Just once, the first time the application runs into a particular sandbox boundary. The application can decide for itself what granularity it wants to request, t

Just once, the first time the application runs into a particular sandbox boundary. The application can decide for itself what granularity it wants to request, then I accept or decline. For example, the first time I use Chrome to visit a website, it would trigger a dialog requesting permission to “Connect to websites” (i.e. initiate outbound TCP connections toward ports 80 and 443). The first time I tried to use WebRTC, the dialog would appear for that.