Permissions-Policy.

An HTTP response header (formerly Feature-Policy) that lets a site declare which browser features — camera, microphone, geolocation, payment, USB, sensors — its own document and any embedded iframes are allowed to use. It belongs to the Application Security category of cybersecurity.

An HTTP response header (formerly Feature-Policy) that lets a site declare which browser features — camera, microphone, geolocation, payment, USB, sensors — its own document and any embedded iframes are allowed to use.

Permissions-Policy is the successor to the Feature-Policy header, standardized to a structured-headers syntax and supported by all major browsers. It lets a document express, per powerful feature, who is allowed to use it: the document itself (`self`), specific origins, or no one. A header like `Permissions-Policy: geolocation=(), camera=(self), payment=(self "https://checkout.example")` denies geolocation everywhere, lets the main document use the camera, and lets the document plus checkout.example use the Payment Request API. Permissions-Policy is enforced both for the top-level document and recursively for nested browsing contexts, with the parent able to restrict children further (but never expand their privileges). It is the simplest defense against third-party scripts or iframes silently probing for camera, microphone, geolocation, sensors, fullscreen, autoplay, USB, serial, HID, payment, and many other capabilities; modern hardening guides recommend setting it explicitly alongside CSP and HSTS.

Defences for Permissions-Policy typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Feature-Policy (legacy), Permission policy.