin| be |response|'s [=response/url=]'s [=url/origin=].
 
-  5. For each |permission| in |required permissions to load|:
+  5. [=list/For each=] |permission| of |required permissions to load|:
 
     1. If |permission| does not exist in |inherited policy|, and |permission|'s
-      [=default allowlist=] is not "`*`", return "`Blocked`".
+       [=default allowlist=] is not "`*`", return "`Blocked`".
       
     2. Otherwise, if the allowlist at |inherited policy|[|permission|] does not
-      [=permissions/matches|match=] |origin|, return "`Blocked`".
+       [=permissions/matches|match=] |origin|, return "`Blocked`".
   
   6. Return "`Allowed`."
 </div>

From c6644e7f722cb65c9c7692cb35caed8c529472d4 Mon Sep 17 00:00:00 2001
From: Dominic Farolino <domfarolino@gmail.com>
Date: Wed, 26 Apr 2023 11:59:00 -0400
Subject: [PATCH 12/24] Use navigable active document instead of target
 browsing context, since they are the same

---
 spec.bs | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/spec.bs b/spec.bs
index 44944791..23da04af 100644
--- a/spec.bs
+++ b/spec.bs
@@ -1875,26 +1875,24 @@ TODO: define <dfn>fenced container policy</dfn> here, which is current reference
   |failure| is true, then:" that reads:
 
   8. Otherwise, if the result of [=Should navigation response to navigation request be blocked by
-    Permissions Policy?=] given |navigationParams|'s [=request=],
-    |navigationParams|'s [=response=], and <var ignore>navigable</var> is "`Blocked`", then set
-    |failure| to true.
+    Permissions Policy?=] given <var ignore>navigationParams</var>'s [=response=], and <var
+    ignore>navigable</var> is "`Blocked`", then set |failure| to true.
 </div>
 
 <div algorithm=permissions-policy-block-request>
   Create a new algorithm called <dfn>Should navigation response to navigation request be blocked by
   Permissions Policy?</dfn> in [[!HTML]].
 
-  Given a [=response=] (|response|), a [=request=] (|request|), and a [=navigable=] (|navigable|),
-  this algorithm returns `Blocked` or `Allowed`:
+  Given a [=response=] (|response|) and a [=navigable=] (|navigable|), this algorithm returns
+  `Blocked` or `Allowed`:
 
   1. If |navigable| is not a [=fenced navigable container/fenced navigable=], then return `Allowed`.
 
   2. Let |required permissions to load| be the |navigable|'s [=navigable/fenced frame config
      instance=]'s [=fenced frame config instance/required permissions to load=].
 
-  3. Let |inherited policy| be |request|'s [=request/client=]'s
-     [=environment/target browsing context=]'s [=browsing context/active document=]'s
-     [=Document/permissions policy=]'s [=inherited policy=].
+  3. Let |inherited policy| be |navigable|'s [=navigable/active document=]'s [=Document/permissions
+     policy=]'s [=inherited policy=].
 
   4. Let |origin| be |response|'s [=response/url=]'s [=url/origin=].
 

From bbc1ca9481b7242dfc3c7f109f81fb781d725566 Mon Sep 17 00:00:00 2001
From: Liam Brady <blu2.5@me.com>
Date: Wed, 26 Apr 2023 17:42:38 -0400
Subject: [PATCH 13/24] refactor functions

-split off "create a permissions policy" algorithm into fenced and unfenced versions
- can load check calls unfenced version, keeps rest of algorithm in tact
- modify "create a permissions policy for a navigable from response" step 1 to have a fenced and unfenced if statement
---
 spec.bs | 146 ++++++++++++++++++++++++++++++--------------------------
 1 file changed, 77 insertions(+), 69 deletions(-)

diff --git a/spec.bs b/spec.bs
index 23da04af..d14d25bb 100644
--- a/spec.bs
+++ b/spec.bs
@@ -372,10 +372,10 @@ The <dfn attribute for=HTMLFencedFrameElement>config</dfn> IDL attribute getter
   1. <span class=XXX>TODO</span>
 </div>
 
-The <dfn element-attr for=fencedframe>allow</dfn> attribute, when specified, determines the [=fenced
-container policy=] that will be used when the [=Document/permissions policy=] for a {{Document}} in
-the <{fencedframe}>'s [=fenced navigable container/fenced navigable=] is initialized. Its value must
-be a [=serialized permissions policy=]. [[!PERMISSIONS-POLICY]]
+The <dfn element-attr for=fencedframe>allow</dfn> attribute, when specified, determines the
+[=container policy=] that will be used when the [=Document/permissions policy=] for a {{Document}}
+in the <{fencedframe}>'s [=fenced navigable container/fenced navigable=] is initialized. Its value
+must be a [=serialized permissions policy=]. [[!PERMISSIONS-POLICY]]
 
 The IDL attribute <dfn attribute for=HTMLFencedFrameElement>allow</dfn> must [=reflect=] the
 respective content attribute of the same name.
@@ -657,9 +657,6 @@ A <dfn export>fenced frame config</dfn> is a struct with the following [=struct/
 
   : <dfn>embedder shared storage context</dfn>
   :: null, or an [=fencedframetype/embedder shared storage context=]
-
-  : <dfn>required permissions to load</dfn>
-  :: a [=list=] of [=policy-controlled features=]
 </dl>
 
 <h4 id=fenced-frame-config-instance-struct>The [=fenced frame config instance=] [=struct=]</h4>
@@ -700,9 +697,6 @@ A <dfn export>fenced frame config instance</dfn> is a struct with the following
 
   : <dfn>embedder shared storage context</dfn>
   :: null, or an [=fencedframetype/embedder shared storage context=]
-
-  : <dfn>required permissions to load</dfn>
-  :: a [=list=] of [=policy-controlled features=]
 </dl>
 
 <div algorithm>
@@ -770,9 +764,6 @@ A <dfn export>fenced frame config instance</dfn> is a struct with the following
 
     : [=fenced frame config instance/embedder shared storage context=]
     :: |config|'s [=fenced frame config/embedder shared storage context=]
-
-    : [=fenced frame config instance/required permissions to load=]
-    :: |config|'s [=fenced frame config/required permissions to load=]
 </div>
 
 Each [=navigable=] has a <dfn for=navigable>fenced frame config instance</dfn>, which is a [=fenced
@@ -1769,49 +1760,48 @@ specification is printed below:
 
 Permissions are granted to {{Document}} inside of <{fencedframe}>s through the
 {{FencedFrameConfig}} object and its associated internal [=fencedframeconfig/config=], which defines
-the permissions [=fenced frame config/required permissions to load|required=] for a <{fencedframe}>
+the permissions [=fenced frame config/effective permissions|required=] for a <{fencedframe}>
 to navigate successfully. Specifically, a {{Document}} inside of a <{fencedframe}> can only load if
-it has opted into all of the [=fenced frame config/required permissions to load=].
-
-<h4 id=fenced-container-policies>Fenced container policies</h4>
-
-TODO: define <dfn>fenced container policy</dfn> here, which is current referenced by
-<{fencedframe/allow}>.
+it has opted into all of the [=fenced frame config/effective permissions=].
 
 <h4 id=permissions-policy-patches>Algorithm patches</h4>
 
 <div algorithm=create-permissions-policy>
-  Modify the definition of [=Create a Permissions Policy for a navigable=] to read:
+  Rewrite step 1 of the [=Create a Permissions Policy for a navigable=] algorithm to read:
 
-  Given null or an element (|container|), an [=origin=] (<var ignore>origin</var>), and an optional
-  [=list=] of [=policy-controlled features=] (|required features|), this algorithm returns a new
-  [=Document/permissions policy=].
+  1. [=Assert=]: if not null, <var ignore>container</var> is either a [=navigable container=] or a
+     [=fenced navigable container=].
+</div>
 
-  Rewrite step 1 of the algorithm to read:
+<div algorithm=create-fenced-permissions-policy>
+  Create a new algorithm called <dfn>Create a Permissions Policy for a fenced navigable</dfn> in
+  [[!PERMISSIONS-POLICY]].
 
-  1. [=Assert=]: if not null, |container| is either a [=navigable container=] or a [=fenced
-     navigable container=].
+  Given null or an element (|container|), an [=origin=] (<var ignore>origin</var>), and an optional
+  [=fencedframetype/exhaustive set of permissions=] (|effective permissions|), this algorithm
+  returns a new [=Document/permissions policy=].
 
-  Add a new step after step 1 that reads:
+  1. [=Assert=]: if not null, |container| is a [=fenced navigable container=].
 
-  2. [=Assert=]: if |container| is not a [=fenced navigable container=], |required features| is not
-     given.
+  2. Let |inherited policy| be a new ordered map.
 
-  Rewrite step 4 to read:
+  3. Let |declared policy| be a new ordered map.
 
-  4. If |container| is a [=fenced navigable container=], then for each |feature| supported:
+  4. If |effective permissions| is not null and |feature| [=list/exists=] in |effective
+     permissions|, set |inherited policy|[|feature|] to "`Enabled`".
 
-       1. If |feature| [=list/exists=] in |required features|, set |inherited policy|[|feature|] to
-          "`Enabled`".
+     Otherwise, set |inherited policy|[|feature|] to "`Disabled`".
 
-          Otherwise, set |inherited policy|[|feature|] to "`Disabled`".
+  5. Let |policy| be a new [=permissions/Permissions policy=], with inherited policy |inherited
+     policy| and declared policy |declared policy|.
 
-     Otherwise, for each |feature| supported,
+  6. Return |policy|.
 
-       1. Let |isInherited| be the result of running [=Define an inherited policy for feature in
-          container at origin=] on |feature|, |container| and <var ignore>origin</var>.
+  Note: It is safe to naively set the frame's permissions to the |effective permissions|. By this
+  point, the [=Should navigation response to navigation request be blocked by Permissions Policy?=]
+  check will have verified that the fenced frame is not trying to get extra permissions that the
+  embedder didn't delegate.
 
-       2. Set |inherited policy|[|feature|] to |isInherited|.
 </div>
 
 <div algorithm=allow-attribute-fenced-frame>
@@ -1827,43 +1817,52 @@ TODO: define <dfn>fenced container policy</dfn> here, which is current reference
   value for the allowlist is "`src`", which represents the origin of the URL in the iframe’s src
   attribute, or the fencedframe's [=fenced frame config=].
 
-  When not empty, the <{iframe/allow}> attribute will result in adding an allowlist for each
-  recognized feature to the iframe element’s content navigable's container policy or the fencedframe
-  element's [=fenced navigable container/fenced navigable=]'s container policy, when it is
-  constructed.
+  When not empty, the <{iframe}>'s <{iframe/allow}> or <{fencedframe}>'s <{fencedframe/allow}>
+  attribute will result in adding an allowlist for each recognized feature to the iframe element’s
+  content navigable's container policy or the fencedframe element's [=fenced navigable container/
+  fenced navigable=]'s container policy, when it is constructed.
 </div>
 
 <div algorithm=create-permissions-policy-response>
   Modify the definition of [=Create a Permissions Policy for a navigable from response=] to read:
 
   Given null, a [=navigable container=], or a [=fenced navigable container=] (|container|), an
-  [=origin=] (|origin|), a [=response=] (<var ignore>response</var>), and null or a
-  [=list=] of [=features=] (|required features|), this algorithm returns a new
-  [=Document/permissions policy=].
+  [=origin=] (|origin|), a [=response=] (<var ignore>response</var>), and null or an
+  [=fencedframetype/exhaustive set of permissions=] (|effective permissions|), this algorithm
+  returns a new [=Document/permissions policy=].
 
   Modify step 1 of the algorithm to read:
-  1. Let <var ignore>policy</var> be the result of running
-    [=Create a Permissions Policy for a navigable=] given |container|, |origin|, and
-    |required features|.
+  1. If |container| is a [=fenced navigable container=], then let <var ignore>policy</var> be the
+     result of running
+     [=Create a Permissions Policy for a fenced navigable=] given |container|, |origin|, and
+     |effective permissions|.
+  
+     Otherwise, let <var ignore>policy</var> be the result of running [=Create a Permissions Policy
+     for a navigable=] given |container| and |origin|.
 </div>
 
 <div algorithm=shared-document-creation-changes>
   Modify the [=create and initialize a Document object=] algorithm. Rewrite step 3 to read:
 
   3. Let <var ignore>permissionsPolicy</var> be the result of [=Create a Permissions Policy for a
-    navigable from response|creating a permissions policy from a response=] given
-    |navigationParams|'s [=navigable=]'s [=navigable container|container=], |navigationParams|'s
-    [=navigation params/origin=], |navigationParams|'s [=navigation params/response=], and
-    |navigationParams|'s [=navigable=]'s [=fenced frame config instance=]'s [=fenced frame config
-    instance/required permissions to load=].
+     navigable from response|creating a permissions policy from a response=] given
+     |navigationParams|'s [=navigable=]'s [=navigable container|container=], |navigationParams|'s
+     [=navigation params/origin=], |navigationParams|'s [=navigation params/response=], and
+     |navigationParams|'s [=navigable=]'s [=fenced frame config instance=]'s [=fenced frame config
+     instance/effective permissions=].
 </div>
 
 <div algorithm=new-browsing-context-changes>
   Modify the [=create a new browsing context and document=] algorithm. Rewrite step 7 to read:
 
-  7. Let <var ignore>permissionsPolicy</var> be the result of [=Create a Permissions Policy for a
-    navigable|creating a permissions policy=] given <var ignore>embedder</var>,
-    <var ignore>origin</var>, and null.
+  7. If <var ignore>navigationParams</var>'s [=navigable=]'s [=navigable/traversable navigable=] is
+     a [=fenced navigable container/fenced navigable=], let |permissionsPolicy| be the result of
+     [=Create a Permissions Policy for a fenced navigable|creating a permissions policy for a fenced
+     navigable=] given |embedder|, |origin|, and null.
+
+     Otherwise, let |permissionsPolicy| be the result of [=Create a Permissions Policy for a
+     navigable|creating a permissions policy=] given |embedder| and
+     |origin|.
 
   Note: This change is made in addition to the changes to [=create a new browsing context and
   document=] outlined in [[#creating-browsing-contexts-patch]].
@@ -1888,21 +1887,30 @@ TODO: define <dfn>fenced container policy</dfn> here, which is current reference
 
   1. If |navigable| is not a [=fenced navigable container/fenced navigable=], then return `Allowed`.
 
-  2. Let |required permissions to load| be the |navigable|'s [=navigable/fenced frame config
-     instance=]'s [=fenced frame config instance/required permissions to load=].
+  2. Let |origin| be |response|'s [=response/url=]'s [=url/origin=].
 
-  3. Let |inherited policy| be |navigable|'s [=navigable/active document=]'s [=Document/permissions
-     policy=]'s [=inherited policy=].
+  3. Let |effective permissions| be the |navigable|'s [=navigable/fenced frame config instance=]'s
+     [=fenced frame config instance/effective permissions=].
 
-  4. Let |origin| be |response|'s [=response/url=]'s [=url/origin=].
+  4. Let |permissions policy| be the result of [=Create a Permissions Policy for a navigable|
+     creating a permissions policy=] given |navigable|'s [=navigable container|container=] and
+     |origin|.
 
-  5. [=list/For each=] |permission| of |required permissions to load|:
+  5. Let |inherited policy| be |permissions policy|'s [=inherited policy=].
 
-    1. If |permission| does not exist in |inherited policy|, and |permission|'s
-       [=default allowlist=] is not "`*`", return "`Blocked`".
-      
-    2. Otherwise, if the allowlist at |inherited policy|[|permission|] does not
-       [=permissions/matches|match=] |origin|, return "`Blocked`".
+  6. [=list/For each=] |feature| of |effective permissions|:
+
+    1. If |inherited policy|[|feature|] is "Disabled", return "`Blocked`".
+
+    Issue: This deviates from the implementation. By relying on creating a permissions policy, we
+    are squashing information about why a feature is enabled/disabled. We don't know if it's enabled
+    by default or explicitly enabled, which the implementation relies on to make its decision about
+    whether to allow or disallow a fenced frame load.
   
-  6. Return "`Allowed`."
+  7. Return "`Allowed`."
+
+  Note: After this point, the [=Create a Permissions Policy for a fenced navigable=] algorithm will
+  give the frame the permissions listed in |effective permissions|. This is done to have the
+  list of allowed permissions be the tightest union between the container policy and the permissions
+  needed to load the fenced frame.
 </div>

From 0b940424a6946c0923ab1fa63e0abe88568e8112 Mon Sep 17 00:00:00 2001
From: Dominic Farolino <domfarolino@gmail.com>
Date: Thu, 27 Apr 2023 07:50:30 -0400
Subject: [PATCH 14/24] Tiny cleanup

---
 spec.bs | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/spec.bs b/spec.bs
index d14d25bb..0645f0e1 100644
--- a/spec.bs
+++ b/spec.bs
@@ -1783,17 +1783,15 @@ it has opted into all of the [=fenced frame config/effective permissions=].
 
   1. [=Assert=]: if not null, |container| is a [=fenced navigable container=].
 
-  2. Let |inherited policy| be a new ordered map.
+  2. Let |inherited policy| be a new [=ordered map=].
 
-  3. Let |declared policy| be a new ordered map.
-
-  4. If |effective permissions| is not null and |feature| [=list/exists=] in |effective
-     permissions|, set |inherited policy|[|feature|] to "`Enabled`".
+  4. If |effective permissions| is given, then [=list/For each=] |feature| |effective permissions|,
+     set |inherited policy|[|feature|] to "`Enabled`".
 
      Otherwise, set |inherited policy|[|feature|] to "`Disabled`".
 
   5. Let |policy| be a new [=permissions/Permissions policy=], with inherited policy |inherited
-     policy| and declared policy |declared policy|.
+     policy| and declared policy a new [=ordered map=].
 
   6. Return |policy|.
 

From 311455ee65d2a21ef39f77a362b5be2a0bbc3f8d Mon Sep 17 00:00:00 2001
From: Dominic Farolino <domfarolino@gmail.com>
Date: Thu, 27 Apr 2023 10:50:35 -0400
Subject: [PATCH 15/24] Changes after
 https://github.com/WICG/fenced-frame/pull/81

---
 spec.bs | 33 ++++++++++++++++++---------------
 1 file changed, 18 insertions(+), 15 deletions(-)

diff --git a/spec.bs b/spec.bs
index 472ff39b..e74b885b 100644
--- a/spec.bs
+++ b/spec.bs
@@ -150,8 +150,8 @@ spec: permissions-policy; urlPrefix: https://w3c.github.io/webappsec-permissions
     text: Define an inherited policy for feature in container at origin; url: define-inherited-policy-in-container
     text: default allowlist; url: policy-controlled-feature-default-allowlist
     text: ASCII-serialized policy directive; url: serialized-policy-directive
-    text: inherited policy; url: inherited-policy
     text: serialized permissions policy; url: serialized-permissions-policy
+    text: supported features; url: supported-features
     for: permissions
       text: matches; url: matches
       text: permissions policy; url: permissions-policy
@@ -1774,9 +1774,9 @@ specification is printed below:
 
 Permissions are granted to {{Document}} inside of <{fencedframe}>s through the
 {{FencedFrameConfig}} object and its associated internal [=fencedframeconfig/config=], which defines
-the permissions [=fenced frame config/effective permissions|required=] for a <{fencedframe}>
-to navigate successfully. Specifically, a {{Document}} inside of a <{fencedframe}> can only load if
-it has opted into all of the [=fenced frame config/effective permissions=].
+the permissions [=fenced frame config/effective enabled permissions|exclusively required=] for a
+<{fencedframe}> to navigate successfully. Specifically, a {{Document}} inside of a <{fencedframe}>
+can only load if it has opted into all of the [=fenced frame config/effective enabled permissions=].
 
 <h4 id=permissions-policy-patches>Algorithm patches</h4>
 
@@ -1792,20 +1792,23 @@ it has opted into all of the [=fenced frame config/effective permissions=].
   [[!PERMISSIONS-POLICY]].
 
   Given null or an element (|container|), an [=origin=] (<var ignore>origin</var>), and an optional
-  [=fencedframetype/exhaustive set of permissions=] (|effective permissions|), this algorithm
-  returns a new [=Document/permissions policy=].
+  [=fenced frame config instance/effective enabled permissions=] (|effective permissions|), this
+  algorithm returns a new [=Document/permissions policy=].
 
   1. [=Assert=]: if not null, |container| is a [=fenced navigable container=].
 
   2. Let |inherited policy| be a new [=ordered map=].
 
-  4. If |effective permissions| is given, then [=list/For each=] |feature| |effective permissions|,
-     set |inherited policy|[|feature|] to "`Enabled`".
+  4. If |effective permissions| is given, then [=list/For each=] |supported feature| of the UA's
+     [=supported features=]:
 
-     Otherwise, set |inherited policy|[|feature|] to "`Disabled`".
+       1. If |supported feature| [=list/exists=] in |effective permissions|, then set |inherited
+          policy|[|supported feature|] to "`Enabled`".
 
-  5. Let |policy| be a new [=permissions/Permissions policy=], with inherited policy |inherited
-     policy| and declared policy a new [=ordered map=].
+          Otherwise, set |inherited policy|[|supported feature|] to "`Disabled`".
+
+  5. Let |policy| be a new [=permissions/Permissions policy=], with [=permissions policy/inherited
+     policy=] |inherited policy| and declared policy a new [=ordered map=].
 
   6. Return |policy|.
 
@@ -1840,8 +1843,8 @@ it has opted into all of the [=fenced frame config/effective permissions=].
 
   Given null, a [=navigable container=], or a [=fenced navigable container=] (|container|), an
   [=origin=] (|origin|), a [=response=] (<var ignore>response</var>), and null or an
-  [=fencedframetype/exhaustive set of permissions=] (|effective permissions|), this algorithm
-  returns a new [=Document/permissions policy=].
+  [=fenced frame config instance/effective enabled permissions=] (|effective permissions|), this
+  algorithm returns a new [=Document/permissions policy=].
 
   Modify step 1 of the algorithm to read:
   1. If |container| is a [=fenced navigable container=], then let <var ignore>policy</var> be the
@@ -1861,7 +1864,7 @@ it has opted into all of the [=fenced frame config/effective permissions=].
      |navigationParams|'s [=navigable=]'s [=navigable container|container=], |navigationParams|'s
      [=navigation params/origin=], |navigationParams|'s [=navigation params/response=], and
      |navigationParams|'s [=navigable=]'s [=fenced frame config instance=]'s [=fenced frame config
-     instance/effective permissions=].
+     instance/effective enabled permissions=].
 </div>
 
 <div algorithm=new-browsing-context-changes>
@@ -1908,7 +1911,7 @@ it has opted into all of the [=fenced frame config/effective permissions=].
      creating a permissions policy=] given |navigable|'s [=navigable container|container=] and
      |origin|.
 
-  5. Let |inherited policy| be |permissions policy|'s [=inherited policy=].
+  5. Let |inherited policy| be |permissions policy|'s [=permissions policy/inherited policy=].
 
   6. [=list/For each=] |feature| of |effective permissions|:
 

From 962de6928e9a4fec479c591a3db5d40bb446d5a6 Mon Sep 17 00:00:00 2001
From: Liam Brady <blu2.5@me.com>
Date: Thu, 27 Apr 2023 16:27:44 -0400
Subject: [PATCH 16/24] Update spec.bs

---
 spec.bs | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/spec.bs b/spec.bs
index d14d25bb..0f4ca612 100644
--- a/spec.bs
+++ b/spec.bs
@@ -82,6 +82,7 @@ spec: html; urlPrefix: https://html.spec.whatwg.org/multipage/
       text: historyHandling; url: navigation-hh
       text: referrerPolicy; url: navigation-referrer-policy
       text: attempt to populate the history entry's document; url: attempt-to-populate-the-history-entry's-document
+      text: navigation params; url: navigation-params
       for: navigation params
         text: response; url: navigation-params-response
         text: navigable; url: navigation-params-navigable
@@ -1777,9 +1778,9 @@ it has opted into all of the [=fenced frame config/effective permissions=].
   Create a new algorithm called <dfn>Create a Permissions Policy for a fenced navigable</dfn> in
   [[!PERMISSIONS-POLICY]].
 
-  Given null or an element (|container|), an [=origin=] (<var ignore>origin</var>), and an optional
-  [=fencedframetype/exhaustive set of permissions=] (|effective permissions|), this algorithm
-  returns a new [=Document/permissions policy=].
+  Given null or an element (|container|) and an optional [=fencedframetype/exhaustive set of
+  permissions=] (|effective permissions|), this algorithm returns a new [=Document/permissions
+  policy=].
 
   1. [=Assert=]: if not null, |container| is a [=fenced navigable container=].
 
@@ -1834,7 +1835,7 @@ it has opted into all of the [=fenced frame config/effective permissions=].
   Modify step 1 of the algorithm to read:
   1. If |container| is a [=fenced navigable container=], then let <var ignore>policy</var> be the
      result of running
-     [=Create a Permissions Policy for a fenced navigable=] given |container|, |origin|, and
+     [=Create a Permissions Policy for a fenced navigable=] given |container| and
      |effective permissions|.
   
      Otherwise, let <var ignore>policy</var> be the result of running [=Create a Permissions Policy
@@ -1858,11 +1859,11 @@ it has opted into all of the [=fenced frame config/effective permissions=].
   7. If <var ignore>navigationParams</var>'s [=navigable=]'s [=navigable/traversable navigable=] is
      a [=fenced navigable container/fenced navigable=], let |permissionsPolicy| be the result of
      [=Create a Permissions Policy for a fenced navigable|creating a permissions policy for a fenced
-     navigable=] given |embedder|, |origin|, and null.
+     navigable=] given |embedder| and null.
 
      Otherwise, let |permissionsPolicy| be the result of [=Create a Permissions Policy for a
      navigable|creating a permissions policy=] given |embedder| and
-     |origin|.
+     <var ignore>origin</var>.
 
   Note: This change is made in addition to the changes to [=create a new browsing context and
   document=] outlined in [[#creating-browsing-contexts-patch]].
@@ -1874,20 +1875,20 @@ it has opted into all of the [=fenced frame config/effective permissions=].
   |failure| is true, then:" that reads:
 
   8. Otherwise, if the result of [=Should navigation response to navigation request be blocked by
-    Permissions Policy?=] given <var ignore>navigationParams</var>'s [=response=], and <var
-    ignore>navigable</var> is "`Blocked`", then set |failure| to true.
+    Permissions Policy?=] given <var ignore>navigationParams</var> and <var ignore>navigable</var>
+    is "`Blocked`", then set |failure| to true.
 </div>
 
 <div algorithm=permissions-policy-block-request>
   Create a new algorithm called <dfn>Should navigation response to navigation request be blocked by
   Permissions Policy?</dfn> in [[!HTML]].
 
-  Given a [=response=] (|response|) and a [=navigable=] (|navigable|), this algorithm returns
+  Given a [=navigation params=] (|navigationParams|) and a [=navigable=] (|navigable|), this algorithm returns
   `Blocked` or `Allowed`:
 
   1. If |navigable| is not a [=fenced navigable container/fenced navigable=], then return `Allowed`.
 
-  2. Let |origin| be |response|'s [=response/url=]'s [=url/origin=].
+  2. Let |origin| be |navigationParams|'s [=navigation params/origin=].
 
   3. Let |effective permissions| be the |navigable|'s [=navigable/fenced frame config instance=]'s
      [=fenced frame config instance/effective permissions=].

From acf08d2c66899f9b82321b4dd34702a5a44225d7 Mon Sep 17 00:00:00 2001
From: Liam Brady <blu2.5@me.com>
Date: Thu, 27 Apr 2023 17:55:40 -0400
Subject: [PATCH 17/24] refactor to only allow *

---
 spec.bs | 160 ++++++++++++++++++++++++++++----------------------------
 1 file changed, 80 insertions(+), 80 deletions(-)

diff --git a/spec.bs b/spec.bs
index e236e38d..549e8425 100644
--- a/spec.bs
+++ b/spec.bs
@@ -74,8 +74,6 @@ spec: html; urlPrefix: https://html.spec.whatwg.org/multipage/
         text: cross-origin isolation mode; url: bcg-cross-origin-isolation
       for: cross-origin isolation mode
         text: none; url:cross-origin-isolation-none
-    urlPrefix: document-lifecycle.html
-      text: create and initialize a Document object; url: initialise-the-document-object
     urlPrefix: browsing-the-web.html
       text: create navigation params by fetching; url: create-navigation-params-by-fetching
       text: document state; url: she-document-state
@@ -153,6 +151,10 @@ spec: permissions-policy; urlPrefix: https://w3c.github.io/webappsec-permissions
     text: ASCII-serialized policy directive; url: serialized-policy-directive
     text: serialized permissions policy; url: serialized-permissions-policy
     text: supported features; url: supported-features
+    text: Define an inherited policy for feature in container at origin; url: define-inherited-policy-in-container
+    text: Is feature enabled in document for origin?; url: is-feature-enabled
+    text: declared policy; url: declared-policy
+    text: allowlist; url: allowlist
     for: permissions
       text: matches; url: matches
       text: permissions policy; url: permissions-policy
@@ -1782,42 +1784,24 @@ can only load if it has opted into all of the [=fenced frame config/effective en
 <h4 id=permissions-policy-patches>Algorithm patches</h4>
 
 <div algorithm=create-permissions-policy>
-  Rewrite step 1 of the [=Create a Permissions Policy for a navigable=] algorithm to read:
-
-  1. [=Assert=]: if not null, <var ignore>container</var> is either a [=navigable container=] or a
-     [=fenced navigable container=].
-</div>
-
-<div algorithm=create-fenced-permissions-policy>
-  Create a new algorithm called <dfn>Create a Permissions Policy for a fenced navigable</dfn> in
-  [[!PERMISSIONS-POLICY]].
-
-  Given null or an element (|container|) and an optional [=fencedframetype/exhaustive set of
-  permissions=] (|effective permissions|), this algorithm returns a new [=Document/permissions
-  policy=].
-
-  1. [=Assert=]: if not null, |container| is a [=fenced navigable container=].
-
-  2. Let |inherited policy| be a new [=ordered map=].
+  Modify the definition of [=Create a Permissions Policy for a navigable=]:
 
-  4. If |effective permissions| is given, then [=list/For each=] |supported feature| of the UA's
-     [=supported features=]:
+  Given null or an [=element=] (|container|), an [=origin=] (|origin|), and an optional [=boolean=]
+  |fenced| that defaults to false, this algorithm returns a new Permissions Policy.
 
-       1. If |supported feature| [=list/exists=] in |effective permissions|, then set |inherited
-          policy|[|supported feature|] to "`Enabled`".
+  Rewrite step 1 to read:
 
-          Otherwise, set |inherited policy|[|supported feature|] to "`Disabled`".
+  1. [=Assert=]: if not null, <var ignore>container</var> is either a [=navigable container=] or a
+     [=fenced navigable container=].
 
-  5. Let |policy| be a new [=permissions/Permissions policy=], with [=permissions policy/inherited
-     policy=] |inherited policy| and declared policy a new [=ordered map=].
+  Rewrite step 4 to read:
 
-  6. Return |policy|.
+  4. For each |feature| supported:
 
-  Note: It is safe to naively set the frame's permissions to the |effective permissions|. By this
-  point, the [=Should navigation response to navigation request be blocked by Permissions Policy?=]
-  check will have verified that the fenced frame is not trying to get extra permissions that the
-  embedder didn't delegate.
+     1. Let |isInherited| be the result of running [=Define an inherited policy for feature in
+        container at origin=] on |feature|, |container|, |origin|, and |fenced|.
 
+     2. Set <var ignore>inherited policy</var>[|feature|] to |isInherited|.
 </div>
 
 <div algorithm=allow-attribute-fenced-frame>
@@ -1843,45 +1827,18 @@ can only load if it has opted into all of the [=fenced frame config/effective en
   Modify the definition of [=Create a Permissions Policy for a navigable from response=] to read:
 
   Given null, a [=navigable container=], or a [=fenced navigable container=] (|container|), an
-  [=origin=] (|origin|), a [=response=] (<var ignore>response</var>), and null or an
-  [=fenced frame config instance/effective enabled permissions=] (|effective permissions|), this
-  algorithm returns a new [=Document/permissions policy=].
-
-  Modify step 1 of the algorithm to read:
-  1. If |container| is a [=fenced navigable container=], then let <var ignore>policy</var> be the
-     result of running
-     [=Create a Permissions Policy for a fenced navigable=] given |container| and
-     |effective permissions|.
-  
-     Otherwise, let <var ignore>policy</var> be the result of running [=Create a Permissions Policy
-     for a navigable=] given |container| and |origin|.
-</div>
+  [=origin=] (|origin|), and a [=response=] (<var ignore>response</var>), this algorithm returns a
+  new [=Document/permissions policy=].
 
-<div algorithm=shared-document-creation-changes>
-  Modify the [=create and initialize a Document object=] algorithm. Rewrite step 3 to read:
+  Add a step before step 1 that reads:
 
-  3. Let <var ignore>permissionsPolicy</var> be the result of [=Create a Permissions Policy for a
-     navigable from response|creating a permissions policy from a response=] given
-     |navigationParams|'s [=navigable=]'s [=navigable container|container=], |navigationParams|'s
-     [=navigation params/origin=], |navigationParams|'s [=navigation params/response=], and
-     |navigationParams|'s [=navigable=]'s [=fenced frame config instance=]'s [=fenced frame config
-     instance/effective enabled permissions=].
-</div>
+  1. If |container| is a [=fenced navigable container=], let |fenced| be true.
 
-<div algorithm=new-browsing-context-changes>
-  Modify the [=create a new browsing context and document=] algorithm. Rewrite step 7 to read:
+     Otherwise, let |fenced| be false.
 
-  7. If <var ignore>navigationParams</var>'s [=navigable=]'s [=navigable/traversable navigable=] is
-     a [=fenced navigable container/fenced navigable=], let |permissionsPolicy| be the result of
-     [=Create a Permissions Policy for a fenced navigable|creating a permissions policy for a fenced
-     navigable=] given |embedder| and null.
-
-     Otherwise, let |permissionsPolicy| be the result of [=Create a Permissions Policy for a
-     navigable|creating a permissions policy=] given |embedder| and
-     <var ignore>origin</var>.
-
-  Note: This change is made in addition to the changes to [=create a new browsing context and
-  document=] outlined in [[#creating-browsing-contexts-patch]].
+  Modify the now step 2 of the algorithm to read:
+  2. Let <var ignore>policy</var> be the result of running [=Create a Permissions Policy
+     for a navigable=] given |container|, |origin|, and |fenced|.
 </div>
 
 <div algorithm=attempt-populate-history-patches>
@@ -1898,19 +1855,19 @@ can only load if it has opted into all of the [=fenced frame config/effective en
   Create a new algorithm called <dfn>Should navigation response to navigation request be blocked by
   Permissions Policy?</dfn> in [[!HTML]].
 
-  Given a [=navigation params=] (|navigationParams|) and a [=navigable=] (|navigable|), this algorithm returns
-  `Blocked` or `Allowed`:
+  Given a [=navigation params=] (|navigationParams|) and a [=navigable=] (|navigable|), this
+  algorithm returns `Blocked` or `Allowed`:
 
   1. If |navigable| is not a [=fenced navigable container/fenced navigable=], then return `Allowed`.
 
   2. Let |origin| be |navigationParams|'s [=navigation params/origin=].
 
   3. Let |effective permissions| be the |navigable|'s [=navigable/fenced frame config instance=]'s
-     [=fenced frame config instance/effective permissions=].
+     [=fenced frame config instance/effective enabled permissions=].
 
   4. Let |permissions policy| be the result of [=Create a Permissions Policy for a navigable|
-     creating a permissions policy=] given |navigable|'s [=navigable container|container=] and
-     |origin|.
+     creating a permissions policy=] given |navigable|'s [=navigable container|container=],
+     |origin|, and <var ignore>fenced</var> set to true.
 
   5. Let |inherited policy| be |permissions policy|'s [=permissions policy/inherited policy=].
 
@@ -1918,15 +1875,58 @@ can only load if it has opted into all of the [=fenced frame config/effective en
 
     1. If |inherited policy|[|feature|] is "Disabled", return "`Blocked`".
 
-    Issue: This deviates from the implementation. By relying on creating a permissions policy, we
-    are squashing information about why a feature is enabled/disabled. We don't know if it's enabled
-    by default or explicitly enabled, which the implementation relies on to make its decision about
-    whether to allow or disallow a fenced frame load.
-  
   7. Return "`Allowed`."
+</div>
 
-  Note: After this point, the [=Create a Permissions Policy for a fenced navigable=] algorithm will
-  give the frame the permissions listed in |effective permissions|. This is done to have the
-  list of allowed permissions be the tightest union between the container policy and the permissions
-  needed to load the fenced frame.
+<div algorithm=define-inherited-policy-in-container-patches>
+  Modify the definition of the [=Define an inherited policy for feature in container at origin=]
+  algorithm to read:
+
+  Given a feature (|feature|), null or a [=navigable container=] (|container|), an [=origin=] for a
+  document in that container (|origin|), and an optional [=boolean=] |fenced| that defaults to
+  false, this algorithm returns the [=permissions policy/inherited policy=] for that feature.
+  
+  Rewrite step 3 to read:
+
+  3. If the result of executing [=Is feature enabled in document for origin?=] on |feature|,
+     |container|'s [=Node/node document=], |origin|, and |fenced| is "Disabled", return
+     "Disabled".
+
+  Rewrite step 7 to read:
+
+  7. If |fenced| is false, |feature|’s [=default allowlist=] is `'self'`, and |origin| is [=same
+     origin=] with |container|’s [=Node/node document=]’s origin, return `"Enabled"`.
+</div>
+
+<div algorithm=allowed-origins>
+  Define a new constant, <dfn>allowed origins for fenced permissions policies</dfn>, that is set
+  to the following list:
+  
+  ["`https://*`", "`https://*:*`", "`*`"]
 </div>
+
+<div algorithm=is-feature-enabled-patches>
+  Modify the definition of the [=Is feature enabled in document for origin?=] to read:
+
+  Given a feature (|feature|), a {{Document}} object (|document|), an [=url/origin=] (|origin|), and
+  an optional [=boolean=] |fenced| that defaults to false, this algorithm returns "`Disabled`" if
+  |feature| should be considered disabled, and "`Enabled`" otherwise.
+
+  Rewrite step 3 to read:
+
+  3. If |feature| is present in |policy|'s [=declared policy=],
+
+    1. If |fenced| is set to false, and the [=allowlist=] for |feature| in |policy|'s [=declared
+       policy=] [=permissions/matches=] |origin|, then return "`Enabled`".
+
+    2. Otherwise, if |fenced| is set to true, and the [=allowlist=] for |feature| in |policy|'s
+      [=declared policy=] [=permissions/matches=] one of the origins in [=allowed origins for fenced
+       permissions policies=], then return "`Enabled`".
+
+    3. Otherwise, return "`Disabled`".
+
+  Rewrite step 5 to read:
+
+  5. If |fenced| is set to false, |feature|’s [=default allowlist=] is `'self'`, and |origin| is
+     [=same origin=] with |document|’s origin, return "Enabled".
+</div>
\ No newline at end of file

From 7d3bed47c566e6a65d135d3f7c1cedd4110bda42 Mon Sep 17 00:00:00 2001
From: Liam Brady <blu2.5@me.com>
Date: Thu, 27 Apr 2023 17:57:13 -0400
Subject: [PATCH 18/24] fix failing build

---
 spec.bs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/spec.bs b/spec.bs
index 549e8425..f5a42064 100644
--- a/spec.bs
+++ b/spec.bs
@@ -1786,7 +1786,7 @@ can only load if it has opted into all of the [=fenced frame config/effective en
 <div algorithm=create-permissions-policy>
   Modify the definition of [=Create a Permissions Policy for a navigable=]:
 
-  Given null or an [=element=] (|container|), an [=origin=] (|origin|), and an optional [=boolean=]
+  Given null or an element (|container|), an [=origin=] (|origin|), and an optional [=boolean=]
   |fenced| that defaults to false, this algorithm returns a new Permissions Policy.
 
   Rewrite step 1 to read:

From d8115f4d6a4bc564747d53812d9603bf6ea6fe98 Mon Sep 17 00:00:00 2001
From: Liam Brady <blu2.5@me.com>
Date: Fri, 28 Apr 2023 12:17:19 -0400
Subject: [PATCH 19/24] only allow the special value *

---
 spec.bs | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/spec.bs b/spec.bs
index f5a42064..895cecbc 100644
--- a/spec.bs
+++ b/spec.bs
@@ -155,6 +155,7 @@ spec: permissions-policy; urlPrefix: https://w3c.github.io/webappsec-permissions
     text: Is feature enabled in document for origin?; url: is-feature-enabled
     text: declared policy; url: declared-policy
     text: allowlist; url: allowlist
+    text: the special value *; url: the-special-value
     for: permissions
       text: matches; url: matches
       text: permissions policy; url: permissions-policy
@@ -1898,13 +1899,6 @@ can only load if it has opted into all of the [=fenced frame config/effective en
      origin=] with |container|’s [=Node/node document=]’s origin, return `"Enabled"`.
 </div>
 
-<div algorithm=allowed-origins>
-  Define a new constant, <dfn>allowed origins for fenced permissions policies</dfn>, that is set
-  to the following list:
-  
-  ["`https://*`", "`https://*:*`", "`*`"]
-</div>
-
 <div algorithm=is-feature-enabled-patches>
   Modify the definition of the [=Is feature enabled in document for origin?=] to read:
 
@@ -1920,8 +1914,7 @@ can only load if it has opted into all of the [=fenced frame config/effective en
        policy=] [=permissions/matches=] |origin|, then return "`Enabled`".
 
     2. Otherwise, if |fenced| is set to true, and the [=allowlist=] for |feature| in |policy|'s
-      [=declared policy=] [=permissions/matches=] one of the origins in [=allowed origins for fenced
-       permissions policies=], then return "`Enabled`".
+      [=declared policy=] is [=the special value *=], then return "`Enabled`".
 
     3. Otherwise, return "`Disabled`".
 

From b2a4b9683d310718a3ce2f5b145aebd90d441efa Mon Sep 17 00:00:00 2001
From: Dominic Farolino <domfarolino@gmail.com>
Date: Fri, 28 Apr 2023 15:26:17 -0400
Subject: [PATCH 20/24] Elaborate on intro with examples

---
 spec.bs | 70 ++++++++++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 64 insertions(+), 6 deletions(-)

diff --git a/spec.bs b/spec.bs
index 895cecbc..ec7450ea 100644
--- a/spec.bs
+++ b/spec.bs
@@ -1776,11 +1776,69 @@ specification is printed below:
 
 <h3 id=permissions-policy-changes>Permissions Policies</h3>
 
-Permissions are granted to {{Document}} inside of <{fencedframe}>s through the
-{{FencedFrameConfig}} object and its associated internal [=fencedframeconfig/config=], which defines
-the permissions [=fenced frame config/effective enabled permissions|exclusively required=] for a
-<{fencedframe}> to navigate successfully. Specifically, a {{Document}} inside of a <{fencedframe}>
-can only load if it has opted into all of the [=fenced frame config/effective enabled permissions=].
+*This introductory sub-section is non-normative.*
+
+The [=policy-controlled features=] available to {{Document}}s inside of a <{fencedframe}> are
+determined exclusively by the {{FencedFrameConfig}} that the <{fencedframe}> navigates to.
+Specifically, the {{FencedFrameConfig}}'s [=fencedframeconfig/config=]'s [=fenced frame
+config/effective enabled permissions=] defines the exclusive list of [=policy-controlled features=]
+that will be enabled in the {{Document}} (all others will be disabled).
+
+During navigation, the {{FencedFrameConfig}}'s [=fencedframeconfig/config=] [=instantiate a
+config|instantiates=] a [=navigable/fenced frame config instance=] that is stored on the [=fenced
+navigable container/fenced navigable=]. This navigable's [=navigable/fenced frame config
+instance=]'s [=fenced frame config instance/effective enabled permissions=] is consulted [=Should
+navigation response to navigation request be blocked by Permissions Policy?|during navigation=]. A
+<{fencedframe}> navigation can only succeed if the [=Document/permissions policy=] for the
+navigation's resulting {{Document}} has an [=permissions policy/inherited policy=] such that the
+[=inherited policy for a feature|inherited policy value=] is "`Enabled`" for each feature in the
+[=fenced frame config/effective enabled permissions=]. Otherwise the environment the <{fencedframe}>
+is embedded in is deemed unsuitable for the [=fenced frame config=], and the navigation is blocked.
+
+At the same time, to make sure that a <{fencedframe}>'s embedder does not directly influence content
+in the <{fencedframe}>'s based on that navigation's [=navigation params/origin=] (since the origin
+is derived from cross-site data), this specification modifies various [[PERMISSIONS-POLICY]]
+algorithms such that a <{fencedframe}> {{Document}}'s [=permissions policy/inherited policy=] is
+computed without consideration of whether its [=navigation params/origin=] is [=same origin=] with
+its embedder's.
+
+Considering all of the above, we get the following interesting implications:
+
+ * If a [=policy-controlled feature|feature=] that [=list/exists=] in the [=fenced frame
+   config/effective enabled permissions=] has a [=default allowlist=] of [=the special value *=],
+   and no \`<a http-header>`Permissions-Policy`</a>\` header is served on the <{fencedframe}>
+   embedder, and the <{fencedframe/allow}> attribute is empty, the navigation inside the
+   <{fencedframe}> will succeed, and the resulting {{Document}} will be [=allowed to use=] the
+   [=policy-controlled feature|feature=] (i.e., it will be enabled).
+
+ * If a [=policy-controlled feature|feature=] that [=list/exists=] in the [=fenced frame
+   config/effective enabled permissions=] has a [=default allowlist=] of <a for="default
+   allowlist">`'self'`</a>, and no \`<a http-header>`Permissions-Policy`</a>\` header is served on
+   the <{fencedframe}> embedder, and the <{fencedframe/allow}> attribute is empty, the navigation
+   inside the <{fencedframe}> will be blocked.
+
+   Note: This is because ordinarily this [=policy-controlled feature|feature=] would only be enabled
+   if the subframe's {{Document}} was [=same origin=] with its embedder, a check this specification
+   avoids for fenced frames, since the <{fencedframe}>s {{Document}}'s [=Document/origin=] is
+   derived from cross-site data. Therefore, we simply "fail close".
+
+ * If a [=policy-controlled feature|feature=] that [=list/exists=] in the [=fenced frame
+   config/effective enabled permissions=] has a [=default allowlist=] of <a for="default
+   allowlist">`'self'`</a> but either the \`<a http-header>`Permissions-Policy`</a>\` header served
+   on the <{fencedframe}>'s embedder *OR* the <{fencedframe/allow}> attribute sets that
+   [=policy-controlled feature|feature=]'s [=allowlist=] to [=the special value *=], then the
+   navigation inside the <{fencedframe}> will succeed, and the resulting {Document}} is [=allowed to
+   use=] the [=policy-controlled feature|feature=].
+
+ * If a navigation inside a <{fencedframe}> would otherwise succeed, but the [=response=] on the
+   navigation inside the <{fencedframe}> is served with a \`<a
+   http-header>`Permissions-Policy`</a>\` header that sets the [=allowlist=] to "`none`" or an
+   otherwise incompatible [=origin=] for a feature in the [=fenced frame config/effective enabled
+   permissions=], the navigation still succeeds, but the {{Document}} in the <{fencedframe}> is
+   **not** [=allowed to use=] the feature.
+
+   Note: This is OK because it is the <{fencedframe}>'s content *itself* that is making the decision
+   to disable a particular feature, not its embedder environment.
 
 <h4 id=permissions-policy-patches>Algorithm patches</h4>
 
@@ -1922,4 +1980,4 @@ can only load if it has opted into all of the [=fenced frame config/effective en
 
   5. If |fenced| is set to false, |feature|’s [=default allowlist=] is `'self'`, and |origin| is
      [=same origin=] with |document|’s origin, return "Enabled".
-</div>
\ No newline at end of file
+</div>

From 05e7ec496eabd25daff66f4c6a21c6060ed2d1d6 Mon Sep 17 00:00:00 2001
From: Dominic Farolino <domfarolino@gmail.com>
Date: Fri, 28 Apr 2023 15:43:11 -0400
Subject: [PATCH 21/24] Document special value better

---
 spec.bs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/spec.bs b/spec.bs
index ec7450ea..fdbd6373 100644
--- a/spec.bs
+++ b/spec.bs
@@ -1800,7 +1800,8 @@ in the <{fencedframe}>'s based on that navigation's [=navigation params/origin=]
 is derived from cross-site data), this specification modifies various [[PERMISSIONS-POLICY]]
 algorithms such that a <{fencedframe}> {{Document}}'s [=permissions policy/inherited policy=] is
 computed without consideration of whether its [=navigation params/origin=] is [=same origin=] with
-its embedder's.
+its embedder's. Therefore a feature can only be enabled inside of a <{fencedframe}> if its embedder
+*explicitly* delegates it via [=the special value *=] [=allowlist=].
 
 Considering all of the above, we get the following interesting implications:
 

From 642b67aa749335475b34fcdd3345e016bbc1ecae Mon Sep 17 00:00:00 2001
From: Dominic Farolino <domfarolino@gmail.com>
Date: Sat, 29 Apr 2023 07:02:30 -0400
Subject: [PATCH 22/24] Intro and fixes

---
 spec.bs | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/spec.bs b/spec.bs
index fdbd6373..2f701591 100644
--- a/spec.bs
+++ b/spec.bs
@@ -1796,12 +1796,12 @@ navigation's resulting {{Document}} has an [=permissions policy/inherited policy
 is embedded in is deemed unsuitable for the [=fenced frame config=], and the navigation is blocked.
 
 At the same time, to make sure that a <{fencedframe}>'s embedder does not directly influence content
-in the <{fencedframe}>'s based on that navigation's [=navigation params/origin=] (since the origin
-is derived from cross-site data), this specification modifies various [[PERMISSIONS-POLICY]]
-algorithms such that a <{fencedframe}> {{Document}}'s [=permissions policy/inherited policy=] is
-computed without consideration of whether its [=navigation params/origin=] is [=same origin=] with
-its embedder's. Therefore a feature can only be enabled inside of a <{fencedframe}> if its embedder
-*explicitly* delegates it via [=the special value *=] [=allowlist=].
+in the frame based on that navigation's [=navigation params/origin=] (since the origin is derived
+from cross-site data), this specification modifies various [[PERMISSIONS-POLICY]] algorithms such
+that a <{fencedframe}> {{Document}}'s [=permissions policy/inherited policy=] is computed without
+consideration of whether its [=navigation params/origin=] is [=same origin=] with its embedder's.
+Therefore a feature can only be enabled inside of a <{fencedframe}> if its embedder *explicitly*
+delegates it via [=the special value *=] [=allowlist=].
 
 Considering all of the above, we get the following interesting implications:
 
@@ -1828,8 +1828,8 @@ Considering all of the above, we get the following interesting implications:
    allowlist">`'self'`</a> but either the \`<a http-header>`Permissions-Policy`</a>\` header served
    on the <{fencedframe}>'s embedder *OR* the <{fencedframe/allow}> attribute sets that
    [=policy-controlled feature|feature=]'s [=allowlist=] to [=the special value *=], then the
-   navigation inside the <{fencedframe}> will succeed, and the resulting {Document}} is [=allowed to
-   use=] the [=policy-controlled feature|feature=].
+   navigation inside the <{fencedframe}> will succeed, and the resulting {{Document}} is [=allowed
+   to use=] the [=policy-controlled feature|feature=].
 
  * If a navigation inside a <{fencedframe}> would otherwise succeed, but the [=response=] on the
    navigation inside the <{fencedframe}> is served with a \`<a

From b47f023c5e5742f2e4624c29bebcb2d9b102fd6c Mon Sep 17 00:00:00 2001
From: Dominic Farolino <domfarolino@gmail.com>
Date: Sat, 29 Apr 2023 07:59:33 -0400
Subject: [PATCH 23/24] Fixes and stuff

---
 spec.bs | 164 +++++++++++++++++++++++++++++++-------------------------
 1 file changed, 90 insertions(+), 74 deletions(-)

diff --git a/spec.bs b/spec.bs
index 2f701591..cb1eb1a5 100644
--- a/spec.bs
+++ b/spec.bs
@@ -144,21 +144,14 @@ spec: RFC8941; urlPrefix: https://www.rfc-editor.org/rfc/rfc8941.html
       text: token; url: name-tokens
 spec: permissions-policy; urlPrefix: https://w3c.github.io/webappsec-permissions-policy
   type: dfn
-    text: Create a Permissions Policy for a navigable; url: algo-create-for-navigable
-    text: Create a Permissions Policy for a navigable from response; url: algo-create-from-response
-    text: Define an inherited policy for feature in container at origin; url: define-inherited-policy-in-container
-    text: default allowlist; url: policy-controlled-feature-default-allowlist
     text: ASCII-serialized policy directive; url: serialized-policy-directive
     text: serialized permissions policy; url: serialized-permissions-policy
     text: supported features; url: supported-features
-    text: Define an inherited policy for feature in container at origin; url: define-inherited-policy-in-container
-    text: Is feature enabled in document for origin?; url: is-feature-enabled
     text: declared policy; url: declared-policy
-    text: allowlist; url: allowlist
     text: the special value *; url: the-special-value
+    text: permissions policy; url: permissions-policy
     for: permissions
       text: matches; url: matches
-      text: permissions policy; url: permissions-policy
 spec: CSP; urlPrefix: https://w3c.github.io/webappsec-csp/
   type: dfn
     text: directive value; url: directive-value
@@ -292,7 +285,7 @@ dl, dd {
  <dd>[=Global attributes=]</dd>
  <dd><code>[=width=]</code> — Horizontal dimension</dd>
  <dd><code>[=height=]</code> — Vertical dimension</dd>
- <dd><code><{fencedframe/allow}></code> — [=permissions/Permissions policy=] to be applied to the <{fencedframe}>'s contents</dd>
+ <dd><code><{fencedframe/allow}></code> — [=Permissions policy=] to be applied to the <{fencedframe}>'s contents</dd>
  <dt>[=Accessibility considerations=]:</dt>
  <dd><p class=XXX>TODO</p></dd>
  <dt>[=DOM interface=]:</dt>
@@ -1806,17 +1799,17 @@ delegates it via [=the special value *=] [=allowlist=].
 Considering all of the above, we get the following interesting implications:
 
  * If a [=policy-controlled feature|feature=] that [=list/exists=] in the [=fenced frame
-   config/effective enabled permissions=] has a [=default allowlist=] of [=the special value *=],
-   and no \`<a http-header>`Permissions-Policy`</a>\` header is served on the <{fencedframe}>
-   embedder, and the <{fencedframe/allow}> attribute is empty, the navigation inside the
-   <{fencedframe}> will succeed, and the resulting {{Document}} will be [=allowed to use=] the
-   [=policy-controlled feature|feature=] (i.e., it will be enabled).
+   config/effective enabled permissions=] has a [=policy-controlled feature/default allowlist=] of
+   [=the special value *=], and no \`<a http-header>`Permissions-Policy`</a>\` header is served on
+   the <{fencedframe}> embedder, and the <{fencedframe/allow}> attribute is empty, the navigation
+   inside the <{fencedframe}> will succeed, and the resulting {{Document}} will be [=allowed to
+   use=] the [=policy-controlled feature|feature=] (i.e., it will be enabled).
 
  * If a [=policy-controlled feature|feature=] that [=list/exists=] in the [=fenced frame
-   config/effective enabled permissions=] has a [=default allowlist=] of <a for="default
-   allowlist">`'self'`</a>, and no \`<a http-header>`Permissions-Policy`</a>\` header is served on
-   the <{fencedframe}> embedder, and the <{fencedframe/allow}> attribute is empty, the navigation
-   inside the <{fencedframe}> will be blocked.
+   config/effective enabled permissions=] has a [=policy-controlled feature/default allowlist=] of
+   <a for="default allowlist">`'self'`</a>, and no \`<a http-header>`Permissions-Policy`</a>\`
+   header is served on the <{fencedframe}> embedder, and the <{fencedframe/allow}> attribute is
+   empty, the navigation inside the <{fencedframe}> will be blocked.
 
    Note: This is because ordinarily this [=policy-controlled feature|feature=] would only be enabled
    if the subframe's {{Document}} was [=same origin=] with its embedder, a check this specification
@@ -1824,12 +1817,21 @@ Considering all of the above, we get the following interesting implications:
    derived from cross-site data. Therefore, we simply "fail close".
 
  * If a [=policy-controlled feature|feature=] that [=list/exists=] in the [=fenced frame
-   config/effective enabled permissions=] has a [=default allowlist=] of <a for="default
-   allowlist">`'self'`</a> but either the \`<a http-header>`Permissions-Policy`</a>\` header served
-   on the <{fencedframe}>'s embedder *OR* the <{fencedframe/allow}> attribute sets that
-   [=policy-controlled feature|feature=]'s [=allowlist=] to [=the special value *=], then the
-   navigation inside the <{fencedframe}> will succeed, and the resulting {{Document}} is [=allowed
-   to use=] the [=policy-controlled feature|feature=].
+   config/effective enabled permissions=] has a [=policy-controlled feature/default allowlist=] of
+   <a for="default allowlist">`'self'`</a>, and the <{fencedframe}>'s <{fencedframe/allow}>
+   attribute contains the [=policy-controlled feature|feature=] but no [=allowlist=], the rules
+   described in <a href=allow-attribute-fenced-frame>The `allow` attribute section</a>, the default
+   [=allowlist=] for the feature will be `'src'` which is meant to represent the embedder-supplied
+   navigation [=URL=], for which there is none when navigating a <{fencedframe}>, as the navigation
+   [=URL=] is determined by the [=fenced frame config=]. The navigation will be blocked.
+
+ * If a [=policy-controlled feature|feature=] that [=list/exists=] in the [=fenced frame
+   config/effective enabled permissions=] has a [=policy-controlled feature/default allowlist=] of
+   <a for="default allowlist">`'self'`</a> but either the \`<a
+   http-header>`Permissions-Policy`</a>\` header served on the <{fencedframe}>'s embedder *OR* the
+   <{fencedframe/allow}> attribute sets that [=policy-controlled feature|feature=]'s [=allowlist=]
+   to [=the special value *=], then the navigation inside the <{fencedframe}> will succeed, and the
+   resulting {{Document}} is [=allowed to use=] the [=policy-controlled feature|feature=].
 
  * If a navigation inside a <{fencedframe}> would otherwise succeed, but the [=response=] on the
    navigation inside the <{fencedframe}> is served with a \`<a
@@ -1841,10 +1843,31 @@ Considering all of the above, we get the following interesting implications:
    Note: This is OK because it is the <{fencedframe}>'s content *itself* that is making the decision
    to disable a particular feature, not its embedder environment.
 
+The patches in the below section "fence" the appropriate [[PERMISSIONS-POLICY]] algorithms to
+achieve the outcomes described in the above explanatory content.
+
 <h4 id=permissions-policy-patches>Algorithm patches</h4>
 
+<div id=allow-attribute-fenced-frame algorithm=allow-attribute-fenced-frame>
+  Rename the <a href=https://w3c.github.io/webappsec-permissions-policy/#iframe-allow-attribute>The
+  `allow` attribute of the `iframe` element</a> section to "The `allow` attribute of the `iframe`
+  and `fencedframe` element", and rewrite the section to read:
+
+  <{iframe}> and <{fencedframe}> elements have an respective `allow` attributes (<{iframe}>:
+  <{iframe/allow}>; <{fencedframe}>: <{fencedframe/allow}>), which contain an [=ASCII-serialized
+  policy directive=].
+
+  The allowlist for the features named in the attribute may be empty; in that case, the default
+  value for the [=allowlist=] is "`src`", which represents the origin of the URL in the iframe's
+  <{iframe/src}> attribute, or the fencedframe's [=fenced frame config=].
+
+  When not empty, the <{iframe}>'s <{iframe/allow}> or <{fencedframe}>'s <{fencedframe/allow}>
+  attribute will result in adding an [=allowlist=] for each [=supported feature=] to the <{iframe}>
+  or <{fencedframe}>'s [=container policy=].
+</div>
+
 <div algorithm=create-permissions-policy>
-  Modify the definition of [=Create a Permissions Policy for a navigable=]:
+  Modify the [$Create a Permissions Policy for a navigable$] algorithm:
 
   Given null or an element (|container|), an [=origin=] (|origin|), and an optional [=boolean=]
   |fenced| that defaults to false, this algorithm returns a new Permissions Policy.
@@ -1858,33 +1881,14 @@ Considering all of the above, we get the following interesting implications:
 
   4. For each |feature| supported:
 
-     1. Let |isInherited| be the result of running [=Define an inherited policy for feature in
-        container at origin=] on |feature|, |container|, |origin|, and |fenced|.
+     1. Let |isInherited| be the result of running [$Define an inherited policy for feature in
+        container at origin$] on |feature|, |container|, |origin|, and |fenced|.
 
      2. Set <var ignore>inherited policy</var>[|feature|] to |isInherited|.
 </div>
 
-<div algorithm=allow-attribute-fenced-frame>
-  Rename the <a href=https://w3c.github.io/webappsec-permissions-policy/#iframe-allow-attribute>The
-  `allow` attribute of the `iframe` element</a> section to "The `allow` attribute of the `iframe`
-  and `fencedframe` element", and rewrite the section to read:
-
-  <{iframe}> and <{fencedframe}> elements have an respective `allow` attributes (<{iframe}>:
-  <{iframe/allow}>; <{fencedframe}>: <{fencedframe/allow}>), which contain an [=ASCII-serialized
-  policy directive=].
-
-  The allowlist for the features named in the attribute may be empty; in that case, the default
-  value for the allowlist is "`src`", which represents the origin of the URL in the iframe’s src
-  attribute, or the fencedframe's [=fenced frame config=].
-
-  When not empty, the <{iframe}>'s <{iframe/allow}> or <{fencedframe}>'s <{fencedframe/allow}>
-  attribute will result in adding an allowlist for each recognized feature to the iframe element’s
-  content navigable's container policy or the fencedframe element's [=fenced navigable container/
-  fenced navigable=]'s container policy, when it is constructed.
-</div>
-
 <div algorithm=create-permissions-policy-response>
-  Modify the definition of [=Create a Permissions Policy for a navigable from response=] to read:
+  Modify the [$Create a Permissions Policy for a navigable from response$] algorithm to read:
 
   Given null, a [=navigable container=], or a [=fenced navigable container=] (|container|), an
   [=origin=] (|origin|), and a [=response=] (<var ignore>response</var>), this algorithm returns a
@@ -1892,13 +1896,12 @@ Considering all of the above, we get the following interesting implications:
 
   Add a step before step 1 that reads:
 
-  1. If |container| is a [=fenced navigable container=], let |fenced| be true.
+  1. Let |fenced| be true if |container| is a [=fenced navigable container=], and false otherwise.
 
-     Otherwise, let |fenced| be false.
+  Modify what is *now* step 2 of the algorithm to read:
 
-  Modify the now step 2 of the algorithm to read:
-  2. Let <var ignore>policy</var> be the result of running [=Create a Permissions Policy
-     for a navigable=] given |container|, |origin|, and |fenced|.
+  2. Let <var ignore>policy</var> be the result of running [$Create a Permissions Policy
+     for a navigable$] given |container|, |origin|, and |fenced|.
 </div>
 
 <div algorithm=attempt-populate-history-patches>
@@ -1907,40 +1910,52 @@ Considering all of the above, we get the following interesting implications:
   |failure| is true, then:" that reads:
 
   8. Otherwise, if the result of [=Should navigation response to navigation request be blocked by
-    Permissions Policy?=] given <var ignore>navigationParams</var> and <var ignore>navigable</var>
-    is "`Blocked`", then set |failure| to true.
+    Permissions Policy?=] given <var ignore>navigationParams</var> is "`Blocked`", then set 
+    |failure| to true.
+
+  Note: If this algorithm returns "`Blocked`", the pre-existing {{Document}} in the <{fencedframe}>
+  does not stick around; an error page will be loaded.
 </div>
 
 <div algorithm=permissions-policy-block-request>
   Create a new algorithm called <dfn>Should navigation response to navigation request be blocked by
   Permissions Policy?</dfn> in [[!HTML]].
 
-  Given a [=navigation params=] (|navigationParams|) and a [=navigable=] (|navigable|), this
-  algorithm returns `Blocked` or `Allowed`:
+  Given a [=navigation params=] (|navigationParams|), this algorithm returns "`Blocked`" or
+  "`Allowed`":
+
+  1. Let |navigable| be |navigationParams|'s [=navigation params/navigable=].
 
-  1. If |navigable| is not a [=fenced navigable container/fenced navigable=], then return `Allowed`.
+  1. If |navigable| is not a [=fenced navigable container/fenced navigable=], then return
+     "`Allowed`".
 
-  2. Let |origin| be |navigationParams|'s [=navigation params/origin=].
+  1. Let |origin| be |navigationParams|'s [=navigation params/origin=].
 
-  3. Let |effective permissions| be the |navigable|'s [=navigable/fenced frame config instance=]'s
+  1. Let |effective permissions| be the |navigable|'s [=navigable/fenced frame config instance=]'s
      [=fenced frame config instance/effective enabled permissions=].
 
-  4. Let |permissions policy| be the result of [=Create a Permissions Policy for a navigable|
-     creating a permissions policy=] given |navigable|'s [=navigable container|container=],
-     |origin|, and <var ignore>fenced</var> set to true.
+  1. Let |permissions policy| be the result of [$Create a Permissions Policy for a navigable|
+     creating a permissions policy$] given |navigable|'s [=fenced navigable container=], |origin|,
+     and <var ignore>fenced</var> set to true.
 
-  5. Let |inherited policy| be |permissions policy|'s [=permissions policy/inherited policy=].
+     Note: This is identical to the [=Document/permissions policy=] that will be created when the
+     navigation constructs the ultimate {{Document}} for this pending navigation. We create it now
+     and run tests on it since this is the appropriate time to determine if a navigation will fail,
+     and then throw it away. If the navigation succeeds, it will be recreated identically and
+     unconditionally installed on the {{Document}}.
 
-  6. [=list/For each=] |feature| of |effective permissions|:
+  1. Let |inherited policy| be |permissions policy|'s [=permissions policy/inherited policy=].
 
-    1. If |inherited policy|[|feature|] is "Disabled", return "`Blocked`".
+  1. [=list/For each=] |effective permission| of |effective permissions|:
 
-  7. Return "`Allowed`."
+    1. If |inherited policy|[|effective permission|] is "Disabled", return "`Blocked`".
+
+  1. Return "`Allowed`."
 </div>
 
 <div algorithm=define-inherited-policy-in-container-patches>
-  Modify the definition of the [=Define an inherited policy for feature in container at origin=]
-  algorithm to read:
+  Modify the [$Define an inherited policy for feature in container at origin$] algorithm to
+  read:
 
   Given a feature (|feature|), null or a [=navigable container=] (|container|), an [=origin=] for a
   document in that container (|origin|), and an optional [=boolean=] |fenced| that defaults to
@@ -1948,18 +1963,19 @@ Considering all of the above, we get the following interesting implications:
   
   Rewrite step 3 to read:
 
-  3. If the result of executing [=Is feature enabled in document for origin?=] on |feature|,
+  3. If the result of executing [$Is feature enabled in document for origin?$] on |feature|,
      |container|'s [=Node/node document=], |origin|, and |fenced| is "Disabled", return
      "Disabled".
 
   Rewrite step 7 to read:
 
-  7. If |fenced| is false, |feature|’s [=default allowlist=] is `'self'`, and |origin| is [=same
-     origin=] with |container|’s [=Node/node document=]’s origin, return `"Enabled"`.
+  7. If |fenced| is false, |feature|’s [=policy-controlled feature/default allowlist=] is
+     `'self'`, and |origin| is [=same origin=] with |container|’s [=Node/node document=]’s
+     origin, return `"Enabled"`.
 </div>
 
 <div algorithm=is-feature-enabled-patches>
-  Modify the definition of the [=Is feature enabled in document for origin?=] to read:
+  Modify the [$Is feature enabled in document for origin?$] algorithm to read:
 
   Given a feature (|feature|), a {{Document}} object (|document|), an [=url/origin=] (|origin|), and
   an optional [=boolean=] |fenced| that defaults to false, this algorithm returns "`Disabled`" if
@@ -1979,6 +1995,6 @@ Considering all of the above, we get the following interesting implications:
 
   Rewrite step 5 to read:
 
-  5. If |fenced| is set to false, |feature|’s [=default allowlist=] is `'self'`, and |origin| is
-     [=same origin=] with |document|’s origin, return "Enabled".
+  5. If |fenced| is set to false, |feature|’s [=policy-controlled feature/default allowlist=] is
+     `'self'`, and |origin| is [=same origin=] with |document|’s origin, return "Enabled".
 </div>

From cad585364de5efbabef398b6c490a589e17a80bf Mon Sep 17 00:00:00 2001
From: Dominic Farolino <domfarolino@gmail.com>
Date: Sun, 30 Apr 2023 08:35:20 -0400
Subject: [PATCH 24/24] Adjustments

---
 spec.bs | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/spec.bs b/spec.bs
index cb1eb1a5..4d8a99a8 100644
--- a/spec.bs
+++ b/spec.bs
@@ -1967,10 +1967,14 @@ achieve the outcomes described in the above explanatory content.
      |container|'s [=Node/node document=], |origin|, and |fenced| is "Disabled", return
      "Disabled".
 
+  Note: We don't have to rewrite step 2, which also delegates to the same algorithm, to pass in the
+  |fenced| [=boolean=] because step 2 has to do with checking to see if |feature| is enabled
+  |container|'s [=Node/node document=], not the {{Document}} hosted *inside* |container|.
+
   Rewrite step 7 to read:
 
-  7. If |fenced| is false, |feature|’s [=policy-controlled feature/default allowlist=] is
-     `'self'`, and |origin| is [=same origin=] with |container|’s [=Node/node document=]’s
+  7. If |fenced| is false, |feature|'s [=policy-controlled feature/default allowlist=] is
+     `'self'`, and |origin| is [=same origin=] with |container|'s [=Node/node document=]'s
      origin, return `"Enabled"`.
 </div>
 
@@ -1995,6 +1999,6 @@ achieve the outcomes described in the above explanatory content.
 
   Rewrite step 5 to read:
 
-  5. If |fenced| is set to false, |feature|’s [=policy-controlled feature/default allowlist=] is
-     `'self'`, and |origin| is [=same origin=] with |document|’s origin, return "Enabled".
+  5. If |fenced| is set to false, |feature|'s [=policy-controlled feature/default allowlist=] is
+     `'self'`, and |origin| is [=same origin=] with |document|'s origin, return "Enabled".
 </div>