I setup a test page for this, and it seems you are right. Test 1: * Feature-Policy "microphone https://example.com" * Javascript that accesses mic

I setup a test page for this, and it seems you are right. Test 1: * Feature-Policy "microphone https://example.com" * Javascript that accesses microphone hosted on example.com * Everything loaded and worked as expected Test 2: * Feature-Policy "microphone https://example.com" * Javascript that accesses microphone hosted on 3rd-party.com * Everything loaded and worked - not as expected I definitely didn't understand this new header. I still see how its useful, but not quite as robust as I had expected.