Thanks for the docs. The examples (2 & 3, https://github.com/w3c/webappsec-permissions-policy/blob/main/permissions-policy-explainer.md#example-2---enable-geolo

Thanks for the docs. The examples (2 & 3, https://github.com/w3c/webappsec-permissions-policy/blob/main/permissions-policy-explainer.md#example-2---enable-geolocation-in-a-cross-origin-frame https://github.com/w3c/webappsec-permissions-policy/blob/mai...) seem to me to say that search.google.com can’t grant location permissions to an iframe if the parent was forbidden them, but I didn't find an explicit example for what happens if the iframe domain already got permission previously. As you say the UI for requesting in this case would be weird, and this seems like a big security hole to me, but I can’t see a bit of the spec that explicitly forbids (though I only scanned the doc.)