Skip to content

Document Permissions Policy as a security mitigation - #275

Merged
domfarolino merged 2 commits into
webmachinelearning:mainfrom
mlmrx:ml/document-tools-permissions-policy
Sep 15, 2026
Merged

domfarolino merged 2 commits into
webmachinelearning:mainfrom
mlmrx:ml/document-tools-permissions-policy

Conversation

@mlmrx

@mlmrx mlmrx commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

Summary

  • document how site authors can disable WebMCP with Permissions Policy
  • explain the same-origin defense-in-depth benefit for injected or compromised scripts
  • clarify that the control does not mitigate the underlying script compromise

This follows the deployer guidance proposed by @ck-glen-clarkson in #178.

Closes #178.

Validation

  • W3C spec-generator: Bikeshed processing with die-on=warning
  • git diff --check

Preview | Diff

@mlmrx

mlmrx commented Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

+@ck-glen-clarkson

@mlmrx

mlmrx commented Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

-@ck-glen-clarkson

Comment thread index.bs Outdated
Comment thread index.bs Outdated
@mlmrx
mlmrx force-pushed the ml/document-tools-permissions-policy branch from 5ccdc79 to d8f4741 Compare September 10, 2026 10:08
@domfarolino
domfarolino merged commit df2d824 into webmachinelearning:main Sep 15, 2026
2 checks passed
github-actions Bot added a commit that referenced this pull request Sep 15, 2026
SHA: df2d824
Reason: push, by domfarolino

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Please formally document Permissions-Policy: tools=() as a security control

2 participants