A consultation widget may load normally while its camera or microphone fails. Do not tell staff to weaken browser protection until the supplier identifies the exact feature, parent policy, embedded origin and consent state. A functioning iframe is not evidence that all powerful features are permitted.
Source-bound fact
An iframe feature must also be allowed by the parent policy; a child allow attribute cannot override a parent denial. Official reference · Checked 17 October 2026.
Filled synthetic acceptance example
Synthetic teaching example, not a client case or a real-platform assessment. On narrow screens, scroll to read the complete table.
| Input | Check basis | Expected |
|---|---|---|
| Parentdenies; childallows; useragrees | parent gate still fails | unavailable |
| Parentallows originA; childallowsA; consentdenied | user gate fails | unavailable |
| All stated gatesallow | necessary conditions only | candidate for actual device test |
Supplier acceptance procedure
- Record the feature and exact final iframe origin, including redirects, without collecting media.
- Compare parent header, child allow declaration and user permission independently.
- Require a denied-permission fallback and a supported-device demonstration before rollout.
Interpret the output
The finite intersection model explains why three successful-looking settings can still leave a feature unavailable. It is not a Permissions-Policy parser or a device permission test. Browser support, secure context and operating-system permissions remain additional gates.
Explicit limits
No prompts are accepted, no microphone/camera is accessed and no production policy is relaxed. This is distinct from sandbox origin messaging and embedded-login cookies.
Replay the finite teaching model
Save both files in one folder and use Node22 or newer. JSON contains inputs and expected results. The script processes synthetic data only, with no network, credentials, payment or paid API calls. Passing is not evidence that a real integration passed acceptance.
Filled inputs and expectations · Inspectable teaching script
node check.mjs embedded-feature-permission-matrix.json