If it were an allow list, then they wouldn't be able to add more features to the list without breaking backwards compatibility. For example, imagine your site

If it were an allow list, then they wouldn't be able to add more features to the list without breaking backwards compatibility. For example, imagine your site relies on document.write to function, and there's currently no feature policy that lets you whitelist that feature. You create a whitelist that includes the features you do use, but that list doesn't mention document.write, because there's currently no way to block or allow that with a feature policy. Now imagine Chrome adds a feature policy for document.write six months later; your site will break because you didn't explicitly whitelist document.write, even though that would have been impossible for you to do at the time your site was first created.