A capability stays maintainable only when the team can explain every state, retry, and piece of residual data—not merely show one successful run. Permissions Policy can block a feature before a user prompt. The top-level header and iframe allow both matter, especially across origins; reporting this as a broken device misleads diagnosis.
Browser capability depends on version, permission, visibility, and device policy. Use capability detection and an explained fallback instead of treating one development machine as the product contract.
Questions the design must answer
This capability crosses clients, networks, and servers, so a local optimization can create a system failure. Decisions must constrain both endpoints, persisted truth, and operating budgets together.
- Expose only required capabilities at top level and use an explicit allowlist for third-party frames.
- Detect policy and API capability and distinguish policy denial, user denial, and absent hardware.
- Include fullscreen and clipboard in the embed contract and document required allow values.
Permissions Policy is a deployment contract. Minimize exposure and make policy denial diagnosable before asking users to guess.
Edge cases are part of the feature
Prioritize faults that silently preserve false facts: the interface looks recovered while a queue, permission, or counter has diverged. The defect often appears only on the next action.
- Direct development works while portal embedding blocks every capture feature.
- A wildcard header exposes sensitive capabilities to any embedding origin.
- Policy changes are tested only in Chromium and UI assumptions fail elsewhere.
Prove that it works with evidence
Write the expected state trace before injecting faults. At every phase, reconcile user-visible outcome, both protocol endpoints, persistent records, and resource counts to prove the loop.
- Run the permission matrix in same-origin, allowed cross-origin, and denied cross-origin frames.
- Deny through policy and through prompt separately; logging and recovery must differ.
- Audit production headers and embed docs for consistent defaults, CSP, and allow attributes.
The release standard is practical: the normal path is fast, abnormal paths converge, recovery never overrides an explicit user decision, and operators can diagnose faults from limited, privacy-safe evidence.