Should limitations be placed on use of permission-controlled features while in (immersive) XR sessions?

[ddorwin]

#720 addresses the timing of consent requests for XR capabilities. Some of the same concerns (see #720 (comment)) about mid-session requests also reply to consent/permission requests for non-XR web platform features. As these are independent APIs, they are not implicitly addressed by the outcome of 720.

This issue tracks determining what, if any, restrictions might be placed on consent/permission requests from non-XR APIs. Possible outcomes might include preventing them altogether, including them in some API mechanism (i.e., resulting from #720 or #723) for specifying that those features might be used, or no restrictions.

Note that this issue is separate from determining how to deal with overlap of capabilities/permissions (#702).

[Manishearth]

We discussed this at TPAC; for now it seems like all UAs have a path for doing midsession consent prompts, so we don't need to block this.

If this changes in the future we can reopen this discussion along with #740.