That fine-grained permission isn't handled by the user. You as a user don't employ CSP. Rather, when requesting the permission from the OS, the developer has t

That fine-grained permission isn't handled by the user. You as a user don't employ CSP. Rather, when requesting the permission from the OS, the developer has to supply a list of approved scopes and domains, and anything outside of that gets automatically blocked. No involvement from the user.