Good walkthrough of an underused header. One boundary worth stating explicitly, because it decides whether the control actually protects you: Permissions-Policy governs features per browsing context, so it is excellent at constraining what an embedded iframe may do, but it does nothing against a third-party script you loaded into the top document itself. A tag-manager script running in your own origin can still call getUserMedia regardless of the header; the only thing that mitigates that is script governance (SRI where possible, CSP script-src with strict allowlists, and ideally not giving the third party your origin at all). The other pairing that matters: Permissions-Policy and CSP frame-ancestors answer different questions - the first says "what may my embedded content do," the second says "who may embed me" - and you need both, because an attacker who can iframe your authenticated page has a clickjacking channel that camera/mic/geo lockdowns never touch. Two headers, two threat models.