Permissions-Policy

The syntax looks like Permissions-Policy: camera=(), geolocation=(self), a list of features and which origins may touch them. Two uses are distinct. Defensively it limits the damage from a compromised third-party script or an injected frame: with the camera declared off-limits, no script on the page can even ask for it, whatever it attempts. Organisationally it lets a site set rules for content it doesn't control — an advertising frame can be denied autoplay and location data without the ad network needing to be consulted. Note that it restricts the ability to request permission rather than permission already granted, and that a feature not mentioned defaults to being allowed for the same origin.